Business Blogging Pros

VaultPress vs BackupBuddy Vs Updraft Plus

I recently decided to stop relying upon my web hosting company for daily backups.  In the process I evaluated three WordPress backup plugins:

• VaultPress
• BackupBuddy
• UpdraftPlus

Bottom Line: for me, UpdraftPlus  was the best choice, though for most people I thing VaultPress would be fine.

VaultPress

VaultPress is offered by Automatic, the same people behind WordPress.com. VaultPress stores the backups on Automatic's servers. There is no option to store your backups elsewhere. It can be inexpensive - if you dig a bit you can find the option whereby the charge is only $5/month.

I have several clients using VaultPress and it has always performed flawlessly.

There are two things you should know about VaultPress:

1. It backs up the WP-Content folder (and it's subfolders and contents) and nothing else.  For most people that is just fine, but I have clients with additional folders in the root of the site containing videos, podcasts, etc.  If the site were to go down, restoring just wp-content would not be enough.
2. It backs up only tables in the database containing the 'wp_' (or whatever you have chosen) prefix.  There is a plugin I use (Digital Access Pass) that creates its own tables in the database with the prefix 'dap_'.  Whatever backup tool I use needs to backup everything in the database.

Bottom line for me was that VaultPress did not give me the functionality I needed.

BackupBuddy

On paper, BackupBuddy looked like the perfect choice.

• It can be configured to backup every file, including custom folders you have created in the root of your website.  
• It can be configured to backup the entire database.
• If offers several options as to where it stores the backups.You can store the backups on your website, or offsite in Amazon S3, Dropbox, etc.
• In fact, you can have it store multiple copies of the backups in multiple different repositories for redundancy.

One negative: BackupBuddy does not support WordPress Multisite.

After using BackupBuddy for a few weeks however, I found that it simply was not robust. I have a couple dozen little websites and blogs.  Almost every day, I would receive error messages telling me that the backup process failed on at least three of them, which meant I would have to go investigate and manually re-initiate the backup process.  If it was always failing on the same three websites then I could find the problem and fix it.  Not so however. I frequently had failures one sites that had run fine to several days. When I explained the problem to their support guy, his response was:

"My own personal approach is that if the hosting can be a bit flakey sometimes then I don't bother with chasing up the occasional backup failure on a site"

I'm sorry, that doesn't cut it. Not only is the backup process not robust, I found that the Restore process suffered from the same non-robustness. I was in the process of moving some of my websites to a different hosting company, and found that the backup files created by BackupBuddy were so large that I could never get them to successfully upload to the new server without timing out.

The bottom line with BackupBuddy was that I had to babysit it way too much.

UpdraftPlus

UpdraftPlus is the premium version of the free Updraft plugin. I offers several features that the free version does not have. (You can find a comparison chart here.)

UpdraftPlus offers all the features that BackupBuddy does (or at least the features important to me) and it just works. (It also supports WordPress Multisite but I have not tested it there.)

I've been using it for about a week now on over a dozen websites and it has operated without a hiccup. I've used the Restore functions to move websites between servers and it worked very smoothly (UpdraftPlus divides the backup into several zip files instead of one huge one, thus avoing the timeout issue.)

 

How Much is Your Data and Reputation Worth?

By now I'm sure you've heard of the Panama Papers: a leaked set of 11.5 million confidential documents that provide detailed information about more than 214,000 offshore companies listed by the Panamanian corporate service provider Mossack Fonseca, including the identities of shareholders and directors of the companies.

The documents show how wealthy individuals, including public officials, hide their money from public scrutiny. At the time of publication, the papers identified five then-heads of state or government leaders from Argentina, Iceland, Saudi Arabia, Ukraine, and the United Arab Emirates; as well as government officials, close relatives, and close associates of various heads of government of more than forty other countries, including Brazil, China, France, India, Malaysia, Mexico, Pakistan, Peru, Romania, Russia, South Africa, Spain, Syria, and the United Kingdom.

Iceland's Prime Minister has resigned. Britain's Prime Minister is having to explain how his family is connected to it. The names of hundreds of Americans have surfaced in the Panama Papers.

All because someone did not keep their WordPress website up to date.

Post-mortem analysis found that the hackers got in via a well-known vulnerability in an out-of-date version of a popular WordPress plugin named "Slider Revolution". The plugin's authors updated the plugin two years ago and eliminated the vulnerability, but the newer version was never installed on the 'target' website.

