Finally got hacked after 6 years of safe journey online.

Two weeks back, a simple site search site:ReviewOfWeb.com on Google revealed some unwanted results which clearly showed that my site was under attack. Here is how some of my site URLs looked like in Google. [Check the description.]

The interesting thing about this hack was that it was a conditional redirect, or in simple words, when you would navigate to this site by directly entering the URL in address bar, you would get the actual page of my website but when a visitor arrives from a search engine he would get re-directed to the spammers website in what was probably an iframe.

What should you do in a similar situation?

Calm down! It is unnerving to see your site being surrounded by malware and Google showing nasty links and text below your site URL, but the damage is done and you have to correct that. Worrying about it may make the matter worse.

How to identify the files that got hacked?

SSH to login to your website and find the last modified files by the timestamp. You can ask your webhost. In my case the hacker had inserted a base64_decode() in my wordpress header file. Though I was able to nail down the files which were hacked, just to be doubly sure I preferred to hire a professional malware removal agency Sucuri.net

Folks at Sucuri were super fast and removed the malware within half and hour of opening a ticket with them. They followed up with some general recommendations on how to prevent further attacks. The recommendations included changing FTP credentials, wordpress login credentials, database passwords, updating core wordpress, wordpress plugins and running a thorough virus scan on the personal machine. I did as advised by them.
To my surprise, within 2 hours the malware returned, this time affecting another file – index.php

This was more worrying since it seemed the intruder was targeting at will. While it is relatively easy to identify the files that get hacked, at times it is extremely difficult to identify how the intruder reached those files. Since I had already updated my wordpress installations and changed passwords, I nailed down three possibilities -

1. A vulnerable wordpress plugin that is not updated by the developer.
2. Vulnerable wordpress theme.
3. Open permissions (chmod 777) on my shared server.

First, I uninstalled all the plugins, removed all except the core tables from the wordpress database and then did a fresh reinstall of the plugins that were really required. Along with that, I also changed my theme framework from Woo Theme to the current Thesis theme (In the recent past, WooTheme framework had been targeted twice). There was an unused script in my account whose temp folder had open permissions, which I fixed.

Final Cleanup act

The excellent folks at Sucuri – a special thanks to David Dede – did the clean up once again and since then this site is pretty safe. Sucuri not only provides clean up services but they also provide a facility whereby your site is checked every 6 hrs for any major/core file changes. A premium wordpress plugin is included which helps in 1 click ‘hardening’ of wordpress installation, logging changes to your wordpress files and blocking bad bots from visiting your website. I have now upgraded my plan at Sucuri and secured all my sites. You can check more about Sucuri here

Over to you. Have you ever got hacked? How did you clean the mess? More importantly were you able to identify the source?

WordPress site hacked. Here is what I did to “un-hack” it is a post from ReviewOfWeb

Creating an email list has become a backbone for any internet based business today. You may hate the pop-ups that would flash on a website but the reality is that – and almost all webmasters would agree to it – opt-in pop ups are the fastest way to increase email subscribers.

WPSubscribers is one such promising pop-up opt-in plugin available in wordpress arena which is subject of our review today.

Installation and Activation

The plugin is available as a zip file which is around 8.5MB in size. You won’t be able to install the plugin via Upload feature present in your wordpress dashboard. You would need to upload the plugin manually to your plugins directory wp-content/plugins/via FTP. It took us around 10 mins to upload this plugin due to the size.

Once uploaded, you should install and activate the plugin. In case you have purchased unlimited license version you just need to enter the email and login id number in your wordpress dashboard but in case you have purchased a 3 website license version, you would need to additionally enter the URLs in your WPSubscribers Member’s Area.

After you activate the plugin, make sure to go to WPSubscribers under your wordpress dashboard, 1) enter your html opt-in code in the Code Detector and save the changes and 2) Go to Create Optin Forms and hit Save Changes. These are some important steps. If you just activate the plugin thinking that you may come later to add the opt-in code, you may find that your theme look-and-feel has gone for a toss!

