beyond the install 10 Things you should do after you install WordPress by Terri Orlowski beyond the office

Transcription

1 beyond the install 10 Things you should do after you install WordPress by Terri Orlowski

2 beyond the install 1. Install a backup plugin It may seem silly but the very first thing that I recommend after you ve set up a new site is to install a backup plugin. Sure, you ve just set up the site and there s not really anything in it yet but there will be very soon. And having the plugin already installed and set up makes it that much easier to make incremental backups as you re building your site. Even though the suggestions I m making in this report are fairly simple, and are intended for a brand new site, there is the potential for things to go awry if you click the wrong button or setting. For this reason, I strongly encourage you to make a backup of your site before you start, and in between each of the tasks in this report, to create a running baseline as you re getting things started. For a quick and easy backup, I use BackupBuddy from ithemes. It s easy to use and works without issue on most servers. If you re using GoDaddy hosting, please note that their default server configuration doesn t usually play nicely with BackupBuddy. 2. Remove the admin username If you used the one-click install feature that many hosting companies provide, chances are pretty good that your username is admin. The can present a huge security problem for your site because hackers know that and it makes it easier for them to try to gain access to your site. Recently, there was a large-scale concentrated effort to hack WordPress websites. The attacks weren t trying to exploit a plugin vulnerability or hosting configuration setting. The only thing that these hacking attempts had in common was that they were trying to brute-force hack or guess the password for the admin username. The easiest way to protect your site during that attack was simply to not be using the admin username. So what do you do If you already have the admin username? Fortunately, there s a relatively simple way to address this problem. 1. Log in to your site using the admin username 2. Go to Users -> Add New 3. Enter a new username that s not admin. You could use your name, first initial & last name, adminfirstname - almost anything. Just don t use admin. 4. address - here s where things might get tricky for a minute. You cannot have two user accounts that use the same address, so you will have to (temporarily) enter an address here that s different from your admin account address. This can be changed later, but it is needed to create the account. PO Box , Pittsburgh, PA T: URL:

3 5. First Name, Last Name & Website are optional. 6. Use a really strong password. A strong password should be at least 12 characters and use both upper and lower case letters, numbers, and special characters. If you re having trouble with this, try using a pass phrase or acronym as your password, so it s not a dictionary word. Try replacing some letters with symbols, such as 0 (zero) instead of O, 3 instead of E,! instead of I or L, etc. 7. Make sure you choose Administrator as the role. This is important. 8. Complete the account creation by clicking on the add New User button. 9. Log out and log back in to your site with your new Administrator user account that you just set up. 10. Hover over the admin user account line and then select the Delete link. (Now is the time to make sure you have a backup of your site. Once you click the confirm button in the next step, you can lose all of your posts if you don t have the settings correctly.) 11. On the next screen, you ll be asked who to attribute all of the posts, pages and media that were created by the admin account to. Here you should select Attribute all posts to: and select your new account from the drop-down list. Then you can click the Confirm Deletion button. 12. After you ve deleted the admin account, you can go back to your new user account and change the address back to your preferred address, if you had to enter a temporary one to create the account. 13. If deleting the admin account is too scary for you right now, there s another way to protect your site from this vulnerability. It s not as effective, but it is generally more acceptable to those concerned about click the Delete button. Instead of clicking on the Delete link as in step 10, click on the Edit link. Then select Subscriber from the

4 drop down list for User Role. This will prevent the admin user from being able to make any changes to your site. So, even if that account does get hacked, the hackers won t be able to use it to damage your site. 3. General Settings The General Settings (Settings -> General) area is often neglected in WordPress sites. However, spending just a few minutes here can increase your rankings and decrease frustration. Tagline - by default, the tagline for new WordPress sites is Just another WordPress site. But you re not just another WordPress site. Use this space to briefly describe your website. Many themes use the description entered here as part of your title tag, so using keywords here can assist with SEO efforts. WordPress Address & Site Address - DON T change these. Changing these settings will affect your ability to access WordPress. I ve done that before. It s no fun. Learn from my experience. Membership - Most of the time, it s best to leave this field unchecked (as it is by default). If you allow anyone to be able to register and create an account with your site, you could open your site up to more potential hacker access. Time Zone - This will determine what time zone WordPress uses for timing or automatically scheduling your posts. Set it to your time zone. Options include a full range of UTC-X zones, but I recommend picking a major city. Some plugins require this, and this will also ensure that the appropriate changes are automatically made for Daylight Savings Time. 4. Permalinks Permalinks (Settings -> Permalinks) are the individual links to pages, posts and uploaded media on your site, such as and

