Ed Nailor

Using Sessions in WordPress

Ed Nailor — Thu, 08 Jul 2010 03:56:37 +0000

WordPress does not, by default, allow sessions. In a recent project, I needed to use sessions. So how do you use sessions in WordPress?

Simple. Add the following line to your functions.php file within the open and close php tags, and you can then use sessions as needed.

if ( !session_id() )
add_action( 'init', 'session_start' );

Ocoee Whitewater Rafting June 2010

Ed Nailor — Wed, 23 Jun 2010 18:24:08 +0000

WoooHooo!

On June 26, 2010 you will find me somewhere in the rapids of the Ocoee River in Tennessee. I am finally getting away to enjoy some whitewater rafting after a couple years of not being able to go. This is long over due and highly looked forward to!

So please be advised, unless you too are on the river, I will be unavailable during the weekend!

OMG WP3

Ed Nailor — Thu, 17 Jun 2010 20:04:35 +0000

I just want to say, WordPress 3.0 is finally released!

Yeah!

WordPress 3.0 TinyMCE Editor Styling to Match Theme Style

Ed Nailor — Wed, 16 Jun 2010 14:52:23 +0000

Now you can control the styles of the WordPress content editor (TinyMCE) by using the following snippet in your functions.php file, and by adding an editor-style.css file to your theme.

add_editor_style();

http://www.deluxeblogtips.com/2010/05/editor-style-wordpress-30.html

WordPress 3.0 Login Form

Ed Nailor — Wed, 16 Jun 2010 14:45:55 +0000

Very cool snippet to add a WordPress login form anywhere you want:

More details @ http://codex.wordpress.org/Template_Tags/wp_login_form

Default WordPress Configurations Built in Theme

Ed Nailor — Wed, 16 Jun 2010 14:32:39 +0000

Using the code below, you can allow your theme to set the default configuration for WP. Useful if you use the same theme as a framework a d do a lot of clean website installs.

function set_theme_defaults() {
$o = array(
 'avatar_default'            => 'blank',
 'avatar_rating'             => 'G',
 'category_base'             => '',
 'comment_max_links'         => 0,
 'comments_per_page'         => 0,
 'date_format'               => 'F j, Y',
 'default_ping_status'       => 'closed',
 'default_post_edit_rows'    => 30,
 'links_updated_date_format' => 'j. F Y, H:i',
 'permalink_structure'       => '/%postname%/',
 'rss_language'              => 'en',
 'timezone_string'           => 'America/New_York',
 'use_smilies'               => 0,
 'page_on_front'             => 2,
 'show_on_front'             => 'page',
 'uploads_use_yearmonth_folders'    => '',
 );

 foreach ( $o as $k => $v )
 {
 update_option($k, $v);
 }

 // Delete dummy post and comment.
 wp_delete_post(1, TRUE);
 wp_delete_comment(1);

 return;
}
register_activation_hook(__FILE__, 'set_theme_defaults');

http://new2wp.com/noob/collection-of-WordPress-and-jquery-code-roundup/

WordPress 3.0 – Tips, Ticks and How To’s

Ed Nailor — Wed, 16 Jun 2010 14:17:19 +0000

WordPress 3.0 is just about to be launched to the public. As of this writing, RC3 is available, but from what I have read, the actual final version could come out as early as later today. I am looking forward to it, but as with anything new, there are new things to learn, adapt and implement. Over the next few days, I will be adding snipets of various articles I have read releated to the new changes within WP 3.0 and how to add them or use them within your new website.

I am not doing this to take credit for the information; rather this is for ME! My idea is to put all of this reference material in one place, in an easy to read format. Some of the articles I have found are bloated with information I do not need, either because I am already familiar with the subject, or it just doesn’t apply. So what I post will be a bit more stripped down, but will provide links to the full versions of the articles is someone reading my postings wants to get more info.

So, if you are reading this, and you are not me, I hope you enjoy!

First Look at WordPress 3.0

Ed Nailor — Tue, 15 Jun 2010 03:29:36 +0000

Recently, WordPress 3.0 RC-1 became available. I normally don’t mess with release canidate versions as you never know what you are getting, but I happened to have a great project that seemed fitting to try this. Since 3.0 is now allowing Custom Post Types along with the new Custom Menu feature, this was the right fit.

