Let’s take a look at this fantastic plugin, and a quick walkthrough on how to add and display your recipes.

Display Options

Recipress can output your recipes in a variety of places, with the default being on single post pages only just after the main content (if there is any). If you want the full recipe to appear in search results or the index, archives, etc you can do all of that.

There are 3 main display styles to choose from – light, dark, and textured – so it should suit most blogs. Though I haven’t tried, I imagine you can edit the individual CSS files if you wanted to change them, though there is no specific “upload custom CSS” option.

Custom Taxonomies

Taxonomies are added for ingredients, cuisine style, course, and skill level – but you needn’t use the latter 3 if you don’t want them. The plugin comes with about 18 ingredients pre-programmed for you, but adding more is as easy as… pie?

Adding A Recipe

You’ll find a new custom section on your post edit screen, and ticking the “Add a Recipe to this post?” checkbox will enable the recipe editor.

It’s broken down into 3 parts. The first is some basic meta about the recipe – prep time, yield – that sort of stuff.

Next up are the ingredients. The ingredient names are all contained within a separate taxonomy, so they work like tags. As you add your own archive of ingredients, they will appear when you start typing the first few letters.

Creating them as a whole taxonomy also means you can do things like list all recipes with “chilli”, or show an ingredient cloud widget. Other than that, it’s easy to add amounts, notes, re-arrange the order or ingredients, etc.

Finally comes the instructions which are broken into steps. Each step can have an individual photo added. At the time of writing this, I did have a small bug with the latest jQuery – if you find the upload image dialog goes blank after clicking “Use this image“, open up your the wp-content/plugins/recipress/js folder, and replace the contents of back.js with the code from this pastebin. Hopefully the author will release an update soon to fix that officially, but this will suffice for now.

I should also add that you need to upload images for the recipe in the size you’d like them to display – it takes the original URL rather than the thumbnail or medium sizes. The plugin could do with some auto-resizing options, but to work around this either resize before you upload, or add the following CSS rules to your theme’s style.css

/* Change to the width of your post section, this refers to the step pictures */
#recipress_recipe.recipress-recipress img {
width: 450px ;
height: auto ;
margin: 10px 0 ;
}
/* Assume thumbnail size of 150px for first image in recipe */
#recipress_recipe.recipress-recipress img.wp-post-image{
width: 150px;
height: auto;
margin: 10px 0;
}

To set the “finished recipe” image, just use the standard WordPress featured image. You can adjust this in the Recipress options if you’d like to use a different image though.

You should end up with something like this:

Summary

The display style of this plugin is beautiful, and adding recipes honestly couldn’t be simpler. There some great widgets included, and if you plan on writing a lot then use of a full custom taxonomy for ingredients is really innovative.

On the downside, there’s a few bugs as I’ve outlined already. Also, the output is mostly hRecipe formatted for rich snippet data, but it’s missing quite a few crucial parts, so the implementation isn’t complete and Google doesn’t parse it as such. This should be an easy fix though, so hopefully the author will update soon. There’s a Pro version in the works according to the support site.

What do you think? Will you be posting some recipes for us?

Flavors.me is a great ready-made way to do that, but it isn’t perfect for my needs and certainly doesn’t demonstrate any skills beyond signing up for a free service. I’d also much rather host something on my own server, as the perils of placing your trust in web services has often been tested. Today I’m going to walk you through how to create your own WordPress lifestream, and if you follow along with the tutorial, you should end up with something not dissimilar to this:

It’s a freely available theme, and clicking on any post will take you to the original source.

So what are my requirements?

• Runs on WordPress. Given that I try to market myself as a WordPress guru and consultant, doing it it on any other platform would just be embarrassing. I should be able to demonstrate that WordPress is quite capable of doing what I want.
• Aggregates various feeds, automatically and without my input.
• Doesn’t duplicate content, but instead links back to the original article. This is very important, and I’ll explain it later.
• Uses images where available – nothing is more boring than a wall of text.

