I recently noticed a sharp drop in my Google traffic. Logging in to my webmaster panel I noticed the site was now popular with terms such as poker and viagra. Definitely not what I want to be linking to. An investigation at the blog revealed no visible links. However, looking into the source code they were there but hidden by a css trick of placing them outside of the viewable screen area.

By disabling wp_footer by simply commenting it out in the theme files the problem went away. However, it wasn’t a permanent solution. An upgrade of the theme I was using (WooThemes) didn’t fix issues.

Further investigation into the MySQL table revealed an MySQL insertion had occurred:

Table: wp_options
option_id: 1120
blog_id: 0
option_name: siteurlpath
option_value: (really long)

The option_value was huge with a base64_decode where the hack was hidden. I deleted this entry from WordPress and low and behold the hack disappeared. Re-enabling wp_footer the links were still not showing in the source code. Wp Footer hack removed!

I believe the hackers got in through the TimThumb vulnerability present in many WooThemes files. Therefore, I upgraded it to the new version to be sure no similar attacks can be made. As a precaution I also changed all of my passwords (admin, FTP, cpanel etc).

I hope this write up helps others deal with these issues. I’m happy to take questions in the comments but do be aware this isn’t my main area of strength. I’m a writer not a WordPress programmer.

I’ll update this post if any further WordPress hacks appear and let you know how I dealt with them.

This can be downloaded as part of the Windows Live Essentials package.

Above is a screenshot of the desktop blog editor in action showing this post as it was being written.

One way of monetizing my cycling site is through the use of Affiliate Links. My audience is interested in cycling products so whenever I mention a product that I genuinely like, trust and would use myself (remembering trust is everything) I add a link. Often these links look very unsightly. Take for example this typical affiliate window link:

http://www.awin1.com/cread.php?platform=dl&awinmid=1857&awinaffid=87595&clickref=&p=http%3A%2F%2Fwww.wiggle.co.uk%2Fp%2Fcycle%2F7%2FErgon_GC2_Handlebar_Grips%2F5360036781%2F

It’s like Shrek of the affiliate links. The solution is to cloak the link. So it looks a little something more like this:

http://www.londoncyclist.co.uk/go/ergon/

That’s much more snazzy.

People are more likely to click on the second link as it looks more trust worthy. For a start it has your brand name behind it and secondly there is not a ton of scary looking characters that they don’t recognise.

It is links like the first one that I first discovered affiliate marketing because I typed in awin1.com to see what it referred to. It is how I came across affiliate window and the sites such as Wiggle and Evans Cycles that you can promote with it.

How you link cloak in wordpress

To do this all you need is a plugin called the Link Cloaking Plugin. It works wonders with WordPress and I’ve never had any issues with it. The founders behind the Link Cloaking Plugin have also recently released a premium version which adds some great new features in particular the ability to look at detailed statistics of how many clicks the link has received.

Once the link cloaking plugin is added to WordPress you can click on Tools > Cloaked links and add new links. You can also change the /go/ part of the link from the Settings > Link Cloaking page.

Give the plugin a download today and remove all the ugly links from your site.

Soon I’ll discuss in detail how to use the plugin. I’ll also take a look at some competing link cloaking plugins and go into the features of the advanced version.

The code I ended up using:

$chosen = mt_rand(1,3);
switch($chosen){
case 1:
include ‘first.php’;
break;
case 2:
include ‘second.php’;
break;
case 3:
include ‘third.php’;
break;
default:
echo ‘something went horribly wrong’;
}

From: Random HTML snippets with PHP include?

This worked very well for me. I simply removed case 3 and changed mt_rand(1,3); to mt_rand(1,2);

This then randomly chose between my first block of text and my second block of text. This meant I could split test their effectiveness by embedding two different aweber forms. When the first form is randomly loaded it counts it in Aweber and then when the second form randomly loads again the results are counted. This meant I could customise the text in a way I wanted and not have to use Awebers built in e-mail forms which were not effective and looked ugly.

Hope this helps someone looking to randomise the way content appears on a page.

