Keep your site safe – WordPress Security
During our last meetup, I talked about some basic WordPress Security principles. You can read all about it here:
Tag Archives: Meetup
News in the WordPress world, October 2015
News in the WordPress world, October 2015
WordPress 4.4.
WordPress 4.4 Beta 2 is available for testing. The new version of WordPress will include 3 new important features:
- Responsive Images. All image sizes are now included in the HTML output of an image, allowing your browser to pick the best image for your screen resolution.
- The basics of the REST API infrastructure. It’s the first half of the REST API. You still need to use the separate plugin if you want to use the REST API on a site, but soon you won’t!
- WordPress becomes an oEmbed provider. You can now embed WordPress posts, pages, and post types in other WordPress sites.
Plugin translations
If you’ve had to deal with plugin translations in the past, you know it used to be a cumbersome process: people who translated your plugin had to send you .po and .mo files, and you would commit those files into your plugin’s languages folder in the next release. Things are much easier now, thanks to WordPress.org. All translations happen on translate.wordpress.org. You can contribute to translations for just about any plugin, and as soon as your translations get approved, they’ll be shipped to everyone using the plugin.
Even the readme can be translated, so we’re slowly moving towards a fully localized plugin repository!
Let’s Encrypt
Not a WordPress news, but something that will affect everyone with a website. Let’s Encrypt is a new free SSL certificate authority, and is now trusted by all major browsers. Soon they’ll stat issuing free SSL certificates to everyone who’d need one. They contribute to a safer internet for everyone.
More XML-RPC news
XML-RPC is a feature allowing you to interact with a WordPress site. It’s used by the mobile apps, by plugins like Jetpack, by services like IFTTT, and by many other apps and services.
Since it can be used to publish posts remotely, it’s one of the points of entry hackers like to target. They’ll try to authenticate to your site via XML-RPC, and access your site through there.
Unfortunately, it can be abused, and the Sucuri security firm discovered that hackers had discovered a new way to abuse that feature. They now use a method named system.multicallto execute multiple methods inside a single request. That means they can test several username / password combinations to get into your site in one single request. That’s consequently not enough to just block folks who do multiple requests to your site’s XML-RPC in a short period of time, you now have to look at what people do in these requests. We’ll cover how to protect yourself against those attacks in my talk, a bit later.
WordPress Budapest Meetup — Happy Halloween!
http://www.meetup.com/Budapest-WordPress-Meetup/events/225778081/
It’s been a while since our last meetup! This time, we’d like to try something different. We haven’t decided about a topic yet and we’d like you to decide what you want to hear about!
Please fill in this survey, and tell us what you’re interested in. We’ll then find speakers and update this post and the Meetup page accordingly.
https://jeherve.polldaddy.com/s/wpbudapest-topics
Thank you!
News in the WordPress world, April/May 2015
Update all the sites!
There were quite a few releases in the past few weeks:
- 4.1.2, 4.2, 4.2.1, 4.2.2
- Popular plugins, Security plugins (iThemes Security), Core, … Everyone has had their share of security issues in the past few weeks.
- Luckily, WordPress’ Automatic Updater took care of most of these updates for you. You can learn more about the updater and how to configure it here.
- The last security issue concerned Genericons, an icon font that’s bundled into several themes including Twenty Fifteen, and in popular plugins like Jetpack. You can read more about the vulnerability here.
- Update fatigue is dangerous. Don’t give up, update, and thank the Core Security team who’s there to save us by reacting quickly and shipping new releases to fix all these issues.
WordPress.org Now Requires Theme Authors to Use the Customizer to Build Theme Options
From now on, all themes submitted to the WordPress.org theme repository will have to use the Customizer for their theme options:
- https://make.wordpress.org/themes/2015/04/21/this-weeks-meeting-important-information-regarding-theme-options/
- http://wptavern.com/wordpress-org-now-requires-theme-authors-to-use-the-customizer-to-build-theme-options
If you are not familiar with the customizer, and if you’d like to add options to your theme, I would suggest checking out the Customizer API docs on WordPress.org.
WordPress 4.3 will be all about enabling users of touch and small-screen devices.
WordPress 4.2 was shipped a couple of weeks ago, and the core developers are already planning 4.3. You can find out more about the focus of the next major WordPress release here:
- https://make.wordpress.org/core/2015/04/28/wordpress-4-3-kickoff/
I would also suggest subscribing to make/flow if you’d like to help with testing and share your opinions.
