Tips Tuesday – Secure Site Webinar, Google Crawls, Brute Force Protection

Hello Happy Site Owners!

Tips this week include:

• The Secure Site Setup Webinar this Thursday
• New time for the live Tips Tuesday recap
• How to bring joy back into your business
• Site revamp projects
• Accelerated site creation classes
• How to turn off the link counter in Yoast SEO
• A super Google Crawl Bot case study
• Google testing new Search Console design
• New image optimization tester tool
• Why and how to rotate your SALT keys for brute force protection
• Why to disable XML-RPC to prevent brute force and DDoS attacks
• What’s up with A2 Hosting partnering with Sucuri
• New Gutenberg Boilerplate for designing your own blocks
• The new features in Gutenberg 0.5.0
• Dev discussion updates on PHP and WordPress
• Why you should update your PHP version now
• New Webmention and Annotation standards and how to get them on your site now
• Liquid Web acquires iThemes Exchange e-commerce plugin
• Staggering trends in video marketing adoption rates

Listen to the Podcast

Podcast: Play in new window | Download

Subscribe: Android | RSS

Watch the Live Video Recap

Streamed live on the BlogAid Facebook page 

BlogAid Happenings

Catch the Recap Live at New Time

Join me on the BlogAid Facebook page for the live Tips Tuesday recap where we can discuss this week’s top site news. And I always have something new in there that’s not in the post.

I’ll be on at an earlier time this week at 4pm ET / 1pm PT so more folks can catch the show.

And you can always catch the replay on the BlogAid YouTube Channel too.

Secure Site Setup Webinar

Heads up to all designers and webmasters.

The webinar is this Thursday at 1pm ET / 10am PT.

I’ll be setting up and securing a site from scratch right in front of you.

Nothing is hidden or skipped.

This is a must-know skill for anyone who sets up sites for clients, or needs to vet a partner to do it for them.

Booming Bloggers Hub Meet and Greet

I’m delighted to get to meet live with all of my VIP site audit clients this Wednesday for our first meet and greet. We’re already going big guns in our Facebook group too. And, I’m already doing quick fixes for my clients there too.

Bring Some Joy into Your Business

This past weekend was my birthday and I hopped on YouTube Live with a little message about how I’m celebrating.

I’ve revived my carving hobby and I finally figured out a way to run my carving site, Heartwood Art,  for passive income and still keep it a hobby.

Plus, it’s a great way to take a deep dive into the affiliate and PPC arena that so many of my clients are in.

And, it’s a super way to bring all of that inspiration, joy, and enthusiasm back into my online business and have it spill into what I do here on BlogAid.

How do you keep it fresh after blogging for so many years?

Feel free to leave a comment here on the blog or anywhere you see this post online.

Site Revamp Projects

This month I’ve had string of longer projects to help clients map out a plan for improving their sites.

Those plans include:

• Moving to better hosting
• Deleting their site files and databases at the old host so their info is not sitting there unattended
• Transferring to a better domain registrar so they can get entirely away from the old host
• Splitting multiple sites under one cPanel to their own cPanels

All of this will make their sites more secure and faster too.

Once we get to the new host and have the sites split, then we can do:

• full security measures on each
• Get a real backup solution for each site
• Get each domain on CloudFlare
• Convert each site to HTTPS

And then we’ll tackle the theme design part of the project.

Right now I’ve got them on a sandbox site learning all about all they can do with the Genesis framework. And then we’ll go theme shopping for the best structure to meet their conversion goals.

These are long projects. But the way I project manage them gives us nice break points for budgeting both time and money, so no one is overwhelmed.

And clients are more confident in their decisions about everything because we have consults first. Those are so important to gather info about their ultimate goals and level of involvement.

Some folks are more tech savvy than others and want to do parts of the project themselves, which is fine by me.

Same with site audits. During our 2 hour live chat to go over the 20 page report, my clients fully understand what’s going on with their sites and can make educated decisions about how to improve it.

They usually hire me to make our to do list, with everything broken into phases of what each of us need to do, and in what order.

Some of those phases are things they will do over time, after all the main fixes are complete, like:

• Take the DIY SEO course
• Get bulk image optimization services (contact me for details)

Scratch to Published Accelerated New Site Creation

Right now I also have 2 clients in my Scratch to Published live classes.

One client had started a blog about a year and half ago and just wasn’t getting anywhere with traffic and monetizing it.

We had a consult and found her real passion and base of authority and knowledge was actually in an entire other niche.

Now she is building that site from the ground up, with a focus on traffic and conversion. Her editorial calendar is full for the rest of the year.

And every blog post has a specific purpose that will meet her goals.

I would not be surprised to hear that she’s making money in the first month after launch. I’m 100% positive that she’s going to have traffic!!