Setting and Configuration

As soon as you activate the plugin, WPSubscribers settings widget can be seen in your wordpress dashboard. WPSuscribers provides a host of options when it comes to setting up an opt-in code or creating an opt-in form. I suggest you to go through the extensive tutorials on WP subscribers website.

Setup Opt-in Code

Under Setup Opt-in code –> Code Detector, you can put code from any of the email providers out there – be it Aweber, Feedburner email, Mailchimp etc. WPSubscribers will extract the form action URL, name, email and hidden fields for you, so that you need not squint your eyes digging the huge opt-in code provided by these email list providers. We added the email code that feedburner provides and within a jiffy this tool extracted the ‘form action URL’ and various ‘hidden fields’. You can add multiple opt-in codes and each opt-in code will have an id associated with it. The first opt-in will have an id of 0 and this will increase as you add more codes.

By default it provides name field and email field. You can however customize this to your liking and put additional fields to your opt-in form.

Create Opt-in Forms

Under this section, you can create different types of pop-ups or opt-in forms depending upon your requirement.

There are 3 types of opt-in pop-ups available -

1. Generic Opt-in Popup
2. Exit Popup: Those annoying Javascript pop-ups you see on some websites – one that won’t allow you to leave unless you take some action. A BIG no for me.
3. HTML Exit popup: Similar to Exit popup but it supports HTML, images and videos too.

If you don’t like pop-ups at all, you can create simple opt-in forms that can be placed on various parts of your blog. You can create 4 types of forms -

1. Post Opt-in form: Opt-in form that can be placed on top/bottom of your posts.
2. Footer Opt-in form: Opt-in form that can be placed on the footer of your blog.
3. Header Opt-in form: Opt-in form that can be placed on the top of your blog.
4. Custom Opt-in form: A custom opt-in form that can be placed anywhere depending upon your requirement.

For this demo, we will create an opt-in popup.

Under “Create Opt-in forms” as shown in the image above, go to Create Opt-in popup tab. Enable the Opt-in pop up by ticking the checkbox. Click on Create New Popup. On this step you can choose your pop-up design from 12 good looking templates. You can also choose the color of popup forms. There are 8 colors available.

If you’re still not satisfied you can select a Custom pop-up style where you can include your own images and videos. Full marks to WPSubscribers in this area.

Now hit ‘Save Changes’ to edit the template for your liking. We would like to see a couple of improvements here. There should be a method to change the height and width of templates without writing our own CSS. Also, we should be able to see the preview within the wordpress dashboard itself.

As they say Beauty is in the details, the team at WPSubscribers has left no stone un-turned to make your form look good. If you click on the image button shown above, you will get various setting to customize the image present in the opt-in form. You can even choose to put different images for ‘mouse over’ and ‘mouse out’ actions.

Hit ‘Save Changes’ and proceed to Configure Display location for the opt-in. Display location is completely customizable where you can choose to display/ not display the pop-up based on category/pages/archives/search pages.

If you have created multiple pop-ups and all are enabled, they will be rotated. Nice thought!

WPSubscribers may want to have radio buttons instead of check boxes here. it won’t make much sense (unless I am missing something!) if we check the boxes for both ‘display pop-up’ and ‘don’t display pop-up’.

They have also provided Opt-in Analytics where you can view number of times when the opt-in appeared and number of times when it was submitted.

Facebook Opt-in

Facebook has more than 800 million active users. It makes complete sense to integrate Facebook in your opt-in form. Check this tutorial to integrate Facebook. Among others, you have various settings to redirect a user to another URL after login or post a message to user’s wall.

Referral Opt-in

With referral opt-in you can provide incentives to your readers for referring their friends. It’s like an affiliate system built within a popup-form.

Other Opt-in forms

You can make your readers automatically opt-in using various forms present under this heading. An opt-in form can be placed below the comment box and can even be hidden-and-checked to force user to opt-in to your list.

You can also force your readers to opt-in by enabling opt-in on hidden content. The idea is simple. You would hide a piece of content from normal visitors and would instead have a piece of text like “Subscribe to view this content”. If they want to view that piece they should subscribe to your list.

