Skip links

Performancing

Main navigation

Blog

Screencast: ScribeFire FireFox Extension Reviewed

Long time readers of Performancing will certainly remember a FireFox extension which went by the same name as the site. The extension underwent a name change in 2007. Instead of being called Performancing, it is now called ScribeFire and serves as an external blog management tool. This is the editor I’ve been using for quite some time now to create posts, as well as manage my own blog when I’m on the road.

This video is my second screencast and goes over the abundant amount of features and possibilities this extension provides. I’ve changed a few exporting features in Camtasia and I’m hoping those changes have reflected in better video quality. Enjoy.

NOTE: You may see things better if you view it in full screen mode. Looks like I still have to figure out the magic formula.

Reader Question: Is WordPress Safe To Use?

Terri recently sent me an email and wanted to know some precautionary steps as well as advice on how to keep WordPress safe from being hacked. Terri also wanted to know the differences in security between a self hosted version of WordPress versus the security risks of using WordPress.com

I have been doing a lot of research about the pros/cons of different blogging platforms and CMS. At the same time, I have come across a lot of information related to WordPress sites being hacked and other security issues. When I read about the pros/cons of self-hosted vs hosted solutions for blogs, it is interesting that I don’t read too much about security vulnerabilities being a huge disadvantage to using a self-hosted solution. How concerned should bloggers be about being hacked? Is the threat big enough for someone not to choose WP as a blogging platform or CMS? Besides backing up your database (which could be infected also) and upgrading WP to the most recent version, what other precautions should you take to keep a WP blog safe? Also, I heard that the upgrades that WP makes makes it more open to attacks. Your thoughts?

Well Terri, I’ll first start off by pointing you to a post that Matt Mullenweg published a few months ago which goes into detail on how to keep your blog safe.

The article boils down to a couple of simple points:

  • Upgrading WordPress ASAP to the newest release.
  • Changing Your Password On A Regular Basis/Using A Strong Password

The majority of times it’s discovered that a WordPress powered site has been hacked, that site was using an older version of WordPress. This makes sense given that newer versions patch previously discovered security holes.

Hosted / WordPress.com

When deciding if you should go the hosted or self hosted route because of security, using WordPress.com is going to come out on top. This is because Automattic runs a tight ship with WordPress.com. Generally, the only thing you’ll have to worry about is using a strong password. WordPress.com doesn’t allow users to upload third party widgets, nor do they allow javascript from being executed in a Text Widget.

Self Hosted / WordPress.org:

When going the self hosted route, it’s a different ballgame. There is an awesome article on the WordPress Codex which goes into detail on how to harden your WordPress installation ( Hardening_WordPress ). At a glance though, this is what you’ll have to worry about:

  • 1 Vulnerabilities on your computer
  • 2 Vulnerabilities in the WordPress package itself
  • 3 Server vulnerabilities
  • 4 Network vulnerabilities
  • 5 Passwords
  • 6 File permissions
  • 7 Database security
  • 8 Securing wp-admin
  • 9 SSL Encryption Security
  • 10 Plugins
  • 10.1 Security Plugins
  • 10.2 Plugins that need write access
  • 10.3 Code execution plugins
  • 11 Security through obscurity

As you can see, there is plenty more to worry about using a self hosted version of WordPress rather than letting Automattic do the worrying for you. However, after going through each section of the Hardening WordPress article, you should be ready to go.

Security Through Plugins:

Alternatively, you can step it up a notch by using a variety of different plugins which are available to help make WordPress that much more secure. Here is a list of plugins/resources to help you along the way.

WP Security Scan – This plugin acts like a spyware/virus scanner in that it scans your WordPress installation for security vulnerabilities and suggests corrective actions.

Login Encrypt – Login Encrypt appends a snippet of javascript to the wp-login which generates a unique DES key each time a user logs in. Using that key, the password of the user is encrypted.

AskApache Password Protect – This plugin makes it easy to put up a virtual wall around your WordPress installation. This plugin allows you to create a username and password to protect your entire /wp-admin/ folder and login page. Plugin can only be used on Apache based webservers.

Admin SSL – Secures any WordPress URL using Private or Shared SSL. Once the plugin is activated go to the Admin SSL config page to enable SSL and read the installation instructions.