5 The default setting for permalinks in WordPress is - not very attractive, huh? This also leaves no opportunity for keywords in your URL, which is a great way to increase SEO, and gives your visitors an immediate sense of what the page is for. There are many options for permalinks, and you can create your own configuration as well. However, the generally accepted best permalink setup is to use the post name setting. This setting will use the title of your page or post as the permalink. Other options could be /blog/% postname%/ which will add /blog/ before all blog posts, but not pages (this is the structure that I use on my site) or /%year%/%postname%/ if you want the year to display in the permalink. 5. Comment Settings Continuing in our Settings area, I now direct your attention to the Comment or Discussion Settings (Settings -> Discussions). As you ll see, there are a lot of settings on this page. Under the Default Article Settings area, the first two options deal with pingbacks and trackbacks. I could try to explain these to you, but I d rather direct you to an excellent blog post about it that does a great job of explainging these technical terms in normal language - The last one in this section should be turned on, in my opinion. Part of the reason for blogging, especially as a business, is to engage with your visitors and get their feedback. If you have comments turned off, that becomes very difficult, so my recommendation is to leave this enabled (checked.) Other Comment Settings - Here I recommend that you the first option checked, to require comment authors to give name and . It s doesn't really do a lot to prevent spam, because the spam bots will just put a fake name and address in here, but it will allow you to get to know people that are visiting and commenting on your site. For the option for Users must be registered and logged in to comment, I prefer to leave this unchecked. Having it checked isn t really going to abate much spam, but it will

6 cause you to receive notifications every time someone has registered and then you have to manage those users. Also, if you re going to enable this option, then you also need to turn on the setting to allow people to register. (Under Settings -> General). I also recommend using the configuration that I have, as seen above, for me whenever, Before a comment appears, and Comment moderation. These have proven to be fairly safe and efficient comment settings for me. Make a backup! If you haven t made a backup recently, make one now. As I said before, it s a good idea to get into the habit of making frequent full (database and files) backups during the development period. If your server were to crash and you didn t have the backup, it could be a tedious chore to have to go over all the settings and changes that you ve made again. If you re using BackupBuddy, go to BackupBuddy > Backups -> Complete Backup. Be sure to download the backup file to your computer when it is complete.

7 6. Theme To install your chosen theme, go to Appearance -> Theme and then select the Install Themes tab from the top of the right side. Here you can choose to install a theme from the WordPress theme repository or upload a theme that you ve downloaded, either from a private developer or from a premium theme shop. If you re not sure how to install themes, check out these video blog posts on my site: Install WordPress theme automatically - Upload and Install a WordPress theme - Once you have installed your chosen theme, it s a good idea to delete any themes you don t need. I recommend keeping one extra theme, such as Twenty Twelve, as sometimes you need to be able to switch to a different theme for troubleshooting purposes. However, leaving unused themes around can leave potential security holes open on your site. If you re not using it, delete it to be safe. 7. Dump the extra plugins The same security concern exists for extra plugins as I mentioned above for extra themes. If you re not using the plugin, get rid of it. Make a backup before you start deleting things, just to be safe. However, if you have an inactive plugin that you haven t used or have no intention of using it again, make it go away. Some hosting companies like to include a whole bunch of extra themes and plugins when you use their one-click install (another reason that I don t like that installation method) so be sure to take a few minutes to get rid of things that aren t needed, for security and performance. After you ve done this, make a new backup so you have a new baseline for the future. 8. Remove the default content No matter how you installed WordPress, your brand new site came with a sample page, post and comment. Before you start adding your own content, it s time to get rid of the starter content. Be sure to empty the trash after you delete the starter content to make sure your database stays clean. 9. Rename the uncategorized category In addition to the starter content, your website comes with a starter category - cleverly named Uncategorized. Every blog post gets assigned a category. If you don t specifically select one, the default category will be chosen. There s nothing wrong with using a