Other Settings

This is important if you are going for pop-ups. Once you have set up your pop-up form, make sure to visit this section and customize pop-up timing to your liking. I personally I don’t like a pop-up as soon as I visit the site. I have configured ReviewOfWeb’s pop-up to appear at 5000ms (5th second after the page loads).

I am sure you have seen the demo on this blog when you visited this post. (In case you’re reading this article in an RSS feed/email make sure to visit the home page to see this plugin in action)

Final Thoughts

An excellent opt-in plugin with mindboggling options. I like the fact that author has put considerable thought and explored the needs of webmasters while designing this plugin. I am yet to see a plugin that will provide you such a vast variety of options and customizations, yet it remains easy for a new user. In case you don’t like the pop-ups, you can always use this plugin to place opt-in form on different places on your blog without annoying the reader.

As of writing this article the plugin costs $47 for 3 sites license and $97 for unlimited sites license. You can buy it here!

WPSubscribers – A wp plugin to create an email list on steroids is a post from ReviewOfWeb

A great service offered by the folks at ManageWP. You can manage all your sites, clone a site, take backups of your sites all under a single dashboard. Check our video review below.

If you have more than one wordpress blog, you’d love this is a post from ReviewOfWeb

As the name suggests, WordPress Review Plugins enables you to quickly and effortlessly put good looking reviews on your wordpress enabled websites. In this review we are going to compare two of the best wordpress review plugins providers out there wpReviewSite and wpReviewEngine. (ReviewOfWeb tried contacting MyReviewPlugin folks but the queries went unanswered, hence it is not included in the review]

As always, we will try to bring an unbiased opinion for the two products so that readers can take an informed decision before choosing to purchase a wordpress review plugin.

For the purpose of this review we have purchased two brand new domains Email AutoResponders Reviews and WordPress Membership Site Reviews. After a quick wordpress install, we installed wpReviewEngine on Email AutoResponders Reviews and wpReviewSite on WordPress Membership Site Reviews. Here is a detailed comparison and review for both these plugins

ReviewOfWeb’s View

Both plugins are just fine if you are looking for a basic review system in your wordpress enabled website.
However, we see wpReviewEngine folks have done a great job of including many helpful features to make reviewers life easy. Also, wpReviewEngine plugin has many more customization options available when compared to wpReviewSite. Given the good set of features, ease of customizations and nearly the same cost our vote goes to wpReviewEngine plugin

Over to readers, have you tried any of the plugins listed above? How would you rate them?

PS: Thanks Bob and Dan for agreeing to face the challenge.

WordPress Review Plugins: wpReviewSite vs wpReviewEngine + Discount Codes is a post from ReviewOfWeb

Accessing your WordPress-powered admin panel from your mobile phones may seem impossible — or at least hard to do — a couple of years ago, but with the help of native WordPress for iPhone apps managing and maintaining your site on-the-go will be as easy as it can possibly get.

IPhone users now enjoy the luxury of being able to maintain their blog on-the-go with the help of WordPress for iPhone. The latest version (2.1) allows you to create posts, upload photos, edit pages, and manage comments on your blog from your iPhone or iPod touch.

The user interface of WordPress for iPhone is extremely intuitive, allowing you to access features with a few simple touches. Uploading photos, even photo-blogging extensively, will not be a problem at all because the app integrates nicely to iPhone’s camera and multimedia features.

Categories and tags as well as old posts and media will be accessible as well; they are streamed to you as soon as you configure your app. Since the WordPress for iPhone works for both self-hosted WordPress platform as well as free WordPress.com blogs, so you will have no problem at all configuring the app to work with your site. It supports SSL-encrypted connection for streaming data, so you wouldn’t have to worry about security issues at all.

The WordPress for iPhone 2.1 is now available on iTunes. You can also install the app on your iPod Touch, so get your copy right away.

WordPress for iPhone: Maintain Your Blog On-the-Go is a post from ReviewOfWeb

Akismet is a proven way to prevent comment spam in wordpress powered blogs. It does a great job of sifting spam comments and redirecting them to the spam folder.

There is still a problem with this. Though spam get redirected to the appropriate folder but it unnecessarily clogs our MYSQL database. Moreover there is always a chance that among the hundreds of spam comments there is one good comment and unknowingly you might end up deleting that good comment as well, while cleaning up the folder.