Duplicate Content Issue

The problem with a lot of WordPress RSS-aggregator plugins is that they copy the entire content of the original and create a page that is considered a duplicate by Google, thereby labelling you a dirty rotten content-thief. Serious efforts have been made by Google this year to remove and de-rank those websites that copy other peoples work and try to pass it off as their own – often called spam blogs – but any legitimate attempts by you to republish your own work in its entirety are going to fall foul of the same fate.

To mitigate this, I’ve found a fantastic plugin that still pulls content into your blog to give the freedom that WordPress allows, but also changes the permalink structure of the articles to point directly to their original source.

You Will Need

• The Shaken Grid Lite free theme – you must supply a valid email to which the download link will be sent, but it’ll send a separate email asking you to subscribe to the email list, which you can ignore if you wish.
• The Feed WordPress Plugin, which will handle pulling in all the content automatically and adjusting permalinks.
• YD FeedWordpress Content Filter, which will import images so we can use them locally.
• This file which I wrote to fix the issue of featured images not being set by Feed WordPress – rename it to loop.php and replace the same file in your Shaken Grid Lite theme directory. If the featured thumbnail isn’t available, it will use the first attached image file. Feed WordPress will automatically download and attach the media item in the RSS feed, but it doesn’t create the featured image. This solves that problem.
• FTP access to your site, or the ability to edit theme files.
• A variety of RSS feeds you wish to aggregate.
• A decent webhost that isn’t going to disable your account if you use a little power. Feed aggregator plugins are notorious for annoying shared web hosts, but we’ll try to minimize the impact. If you’re at the point where you’re hosting a number of your own successful blogs though, perhaps it’s about time you looked at upgrading to your own virtual server.

Setup

Install and activate FeedWordPress, then the YD Content Filter plugin through the standard Plugins -> Add New interface, and upload and activate the Shaken Grid Lite theme.

There should now be a Syndication section on the admin sidebar. Expand it, and I’ll walk you through the options to set up on each screen.

Syndication

• This is where you add feed sources. Enter the URL in the box – either a direct feed URL or just a general website address.

• It’ll then validate your feed, or give a choice of feeds that it auto-discovered.

Feed & Update Settings

• By default, your feeds won’t update automatically, so change that setting here under the Update Scheduling option. Set it to update after a page load, and leave it at the default 60 minutes.

Post & Links

• Double check so that under the Links option, the Permalink points to the copy on the original website.

• Disable comments and pings too.

You can safely leave the rest of the options alone.

• The YD FeedWordpress options should be under your regular Settings tab on the sidebar. Click on that, and make sure that the option to Import Images as Local Attachments is enabled.

Theme Adjustments

If you check out your page now, you’ll notice that images aren’t displaying correctly and the full article is being shown instead of just a short snippet. To solve this, download the file I mentioned earlier and navigate to the Shaken Grid Lite theme directory through FTP. Replace the loop.php with the one supplied (rename it to loop.php obviously). Alternatively, if you’re unable to access FTP but can edit the files through WordPress, copy and paste the contents instead.

Assuming the feeds you’ve imported are actually providing featured images, they should now be showing on your homepage. If they aren’t, it’s out of the scope of this article to fix your website, but let us know if you’re having problems in the comments and perhaps we could check your feed for you.

That’s it, you should be well on your way now to having all your published content aggregated. Don’t forget you can still post regular articles on the blog too – they’ll appear alongside and mixed in with the rest, but clicking on them will take you to the full version just like a regular blog would. Happy life-streaming!

E-Commerce – Your Own Online Shop

You might be surprised to learn that you can run an entire online store from WordPress, and more importantly you can do it for free.

WP eCommerce has been the standard for a long time and powers some really impressive sites like Icon Dock. With a free core feature set and premium upgrades (additional payment processors, affiliate managers, etc), it’s the choice of developers with easy to customise templates.

