It’s a shame isn’t it? You put all that effort into building a site and some script kiddie comes along and violates it for you. You come along and find links to malpractice insurance california, pharmaceuticals and all sort of things!

Anyway, here are a list of things to think about when cleaning the infection:

Make sure that your files on the server are clean. That means deleting and re-uploading. Files that you don’t replace, should be swept.

Check for files that don’t belong, directories that don’t belong. Image files with changed timestamps — look at those. Its VERY common for there to be scripts on sites that are named in such a way to mask the fact that they are scripts.

Be suspicious, when youre looking at things.

Look at your permissions. Do you have world writable files? Any world-writable directories? Are they necessary?

You need to check your database. Look for rogue plugins being loaded, look for rogue users (specifically look for a user named wordpress). You will NOT see rogue plugins or rogue users in your wp-admin/ area. You need to check your database.

Make sure ALL of your plugins are current.

Make sure your wordpress is current.

Change your mysql password that wordpress uses (update your wp-config.php with that new password). Especiallly important in cases where you see changes to your mysql database.

Change any admin level passwords on your blog. Change your ftp password(s)

Scan your local machine for malware.

Look at any other software that’s being used on your site. Is it current?

That’s just an outline and not a complete list.

There’s quite a bit to do, but it’s all necessary.

If you cant do it all — get help.

Then there’s this:

http://codex.wordpress.org/FAQ_My_site_was_hacked

and

http://codex.wordpress.org/Hardening_WordPress

That information was taken from one of the WordPress message board. It’s packed with good advice though, so worth checking out! Good luck!

I ran into this the other day and tried using is a method called mysql_insert_id which is the standard PHP way of doing this.It didn’t quite work though, as my queries were all going through the WordPress class $wpdb and I couldn’t guarantee that my query was the last thing that was being executed.

Well, it turns out that one can use the class varialbe $wpdb->insert_id which is updated with mysql_insert_id when your INSERT is completed. Now that’s easier than finding a Arai Signet-q when you’re really looking for one right?

Looking at the name of your blog, I can tell that it’s hosted on the WordPress website, so you don’t need to worry about upgrades, they will take care of that for you. Nice Sferra linens by the way. Anyway, if you were hosting your own hosting service, then it would be advisable to upgrade the blog as soon as possible.

Instructions to upgrade can be found on the upgrade page on the WordPress website, however things are much easier since the more recent versions of WordPress, as you can now upgrade with a single click and let your blog do all the work. The one thing to remember is that you should always backup your site before kicking off an upgrade. Just in case, you can never be too sure; can you?

I found this question on Twitter by Ang from Ang’s Chicken Coop who had recently migrated to the latest version of WordPress and probably found that her WordPress plugin that did her word count wasn’t working any more. The great thing is that WordPress now has a word count built into it, but she probably hadn’t spotted it, which can sometimes happen when you’re moving to new software and things suddenly change place.

Well, the great news is that you don’t even need a plugin any more; the word count is display on your screen right under your text editing area (shown below):

Voila, problem solved! I wish all my problems could be answered as easily as this one. Now if I had some home theater seating in my home office, I would just put my feet up, put on a good movie and relax in the knowledge that I’ve helped someone today

It was only recently that LinkedIn announced an API for development teams to build Applications that can integrate with their website. The boys down at WordPress managed to roll out an application pretty sharpish that lets you specify a WordPress blog which gets fed into your Profile page. Here’s how to implement it:

• Click on “Applications” at the bottom of your left hand menu
• Select the WordPress Application (shown alongside)
• Click Update Settings on the WordPress Application main screen
• Specify the URL of your blog. You can also specify here whether you want to display all posts or just those which you decorate appropriately.
• Click Save

If you visit your profile page, you’ll now see your blog posts showing there for the whole world to see.

It’s pretty useful I though, especially if your blog is very much in line with what your profile is about. It’s helpful to showcase your blog, especially if it serves as a vehicle for you to increase your credibility and spread your thoughts. Much better than fighting over bar stools and drinking beer (though social events shouldn’t be undervalued)

I got this question from my friend Leo who’s quickly becoming a WordPress fan. I knew he wasn’t talking about WordPress.com, because they have extra functionality to allow bloggers to embed Google Videos. In fact, inserting a piece of code like this:


allowed me to add a video directly to a post. You can see this on my test blog.

It’s a bit less straight-forward on a self-hosted blog, but it’s not hard once you know how. Here’s what you do.

1. Get the embed code from the Google Video you want to embed
   
2. Insert it into the HTML view in your WordPress editor
   

And voila’ here’s the video

It’s an amusing clip of a biker driving his Harley off the road. He’s going to need lots of Harley parts to repair that bike! Hope he didn’t get too hurt.

Now. A couple of things to keep in mind. If you try editing your post again in “Visual” mode, WordPress messes up the embed code for you and you’ll need to embed it again. Also, this technique works for Youtube and other video clips too.

Anyway .. I hope this helps.

I got this question from Rene who left it as a comment on a question about making permalinks word on GoDaddy. I’ve read a bit about the subject and there are two things you need to check.

The first relates to the fact that Apache uses a file called .htaccess to control thinks like search-engine friendly permalinks. This file redirects request all URLs that don’t have a file associated with them to the main WordPress file and then WordPress can figure out which page to display.

