Any WordPress powered website is vulnerable to these sorts of issues if it hasn’t been specifically setup to avoid them. There are various ways circumvent some of these security issues, including multi-factor authentication, but by far the simplest and most effective approach is to setup an SSL certificate and force your WordPress admin panel to use https for it’s admin panel. The encryption provided by https prevents anyone from snooping on that data. Your information remains confidential from snoopers as only your browser and server are able to decrypt the data.

Typically, websites will pay for an SSL certificate which is respected by all of the major browser vendors. This provides a nice green icon in the admin panel beside where it says https. However there is no need for you to pay for an SSL certificate if you are the only one using the site. As long as you create the SSL certificate yourself, you can trust it This is what I do here on PixoPoint.com so I thought I’d give a quick lesson on how to do it yourself.

There is a plethora of different server setups, so I’m only going to explain the most common setup here, but the same principles should apply for non cPanel setups too. Note, this may not work if your cPanel account is not setup to allow you to create new SSL certificates. If this is the case, simply contact your web host who should be able to setup a certificate for you. If they can’t, then change web hosts! There is no reason you should be forced to use your WordPress admin panel in an insecure fashion simply because of limitations in your web hosting.

SSL link in cPanel

Click the “SSL/TLS Manager” link in cPanel …

The SSL/TLS Manager provides you with links for creating a  private key (KEY), certificate signing request (CSR) and a Certificate (CRT)

The first one you need to create is the private key. Select the domain you want to setup https for, and it will auto-populate the “Host” for you. Then click “Generate”.

You will be provided with the private key although you won’t need to do anything with this as it will be automatically carried forward by the server.

Next up, head back to the SSL/TLS manager and generate a Certificate Signing Request (CSR).

As with the private key, the generated signing request will also be carried forward by the server so you don’t need to do anything with this.

Now head back to the SSL/TLS Manager and create the certificate. The private key and signing request you have already prepared will be automatically used to create the final certificate.

This stage, you will have https working on your site, but the WordPress admin panel won’t use it by default, so you need to force it use https. To do this, you need to edit the wp-config.php file (usually found in the main folder of your WordPress installation). At this point you have a choice between only forcing the login page to use https, which protects your password from being stolen, or forcing https over the entire admin panel. Theoretically the admin panel will load slightly slower when using https, so some people do prefer to take the login https option only. But the performance hit is so minimal that I recommend simply forcing https across the entire admin panel as a further security improvement. This ensures that not only is your password secure, but also your cookies and any private posts and data which you may enter via the admin panel.

Adding the following code to the wp-config.php file will force only the login page to use https (not recommended):
define('FORCE_SSL_LOGIN', true);

Adding the following code to the wp-config.php file will force the entire admin panel to use https (recommended):
define('FORCE_SSL_ADMIN', true);

Now when you visit your sites admin panel, you will be greeted by a lovely warning message! Don’t worry, this is simply because you are using a self-signed certificate, which since you were the one that created it is perfectly okay to use. If you can afford to buy a certificate, then do so, but otherwise this free solution should be good enough for most purposes. You just need to put up with clicking past the error message whenever you visit the admin panel from another computer/browser.

Now once you are logged into your admin panel, you should be surfing along in a totally secure admin panel which your neighbours can’t snoop in on. There will be an unpleasant looking line through “https” in your address bar, but this is not a problem due to you have signed the certificate yourself so is no cause for concern. Your admin panel is locked down nice and tight so that no prying eyes can watch what you are doing on your own site.

Multi-site

If you have a multi-site network with domain mapping, this will probably not work unless you have the domain mapping plugin set to use sub-domains of the primary domain as the admin URL for each sub-domain.

This post was heavily inspired by a similar post by Mika Epstein. Mika is an awesome contributor to the WordPress project and can often be found helping out in the support forums at WordPress.org.

You can see the admin bar in action by installing the latest trunk install of WordPress. Note: Trunk installs are not recommended for use on a live site; you should always wait until an RC or stable version is released (or a beta if you feel adventurous).

Screenshot of the new WordPress Admin bar

The version currently in trunk makes heavy use of javascript and has a lot of unneeded HTML. So this evening I quickly hashed together a pared down version with drastically smaller sprite images, support for IE6 and utilizing a basic unordered list instead of a gaggle of HTML. You can view a test version here. A link to the test version will also be posted on the Admin bar Trac ticket shortly.