8 default category, but having it called uncategorized doesn t leave the best impression. Go to Posts -> Categories and edit the Uncategorized category name to be something else. Some other suggestions include General or Articles. 10. Managing your Gravatar Sounds like a funny word - Gravatar. In the world of WordPress, it refers to the avatar or picture that s associated with your address. While its not essential, it is a nice feature to have integrated with your site. Many theme developers include gravatar functionality with commenting, so by setting up your Gravatar, you re picture (or whatever you choose to use) will show up whenever you comment on gravatar-enabled blogs, including when you reply to comments on your own site. The screen-shot to the right includes some examples of gravatar-enabled comments on a blog. To set up your Gravatar, just to go to gravatar.com. As long as you use the same address as you used for your administrator account, your gravatar will show up in the admin section of your site when you re logged in. Bonuses!!! Everyone loves bonuses, right? Here s some bonus tips for you. Use Google Analytics - Google Analytics is a free website statistics package from Google. The amount of information that s available is amazing - from keywords to traffic sources, to user location, technology being used, and so much more. Go to google.com/analytics/. All you need to sign up is a Google account. Once you sign up, I recommend a plugin called WP Google Analytics to integrate the necessary tracking code into your website. Use Google Sitemaps - Another free service that Google offers is Webmaster tools. There is a wealth of information available there about the health of your site and how Google views it and the content. Go to to sign up. After you do, install the Google XML Sitemaps plugin on your site. This plugin automatically creates a sitemap, which is a specially formatted list of all of the pages and resources on your site, and periodically submits it to Google, so Google knows when things have been added or updated on your site. After you install the plugin, copy the URL it gives you for your sitemap and submit it under Google Webmaster Tools so Google can track your site better. Don t miss my favorite plugins.(next page)

9 My Favorite Plugins In addition to the plugins that I ve already mentioned, (BackupBuddy, WP Google Analytics, Google XML Sitemaps), below is a listing of some of my favorite plugins that I use on pretty much every site that I create. Bulk Page Creator - I use this plugin when I m working on a new site and have many pages to create at once. Sometimes I just want to get the pages named and published so I can work on the menus and such. Broken Link Checker - This one is self-explanatory. It will periodically (default is every 72 hours) check all of the links on your site, including images, to make sure that they are still working. If a link is found to be broken, you ll get an notification. The plugin also includes a very easy to use interface to fix broken plugins. Redirection - Sometimes you want to make an easy to remember URL, such as yourdomain.com/fb for your Facebook Page. Or sometime you ve moved a page from one URL to another. You can use the Redirection plugin to create a connection from the old location to the new location so you don t lose the link juice that s already been generated. The above plugins can all be installed from the WordPress plugin repository. If you need help with how to do that, check out this blog post: -wordpress-pluing-from-repository/ Gravity Forms - This is a premium plugin, which means that you have to pay for a license to use it on your site. It s pretty inexpensive and can be used to make any kind of form from your basic contact form to optin forms that can connect with your marketing service, to more complicated forms such as real estate buyer profiles and surveys. To purchase your Gravity Forms license, go to Disclosure: Some of the links in this report or on my website at beyondtheoffice.com may be affiliate links, which means that I can earn some money by you using my links for those products. I do not recommend products that I haven t used or review myself.

10 Got More WordPress Questions? Done-With-You Website Congratulations on using WordPress to power your website. Did you know that WordPress powers about 20% of all website, around the world? With such a huge community of users and enthusiasts, there s lots of resources around to help you get your questions answered. But sometimes you just want to have some available to answer your questions, one on one. offers two one-on-one training options for you: The Done With You Website package give you an hour and a half of one on one time with me where we can actually work on your site as we go. I ll show you the basics of adding and editing content and graphics, my favorite plugins, how to find new plugins, and will answer any other questions that you have about your site. This package also includes ithemes Builder for you to use on your website, and can cover how to use this tool to create a great theme for your site. Hourly 1:1 Q&A $197 This is perfect for anyone with a WordPress website who wants to maintain it themselves, but need a point in the right direction on how to do some things. Training can be done via screen-sharing, so you can be in front of your own computer and familiar surroundings. $75 USD/hour Ready to get started? Go to wordpress-individual-training-consultation/.