Now .. the one thing you need to realise about .htaccess is that if Apache doesn’t find out, it will try the parent directory for the file and work it’s way up the tree until it finds a file. So, the first thing to check is that you do have a file called .htaccess in the root folder of your new blog to ensure it’s trapping requests.

The other thing to check is your wp-config file. I found a blog post from someone who had a similar problem which suggests that the configuration file for the 2nd blog he created wasn’t working properly and ended up pointing at a different blog. This resulted in his URLs pointing at the parent blog and pages being redirected to the wrong place.

Unfortunately you’re going to have to try and debug this one, but I’m happy enough to give you a hand and update this article with whatever we find. It’s not as simple as clipping on a pulse oximeter to see if your blood oxygen levels are low, but I’m sure we can get to the bottom of it in the end.

Let me know how you fare.

I got this question from the Webmistress down at Carper Diem, who was getting worried about all the alerts WordPress was sending her way warning her to upgrade her blog. The newer versions of WordPress now show an alert on ever page if the blog software needs upgrading. It’s not the end of the world if you don’t upgrade, but newer versions always have more functionality and usually have better security also, so it’s always a good idea to upgrade if you can. This is the message you’ll see when you need to upgrade:

Now, in this case, the blog was installed using Fantastico, a great utility that a number of hosting companies provide to make installing software really really easy. Most hosting companies and franchises tend to use it as it makes things easier for their technical support guys if people can just install software effortlessly. And the great thing is that upgrading the software is just as effortless. Here’s how you do it:

• Log into Fantastico. It will show you that an installed package needs an upgrade
  
• Click on the new version of WordPress
  
• Click Upgrade
  

Fantastico will do all the work for you, take backups of your blog, install the new software and get it all set up. There you go, that wasn’t hard was it?

Karen dropped off this question a couple of days ago and given the impending release of WordPress 2.6, I thought now would be a good time to answer it. Everyone who set up a blog or website needs to understand how their site can be hacked or defaced, what are the risks they face and what, at the end of the day, are just hyped up incidents who you can safely ignore.

First of all, let’s look at this from the villain’s point of view. Why would someone want to hack your website. Well, there are a number of reasons. In the past it was done simply to show up. There was a certain pride in being able to break into, say the UN’s website and leave your name all over it. High profile sites were the main target back then and the little guy didn’t really need to worry too much about these threats. Nowadays, unfortunately, there is money to be made by breaking into someone’s website. I’m not talking about high-profile cases where for example, a medicare advantage website suffers a DDOS attack and held at ransom by the people launching it. Instead, smaller outfits now try to get into people’s website to embed links to sites that will pay them for the privilege. And it’s usually adult website who are ready to pay a premium for traffic, so those are the link to watch out for. However, if someone broke into your website and changed your AdSense code so that THEY get credited with your income, then there’s still something worth doing for them there.

So, with that in mind, here are some tips to protect your blog from getting hacked:

• Make sure your administration password is secure: This is the key to your website. In the same way that you wouldn’t give the key to your house to a stranger, don’t throw this around. Instead, make sure it’s secure and DON’T GIVE IT TO ANYONE. If you need to give access to your website, create a new account, then delete it when they are done. The more people who know your administration password, the more chance there is that someone can intercept it and use it against you.
• Make sure you’re always running the latest version of your software: As you may be aware by now, new versions of your WordPress blog and WordPress plugins come out all the time. Whenever an exploit is found for a particular version, manufacturers can release a fix quite quickly. However, if you’re running an older version of their software, you are leaving yourself open to people using that exploit to get through your defenses. Always make sure you are running the latest version of any software.
• Always keep backups: Make sure you have a recovery plan for your  blog. If the unthinkable happens, you can always throw it all away and recover from a backup. And try to keep multiple backups too, if the last one you took was compromised, it’s always good to be able to go to an older one. Backups can mean the difference between looking a few days of posts and losing everything you ever posted to your blog.

I hope these suggestions can help you feel more confident in what you’re doing. The nice thing is that you’re not alone out there, there are thousands of WordPress users out there and if there’s a problem with the software you’re running it will get fixed pretty sharpish.

This question was submitted on AskOwen by Connie who runs BrainFoggles and judging by the questions on the WordPress forums, this doesn’t seem to be an isolated issue. Unfortunately, I think there are probably a number of probable causes for this issue and just like termites in your home furniture, if you don’t notice the problem straight away, it just gets worse and worse; but I’ll go into a couple of things to watch out for and a way you can explicitly cure the problem.

First of all, what can stop automated mail from being sent to you? Well, one factor that can contribute to this is the anti-spam measures that your hosting provider implements. There has been a move in the last few months to try and reduce spam by ensuring that the email they send only comes from legitimate accounts on their system. Now, since WordPress 2.3.1, there are cases when WordPress sends email originating from “wordpress@yourdomain.com”. If this account doesn’t exist on your host, then this email will get blocked by your provider. To address this, create an account on your mail server using the account name of “wordpress” (thus creating an account “wordpress@yourdomain.com”) and forward this to your usual mail account.

It’s also possible that some plugins send email from the Administration email account in WordPress (the one under Settings -> General Settings), so make sure that this is one your host recognises. If you prefer using your Gmail account for example, set up a local email address and forward that to your Gmail account, then configure WordPress to send to the local account.

If you’re *still* having problems, there’s a little WordPress plugin called Comments Notifier that can be quite useful. This enables you to send notification of comments to multiple email addresses. It might just solve your problems.

Good luck, and let us know if this solves your problem.