The only javascript used in my new version is a suckerfish script to trigger support for the dropdowns in IE6. Some slick slide-down animations on the dropdowns would also be a nice touch, but I haven’t added those in since there weren’t any in the trunk version.

The current trunk admin bar makes heavy use of !important declarations. I’ve totally avoided this as it tends to cause nothing but headaches if you ever need to over-write it, however it may be necessary to include a few of them simply to force it to work with as many potential themes as possible. I’ll deal with that if someone questions it. In general, the use of !important should be avoided where possible, although this may be an unfortunate example where it may be unavoidable.

If you have any opinions on the addition of the new admin bar or my version of it, please leave a comment

Flash - the cause of, and solution to, most of the internet's problems.

Aside from the known issues with flash, there is a major problem with the default setup of most flash objects which many people are unaware of.

A quick search through our support forum, will show up dozens of questions relating to Adobe Flash objects and dropdown menus appearing beneath them. The usual solution people look to as a solution, is to modify the z-index of either their menu, the flash object, or both. Unfortunately this only leads to dead-ends and confusion on the part of the site owner.

The solution thankfully, is relatively simple. All you need to do is to set the Flash object to “transparent”, and your dropdown menu will appear on top of the object instead of below it. I suspect Adobe added this behaviour intentionally as a way of hacking people’s sites into work as expected but has infuriated many web developers as this is not what would typically be expected for browser behaviour.

The solution

Add the following between your <object> tags:

<param name="wmode" value="transparent" />

Add this in an <embed> tag:

wmode="transparent"

Your code should now look something like this:

<object>
  <param value="blabla.swf" / >
  <param name="wmode" value="transparent" / >
  <embed src="transparency.swf" wmode="transparent" type="application/x-shockwave-flash">
  </embed>
</object>

The book is easy to read, easy to understand and ideal for those wanting to branch out from being the user of an AJAX’ified WordPress plugin or theme into adding their own customised functionality to their site.

The book is 249 pages long and covers the following:

• The basics of AJAX
• How to load scripts correctly in WordPress
• How to set up PHP classes
• Loads of code examples

The book is for sale for US$24 from the WordPress and AJAX site.

PixoPoint Theme Integrator plugin page on WordPress.org

If you find the plugin useful, please rate is up by logging into the repository and clicking the stars in the right hand sidebar If you are using the plugin, please let us know as we’d love to see some more examples of the plugin in action.

The PixoPoint Theme Integrator page in the WordPress.org plugins repository

Jeff Chandler, the host of WordPress Weekly.

For those of you looking for another way to find out about the latest news, tips and information about WordPress but are sick and tired of reading through blog after blog of posts, an excellent alternative is to listen or even participate in a WordPress related podcast.

The leading podcast on WordPress is the WordPress Weekly podcast hosted by Jeff Chandler. Jeff does an excellent job of presenting the latest news and has a slew of top level WordPress  plugin authors, themers and general WordPress experts on his show, both as interviewees and during round table discussions with other WordPress experts.

Live broadcast

One of the key ingredients to the success of WordPress weekly is not only the boundless enthusiasm of Jeff as host of the show, but also the live setup. You can listen to the podcast live as it happens, and even call in if you would like to ask a question. There is also a chat box for the live listeners to discuss the podcast as it happens and to ask questions which may be answered on the show.

The live service is provided by the TalkShoe podcasting service. Visit the WordPress Weekly Talkshoe page to see the upcoming live schedule and to join in on the conversation.

Other WordPress podcasts

Press This by Joast de Valk
WordCast by Bitwire Media

Thanks to Ronald Huereca for the photo of Jeff. Ronald is our JavaScript guru so if you have a use for any JavaScript/AJAX related WordPress work, please get in touch!

Dropline menu

Dre Armeda from CubicTwo contacted us regarding the construction of a custom menu design for one of his clients. He requested a “simple solution for the sub-nav (with horizontal slider) to be extended like the image attached”. The image was of a dropline menu as follows:

Design sent to display exactly how the menu would look. Click to see the zoomed in version.