Login Lockdown – Login LockDown records the IP address and timestamp of every failed login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. A good way to protect against brute force attacks.

Resources:

Noupe showcases 10 WordPress security tips/tricks/hacks

BlogSecurity released a Whitepaper specifically about WordPress security. The whitepaper is at version 1.2 and was released back in April of 2008.

Speckyboy gives you his list of the best 10 security WordPress plugins to use

Is the threat big enough for someone not to choose WP as a blogging platform or CMS?

In my opinion, no. WordPress is the most popular blogging/publishing platform on the web which means it’s a prime target for hackers. It doesn’t matter which publishing platform you decide to go with, each one of them has or will have security vulnerabilities. To make things worst, you could have a perfectly hardened WordPress installation and discover it’s been hacked thanks to something like an SQL injection via a plugin you installed. It’s a constant race between good and evil. If you make it a routine to keep ahead of the game and keep your blog up to date, more often than not, you’ll be safe.

Also, I heard that the upgrades that WP makes makes it more open to attacks. Your thoughts?

This is what I would consider to be FUD (Fear, Uncertainty, Doubt). Upgrading WordPress from one version to the next does not make it more prone to security vulnerabilities. In fact, it’s the complete opposite. There is only one scenario I can think of where this might be an issue and that is, if you were to upgrade to a newer version of WordPress and that version had a 0 day exploit within the code that no one knew about, then you could be at risk. But considering no one would know about the exploit, what could be done about it? Nothing.

So rest assure that upgrading your blog as soon as you can after a new version has been released is one of the best things you could do to keep your blog safe. Not doing so is a recipe for disaster.

Conclusion:

Terri, I hope that answers all of your questions. You now know the differences in security between using a self hosted version versus a hosted version of WordPress. With the Codex article along with the resource links and plugins, you now have a better grasp on how to ensure your blogs safety against malicious attacks.

Your Turn:

If you had to answer Terri’s questions, what would have said differently? Do you disagree with anything I’ve said? Let me know in the comments. Also, if you have any more tips and tricks in terms of making WordPress more secure, share those as well.

How to Create User Generated Linkbait and Build Relationships at the Same Time

As I’ve realized the value of time, I try to look for ways to save time in my blogging.

One of the ways to increase blogging productivity is to do something that covers more than one necessary blogging activity.

Here is a way to create linkbait, or linkworthy content, with other people in your niche while at the same time buiding relationships with them.

A couple months ago, Distilled published a great article about creating user generated linkbait through forums.

Here’s their method step-by-step:

  1. Find a forum with a decent traffic level in your niche
  2. Spend some time contributing to the community, get your name respected and ensure the mods don’t see you as a spammer (having a trusted profile in your niche community/forum is worth it’s weight in gold – treat this as a serious investment and don’t ruin it for a one-shot chance at linkbait)
  3. Start a post on the forum with the seed of an idea, and a couple of examples from you
  4. Let the forum community chip in their own ideas and funny comments and let them grow the idea for you
  5. Wait for the thread to die down and compile all the best bits from it
  6. Write this up into a piece of linkbait for your site
  7. Social media success!

This idea is excellent because you make yourself known to other members in your niche while leveraging their input to create quality content.

One thing I would add to the post is to give credit to the forum where you got the information. You can link to the forum thread at the end of your linkbait and even mention the contributors by name.

Two Performancing Examples

I know this method works because we’ve done a similar thing and it has worked for us.

A couple months ago, our paid forum, Hive, was an invite-only forum. Ahmed asked the members of the forum for our best blogging tips. He compiled them and created 27 Tips for Building a Kick-Ass Blog.

We marketed it on Digg and it got on the front page with over 900 diggs. This led to a ton of links.

I did the same thing on my post: Onpage SEO: 7 Tips That Are Easy to Implement.

It did not get as many links or hit the front page of Digg (SEO is a bad word for Digg users). However, it did get links from two top SEO blogs, Search Engine Land and Search Engine Watch.