In terms of out-of-the-box ease of setup for non-technical users though, my favourite is JigoShop, with which you can have an attractive and fully functional shop up in minutes, fully compatible with the default twenty-eleven WordPress theme. Nice!

Classifieds & Job Listings

For local sites especially, providing classified ads can be a great resource, as can a jobs site. Be aware that with any systems like these though, you really need a strong initial boost of activity and new users to prevent the site becoming stale. It may be best to create the community first, instead of creating a classifieds or job site from scratch and expecting the users to naturally come.

For classifieds, the best contender by far is Classipress, a premium theme for $99 but feature rich and mature with full support. The same developers also make Jobroller, a respected job listing theme at a similar premium price.

On the free side, Another WordPress Classifieds Plugin is an impressive alternative with a good selection of basic features – including the ability to charge users for listings using Google Checkout or Paypal.

For free job listings, WordPress Job Manager does an admirable job, and the developer is always active in the support communities and project development. It integrates well, and has fantastic reviews on the plugin repository. If you’re looking to integrate it into your existing design and have the power to easily customise, Job Manager might be a better solution than a costly premium plugin.

Membership Subscriptions

It’s hard to believe that anyone would subscribe to a website in this age of physical newspapers sales declining and sentiment against paywalls running at an all-time high – but if you’ve got niche knowledge on a topic that doesn’t have the traffic pull for you to make money through regular forms of advertising, then a subscription model may be the way to go.

Membership is a well developed free plugin to handle every aspect of running a members-only site, compatible with the latest WordPress and a favourite of many.

On the premium front, Wishlist Member is widely regarded as the best there is by those who make a living out of this – but at $99 for a single domain you’d better be certain of a subscriber base. Luckily, a 30-day free trial lets you decide if it’s right for you. With a full set of training videos, sequential content delivery and integration with a number of payment processors, it really has an expansive feature set.

A Reviews Site

My own iPad Board Games site is a collaborative reviews site running on WordPress, and uses the fantastic (and free) GD Star Ratings plugin at the core allowing anyone to vote on the games. It is quite a complex plugin with various rating types – posts, comments, multi-rating blocks, stars or thumb-up/down – and to get the best of it you really need to read up on the vast templating options. Certainly worth the time involved though, I’m sure you’ll agree.

On the premium side, it hard to fault wpreviewsite in anything but price – $97 for a single site license, though it is feature rich and works well out of the box for those of you in a hurry.

ReviewIt is a significantly cheaper theme option at $40 and supports the community plugin BuddyPress as well, but I’m not a fan of fixed theme options as they tend to look quite cookie-cutter.

Discussion Forum

Simple:Press is my choice for any sites that need a fully integrated and WordPress-centric discussion forum. It works right into your existing theme and looks great even without customising it, featuring the full gamut of forum features you’d expect. A full WordPress integration, user accounts remain managed by WordPress, so for tying it to other parts of your site you couldn’t ask for more.

I hope you can see just how powerful WordPress is for rapid website development of a variety of site types – not just blogs – and perhaps even gained a little inspiration in the process.

Many of the plugins mentioned today are featured on our freshly published Best WordPress Plugins page, but be sure to check out the full archives of WordPress tutorials too for lots more general blogging tips and in-depth theme-customization tutorials.

Image Credit: ShutterStock

Need a forum on your blog? Need to sell stuff? Want a better way to handle user comments? We guarantee that there’s at least a few plugins that you’ll find handy on our brand new Best Of: WordPress Plugins page!

We’ve skimmed through the internet and found 40 of the best WordPress plugins and compiled them onto the Best Of: WordPress Plugins page for your convenience. Bookmark the Best Of: WordPress Plugins page and go back for more!

If we’ve left out your favourite plugin, please do let us know in the comments section.

Share the page with your friends using the social sharing buttons right there on the page itself.

