Ed Nailor » Websites

OMG WP3

Ed Nailor — Thu, 17 Jun 2010 20:04:35 +0000

I just want to say, WordPress 3.0 is finally released!

Yeah!

WordPress Admin Brute Force Password Hack

Ed Nailor — Thu, 15 Apr 2010 13:25:54 +0000

Recently, a client of the company I am working for contacted me because their WordPress based website was “messed up.” This website was developed prior to me joining the firm, but I was happy to take a look. After reviewing the website, it was apparent that the website had been hacked.

Avoid the website hacker with simple security changes

It appears at first glance that this was an Admin Brute Force Password hack, which is not an uncommon hack that affects WordPress websites. As a matter of fact, this is a common attack on a number of CMS platforms. Any CMS platform that has a master user account with the login name of “admin” is vulnerable to this kind of attack.

The hack is a rather simple one, which is why it isn’t all that uncommon. Since a majority of WordPress and other CMS installations typically create the first and main administrator user with the user name of “admin”, all a hacker must then do is guess at the password. With a typical password (6-8 characters), this can be pretty easy. As a matter of fact, a leading newspaper recently published a report that showed that a high number of people use a simple password, the most common was actually 123456.

Hackers will use simple programs that will continually guess at the password until they get in. This is known as brute force, as they just keep up until they win. And since they already have the user name (“admin”) their job is simply to guess the password.

How to secure yourself against this attack

Securing your website against this type of attack is rather easy. Most people don’t do it simply because they don’t know to do it.

First, log in under the admin user name and click over to edit your user profile (in WordPress, you can click on your user name in the top right corner to get to your profile quickly.) Once on the profile page, change your email address to something generic. Since most CMS programs do not allow multiple users to share an email address, this is how we will be able to use our real email address when we set up the new user. Once you have made the email change, update your profile.

Next, you will add a new user. In WordPress, click on “Users” and then “Add New.” Here you will add your new administrative user. Think of something unique for the admin, not just “admin1″ or something simple. Maybe “superadmin24″ or “webmastersurpreme” would be good for you! No matter what it is, make it different that just “admin,” enter your real email address for this user, and create a good password (8-12 characters, with a combination of upper and lower case letters, numbers and special characters such as * _ – @ #.) Make sure you assign this new user the role of “administrator” – this is very important! One final thing… make sure your new admin name is not disclosed on the website. In WordPress, you can change the “public display” name to anything you wish. If you don’t change how the name is displayed publicly, all your work is in vain, as you just gave away the user login name! Once you have added this new user, log out of the CMS.

Finally, log back in to the CMS with your new user and password, return to the “Users” page and delete the “admin” user. In WordPress, you will be given the option of assigning all posts and pages to the new user. Make sure you do so or you will lose all that content!

There you have it! You have removed the “admin” user and replaced it with something more unique and more secure. Now a hacker will have to guess at the user name and password to gain entry this way, which most will give up after a few tries and move on to easier prey!

I hope this helps you secure your websites a bit more. Fixing hacked websites can be a messy thing to do, and inevitably, you end up losing some content… sometimes all of it. So until the CMS systems offer you an option during installation, you can help protect yourself from this attack.

PS. It is worth noting that this website was developed prior to my employment with Creative Services. WordPress / CMS websites that I develop are not released with the “admin” user in place. So hackers, I can save you the trouble of even trying!

3 New Website Designs

Ed Nailor — Wed, 10 Mar 2010 03:56:47 +0000

I wanted to share a couple website designs I have been working on. You may notice that these are designed specifically with the real estate market in mind, but in many cases they could be adapted to a different industry if needed.

Currently, these designs have not been placed on anyone’s website. They were creative exercises for myself. However, they are available for purchase if you may be interested. Simply contact me with a request and we can work out the details.

The Homestead Design

The Concept

A nice home with a lush green lawn, using the lawn area as the backdrop of the website content. Using a combination of bright colors with earth tones and textures creates a lively, rich and inviting website. The dark textured background allows the design of the site and the content to stand out on the page!

Suitable Uses

Ideally suited home related websites and services, such as:

real estate agents
mortgage loan officers / lenders
home repair services

The Thompson Design

The Thomspon Design

The Concept

Light, clean and sharp. While this design seems to embody these design elements, it still projects both a friendly and professional look and feel.

Suitable Uses

This website is very versatile and can be used for a wide variety of websites. While the design is shown with the example of a real estate website, this can be adapted to virtually any professional service.

Special Notes

When used as a real estate website, pay special attention to the ever-present property search bar located just under the header image.

The Vineyard Design

The Concept

With this stylish and contemporary design, the dark background makes the white body just pop off the screen. The Vineyard was designed to employ a vertical navigation system that hovers over an attractive header image. The use of white on black, with varied shades of gray give great contrast, yet bring the entire site together in a very nice way. This is not your typical black and white look!