The only solution I could think of was to create a new site and set it up exactly as I wanted it and then transfer it to the main site, this would allow for minimum downtime and plenty of stress free time to test out the site before making it live. I effectively “spring cleaned my wordpress” so it is as if I’m starting from scratch but  then uploading all the database content.

So… how did I do it?

1) I used fantastico in my cpanel to automatically install a new instance of wordpress in a subdomain so instead of efinet.co.uk I installed to test.efinet.co.uk. Use whatever tool your hosts gives you to setup a new wordpress or just install it yourself to a subdomain.

2) Then I copied over from my other database all the database files.Luckily they had a different name. Effectively I now had a copy of all the new database files and the old ones that contained all the data I wanted to transfer.

3) Luckily when I did this they had different names. This allowed me to rename each of them one by one so I can effectively test out if there was going to be any problems. So my old one was called wp_55_posts for example and the new one was wp_posts. So what I would do is rename the new one to wp_posts_new and the old one to wp_posts.

4) I discovered that there was an error with renaming the settings file. So I kept the original settings file and just went in and manually edited it using phpmyadmin.

5) There was also a problem with wp_usermeta so I edited my original to look more like the new one. Then everything was working fine.

6) Then I logged into wordpress (with my original username and password) and double checked all the settings matched up wtih my original site (which was still live) and my new site (which I had setup at a subdomain)

7) I cross checked all my plugins and re-uploaded them

Re-uploaded a theme I wanted

9) Double checked all the pages were still there and working

10) Transfered my wp_content/uploads folder which contained all the images

11) Iron out any errors and hey presto your new site works exactly the same as the new one.

12) Then I simply renamed efinet.co.uk folder to efinet.co.uk22 and test.efinet.co.uk to efinet.co.uk

13) This meant the main site was now my new one.

14) From then on you need to go into admin panel settings and change the wordpress blog URL and also site URL.

I think I described the steps fairly well. If you need any help or have a similar problem with your wordpress javascript not working in the admin panel then drop me a comment and I’ll see if I can help. I’m no wordpress expert but this “spring clean” technique worked for me.

I am going to assume you have installed the blog and have logged in as a user into the dashboard. Ready? Lets go!

1/ Themes + Plugins

First of all find yourself a nice theme. I like the ones listed in Smashing Magazine. Download a theme and place it in wp-content/themes then click on design > themes and enable it. Looking good!

Next: Plugins. I recommend WP-Cache, WP-Contact Form and Sociable. But there are many more just have a quick look on google for “top wordpress plugins”.

2/ Activate Akismet and get an Akismet login Key

Click on Plugins. Under Akismet click activate. Then click on Akismet Configuration and follow the instructions to get a wordpress.com account if you don’t already have one. Once you have an Akismet key from wordpress.com copy it into the configuration page.

This will stop those pesky spammers from leaving comments on your blog.

3/ Fiddle with the settings!

Its time to look under the bonnet. Click on the settings page, have a flick through and change the obvious ones which I don’t need to cover here.

- One setting you should change is Permalinks. Under common settings I would recommend “Month and Name”. This will make your blog much more search engine friendly and bring in the visitors.

- Another setting you should look at is under Writing. Scroll down to the bottom and you will see a section called Update Services. I recommend you add some more websites to this list. A good list of suggestions can be found in this wordpress blog.

4/ Secure your WordPress

It is a very good idea to keep your wordpress secured. I am not going to re-write this section because people much cleverer than me have already done that and why clog the internet! Check out: here and here. The one I particularly recommend is removing what version of WordPress you are running from displaying on your site. This involves modifying the header page.

5/ Bookmark the dashboard page so you can quickly access it

Alternatively you may wish to use a weblog client to edit posts.

6/ Get Google Analytics

If you are serious about webdesign you need to track your visitors. For this I recommend Google Analytics (Free) combined with Google Analytics plugin.

7/ Learn!

There are a lot of good sites out there that cover WordPress so do a quick search on Google and see what you come across.

Of course this is not the only initial WordPress article on the web. A good one has been written by Download Squad.