Still, it made me realize just how dangerous it is to make such infrequent backups. It also made me realize the extent of the damage that could have occurred if the database itself had got hacked – I could have lost over a month’s worth of blog posts.

Protecting Yourself With Automated WordPress Site Backups

The problem is I just don’t have time to go in every day, week, or even month, and back up my blog. I’m sure most of you reading this feel the same way. There really isn’t a nicely streamlined, automated solution that allows you to schedule a full backup of your files and database, and get the exported backup somewhere off the web server. Aibek listed some online tools that may help, but in those cases you are dependent on some outside service or website to make it all work.

Configuring Automatic Backups

I decided to spend half of my Sunday putting together a solution. The following setup makes use of two scheduling WordPress plugins, WordPress Backup and DB Manager.  The first backs up your files, and the second backs up your database – both on a schedule. In the last part of the article, I’ll show you how to automate the FTP transfer of those files onto a remote server or PC.

Your first step is to install the WordPress Backup plugin, taking careful note of the installation instructions and implementing the .htaccess file where required. Then go to the configuration area for it. Here is where you can tell the plugin how often to do a backup of your wordpress uploaded images, theme files and plugins.

Make note of the backup directory, you’re going to need this later. The three files stored there will be plugins.zip, uploads.zip and themes.zip.

Next, install the DB Manager plugin. You could also use something like the database plugin Dean described. Pay attent to the .htaccess configuration instructions. Don’t skip the instructions or the backup won’t work properly. Go to the Database Options in your WordPress menu and make a note of the backup path.

There will be multiple files up to the backup archive you define. To FTP these files we’ll have to use wildcards (I’ll show you how).

Set up your database backup on a schedule by changing the Automatic Scheduling settings.

Now that your WordPress files and database will be backed up locally to a location on your web server, it’s time to schedule an FTP job to get those files off the server and onto your local PC.

Scheduling An FTP Transfer

A scheduled FTP transfer is not easy to come by. Most FTP clients that can do it want you to pay for their premium product to do so. To get around this, you need FTP scripting commands that you can schedule, and that’s exactly what WinSCP allows you to do.

Download and run the interactive WinSCP app. Once you’ve established an FTP connection, click on “Session” and save the session.

Once you’ve saved the session details, you can close the application and then open up a text file. Call it anything you like, but remember the name. You will want to type something similar to the following (replace the paths with the paths above that you’ve noted as you set up each plugin).

I created a folder on my local server under D:\backup\TSW_Files where I want to FTP all of those files. Under D:\backup\, I placed the following script file called myfile.txt:

option batch on
option confirm off
open topsecretwriters
get public_html/wp-content/xxxxx/themes.zip d:\backup\TSW_Files\
get public_html/wp-content/xxxxx/uploads.zip d:\backup\TSW_Files\
get public_html/wp-content/xxxxx/plugins.zip d:\backup\TSW_Files\
get public_html/wp-content/xxxxxxx-db/*topsec6_topwp.sql.gz d:\backup\TSW_Files\
exit

The first path in the “get” command is your remote web server path, and the second path is your local backup PC/server path. Next, create a text batch job called backupWP.bat and store it in the c:\program files\WinSCP\ folder. That text file should have the following lines:

@echo off
winscp.com /script=d:\backup\myfile.txt

The myfile.txt script can really be stored anywhere, so long as you keep the path listed in the batch job accurate.

Now, whenever the batch job launches, it will call WinSCP.com, which will in turn run the FTP script commands you defined in your txt file. All you have to do now is schedule backupWP.bat to run using Windows Scheduler (All Programs -> Accessories -> System Tools -> Windows Scheduler).

Now, you’ve basically set up a system where your WordPress block takes regular backups of important WordPress files and the WordPress database to folders on your web server, and you can FTP those backed-up files off your server to a remote location using your daily FTP script.

So, there you have it. Once you’ve set up the system above, you never have to give backing up your blog another thought. Automating the entire process will free you up to do more important things, like writing your first novel, or playing with your kids. Pretty cool, isn’t it?