I did some analysis on my spam comments (wordpress dashboard > comments > spam) and found that they mostly originate from 2-3 common IP’s. If I can get some way to automatically delete comments coming through those IP’s my problem would be partially solved(other spammers would still be there…grrr).

Here is a simple SQL script I wrote to do this:

DELETE FROM `wp_comments`
where `comment_author_IP` = ’66.159.18.9′ OR
`comment_author_IP` = ’84.19.188.218′;

Keep on adding the spammers IP’s that you see from your wordpress dashboard.

Now you can set up a  cron job that runs every night or every week or every fortnight (depending on your requrements). All your spam comments would get deleted automatically at a given interval.

Gozar!

A level above Akismet – Prevent comment spam in wordpress is a post from ReviewOfWeb

You have a lot of blog posts on your wordpress self hosted blog where you refer to a particular URL. Now somehow that URL got changed and you need to edit your posts. To change all those URL’s, one way is to go one by one, open and edit all your posts. Not a smart way.

Other way would be to use MySQL and batch edit them at a click of a button. No need to be a techie, anyone can do this.

This was useful for me when recently I made a move from blogger to wordpress. There were about 25 posts where I needed to change a particular URL. Here is how I did and you can do this in under 5 minutes.

1. Log on to PHPMyadmin. [Your webhost should have provided the URL to access it.] 
2. Select your database name from the drop down given on the left hand side.
3. In SQL tab type UPDATE wp_posts SET post_content = replace(post_content, ‘OLD CONTENT’, ‘NEW CONTENT‘); and hit GO.

The above SQL statement replaces all the occurrences of OLD_CONTENT with NEW_CONTENT inside the content(post_content) of all posts(wp_posts). Make sure that wp_posts is indeed the name of your posts table. On shared hosting the name of this table is different sometimes.

For techies: Here is the syntax of MySql Replace function REPLACE(str,from_str,to_str)

How to batch edit your posts in one shot? is a post from ReviewOfWeb

After a lot of dilly-dallying, finally I made up my mind to move from blogger to wordpress. With the introduction of “Import” feature in wordpress, the process has become quite simple but there are some points to take care of. Here is a step by step process how I made a shift, hope it would be useful for you too. In my case I had to move from blogger custom domain to wordpress. ie from xyz.com on blogger to xyz.com on wordpress. [This tutorial will be useful even for those who are moving from blogspot domain to your own domain on wordpress]

[We assume that you have wordpress installed on the domain you want to move to]

Change your Name Servers to point to the new webhost.

Go to your DNS settings page and point name server to your new host.
 
While registering, your webhost should have provided you with the name server info. If you are moving from custom domain name to wordpress with the same domain name, give ~ 24hrs of time for name server settings to propagate.   

Switch to blogspot.com

If you are moving from blogger custom domain (and same domain) to wordpress, read on. Otherwise skip this step.
You need to switch to blogspot.com otherwise you would not be able to complete next step.

Import all your blogger posts and comments with a click of a button.

Go to wordpress dashboard > Manage > Import. Click on blogger.

On the next page you need to key-in your blogger account details to let wordpress access your blogs. Click on Import button. Your blog posts and comments will now get imported to wordpress.

Redirection through .htaccess file.

This is one of the most important part. Proper redirection ensures that you don’t lose the old traffic and Google juice. We assume that permalinks custom structure that you would be using is /%postname%/ [btw this is one of the most SEO friendly structures] Create a .htaccess file on the new domain. 

1. If you are NOT in the habit of fiddling blogger post slug after publishing: The world would be nicer to you.
   Here is what you can do to ensure proper redirection.
   RedirectMatch permanent ^/[0-9]{4}/[0-9]{2}/([a-z0-9A-Z_-]+) http://xyz.com/$1 
   $1 in the end takes anything that comes out of ([a-z0-9A-Z_-]+) and append to your new blog URL.
2. If you are in the habit of fiddling post slug after publishing (like me): Get ready to do some techie stuff.
   If you tend to change the post slug in blogger after publishing, the above method would simply not work for you, as it didn’t work for me. Here is what I did that ensured 100% redirection. I used one to one mapping for the URL’s. I have tried to automate this process so that it would consume minimal time of yours.