The second client came as a referral from her mother, who is presently going through one of those total site revamp projects I mentioned previously.

She’s launching a new local service business and is new to WordPress. I normally don’t allow folks brand new to site ownership into the Scratch to Published classes, simply because they would overwhelming.

But, she’s like her mother in that she has extreme organizational skills, knows exactly what she is trying to achieve, and has the tenacity to put butt in seat and get the work done. She also has a high-level degree in English, so she knows a little something about writing. Now she’ll be morphing that into SEO copy creation with an eye on conversion.

We’re starting her out on a sandbox site and my WP video tutorials, and then we’ll dive into the live classes.

That’s what’s happening around here. Let’s jump into this week’s tips.

SEO Tips

Yoast SEO: Turn off new link counter

Well, just as soon as Yoast launched the happy new link counter feature, folks started screaming about having a way to turn it off. So, he put a toggle button in the latest 5.0.2 version.

I get that having all of your SEO info available in the list of your pages and posts is handy, but not when those columns take up so much room that your titles are smushed to 2-3 characters per line.

Most of us just go up to the Screen Options tab and turn most of that SEO stuff off. But, then, it’s a pain to turn it on when you do want to see it.

I believe there are plugins that allow you to control column layout width on the admin side, but this is something that I think WP needs to do natively.

Do you use one of those column width control plugins?

Please leave a comment here or anywhere you see this post online, as I would like to have a good example to show the WP dev team when I make the suggestion for something like that going into the core.

Google Crawl Bot Log Analysis Case Study

Do you have any idea how many bots are hitting your site?

I generally look in AWStats for that kind of info. You’ll find that in your cPanel.

But, this post by Glenn Gabe over on Search Engine Land caught my attention.

He uses the Screaming Frog Log Analysis tool to identify the bots. Now, this is a different tool from their crawling spider.

And what he found was eye opening.

There were crawl spikes from bad bots that were trying to disguise themselves as Googlebots.

Now, you may ask, why in the world would a bot want to disguise itself as Google?

Because Google bots are the only ones every site owner lets in. Many site owners actively block other bots by name for better performance.

Gabe wrote up a super case study on his findings from examining the actual logs.

They were able to find and fix legit crawl issues.

Plus, they were able to block the bots that were spoofing Google, which were gathering intel on their site for who knows what reason. And they stopped them from hammering the server, which was driving hosting resources through the roof and driving down performance.

Definitely a post worth reading.

New Google Search Console Design in Beta

Your Google Search Console dashboard may be getting a facelift soon. Google is currently beta testing a new look with a few users. It’s based on their mobile testing site design. So, look for that to roll out in the near future. Check the post for screenshots.

Performance Tips

Image optimization tester tool

Pound for pound, optimizing your images is the best performance improvement you can do on your site.

There’s a new testing tool I came across last week that digs deep into how well your images are performing.

I haven’t had time to fully put it through its paces yet, but definitely something we all should look into.

If you give it a whirl, let us know what you think of it, and the type of helpful info it gave you.

Security Tips

Rotate Your Site’s SALT Keys for Better Brute Force Protection

I hope you had the chance to see my post from last week about how and why to rotate your WordPress SALT keys to better protect your site from brute force attacks.

This is the type of thing I check for my site audit clients.

If you have an older site, like 5 or more years old, guaranteed that these keys are out of date and giving you a big security hole right in the front door of your site.

Disable XML-RPC in WordPress to Prevent DDoS Attack

The XML-RPC input/output layer is still the favorite way for hacker bots to hammer on that front door of your site in a brute force attack.

And if they get in, they can use your hosting resources in a DDoS attack against other sites.

Read my post on how and why you should disable XML-RPC fully.

And this is my big issue with using the VaultPress backup service now. New accounts are required to include JetPack, and you have to leave XML-RPC on for that, even though VaultPress doesn’t require it.

See my UpdraftPlus backup plugin series if you’re looking for a new backup solution.

A2 Hosting Adds Sucuri Service

If you’re on A2 Hosting, you may get a promotional email from them soon that they’ve added integration with the Sucuri scanning and firewall services. Do watch my BlogAid Today Tip about it for more info to help you decide if this is a good fit for you.

And do keep in mind that CloudFlare has a Web Application Firewall too in their $20/mo Pro plan and that’s the one I’m on and advising every site owner use so that it’s fully integrated with their bot protection and CDN too.

Like and Following the BlogAid Facebook Page and subscribe to the BlogAid YouTube Channel so you never miss these tips.

WordPress Tips

Gutenberg Boilerplate

Ahmad Awais, a senior full-stack WordPress dev, has created a nice boilerplate for the Gutenberg editor.

This is probably going to catch on like wildfire with theme and plugin devs who want to create their own custom blocks for the Gutenberg editor.

He has all the code for you, plus video/gif tutorial examples of what it does.