Try the setup above with your own blog and let us know if you were able to make any improvements in the setup, or if you know of any plugins that work as well as these two for a WordPress site backup. Share your thoughts in the comments section below.

Image Credit: Gualtiero Boffi

I wrote a while ago about 8 Proven Ways To Make Your Blog Popular, but let’s take a look today at 3 ways to encourage users to comment on your blog through the clever use of plugins.

Let Users Create An Account

One thing that puts me off commenting a lot of the time is having to type in my name and website relentlessly. I have something to say, but I don’t want to fill in the whole form – let me create some kind of a user account to remember who I am!

I showed you how to this with Janrain, which gives you a set of social buttons where users can log in with their social credentials to automatically create a local user account on your WordPress blog, but creating accounts within WordPress isn’t the only solution and not the best solution if you just want to use it for commenting.

The Disqus comment system is a good alternative, which we use here at MakeUseOf. Disqus completely replaces the built-in WordPress comment form with its proprietary system, and instantly enables existing Disqus users to comment without creating an account, as well as making the process of creating a new account easy from within your blog. In fact, none of the accounts made through Disqus are stored locally in your WordPress database – but the comments themselves are.

There’s a few advantages to this method:

• Disqus handles spam pretty well, so you don’t have to.
• With an account, users are able to keep track of any replies to comments they posted, something which WordPress doesn’t handle by default.
• All the comments are synced with WordPress, so if you ever decide to change back you won’t lose a thing.
• Users are presented with a variety of account creation and login options (including social) if they still want to be anonymous.

• Image previews and uploads – if users post a link to an image, a little preview is automatically pulled in. Uploads are also optional.

• @mentions: This is an incredible feature whereby you can “bring people in” to the conversation by mentioning them, even if they aren’t currently in there. This blog post explains it better.

I’d recommend Disqus if you only want to create user accounts for commenting rather than taking user story submissions or such. The only downside is that it complicates any other commenting-related plugins, and customising the form display isn’t possible without a developer license – the basic system is 100% free though.

Add A Link To Commenters Latest Post With CommentLuv

Very simply, the CommentLuv plugin adds a link to the commenter’s latest blog post if they’ve left a website URL, so it’s certainly an effective way of getting more comments as users are always looking for some free self-promotion.

The downside of this is that you might get a page full of mindless comments if you’re not careful, so make sure you’re as vigilant as ever marking those spammers. There’s even sites around dedicated to finding and sharing blogs that have dofollow CommentLuv links activated.

CommentLuv works within WordPress, and is not compatible with a third party service like Disqus.

There’s also a premium version about to be released soon, but as far as I can see it’s nothing worth getting if you’re only after the basic functionality of linking to a users latest blog post.

Thank Your Commenters

Thank Me Later is a unique WordPress plugin that attempts to solve the problem of users commenting then never coming back. While it isn’t technically going to encourage new readers to comment, it will keep them there once they’ve started (hopefully). It automatically thanks commenters for participating on your blog, and can be easily customised with your own templates. After a pre-defined time since commenting, it will pick one of the templates you provided, and email the commenter.

You can use this to encourage the commenter back to your blog, or perhaps take the opportunity to tell them about the RSS feed or your Twitter account – the possibilities are endless. While some might consider this spamming due to their automated nature, I think if you limited it to one email per visitor (there is this option) then you should be safe. You should also be able to use this plugin alongside Disqus, though I haven’t tested it in practice.

Of course, another great way to encourage comments without using plugins at all is to just ask for it! Speaking of which….do you have any other tips for encouraging comments, with or without plugins? Let us know in the comments!

If you’re a beginner or pro blogger alike with the WordPress system, be sure to check out our growing archives of WordPress tutorials, and keep a look out for our upcoming Best of WordPress Plugins page, coming to a MakeUseOf near you very soon!