Active Sub-menu and integration

Dre requested for the active dropline menu to be loaded by default and for us to install our menu plugin and integrate it seamlessly into his test site.

Construction

We sent back the following page as an exact demonstration of what the menu would look like and asked if there were any corrections to be made.

Demonstration Page

After some email discussion regarding how the menu would work and a modification to the hover graphics we sent back a new link which Dre confirmed was exactly what was required. We were given administrator access to their WordPress admin panel and we installed our menu plugin, configured it, integrated it into their WordPress theme and updated the CSS to load the new design. And here is the final result:

The PixoPoint coded dropline menu on the Industrial Income Trust's website

By providing an exact image of what was required and full specifications as to how the menu was to function (dropline shown by default) and by showing us the exact page the menu was to appear on we were able to provide a demo page of what the menu would look like. This allowed the client to see exactly how the menu would look on their site so that any corrections necessary could be made before adding them to their live site.

The live site

The live site can be seen at IndustrialIncome.com, however there are a couple of splash pages you need to click through before you can reach the menu.

Their new site hosted at RedDevils.co.nz

What we suggested was for them to use the hosted WordPress.com service. This is not the regular self-hosted solution that you can download from WordPress.org, but the hosted system which allows you to create your own blog/site within minutes. We have suggested this previously to those who can’t afford a more traditional solution, but have found it an uphill battle convincing people that WordPress.com can indeed meet their needs in exactly the same way a self-hosted solution would.

Misconceptions about WordPress.com powered sites

Traditionally WordPress.com has only been suggested as a low-budget option for those who can’t afford to upgrade to “proper” hosted setup, however for the Red Devils, we were able to meet all of their requirements without losing anything that they required in their site. We were also able to integrate their teams branding into an existing theme very quickly through some simple CSS upgrades.

The following is a common comment we receive from potential clients when suggesting using WordPress.com for their site.

But you can’t upload themes to WordPress.com and we need our own design

However, despite this, we had no trouble at all in redesigning a WordPress.com site for the Red Devils which suited their needs perfectly by using the “CSS upgrade” option. This costs a mere US$15 and allows you to totally modify the sites CSS. This gives huge power over how the site looks and behaves. We were able to use this to add a new background image, totally change the text colours, remove all remnants of the commenting feature of WordPress (even when comments are disabled their are still occasional bits of text mentioning the comments feature).

The custom CSS upgrade information as found on WordPress.com

The following is another common comment we receive on suggesting clients use WordPress.com to power their site.

No, I must have my own domain for branding purposes!

This is also a fallacy as there is a “domain upgrade” option available for another US$10. All you need to do is to point your domain at the WordPress.com name servers, purchase the upgrade, add the new domain to your list of domains and it will automatically start working and all your own URLs will redirect to the new one automagically. Apart from the small unobtrusive link back to WordPress.com in your footer, no one will have a clue that you are using the WordPress.com service.

The domain upgrade information as seen on WordPress.com

And last, but not least, the following is another common comment we receive on suggesting clients use WordPress.com over a self-hosted solution.

But I don’t want a blog, I want a website!

Ignoring the obvious fact that a blog is actually a website, it is entirely possible to make a WordPress.com “blog” look and behave in a very “non-bloggy” way. You can either ditch the blog functionality entirely and go for an entirely static site, or you can use the method we used for the Red Devils site by removing all mentions of “blog”, turning off commenting and stripping out any errant text which may appear in the site related to the commenting functionality, blog categories etc. This gives a simple list of news items on the front page to ensure that their site visitors see the most important/current content first up. They even use the sticky post feature of WordPress to ensure that news items they want to ensure readers see first are always at the top of the home page.

What other upgrades are available

There are a suite of different upgrades available for those who need them. The Red Devils did not require any of the other available extras, but depending on your requirements you may find some of the other options useful, in particular the ability to remove the occasional advertising which WordPress.com serves to your sites visitors.

The various upgrades available for WordPress.com

Maintenance

The beauty of using WordPress.com, is that not only does it cost almost nothing to setup (US$25 for the CSS and domain name upgrades), but you don’t need to bother maintaining a WordPress installation since they handle everything for you. You also don’t need to worry about DOS attacks, security or any of that stuff as the WordPress.com team have a terrific track record of handling such things spectacularly well.