An Awesome Time-Saving Tip for Checking Your Blog Posts’ Grammar

Many operating systems have wonderful text-to-speech features included by default—ironically enough, this entire article revolves around this feature. Long forgotten and unused, it is now an important part of my work flow. I only began exploring this feature around a month and a half ago on my Mac OS X Leopard system, and I have been using it ever since. It has saved me from having many errors that I would not have noticed otherwise. It is exactly like having someone else read your work for you, but the only difference is that it is now a computer doing it for you.

Enabling Text-to-Speech on Mac OS X

There are only a few steps required to enable text-to-speech shortcuts in Mac OS X Leopard:

  1. Open up your system preferences.
  2. Under the “System” subheading, click on the “Speech” option.
  3. Navigate to the “Text to Speech” tab.
  4. Enable the check-box for “Speak selected text when the key is pressed.”
  5. Click on “Set Key” to open up a dialog box that will allow you to set a key combination to set when you want to have your computer read the text. (I have it activate when the Shift key, Option key, Control key, and ‘S’ key are all depressed.)

After you have done all those steps, try selecting any text on your screen, and press the key combination to see if it works. You should know before you attempt this that text-to-speech synthesis requires a decent system to operate correctly. Apparently it uses up a lot of memory and CPU cycles to calculate the process. Keep this in mind.

An Alternative Method

If you want a different way to access this feature, you could try selecting some text, navigate to the “Edit” menu, and then scroll down to the “Speech” item, and, finally, select “Start Speaking”. However, this method only works in applications that display the “Speech” item under the edit menu. For example, Firefox does not have this menu, but you can still press they key combination set (as explained above) to have the computer read the text back to you.

It’s Not Perfect

Now, I will be the first to admit that it is not a flawless solution. There are times when that monotonous voice will put you to sleep, but I have been fairly impressed overall. The default voice, Alex, works the best for me, but you should try the alternative voices to see if they work better for you.

I would really urge any of you who have a Mac computer to utilize this feature. It might sound silly, but it really does work, and I’m not afraid to state that I use it on a regular basis to help me ensure that my posts are of great reading quality.

Using Something Else?

For those of you on Windows and Linux operating systems, you are in luck. Windows XP, Windows Vista, and Linux have text-to-speech solutions available. I can’t comment on any of these methods for Windows or Linux, but I am sure they work just as well.

Have you tried this before? Are you willing to incorporate this into your work flow? Do the voices sound too weird? Let me know in the comments section!

Weekly Link Dump

While we strive to give you well researched thoughts, opinions and strategies to help you become a better blogger, we realize there is a ton of noise out their on the internet which is hard to wade through. This post is my weekly link dump which contains links to articles which caught my eye during the week in relation to blogging.

Keywebdata – Google testing Digg Like Interface. Let’s users edit search results If Google really rolls out this social search feature, could this be the end of the line for social media sites?

Onecoolsite – How To Become A better Blogger Part 3 – Ethics And Links In part three of an ongoing series Onecoolsite takes a look at two things all bloggers must face. Ethics and links.

DailyBlogTips – Behind The Scenes: Check Out The Desktop of 30 Bloggers DBT has screenshots of 30 different desktops from 30 different bloggers. What fascinates me is that some of these desktops are filled to the brim with icons. How do these bloggers get anything done with organization like that?

CollegeDegrees – 100 Useful Web Tools For Writers Laura Milligan compiled a list of 100 different tools to keep in mind if you’re a writer. The list covers a variety of topics such as, organization, inspiration and getting writing gigs.

ChrisBrogan – If You Intend To Blog Seriously Just about everything this man writes is link worthy and this post is no exception. After reading this post, you may think twice before hitting that publish button.

Explore Other Niches to Spur Creative Thinking

Photo by destinelee

In my last blog post, I wrote about unleashing creativity by blending your niche with another niche. In a similar vein, here is a creative exercise from Dan Pink’s A Whole New Mind: Why Right-Brainers Will Rule The Future. He writes on pages 150 and 151:

One of my favorite exercises in conceptual blending is the “newstand roundup.” If you’re stymied on how to solve a problem, or just want to freshen your thinking, visit the largest newsstand you can find. Spend twenty minutes browsing – and select ten publications that you’ve never read and would likely never buy. That’s the key: buy magazines you never noticed before. Then take some time to look through them. You don’t have to read every page of every magazine. But get a sense of what the magazine is about and what its readers have on their minds. Then look for connections to your own work or life. For instance, when I did this exercise, I figured out a better way to craft my business cards thanks to something I saw in Cake Decorating – and came up with a new idea for a newsletter because of an article in Hair for You. Warning: your spouse might give you uncomfortable looks when come home toting Trailer Life, Teen Cosmo, and Divorce Magazine.