This is a must-read for anyone who designs themes, as you’ll want to know how to style these blocks and know it at the code level.

What’s New in Gutenberg 0.5.0

The WP devs are racing through updates to Gutenberg. I think it’s averaging 20 a week or more.

And this latest update on July 14 is no exception.

They’ve added a way to insert classes for custom blocks, something I know all designers are going to want to have a look at.

They’ve also been working hard on a way to organize all the documentation on Gutenberg. You’ll find new tabs in the sidebar of the Gutenberg documentation page.

And, most importantly, they’ve added a “freeform” block that will allow you to use what they are now calling the “old” editor. Basically, this is a block for TinyMCE so that you can edit just like you’re doing now.

There are tons more additions and changes and I suggest you scan through the Make WordPress post yourself to stay up on it.

WordPress and PHP Updates

The WP devs are also making good progress on what it’s going to take to put WP on a more solid PHP foundation.

One of the discussions centers on putting a new nag in your WP dashboard to alert you that you’re running on an old, unsupported PHP version.

They may have gotten that idea from Joost de Valk, who decided to include such a nag in one of his recent Yoast SEO plugin updates a few months ago.

Update Your PHP Version

If you have not addressed the PHP version on your hosting account yet, you need to get this on your plate. It’s not optional.

PHP versions below 5.6 are no longer supported and present a security risk on your site.

WP and plugin devs are dropping support for them too. And as they do, you could suddenly find yourself with a broken site after you update a plugin.

Take the Seriously Old Plugin Challenge and see how to check your site for PHP 7 compatibility so you can upgrade safely.

Comment Reply Notification Tests Coming Up

Now that I’m starting to come clear from the big, long client projects I’ve had on my plate this month, I hope to soon start tests on the comment reply notification plugins that I’ve been mentioning lately because I found something pretty egregious with a few of the popular plugins.

What the New Webmention and Annotation W3C Standards Mean for WordPress

In the meantime, I’m pretty dadgum excited about 2 new standards that are coming up for adoption in W3C, which is the standards organization for all the code folks use on all kinds of site platforms.

One is for Webmention and the other is Annotations.

As reported on the WPMU Dev blog, Webmentions will take the place of the current pingback/trackback system, which uses XML-RPC and I advise turning completely off.

It used to be a great intra-communication system between WP sites to let other site owners know you dropped a link to them on your site. But hackers got a hold of it and that input/output layer is now their top way to hammer your site in a brute force attack.

This new Webmentions way, folks can leave a link in your comments to where they mentioned you on their site. Yeah, okay, I can see spammy sites running rampant with this, but hopefully there will be some filters on that.

The new Annotation standard allows folks to leave the equivalent of footnotes on your post, which is kind of cool if you do fact based posting and such.

Even though these two new features have yet to be approved by W3C, there are already plugins for both in the WP plugin repository.

Like I said, they’re exciting, but they may also be a spammer’s haven. So, I’ll keep an eye on these for you. If you see them in the wild, let us know.

AJ Morris Acquires iThemes Exchange

iThemes, the folks who make BackupBuddy and iThemes Security, are selling off their iThemes Exchange e-commerce platform to AJ Morris, which is the parent company of Liquid Web. Exchange is a direct competitor of Woocommerce, which was acquired by Automattic, the parent company of WordPress.

Exchange was meant to be a more simplistic way of getting a store running. And I have to say, that was a good idea because Woo is not simple. But, it’s got the lion’s share of market and 100s of extensions that help it do and integrate with just about everything. So, we’ll see what becomes of Exchange going forward. They may end up being a Shopify competitor, instead of a Woocommerce competitor, which would actually make more sense.

Content Marketing Tips

Video Trends for WordPress

If you don’t do anything else in Tips Tuesday this week, scroll to the bottom of this post on video trends and have a look at the staggering data of how fast it is growing.

You cannot afford to miss this train.

Find a way to get into video sooner rather than later, if you haven’t done so already.

Remember when blogging was a new thing, or being on Twitter or Facebook?

Yeah, video is going to be like that in the near future.

My bet is that you can forget being found if you don’t have a video presence on at least one of the popular platforms.

You don’t have to start with talking head videos. There are plenty of other ways to repurpose your current blog content with video. Just have a look at recent Tips Tuesdays where I link to posts from both my friends Denise Wakeman and Ana Hoffman.

If you are ready to jump into the talking head video scene, be sure you follow my friends Ileane Smith and Krishna De.

All four of these folks will dramatically shorten your learning curve and help you get your videos seen.

Wrap Up

That’s a wrap for this week’s Tips Tuesday.

Find these tips helpful? Share them with your peeps!!!!

Subscribe to all BlogAid Posts

Subscribe on iTunes

Be sure to visit BlogAid.net for more tips and resources and I’ll see you online.