Dammit Jim, I m a Mac Admin, not a Web Developer

Transcription

1 Dammit Jim, I m a Mac Admin, not a Web Developer WordPress Basics for Mac Admins PSU Mac Admins Conference July 11, 2018 Tiffany Bridge Baxbridge Digital 1

2 WordPress Bridge Wi-Fi Bridge

3 Who am I?

4 The Best Thing About WordPress

5 The Worst Thing About WordPress

6 The website is broken! Call IT Your boss or client, probably

7 Session Goals Understand the basic components of WordPress Identify emergency troubleshooting techniques Identify basic preventative maintenance items Anticipate future WordPress issues

8 WordPress 101

9 WordPress.org WordPress.com

10 WordPress.org WordPress.com

11 Anatomy of a WordPress Site Theme (CSS/HTML/ PHP/JS) Core WordPress Database (Usually MySQL)

12 Plugins

13 Key WordPress Files

14

15 wp-config.php

16 Your Emergency Toolkit Safari/Chrome web developer tools: Element Inspector, Javascript Console, etc. FTP client Text editor with syntax highlighting cpanel (or other host control panel) access phpmyadmin access

17 Common WordPress Emergencies

18 Oh $#&^, I ve Been Hacked!

19 But what would a hacker want with my site? Photo Credits: Bitcoin Image courtesy Andre Francois via unsplash.com Bot image courtesy Alex Knight vis unsplash.com Spam Wall via Flickr user freezelight, via Creative Commons License

20 And now statistics! Small business websites are attacked on average 44 times per day Source: SiteLock Security 70% of WordPress sites have an exploitable vulnerability Source: Sucuri

21 How do I know I ve been hacked?

22 Cleaning Up a Hack

23 Scan for Malware

24 Clean Infected Files By Hand

25 or Restore From Backup You do have backups, don t you?

26 Then Lock em Out! Remember our old friend, wp-config.php?

27 (We call this the White Screen of Death.)

28 Causes of the WSOD PHP has run out of memory Failed core/plugins update has caused instability Database errors Theme problems

29 First Things First

30 Is WordPress able to load? yourdomain.com/wp-admin/

31 What were you doing when the WSOD started?

32 Try the easy stuff first. Migrating the site? Check the database for references to the development URL. (phpmyadmin or a DB search-and-replace plugin) Updating plugins/themes? Disable the ones you just updated. Editing a file? Check your syntax, or undo your change. Caching plugin? Try dumping cache.

33 If your /wp-admin/ looks like this:

34

35 Enable Debug Mode Find/set in your wp-config.php and see ALL THE ERROR MESSAGES

36 What do we do with error messages?

37 On-Page Errors

38 Try the easy stuff first. Migrating the site? Check the database for references to the development URL. (phpmyadmin or a DB search-and-replace plugin) Updating plugins/themes? Disable the ones you just updated. Editing a file? Check your syntax, or undo your change. Caching plugin? Try dumping cache.

39 Safari Developer Tools

40 Other Things to Check Are your plugins still being supported/updated? (Especially the free ones) Check PHP version compatibility

41 Preventative Maintenance An ounce of prevention is worth hours of Googling error messages. - Ancient WordPress Proverb

42 Above all else

43 WordPress Backups

44 And then Security/malware scanning plugin Caching plugin Regular update schedule WordPress hardening techniques 2-Factor Authentication

45 Security Plugins

46 Caching Plugins

47 A Word About Plugin Hygiene Is it regularly updated/ tested? How does the plugin creator make money? (Free is often expensive)

48 Update on a Schedule

49 Hardening WordPress Move wp-config.php to one level above web root and CHMOD 600 (requires additional steps if WordPress is installed in a subdirectory) Use.htaccess to deny access to files in install directory, /wpincludes/, and /wp-content/ directories Use a plugin to move the location of the login and wp-admin pages Make sure all users have nicknames set and no actual usernames are displayed on the site Ensure nobody has more permissions on the system than they absolutely need to do their job

50 Two-Factor Authentication 1. Decide on your second factor: Google, Yubikey, Authy, SMS, phone call, or user s choice? 2. Pick the 2FA plugin that supports it 3. Install it

51 Choosing a Host Friends don t let friends use cheap shared hosting

52 Key Features Regular, automatic backups (you should still do your own) One-click staging sites Automatic WordPress core updates Let s Encrypt SSL support included BONUS: Automated migration tools

53 Upcoming Emergencies All the (foreseeable) ways your site can break in 2018

54 July 2018: Chrome Flags HTTP Sites Not Secure

55 Solution: Install SSL Make sure your WordPress site URL settings get updated too, or you ll get a White Screen Search-and-replace all your links in the database Make sure your theme only references assets over https Make sure all your external scripts are called over https

56 August 2018: WordPress 5.0 Blocks Editor

57 Solution: Start Testing Now Install Gutenberg plugin on a staging site and start checking posts and pages Pay particular attention to any plugins that augment the native editor- they may break Install the Classic Editor plugin to be sure you re covered while you work on a migration plan

58 December 2018: PHP 5 Support Ends

59 Solution: Start Testing on PHP 7 Plugin: PHP Compatibility Checker Update your staging site s PHP version, if possible Or, set up a local staging environment to test

60 Have the Cavalry on Speed-Dial

61 Know Who To Call Specialist hosts (WP Engine, SiteGround) Maintenance companies (WP Buffs, GoWP) WordPress Consultants

62 Questions?

63 Where to find me LinkedIn: MacAdmins Slack: #wordpress