   Download and install Notepad++
   Go to blogger dashboard. Posting > Edit Posts. View Source.
   Select All and copy paste everything in notepad++ window. 
   Find http://xyz\.blogspot\.com.*" and click find all. You will see the results in a window below. Copy paste from this window into a new one.
   Find (.*)(http://xyz\.blogspot\.com.*")(.*) replace with \2
   Find " and replace with blank [ie leave the replace field blank]
   Find .*#comments and replace with blank [ie leave the replace field blank]
   Find http://xyz\.blogspot\.com  and replace with RedirectMatch permanent ^
   Now Log into phpmyadmin of your new domain. Go to SQL tab and execute this query.

SELECT post_name
FROM wp_posts
WHERE post_status = "publish"
AND post_type = "post"

 
You will get all your posts slug. Copy paste them in notepad++ window and:
Find (.*) and replace with to http://www.xyz.com\1

Hereafter you need to manually place the URL in-front of the corresponding matching URL. I know this is kind of a boring stuff but this is closest to which I could reach and have tried to automate the process as much as I was able to.

Rest of the part should be no brainer.

Change the “Let Search Engines find your blog” under blogger settings to No.

Change the original feed address in feedburner to your new blog’s feed address.

Done. Enjoy!
While I moved from blogger to wordpress I took help from this post of blogbloke.com. I found there were some points that could be improved upon hence wrote a full post on it.

Moving from blogger to wordpress. How I did it and some pitfalls to avoid. is a post from ReviewOfWeb

An excusive and exhaustive list of hand picked tools for bloggers. The inclusion of articles and sites would be on an ongoing basis. You might want to bookmark this for future reference.

Create a Back Up of your blog

Blog Back Up Online: A great free resource. Works for blogspot as well as wordpress users.

Free Photos for your blog

Free Photos for blog from SXC One of the best source for royalty free photos.

Free photos for blog from istockphoto

High quality free photos from HP

Huge list of free photography sites

Free icons for your blog

Free Icons from UserInterfaceIcons

Website Icons

Web2.0 like free icons from FreeIconsWeb

Create a free logo for your blog

Logos from CoolText

Web2.0 Styler

Create those 125*125 ads free

Free 125 Banners

Image Editing

Picasa

To enlarge or shorten image use the ‘Stretch and Skew’ option present under ‘Image’ in our very own MS Paint (Windows user )

Track your website visitors in realtime

maps.amung.us

With maps.amung.us you get to see exactly where your site visitors are from – live! These maps update themselves on your site without having to reload the whole page

Check your website rankings on major search engines, the easy way

Google Position Checker Simply Enter a URL and get its current position on Google Search Engine.

Page RankChecker

Pagerank Checker Tool in over 700 datacenters You can check your blog’s PR across 700 datacenters. Handy tool during those freaking PR updation days.

How to check fake page Rank Check if the Google Page Rank for a particular site is fake. This can be especially useful for those who are into buying and selling domain names.

Site Statistics Tools

Sitemeter: Simple and nice interface. 

StatCounter: Similar to sitemeter but have an advantage that you need not show it’s icon on your blog which is mandatory in case of sitemeter.

Google Analytics: Best, but for geeky guys. Otherwise all the options might confuse you.

SEO for Firefox by Aaron Wall: Quickly check your Page Rank, Yahoo Links, edu links, Alexa, DMOZ status, BOTW and what not. Highly recommended.

Grammar Checking Tool: Good writing creates an lasting impression. Don’t let your bad grammar let you down. If you are not sure about grammar skills. Check these blogs.

Check for speeelling and grammar mistaked

40+ Tips to Improve your Grammar and Punctuation – Dumb Little Man

Find out who is hosting a website

whois.sc The best service of all. You can even drill down to find how many other websites are hosted by this person.

Who is Hosting This? Nice intuitive and easy to remember name, incase you forget the one given above. 

Find out how a website is made.

Web Technology Profiler Will tell you the technology used to create a site.