Alternatively, if you’re lazy like me, you can capture the essence of Pink’s exercise by visiting sites in niches unrelated to your niche.

Creative thinking is out of the box thinking. This means you need to step out of the box, or your comfort zone. Once you’re out of your comfort zone, you’re much more likely to come up with something conceptually unique.

Exploring other niches forces you out of the status quo. It makes you look at things from different perspectives.

I tried this exercise on the net. I realized I should add more pictures on my gaming blog by seeing the myriad of pictures on a fashion blog. A wedding blog post reminded me that telling a story about my life helps me connect to my audience. This dating article gave me an idea for a gaming blog post tentatively titled “How Picky Should You Be When Recruiting New Team Members?” A holiday site inspired me to create a editorial calendar to take advantage of important seasonal events in my niche.

Try this exercise and let me know what you come up with.

Pros And Cons Of Site Registration

As I was having a conversation with Ryan the other day, he brought up the subject of user registration and highlighted a few websites which forced users to register if they were to be part of that community. While that is fine and dandy, there are numerous pros and cons with regards to user registration which I’ll try to highlight in this post.

Pros:

Sense Of Belonging – When a user registers an account for a website, that typically gives them a sense of belonging. They no longer have this sense of just passing through the neighborhood but instead, have become part of the larger collective.

Weeding The Garden – Those who register for a website are more inclined to participate and make use of that membership. After all, if someone has to go through a series of steps to become part of your community, chances are high that they will make their membership worth the effort.

Internal Affairs – Unlike those who browse to your blog, leave a comment, and then disappear as fast as lightning, registration enables you to keep things in house such as communication, participation, etc.

Promotion – If someone registers an account to let’s say your WordPress powered site and you notice that they are contributing by way of excellent comments, you could easily promote the individual through user roles/permissions to become a content producer for the site.

Incentives – In order to build your community, you can offer incentives to those who register an account. These incentives could be increased profile configuration, more authority, etc.

Cons:

Barrier To Entry – More times than not, forcing a user to register with a website is like putting up a sign that says do not disturb. What is the most common method of solving this problem? Moving on to another site which provides the same information with no need to register.

Administrative Headaches – While having a vibrant community of serious people would make any webmasters day, this has the potential to turn into an administrative nightmare. You not only have to care for the site, the sites content, and whatever else may be attached to the site, but you now have to ensure that the registered user information within the database is never damaged. You may also be opening yourself up to performing more than necessary administrative tasks such as assigning user roles/permissions, fixing broken user accounts, changing nicknames around, etc.

More Spam – It doesn’t matter if your user registration form has a CAPTCHA image on it. Spam bots always find a way into your site. The user registration system is one more opening for them to get through. You can almost file this under the administrative headaches category.

More Things To Migrate- This one is also borderline Admin. headache but think about how much easier it would be to migrate data if 10,000 registered user’s weren’t involved. The less things to migrate, the more portable your data is.

These are not all of the pros and cons associated with this topic, but it’s time to delve into some serious discussion. First off, I’m of the opinion that if there will only be 1-10 people associated with a blog or a website which will handle administrative tasks such as content management, content publishing, etc, user registrations should be turned off. Why add the extra overhead if you don’t need it? Secondly, if you are a blogger who enjoys comments, forcing visitors to register an account on your site is a great way to kill the social interaction. If you don’t believe me, check out Kyle Eslicks post on what I feel is a disturbing trend (Blogging Discussion: Registration Required to Comment?)

Conclusion:

So, we’ve covered SOME of the pros and cons related to user registration. It’s time for you to share your thoughts and opinions. For instance, what is your normal reaction when you come across a post in which you would love to comment on but instead of accessing the comment form, you are greeted with a big fat registration page? Do you force users to register an account on your own blog? Has this helped or hurt your blogs ability to grow?

Looking forward to this conversation.