The clients opinion

The Canterbury Red Devils have been very happy so far with the end-product. For negligible up-front cost they have all of the features they wanted for their site, a slick design, their own domain and to the casual observer it looks like the Red Devils have a regular self-hosted WordPress installation.

They have gone from an awkward to use static site which they couldn’t update, there were no RSS feeds, no email subscriptions, no photo galleries and they couldn’t give non-technical users the ability to edit their site. They can now have multiple members of their organisation editing the site with no fear of the site breaking or something going catastrophically wrong. They effectively have infinite bandwidth to handle any potential traffic spikes, their sites security is handled by the best experts in the business and their site loads lightning quick since it is hosted on the massive 1000+ server stack of WordPress.com.

Special thanks to Vince Mitalas from the Red Devils who worked with us on this project and who has been adding all the content ready for the sites launch today.

Vince Mitalas of the Canterbury Red Devils ice hockey team

Getting your own WordPress.com powered site

If you don’t have the CSS coding skills or simply want someone else to handle everything for you, please get in touch with us as we are very keen to build more of these hosted setups. If it matches your requirements, they are an inexpensive way to enter the online world without losing any of the professionalism of the regular self-hosted WordPress installation.

WP Tavern

The WordPress Tavern has become the defacto goto place for many WordPress experts. The site is run by the unofficial WordPress community superstar Jeff Chandler who is based in the USA. The site includes a blog with posts from both Jeff himself and other contributors and a terrific forum for discussing the latest news, tips and tricks of WordPress. The site is also the home of WordPress Weekly, the best podcast about WordPress.

WP Garage

Although not updated as often as it once was, WP Garage is a terrific source of information about plugins, themes and basic tricks. The site is ideally suited to those wanting to move from being a novice WordPress user to a power user as it includes a series of basic coding tricks and tips. The site is run by Miriam Schwab of Israel who is also the CEO of illuminea, an internet presence and marketing firm.

Justin Tadlock / Theme Hybrid

Justin Tadlock is one of the leading experts on theme development for WordPress. Justin is very much at the cutting edge of creating innovative themes which can be modified extensively (via child themes) without touching the core theme code. He is the author of Theme Hybrid and also written some high quality plugins for WordPress. Justin operates a theme club which includes a high quality support forum for his various (free) products.

Other resources

There are so many other resources about WordPress that we couldn’t possibly list them all. However here is a list of resources we also recommend checking out.
Theme Shaper – An excellent site by Candian based Ian Stewart, about WordPress theme development and in particular his parent theme, Thematic.
WP Vibe – A resource site about WordPress plugins and themes by Dre Armeda and Jonathan Dingman.
SitePoint – Although not a WordPress specific site, SitePoint is an excellent place to learn more about the software. SitePoint includes the most popular web development forum on the internet.
WP Mu Tutorials – One of the best places to find Mu specific information about WordPress. The site is run by husband and wife team Ron and Andrea.
Andrew Rickmann’s blog – An excellent site for opinions on the more advanced issues relating to WordPress.
Mark Jaquith on WordPress – Mark Jaquith is one of the core developers for WordPress and also the best of the core developers at dispersing information about the cutting edge of WordPress development.

The following code will produce a clean smooth flowing animation effect just like you can see in the menu above for our own site.

function suckerfishmenu(){
	$('#suckerfishnav ul').css({display:'none'}); // Opera Fix
	$('#suckerfishnav li').hover(function(){
		$(this).find('ul:first').css({display:'none'}).slideDown(300);
	},function(){
		$(this).find('ul:first').css({display:'none'});
	});
}
 $(document).ready(function(){
	suckerfishmenu();
});

To make this work, you simply need to insert the above code after you load jQuery and between the <head> tags for your page and use a dropdown menu with an ID of #suckerfishnav. Make sure you reference the jQuery.js file correctly (available here). If you are using WordPress, then you will want to make sure you are loading jQuery via the enqueue method to avoid clashes with plugins which use jQuery and add var $ = jQuery; to ensure that jQuery works with the non-conflict mode of the version of jQuery version bundled with WordPress.

If all of that seems too complicated, don’t despair as the new version coming soon of our PixoPoint Menu plugin has this new animation method built in so that you won’t need to touch any code to get it working.