Suitable Uses

Again, this one is using real estate as an example, but this can easily be adapted to virtually any website need.

Special Notes

While the image shown here makes the website design appear narrow, this is a bit misleading. The design itself spreads across 1000 pixels, making for a nice wide area to work in. The site design was intentionally a bit longer to allow me to showcase both a home search and featured home within the left sidebar typically sought in a real estate design.

So there you have it. 3 new designs by your’s truly. Any thoughts?

TwitterFeed it is!

Ed Nailor — Sun, 24 Jan 2010 04:26:36 +0000

So I have been looking for something to update my Twitter account when I add a post to this website, and have gone through a number of Twitter plugins, none of which seem to work. I tried TwitterFeed.com again, which takes your RSS feed from your website and then publishes the most recent post(s) to your Twitter profile. They even post to other services, such as Facebook. While I added my Facebook account to my TwitterFeed.com account, nothing has yet updated, so we will see if that works.

As long as TwitterFeed continues to update my posts on a regular basis, I will stick with this. I am not a big fan of adding plugin after plugin as it seems to make your WordPress website bloated and slows things down. Besides, just one more thing to go wrong!

So in short, I am using TwitterFeed to publish my posts from this website to my Twitter account. So, if you want to keep up, you can subscribe to my RSS feed or follow me at http://www.twitter.com/ednailor

TwitterFeed.com

Ed Nailor — Sun, 24 Jan 2010 03:18:12 +0000

I have used TwitterFeed.com in the past, but stopped when it stopped working. But that was a while back, so we will test it again.

This time, I am updating both Twitter and Facebook with posts from my website, so let’s cross fingers that it works!

Testing Bird Feeder

Ed Nailor — Sun, 24 Jan 2010 02:45:25 +0000

Not having much luck in Twitter plugins, so I am testing Bird Feeder… let’s see if it updates my Twitter account…. So far, not happening…

Cross Browser Testing Made Easier

Ed Nailor — Sat, 23 Jan 2010 05:07:19 +0000

When designing and developing a website, one of the more important issues is getting it right in as many browsers as possible. Yes, I know its 2010, but even today we still don’t have a real set standard that all browsers use for rendering a website. Browsers such as Internet Explorer and Firefox have multiple builds, and each one displays a website slightly different. For a designer / developer this is a very frustrating thing!

So once you get your design complete, then you must begin checking all the different browsers to see which ones you need to fix your design in. Most notorious is Internet Explorer 6, which if you are still using this browser, by all means please UPDATE! Not only does IE6 butcher most designs, it is also a very insecure browser!

Anyway, once the design is set, you start checking it against as many browsers as you can. The problem is that it can’t always do that easily. For example, if you want to check your design in all the IE browsers, you have to pull a lot of tricks out of the hat. You see, you can’t run multiple versions of IE on your computer as the latest version replaces the prior one. You can run virtual pcs and install different versions that way, or modify the code of the IE versions to allow them to work side by side. However, these are not the most optimal way of doing things.

Another option is using an online service such as BrowserShots, where your webpage is rendered on multiple servers and different browsers. This can take a long time to get the results, in some cases cost money and you normally get only an image, not the live site. What if there was something better? There is!

I just downloaded the Microsoft Expression Web 3 SuperPreview program. This very cool program compares your website using IE 6, 7 and 8 as well as Firefox. You can see the different browsers side by side, one above another and the coolest view… layered over each other! You can also click on different sections to find out size discrepancies and more. Its a very cool program that seems to have a lot of promise.

It does not compare every browser out there, but since the different versions of IE account for roughly 2/3 of the browsers used online and Firefox uses about half of what’s left, you will cover the vast majority of users. From what I have seen, there was a free version of it that only compared IE versions. I think that is still available, but you will need to search Google to see. I have a paid copy that includes other browsers like Firefox, and it also comes as part of Expression Web 3, Microsoft’s version of Adobe’s Dreamweaver.

I encourage you to check it out if you are a designer / developer. It may make your life a bit better!

Trying Twitter Tools

Ed Nailor — Wed, 20 Jan 2010 12:29:32 +0000

I am looking for the right WordPress plugin that will automatically submit my posts here on Twitter for me. My hope is to have really one key place to post information and to have that update any and all profiles I may have. That way, no matter what someone uses, they can keep updated (if they care to), but I don’t have to go to multiple places to update.

If you have been using a plugin for your WordPress website that updates Twitter, Facebook and even MySpace… and actually works well, please let me know!

Introduce Yourself

Ed Nailor — Fri, 15 Jan 2010 22:22:10 +0000

Hey there! Thank you for stopping by and checking out the website. Along the way, you will get to know me a bit. I’d love to know who you are. So why not take a moment and introduce yourself… go ahead, use the comment form and tell me a little about who you are!

Thanks,
Ed