It seems however, that times have moved on, as has my knowledge of WordPress plugin coding, and so after receiving a reasonable complaint about the performance of the plugin I decided to do a major recode. I need a few of you to test this out before I go shunting it up to the WordPress plugin repository so if you are using the older version, please download this new version and let me know if you experience any problems.

Multi-level Navigation plugin version 2.3

Assuming everything goes well with testing, I’ll hopefully have this uploaded to replace the old one within the next week. I would list off the various upgrades here, but since I totally rewrote most of the code that would take too long for a single blog post

Download the PixoPoint No theme Plugin

Tip: You can access external pages from within WordPress via the WP http API with the following code:
$response = wp_remote_retrieve_body( wp_remote_get('http://pixopoint.com/?no_theme=4' ) );

Any WordPress powered website is vulnerable to these sorts of issues if it hasn’t been specifically setup to avoid them. There are various ways circumvent some of these security issues, including multi-factor authentication, but by far the simplest and most effective approach is to setup an SSL certificate and force your WordPress admin panel to use https for it’s admin panel. The encryption provided by https prevents anyone from snooping on that data. Your information remains confidential from snoopers as only your browser and server are able to decrypt the data.

Typically, websites will pay for an SSL certificate which is respected by all of the major browser vendors. This provides a nice green icon in the admin panel beside where it says https. However there is no need for you to pay for an SSL certificate if you are the only one using the site. As long as you create the SSL certificate yourself, you can trust it This is what I do here on PixoPoint.com so I thought I’d give a quick lesson on how to do it yourself.

There is a plethora of different server setups, so I’m only going to explain the most common setup here, but the same principles should apply for non cPanel setups too. Note, this may not work if your cPanel account is not setup to allow you to create new SSL certificates. If this is the case, simply contact your web host who should be able to setup a certificate for you. If they can’t, then change web hosts! There is no reason you should be forced to use your WordPress admin panel in an insecure fashion simply because of limitations in your web hosting.

SSL link in cPanel

Click the “SSL/TLS Manager” link in cPanel …

The SSL/TLS Manager provides you with links for creating a  private key (KEY), certificate signing request (CSR) and a Certificate (CRT)

The first one you need to create is the private key. Select the domain you want to setup https for, and it will auto-populate the “Host” for you. Then click “Generate”.

You will be provided with the private key although you won’t need to do anything with this as it will be automatically carried forward by the server.

Next up, head back to the SSL/TLS manager and generate a Certificate Signing Request (CSR).

As with the private key, the generated signing request will also be carried forward by the server so you don’t need to do anything with this.

Now head back to the SSL/TLS Manager and create the certificate. The private key and signing request you have already prepared will be automatically used to create the final certificate.

This stage, you will have https working on your site, but the WordPress admin panel won’t use it by default, so you need to force it use https. To do this, you need to edit the wp-config.php file (usually found in the main folder of your WordPress installation). At this point you have a choice between only forcing the login page to use https, which protects your password from being stolen, or forcing https over the entire admin panel. Theoretically the admin panel will load slightly slower when using https, so some people do prefer to take the login https option only. But the performance hit is so minimal that I recommend simply forcing https across the entire admin panel as a further security improvement. This ensures that not only is your password secure, but also your cookies and any private posts and data which you may enter via the admin panel.

Adding the following code to the wp-config.php file will force only the login page to use https (not recommended):
define('FORCE_SSL_LOGIN', true);

Adding the following code to the wp-config.php file will force the entire admin panel to use https (recommended):
define('FORCE_SSL_ADMIN', true);

Now when you visit your sites admin panel, you will be greeted by a lovely warning message! Don’t worry, this is simply because you are using a self-signed certificate, which since you were the one that created it is perfectly okay to use. If you can afford to buy a certificate, then do so, but otherwise this free solution should be good enough for most purposes. You just need to put up with clicking past the error message whenever you visit the admin panel from another computer/browser.

Now once you are logged into your admin panel, you should be surfing along in a totally secure admin panel which your neighbours can’t snoop in on. There will be an unpleasant looking line through “https” in your address bar, but this is not a problem due to you have signed the certificate yourself so is no cause for concern. Your admin panel is locked down nice and tight so that no prying eyes can watch what you are doing on your own site.

Multi-site

If you have a multi-site network with domain mapping, this will probably not work unless you have the domain mapping plugin set to use sub-domains of the primary domain as the admin URL for each sub-domain.

This post was heavily inspired by a similar post by Mika Epstein. Mika is an awesome contributor to the WordPress project and can often be found helping out in the support forums at WordPress.org.

Check it out now! 

The admin page for the auto-update plugin

Hybrid Tabs CSS plugin.

However there is one area which has added clutter to the admin interface. That area is the admin menu which now has a prominent “Feedback” link which allows you to see all the messages submitted via the form.

To remove that link, simply head on over to our “Disable Grunion Admin link” plugin page to install our plugin which removes it for you automagically.

http://wordpress.org/extend/plugins/deregister-contact-form-7/

The PixoPoint.com contact page where we utilize the Disable Contact Form 7 plugin

If you would like to use the functionality of the plugin but prefer to include such functionality in your theme, then simply include the following code in your themes functions.php file:

/**
 * Primary span tag adding function
 * Code from PixoPoint Add Span Tags to Titles plugin (http://pixopoint.com/products/add-spans-to-titles/)
 */
function pixopoint_add_spans_around_words( $name ) {

	// Initially check that it doesn't contain HTML as that's bound to mess things up
	$check = strip_tags( $name );
	if ( $check != $name )
		return $name; // Just spit out original string if HTML was included - no sanitization as assumes that user intended to include HTML

	$name = explode( ' ', $name ); // Explode inidivual words into array
	foreach ( $name as $number => $key ) {
		$new_name .= '<span class="word-' . $number . '">' . $key . '</span>' . ' '; // Add span tags
	}
	return $new_name;
}
add_filter( 'the_title', 'pixopoint_add_spans_around_words' ); // Filtering the title

PixoPoint Add Spans to Titles WordPress plugin in action