Today I’ll take a look at 3 possible systems for offering free stuff on Twitter: a WordPress plugin, a free web service, and a DIY jQuery method.

If you’re new to Twitter or just looking for some tips, you might also be interested in our excellent Complete Guide to Twitter, which you can download for free by simply signing up to our newsletter.

For WordPress: Tweet2Download

As an integrated solution, the Tweet2Download plugin is fairly simple. When uploading media, simply mark it as required to go through the Tweet2Download system. Then on the media insert page you’ll also find a new Tweet2Downloads tab from which your download items can be inserted in a page or post. Click to insert a link as you would with any file download normally, and it will automatically use the Tweet2Download interface.

To adjust the message, you can enter the text in the short code that get’s added to your post edit area.

Note: Like many of these systems, Tweet2Download requires that you create a Twitter account and obtain an API key. Head to this page to do this. Make sure the URL entered is that of your website. When you create one, click on the settings tab, and change the Application Type to be Read and Write (instead of the default Read only). The interface has changed a little since this plugin was created, so be aware that the Twitter app page no longer lists an actual API KEY, instead just use the CONSUMER KEY. Since the app asks for both an API key and a Consumer Key, just add the same key twice.

Non-WordPress Solution: Pay With a Tweet

If you’re looking for one-off solution for your HTML hand-coded website or think the WordPress plugin is overkill for your needs, PayWithATweet web service is probably your easiest option. Just fill in the simple form – though you’ll need to host your own file.

Embed the button on your site (make sure to add the code in HTML view if you’re using this with WordPress – adding any HTML codes to the Visual Editor will break them). When clicked, users will see a screen similar to this. This is the demo that the site uses to offer their own eBook about the effective use of PayWithATweet. Bear in mind that the service is ad-supported.

DIY Method with jQuery

By far this is my favorite solution. For further flexibility and those of you who are confident of editing theme files, might want to try the DIY approach described in this TutorialZine article. This method makes use of jQuery and the whole thing is around 100 lines of code for something that you can re-use on all future projects (or you can of course, just download the complete project files). The advantages of doing it this way are that you won’t be confined by the CSS and UI of the Tweet2Download plugin, and you’ll learn some useful JavaScript skills in the process. The code supplied already looks quite fantastic anyway.

If you’d like to utilise this DIY method in WordPress, you’ll need to create a custom template file by duplicating either page.php or single.php, then add the various codes there. For file download URL I suggest using a custom field attached to the post or page where the download will be attached. The advantage of doing it this way is that if you ever decide to change your methods or switch to a “Like this on Facebook to download system”, you’ll still be able to use the same custom fields and just change a single template file. If you’re unsure about custom fields, I have described them in this Product Database project for WordPress tutorial.

That’s it from me today. I do hope you choose to release something for free and share your talents so everyone can benefit. While we’re on the topic, be sure to check out all the fantastic eBooks we’ve shared at MakeUseOf – I think we’re currently releasing at the astonishing rate of two a month, which means there’s an extraordinary amount of free knowledge in the archives! Whatever the topic, we’ve got you covered!!

If you have any issues setting up a Twitter application or need help making it work within WordPress, do ask in the comments or the MakeUseOf Answers section, and I’ll get back to you as soon as I can.

Obviously, this isn’t suitable for all situations and websites, and you should still provide an alternative method for those who simply don’t have a social profile. In general though, I think it can be safely said that letting people register or log in to your site with one click is a good thing.

So how does one go about adding social login to their WordPress blog? Simple, Janrain is here to help with a basic free plan, which enables you to have up to 2,500 users – far more than many of us will need I suspect. When the time comes to scale, you can easily upgrade to a paid plan.

What Do I Get?

Firstly, the login component is the most important. You’ll get a simple widget that can either be embedded on the page itself, or can pop-up in a modal box when a user clicks a link.

In the comments area of your site, you’ll also get a share link. When users click on that, they can share their comment.