We offer a service whereby we keep your WordPress and plugins up-to-date, along with several other activities designed to keep you safe. Yes, it's expensive, but much less expensive than seeing your client's name and data plastered all over the front page of every major newspaper in the world. 

Update to WordPress 4.4.1 Causes Redirect Loop

Many people who quickly updated their WordPress sites to 4.4.1 were met with a rude surprise: Accessing the site's home page causes a redirect loop. 

If this has happened to you then log in to your dashboard.  Go to Settings->General.  Make sure there are no uppercase characters in these two fields:

WordPerss Address (URL)
Site Address (URL)

These two values may also specified in wp-config.php:

define('WP_HOME','http://yoururl.com');
define('WP_SITEURL','http://yoururl.com');

If there is an uppercase character in these URLs then WordPress 4.4.1 will go into an infinite redirect loop

 

Why Would Hackers Pick On My Site?

When I talk to bloggers and website owners about the important of security, I'm often asked:

"Why would hackers picking on my obscure little blog?"

Your blog or website is not specifically being targeted.  The attacker is using a bot (software program) that is simply fed a list of domain names to check. The bot's goal is to look for specific vulnerabilities.  When a vulnerability is found, the attacker does one of four things:

Defacement - You wake up one morning and discover that your website as been replaced by one advocating 'Free the Armenian Freedom Fighters' or something akin to the adjacent image.

Viagra - This one is so frequent and well known it has its own name: Pharma Hack. Your website is altered so that to a normal visitor it looks just fine.  To Google however it looks like a page of links to an online Viagra store.

Remote Control -The attacker installs malicious code on your site that puts it under the attacker's control, adding your site to the attacker's botnet. Large-scale distributed denial of service (DDoS) attacks almost always employ such botnets

Remote Control Installer - This one is even more insidious.  The attacker installs malicious code on your site that causes your website visitors' computers to be infected and become part of the attacker's botnet.

What Should I Do?

Every website owners should be doing three things:

Implement Security

We recommend two solutions:

• Sucuri.net
• Wordfence

There are differences in functions, features, and price between Sucuri and Wordfence but these are the two products I use to secure my sites and those of my clients.

Keep WordPress and Plugins Up To Date

I can't stress this enough.  For example, Just yesterday I received notification that a Cross-Site Scripting Vulnerability has been discovered in one of the plugins I frequently use.  I've now updated all those site.  The best thing you can do to keep your site protected is to keep WordPress and your plugins up to date.

Strong Passwords and Non-Obvious Usernames

Do you use 'admin' as the username to log in to your website?  You might as well put a big bullseye on your home page.  Use something obscure. Look at your profile page in WordPress and verify that your nickname and display name are different from your username. Use WordPress' New Password function to let WordPress pick a really strong password for you.

A Plug For Our Services

We have a high-end service available to high-profile clients with high-visibility mission-critical websites. It is expensive but but if you absolutely positively cannot afford to be hacked then you should contact us.

WordPress Brute-Force Attackers Keep Getting Smarter

A brute-force attack is one in which the attacker tries to guess your login credentials.  These attacks are almost always automated.  Not long ago I woke up one morning to see that there had been ten thousand brute-force attacks against just one of my blogs overnight.

Traditionally, brute-force attacks are easily detectable. Most security-related plugins can detect and log every login attempt. Several security-related plugins can even be configured to block the IP address of an attacker after a certain number of failed attempts.

In the past few weeks however, a new tactic relying upon WordPress' XML-RPC function has surfaced. The new attack is highly efficient and allows the attacker to try hundreds of password in a single request. The details of this attack can be found in a blog post written by Sucuri.net:

Securi.net Blog Post

Time to Adjust Our Tactics

My personal opinion is that for a piece of software with as big a bullseye on it as WordPress, XML-RPC should be a big No-No. Older versions of Wordpress contained a setting that allowed you to turn XML-RPC off, but no more.

This problem is exacerbated by the fact that the most popular WordPress security plugin (Wordfence) no longer has the ability to disable XML-RPC.  

UPDATE: Wordfence has published a blog post in which they say they DO protect against these attacks.

If you are using Sucucri.net's Cloud Proxy Firewall then don't worry - You are protected against these attacks.

If however you are using Wordfence or some other security plugin that cannot disable XML-RPC then you should install one of the WordPress plugins designed specifically for this purpose.  we are using Disable-XML-RPC.