WordPress’s Rest API is still in the works, version 2.0 was released a few weeks ago
- https://make.wordpress.org/core/2015/04/29/wp-rest-api-version-2-0-beta-1/
- The developers in charge of the API are looking for testers. If you’re interested, and if you want that feature to make it into core sooner rather than later, watch the GitHub repo and submit bug reports!
WordPress Budapest Meetup #3 – WordPress Performance 101 Presentation
My WordPress Performance 101 presentation from our third meetup.
You are welcome to ask any question about it, feel free to comment.
News in the WordPress world, March 2015
Here is a quick recap of last night’s News section. Any questions, shoot!
Security updates
There were a few important security vulnerabilities discovered in WordPress plugins this month:
- WordPress SEO Security release
- Google Analytics for WordPress Security Release
- WPML Security Update, Bug and Fix
- Mandrill Security Update
For some of these updates, the WordPress Security team automatically updated the plugins remotely, using the automatic update system that was added to WordPress in version 3.7. You can read more about this process here.
This automatic update was really useful to patch a lot of WordPress installations in very little time, but some people felt uncomfortable seeing the WordPress security team update code on their site without their consent. Here is a post arguing against automatic plugin updates: On Automatic WordPress Updates.
WordPress 4.2 Beta
The next version of WordPress is just around the corner, and you can help test it! To do so, install this plugin.
To find out what’s new in WordPress 4.2, you can check this post: WordPress 4.2 Beta 1.
Of note, a better plugin installer, a new Press This feature, even more things in the Customizer, and Emojis.
We also talked about the changes to taxonomy terms: you can read more about it here. If you’re a plugin author, you’ll want to review this guide. You can use this plugin to find out if your site includes any shared terms.
If you have any other news to share, post them here!
WordPress Budapest Meetup #3 – 2nd presentation
Blast Off With Jetpack
Discover the Jetpack plugin, and why should you give it a try on your WordPress site.
If you have any questions about my talk, do not hesitate to comment! And if you want to learn more about a specific module, let me know!
WPBudapest Meetup presentation: customizing WordPress using functions.php
Here are the slides for my presentation at WPBudapest meetup.
The presentation included an interactive demo on a test server, which cannot be replicated in the slides 🙂 so if you have any doubts or follow up question, please feel free to contact.
WordPress and the use GPL License
My presentation at the second Budapest WordPress meetup
Here you are the power point file of the presentation
I would like to advice everyone to watch this youtube video, to understand why GPL is the best, and we all would love to participate on the benefit of the WordPress community
Some helpful links:
“Themes are GPL, too” by Matt Mullenweg
List of WP marketplaces that sell 100% GPL products
News in the WordPress world, January 2015
Before we get to post pictures and presentations about last night’s meetup, here is a quick summary of the news topics we talked about.
WordPress Lead Developer changes
Ryan Boren and Peter Westwood step down and are replaced by Helen Hou-Sandi and Dion Hulse.
Ryan Boren becomes UX lead for 2015. If you don’t already, I’d suggest following make.wordpress.org/flux to find out more about some of the biggest UX issues in WordPress.
The plugin installation flow will be improved in WP 4.2.
Done with the boring steps appearing when you would install a plugin. Check trunk, it’s already in there. #29820-core
New frontend editor walkthrough
If you follow make.wordpress.org/core, you probably know about the frontend editor that is being worked on. You can already install it on your test sites, it’s worth giving it a try. Her is a walkthrough from Elegant Themes.
Pressnomics
Pressnomics is a WordPress conference for entrepreneurs and business owners. A few weeks ago, over 250 attendees met in Phoenix to talk about the economics around WordPress. One of the key events of the conference was a QA with Matt Mullenweg, founder of WordPress and CEO of Automattic.
The session wasn’t recorded, but a few quotes generated quite a lot of talk around the future of WordPress, our competitors, and how we need to change to create the next WordPress.
Here are a few of Matt’s quotes:
Matt was referring to plugins transforming WordPress in a turn-key solution including the features that people creating websites have come to expect: social, mobile, stats, … These are all baked in tools like Wix, Squarespace, or Weebly.
Chris Lema – Is the Future Success of WordPress tied to Jetpack?
WP Tavern – How Important is Jetpack on WordPress’ Road to 50% Market Share?
WP Pusher, deploy WordPress themes and plugins from GitHub
cc @sinisterstuf who will talk about deployment methods in our next meetup!