One feature that separates Janrain from its competitors is the ability to post or share items to multiple networks at the same time – something that compulsive sharers will really appreciate.

Set Up

I’ll warn you now this isn’t a one-click install. Due to the fact that your site will be accepting user email addresses and using complicated API calls, you need to set up an account with Janrain. As I mentioned, the free plan will limit your account to 2,500 social users, as well as up to 6 providers (a single provider being say, Facebook or Google – the social networks that users can use to log in).

Anyway, here’s how to get started:

• Head on over to the JanRain Engage site and create a new account. Here’s a direct link to the basic plan. You will need some kind of social profile yourself in order to create an account – yes, Janrain eats their own dog food, as it were. While the free account is limited to one site, you can technically create multiple accounts, but make sure you use a social network with a different email registered to it.
• Fill in the contact information and name your new application (the site you will be using it on would be a good choice, although it doesn’t really matter).
• Click Get Started, then choose Sign-In For Web from the Deployment menu.

Change to Plugins in the drop down menu that currently says widgets :

You can install the plugin at any time to your blog, so open another tab for your blog admin screen and search for the Janrain Engage plugin. In the meantime, click next to move to the choose providers screen. On this screen, you can choose up to 6 services you would like users to be able to log in with.

By default, there’ll be a few added for you. If you wish to add popular services such as Twitter or Facebook, you should be aware that’s there are additional setup steps required, in the form of creating a Facebook or Twitter App. It isn’t as scary as it sounds, and the instructions from Janrain will help guide you through the process. I’ll give you a quick demonstration here too.

Follow the instructions to allow developer access on your Facebook account if you haven’t already, and yes, in order to create a Facebook App, you certainly do need a Facebook account yourself.

Next we are told to click Set Up A New Application. You’ll find this in the top right on a button labelled Create New App (on Facebook, not the Janrain page).

Give your app a new name – the same name you used for Janrain would be the best. Next you’ll be taken to your app details page. Back on the Janrain setup screen, click next. You’ll be asked to enter the App ID and App Secret key that you can find at the top of your app detail page.

Copy those in one by one and click next.

There’s are similar steps to go through for Twitter or any of the providers with a little gear icon shown next them in the Janrain provider selection screen. For now let’s save.

The final step is to click Deployment -> Application Settings and add your domain name to the Domain Whitelist.

Great, we’re all done!

Note: The configuration screens may vary slightly from the time of writing, as Janrain was planning to enable greater customisation of the widgets. 

WordPress Plugin

Assuming you’ve downloaded and activated the WordPress plugin, you’ll see a new Janrain section on your sidebar. Click the setup link and enter your API key. You can get this from the Deployment -> Application Settings screen too which should still be open. It’s on the right hand side, where it says API Key (Secret). Copy and paste this into your wordpress admin screen, and a new screen of options will appear.

I suggest you check all the boxes on this screen, as well as select somewhere for the Login link for comments so that users trying to comment know they can use social credentials.

If it isn’t already, you’ll also need to make sure that Anyone Can Register is enabled on your WordPress general options screen. This step pretty much always catches me out, so double check. By default it isn’t enabled.

That’s it. You should start to see people engaging with your site a lot more now that they don’t have to type in their email every time. I can’t promise to be of any help with your individual problems, but please post in the comments or technical support community if you have any general problems with getting it to work, and I’ll try my best. Before you ask though, do please read the instructions steps once again to make sure you haven’t missed anything.

Be sure to check out all our other WordPress tutorials too for more exciting customisations you can do with the almighty WordPress blogging platform.

Is it worth the effort though? I mean, it would never happen to me, would it? Well, a vulnerability was recently discovered in timthumb.php, a thumbnail making utility that’s used in a considerably large percentage of old themes and plugins (before WordPress built thumbnailing and featured images into the core system). Given that this file can be detected using automated scanners, the chances of your blog being hacked over the coming months is rather high – and you won’t even know if it has been. I’ve seen it happen a few times in the last week alone and now they’re dealing with the fall-out.