The Downside

Unfortunately, disabling XML-RPC can break things:

• WordPress.com's JetPack plugin using XML-RPC
• iPhone/iPad/Android apps for posting to your blog use XML-RPC

I'm sure there are other applications that use WordPress' XML-RPC facility as well.  Frankly, I believe this problem is sufficiently serious that I recommend turning off XML-RPC anyway and stop using these XML-RPC-dependent apps and plugins.

 

 

No Smoke and Mirrors

Business Blogging Pros and Klaroty Strategic Marketing welcome Mark Allen Roberts as a returning client.

We created a website for Mark and his company, No Smoke And Mirrors a few years ago.  Our SEO research and strategies put him at number one on Google for his desired search term, "Fix Sales Problems".

And that's exactly what Mark does.  Frankly, I've never seen anyone who can zero in on a company's sales problems and fix them as insightfully as Mark.

Recently, Mark came to us to update his website to make it more mobile friendly, and we did just that. At the same time, we updated the site with a clean, contemporary appearance.

How's Your WordPress Password Strength?

I woke up this morning to an alert from Wordfence that one of the administrators of a client's website logged in overnight from Istanbul Turkey.  I know for a fact this particular gentleman is not in Istanbul right now.

How did this happen? A weak, easily guessable password.

There has been a dramatic increase in these Brute-Force attacks in the past few weeks. I logged 2500 of these attacks on just one of my websites in just one day.  Almost all the IP addresses are from eastern bloc countries.

What To Do:

1. If you have not updated to the latest version of WordPress do so now. Version 4.3 and later have a new 'Change Password' function that can create strong passwords.

2. If you are not using WordFence or Sucuri.net do so now.  The premium version of Wordfence has the ability to block entire countries, so if you have no reason to expect website visitors from outside the USA then block all non-US traffic.

Is Google Ghosting Your Website?

Have you ever discovered that a long-time friend has suddenly unfriended you, blocked you on Twitter and other social media, and no longer responds to your emails? You’ve been ghosted.

When it happens to you personally, you feel hurt and confused. It’s a whole different problem when Google does it to your business website. Would Google do that? Well, yes. Here is a quote from Google’s blog:

“We will be expanding our use of mobile-friendliness as a ranking signal. This change will affect mobile searches in all languages worldwide and will have a significant impact in our search results.”

We call this mobilegeddon. Google is now evaluating your website for mobile usability If it finds mobile usability errors you will dins this message in your Google Webmaster Tools (now called Google Search Console) account:

Google systems have tested 135 pages from your site and found that 100% of them have critical mobile usability errors. The errors on these 135 pages severely affect how mobile users are able to experience your website. These pages will not be seen as mobile-friendly by Google Search, and will therefore be displayed and ranked appropriately for smartphone users.

You’ll also see a page that looks something like this:

If your website has numerous mobile usability errors two things may happen: 

• Your website’s page rank in mobile search results will be reduced so that it appears below/after search results for other websites that are mobile-friendly.
• If the problem is sufficiently severe your website may not appear at all in search results delivered to mobile devices.

What do you do?

If your website is WordPress then the chances are the problem can be solved easily with a new WordPress theme. The theme is the ‘skin’, but it may also contain other useful functionality as well. When evaluating themes, the term to look for is ‘responsive’. A responsive theme will reformat itself to fit the width of the device it is being displayed upon, whether it is a desktop, tablet, or mobile device.

Right now we’ve either completed or are working on website updates for several clients. We have this process down pat and can complete it quickly and inexpensively.

Have You Checked Out Periscope Yet?

Have you checked out Periscope yet?

Periscope is the new video streaming app from Twitter. (to be precise, Twitter bought Periscope) Download the Periscope app to your Android or iPhone, sign in with your Twitter account and you are al set.

Periscope displays a world map with red dots signifying people who are currently streaming video.  Right now I'm watching video of a beach in Italy. 

Streaming your own video is just as easy: two taps on the screen and you are a broadcaster, right from your phone.

If you turn Twitter sharing on, then your broadcast will be shared with your Twitter followers in a tweet that follows the following formula: LIVE on #Periscope: [Video Title] [Link to Video]. This means that you'll use your other social media channels to direct people to your Twitter feed.

Periscope has great potential for product demos, announcements, video presentations, and all sorts of business and marketing activities..

 

 

Switching from GoToMeeting to StartMeeting

This is not really blogging or social media related but I wanted to pass this along.

I was a long-time user of GoToMeeting. I primarily use it for webinars and for screen sharing during a one-to-one meeting with a client.

Along came a new kid on the block, StartMeeting, that does everything I want at 20% of the cost.

Hard to complain about that.