This will be a short posting, but so far I LIKE! It seems as though I have already been able to replace a number of plugins. As plugins tend to use up resources and provide additional security concerns, this is a great thing.

Most of the documentation is still very lacking, so you will need to do some Googling to find more information. If you are new to WordPress, stick with the current 2.9.2 version that is out, until the final 3.0 version is released. You won’t find enough info to take advantage of the new features.

I will try to get back to some of the new features, and what I do / do not like about them (not everything is perfect). However, work is busy, so this will come when I find the time to do so. Just know, I am digging the new WP 3.0 and will be using a lot of its potential for clients going forward!

WordPress Admin Brute Force Password Hack

Ed Nailor — Thu, 15 Apr 2010 13:25:54 +0000

Recently, a client of the company I am working for contacted me because their WordPress based website was “messed up.” This website was developed prior to me joining the firm, but I was happy to take a look. After reviewing the website, it was apparent that the website had been hacked.

Avoid the website hacker with simple security changes

It appears at first glance that this was an Admin Brute Force Password hack, which is not an uncommon hack that affects WordPress websites. As a matter of fact, this is a common attack on a number of CMS platforms. Any CMS platform that has a master user account with the login name of “admin” is vulnerable to this kind of attack.

The hack is a rather simple one, which is why it isn’t all that uncommon. Since a majority of WordPress and other CMS installations typically create the first and main administrator user with the user name of “admin”, all a hacker must then do is guess at the password. With a typical password (6-8 characters), this can be pretty easy. As a matter of fact, a leading newspaper recently published a report that showed that a high number of people use a simple password, the most common was actually 123456.

Hackers will use simple programs that will continually guess at the password until they get in. This is known as brute force, as they just keep up until they win. And since they already have the user name (“admin”) their job is simply to guess the password.

How to secure yourself against this attack

Securing your website against this type of attack is rather easy. Most people don’t do it simply because they don’t know to do it.

First, log in under the admin user name and click over to edit your user profile (in WordPress, you can click on your user name in the top right corner to get to your profile quickly.) Once on the profile page, change your email address to something generic. Since most CMS programs do not allow multiple users to share an email address, this is how we will be able to use our real email address when we set up the new user. Once you have made the email change, update your profile.

Next, you will add a new user. In WordPress, click on “Users” and then “Add New.” Here you will add your new administrative user. Think of something unique for the admin, not just “admin1″ or something simple. Maybe “superadmin24″ or “webmastersurpreme” would be good for you! No matter what it is, make it different that just “admin,” enter your real email address for this user, and create a good password (8-12 characters, with a combination of upper and lower case letters, numbers and special characters such as * _ – @ #.) Make sure you assign this new user the role of “administrator” – this is very important! One final thing… make sure your new admin name is not disclosed on the website. In WordPress, you can change the “public display” name to anything you wish. If you don’t change how the name is displayed publicly, all your work is in vain, as you just gave away the user login name! Once you have added this new user, log out of the CMS.

Finally, log back in to the CMS with your new user and password, return to the “Users” page and delete the “admin” user. In WordPress, you will be given the option of assigning all posts and pages to the new user. Make sure you do so or you will lose all that content!

There you have it! You have removed the “admin” user and replaced it with something more unique and more secure. Now a hacker will have to guess at the user name and password to gain entry this way, which most will give up after a few tries and move on to easier prey!

I hope this helps you secure your websites a bit more. Fixing hacked websites can be a messy thing to do, and inevitably, you end up losing some content… sometimes all of it. So until the CMS systems offer you an option during installation, you can help protect yourself from this attack.

PS. It is worth noting that this website was developed prior to my employment with Creative Services. WordPress / CMS websites that I develop are not released with the “admin” user in place. So hackers, I can save you the trouble of even trying!

Seeking Mortgage Professional for Referrals

Ed Nailor — Mon, 12 Apr 2010 16:55:56 +0000

This website still gets people looking for a mortgage. I still get inquiries about mortgage related items, even though I am no longer in the mortgage field. I am seeking a mortgage professional in the Charlotte mortgage industry seeking an advertising option to refer interested parties to. I am seeking only ONE professional to advertise on this website. I must feel confident in your ability and professionalism. Please contact me if you are interested in this advertising option.