How Do You Know If Your Site Has Been Hacked?

Normally, you don’t. The most common hack I’ve seen is where the regular site and admin panels work as normal – however, any visitors from Google are hijacked and sent to a site in Russia. Of course, since you’re unlikely to Google your own site, the hack remains undetected until either your users give you feedback, your website hosts shuts you down as a threat, or you get the dreaded warning from Google themselves saying your website is now officially hosting malware. Bye-bye traffic!

The hacker usually also installs a complete GUI backend on your server, giving anyone with the URL access to all your files and free reign to do as they wish. It’s quite scary stuff, and because of the way they can adjust core files, recovering from such an attack takes a lot of work, and certainly isn’t something a regular user can do.

So… How Can I Protect My Blog?

Luckily, this free WebsiteDefender service can scan your site. Head on over there to sign up. However, this service is only available to WordPress bloggers running self-hosted installs. If you’re using WordPress.com, Blogger.com or another similar free hosted blog, you can’t use it. Free hosting plans also don’t work. You need to be able to upload a verification file to your server before the scan will commence, and free accounts are limited to one website.

Registration & Verification

Once you’ve verified your email address entered during registration, you’ll be sent to a page where you can download a small verification file. This needs to be uploaded to the root of your website. When you’ve done that, head back to the site and click the TEST button.

If you get an error similar to what I received, just download the zip file as instructed, then also upload the compat directory to the root of your site.

Presumably, it needs some additional PHP libraries to help the scan which your server doesn’t have. After uploading the folder to the same root directory as the verification file you did a moment again, hit TEST again and you should get a confirmation that the scan will run soon.

In my testing, an email came after about 2 hours detailing any problems, so don’t be alarmed if it takes a while.

The warnings you receive will be ranked from Critical to Low, but it turned up a few unexpected security errors in my report which I’ll need to deal with. It also deems WordPress and plugin updates as medium security, so if you shamefully haven’t updated something yet perhaps this will serve as a helpful reminder.

Each issue will also link to a more detailed explanation and instructions on how to solve it, which is incredibly useful for those of us who are less technical about websites and servers. Don’t worry if you’ve deleted the email – you can access a complete breakdown on the report at any time from the dashboard.

Plugins

The Website Defender team also have a few plugins you can use to secure WordPress, though curiously it makes no mention of them when you perform the scan via the website method outlined above.

WP-Security-Scan

This performs a basic security audit for you on things such as directory permissions, database prefix, .htaccess permissions, default usernames and WordPress version hiding.

Secure WordPress

This will lock down and perform a number of security measures to protect your wordpress. This essentially amounts to removing all references to your WordPress version, removing some lines from your header for Windows Live Writer, and preventing listing of your themes and plugins directory – amongst others.

Both plugins include signup forms for the Website Defender online service and appear to let you link to an existing account. However during testing I was unable to link them as my free quota of one website was already used up (despite the fact that I was trying to link the same URL anyway, it seemed to think it was a different site).

Conclusion

The fact that there are two plugins available as well as being able to run the scan without a plugin via the website is quite confusing to be honest – nor does the website initiated scan even mention the plugins, and I can’t see the logic behind that. While each plugin is unique, it’s difficult to see why they haven’t just made a single ultimate security plugin instead that both hardens your WordPress and checks for issues. I also found that the method of scanning via the website showed more security issues that using the WP-Security-Scan plugin, presumably because of restrictions placed upon what WordPress plugins can actually do.

That’s not to say I don’t thoroughly recommend the free service – because I do think you should go sign up now and make damn sure you aren’t vulnerable to the growing number of WordPress-based exploits. In fact, I’d recommend a combination of the Secure WordPress plugin to lock it down, whilst performing the actual scan through the website method. Let me know how it turns out in the comments.