Test your websites in diferent browsers and mobile phone

Test your web design in different browsers – Browsershots Nice tool to check the layout of your blog in different browsers and their versions.

Check your site on mobile phone

Check your Robots.txt for errors

http://tool.motoricerca.info/robots-checker.phtml Excellent tool to check and validate your robots.txt file. Very Impressive.

Web Directories

DMOZ: Open Directory: Considered to be one of the best web directories. Only negative point is the moderators are very slow to respond. It can days weeks even months before your site gets included. 

Free Directory List:Contains exhaustive list of free web directories.

Free Websites Template

http://www.interspire.com/templates/

Determine your internet connection speed

http://www.computers4sure.com/speed3.asp?Sp=379.4

Download entire website on your computer

Webaroo Download entire website on your computer. 

Learn blogging.

Problogger A great source to learn about blogging

Daily Blog Tips Again nice blog on blogging. Daniel- the author is always ready to help you(even on IM’s)  

Yaro Starak Go over any ‘A’ lister’s blog, you will find them recommending his blog mentoring program. For sure, he must be doing something right.

LearnPHP

Learn PHP:PHP For the Absolute Beginner

How to install and learn PHP

For Blogspot Bloggers

Some useful tips to increase your traffic

Recent Comments Widget For Blogspot Users with Source Code

Web Hosting Coupons

Best Web Hosting Discount Coupons

Email Address To Image Converter

Convert your bots readable address to human readable address and avoid spam Must have for every blogger. You have to give give away your address some or the other time on your website. Finally do away with those (at) and (dot)

WordPress Add-In

125 x 125 advertising plugin for wordpress: Not so talked about. 125*125 banners are hot and the best plugin to cooly manage them.

Adsense

A nice list of adsense Alternatives If unfortunately you get kicked out of adsense or denied entry into it.

Should you find a tool/site worthy of being included above please mention in the comments below

You can add me here on StumbleUpon

43 Hand Picked Tools for Bloggers is a post from ReviewOfWeb

Here, I would like to  share my experience of finding and setting up my blog on my web hosting service provider.

1) Choosing the host:

Since the start of my blogging activities I have followed Digitalpoint Forums religiously, which in a way have immensely helped me in choosing my blog host. I found the reviews for dreamhost web hosting more or less good all over. With features like 500 GB of disk storage on sign up increasing by 2GB every week, 5TB monthly bandwidth increasing by 40 GB every week, one free domain, unlimited domains and subdomains (that can be hosted), very less outage time. It took me no time to choose this as my preferred choice of Web Host.I registered with dreamhost on 11/Dec/07, luckily that was the last day when they allowed $97 discount for the new members. Now the maximum discount offered by them is $50.

2) WordPress Installation:

Within half an hour of subscribing and making payments, I received emails detailing about email and FTP services. Then came wordpress installation part, dreamhost offers a very simple ‘one click installation’ for wordpress(along with other installation options like forums). This can be done either in the root folder eg: ReviewOfWeb.com or you can create a wordpress folder of your own for eg: ReviewOfWeb.com/wordpress. Unless you intend to put your blog itself at the subdomain level, I would suggest you to stick with root folder only and not a seperate wordpress folder ( because of some security issues that comes along with it)

3) Choosing theme:

WP provides a number of built-in themes( through the presentation tab) or through http://themes.wordpress.net/. Other than these, you can get zillions of themes for a google search on “wp themes”. I suggest if you are a newbie to blogging stick with themes provided by WP, they are tested for IE, Firefox layout and other possible problem areas.

4) FTP client or Web Ftp:

FTP stands for File transfer Protocol whereby you can transfer your files to the web host. There are step by step instructions in the mailer from dreamhost to accomplish this task. You have two options here, either download any FTP client or use the web option provided by dreamhost https://webftp.dreamhost.com/ . I prefer the latter just because its simplicity.
Thats it! You are all set to make your mark on web. Enjoy Blogging.

Note: You can use the promocode HIGHESTDISCOUNT1 to get the maximum possible discount of $50 on dreamhost.

4 easy steps to set up your self hosted wordpress blog is a post from ReviewOfWeb