Here are few simple steps to fix timthumb security flaw:

Update: Use Timthumb Vulnerability Scanner plugin.

1. Deactivate unwanted plugins.

2. Delete all inactive plugins and themes. If you have customised any of these themes or plugins, do take a backup in your computer.

3. Go through your active themes and image related plugins and look for a file called thumb.php or timthumb.php . This can be usually found in the root folder of the theme or in folders like scripts, lib etc., If you are looking at the right file, you will see the name of Ben Gillbanks and a link to this project. Woothemes, Gorilla themes, Thesis, early versions of Elegant Themes are some of the theme shops that make use of this script.

Please make sure that the timthumb file is not a modified one provided by the theme or plugin provider. Now, replace this file with the updated and safe script here.

If the file has been modified by the theme or plugin author for additional functions, please follow these steps to update timthumb.

Note: Timthumb is vulnerable even if it is not present in an active theme or plugin. That is why I recommeded deleting inactive plugins and themes. It is easier than checking them one by one. Besides your active WordPress site, do you also have inactive WordPress installations in your server? Repeat these steps for them also. Some might have created a test installation or left a website long inactive and it is easier to forget these. If you have too many themes to check in these installations, it is better to uninstall the site totally  than fixing each theme. Please think twice before doing this and take backup if necessary. Once uninstalled, the data may be lost for ever.

If you need professional help auditing your WordPress blog for this security issue, we are offering this service for 79 USD per one WordPress installation. Please click the “Buy Now” button below to get the service. We will get back to you at once and fix the issue in one business day.

How to fix Timthumb security issue? from Ravidreams - WordPress Services

1. Right click on any page in the site and select “View page source”. You can also select “Page Source” in the view menu in the browser.

In the source page, search for terms like wp-content or wp-admin or wp-includes . Any site not having these words in the source is not powered by WordPress. Some might have changed the wp prefix for security reasons. But is a very rare case.

2. Check domainname.com/readme.html to see if it is powered by WordPress. You can also use this method to see the WordPress version installed. ( Tip by WPWebHost

3. Use BuiltWith Technology Profiler to find out all the technologies used in a website. They have Firefox and Chrome extensions too. ( Tip by Thamizinian )

4. Visit http://domain.com/wp-admin . If it navigates to login page of WP then it is a WP website. But this may not work, if they have changed the WP installation folder or changed the WP prefix. ( Tip by Mayooresan )

5. Right click on the images in the website and check the location. If it points to folders like wp-content/uploads, then its a WP site. Please be aware people may also source images from other websites and they may have their upload folders else where. ( Tip by Mayooresan )

6. Look in the footer for the words “Powered by WordPress”. But many webmasters tend to removed these credentials. ( Tip by Marijan )

7. And here is the last resort. Just ask the website owner

Is there any other easy way to check if a site is done in WordPress? Please let me know in comments. Thanks.

How to find if a site is powered by WordPress? from Ravidreams - WordPress Services

The most used custom WordPress permalink structure is http://example.com/postname/ .

The permalink structure I use is http://example.com/year/month/postname/ . This is good for performance. Also, gives an idea to the user when the post was written. They can also trim the URL like http://example.com/year/month/ or http://example.com/year/ and see archives for that period.

If you write posts daily or write many posts a day like in news websites, then http://example.com/year/month/day/postname is a good structure.

If you want your posts to be timeless, do not include date information and just include the unique post id.

If you like your posts to be aggregated by Google News, it requires to have a unique three digit number in URL. So it will be good to include the post id in the permalink.

Some people are over obsessed with having category name in URL for SEO. But I have seen this affecting blog structure / incompatibility with some plugins. Better to avoid using category names in URL.

Recommended Reading:

WordPress SEO URL / permalinks considerations by Yoast

Best WordPress Permalink structure from Ravidreams - WordPress Services

1. Create a beta site in WordPress. ( http://example.com/beta/ )

2. WordPress import will not work with FTP publishing on Blogger. So, switch FTP publishing to some Blogspot domain name for a moment. Don’t worry. Your blog will be safe as all the FTP files still remain on your server and your site will be accessible.

3. Import your Blogger comments and posts from the Blogspot domain to beta WordPress site.

4. Follow the steps in http://devilsworkshop.org/moving-from-blogger-to-wordpress-maintaining-permalinks-traffic-seo/ to preserve Blogger permalinks and therefore your PageRank.

5. Export the posts and comments from WordPress beta site.

6. Access your site through FTP and rename index.html to index-backup.html . You will have folders like 07, 08 , 09 etc., These are yearly folders containing the FTP published files. Rename all these yearly folders to 07-backup, 08-backup etc.,

7. Install WordPress in the directory where you published Blogger by FTP.

8. Import the WordPress XML file from beta site.

All Done. Have Fun

P. S . 1. If you have trouble accessing homepage after migration, check your .htaccess and remove any line regarding index.html

P.S. 2. Haloscan, a commenting service, is also shutting down. If you have your Haloscan comments tied to your FTP Blogger, follow the steps in

http://justinsomnia.org/2007/11/importing-haloscan-comments-into-wordpress-23-from-blogger/

FTP publishing on Blogger to WordPress: Migration guide from Ravidreams - WordPress Services

To solve this:

1. Login to your Hostgator control panel and contact Live Chat Support.
2. Ask the support technician to white list your thumbnail generation file for mod_security . You will need to give your file name and path.  The file name mostly will be timthumb.php . You can find this file inside the WordPress theme folder. An example file path wp-content/themes/theme_name/timthumb.php

This is a known issue with Hostgator’s WordPress hosting and all the technicians can recognise your request. This problem will be solved by them in minutes.

Before approaching them, make sure that all folders’ permission is set to 755 and files’ permission is set to 644. You may also be asked for the credit card / PayPal info to verify that you are the owner of the hosting account.

Related posts:

How to troubleshoot WordPress?

WordPress Tips

WordPress automatic Thumbnail issue with Hostgator from Ravidreams - WordPress Services

* Keep your WordPress installation and plugins up-to-date always and immediately. Many attackers try to take advantage of loopholes in outdated software. So, do not hesitate to upgrade WordPress fearing it would break custom made themes and plugins. Security should be the top priority. Use only trusted sources for WordPress themes and plugins. Please be aware that most of the pretty looking free WordPress themes may be having malware and free copies of premium themes downloaded from unauthorised places may ruin your website.

* Use a strong, unique and different password each for WordPress admin user name, WordPress MySQL database, FTP user account and the web hosting control panel user name.

These two steps are the most important WordPress security measures as recommended by Matt, the WordPress founder.

* Do not use the default admin user name called “admin”.  Delete it. Create more than one admin user name. Let their names not be the same universal user names you use everywhere.

* Use WP Security scan plugin and follow its directions. Especially, change the default wp_ prefix for the WordPress tables in the database.

* Backup your database, theme files, uploaded media regularly. So, if something goes wrong not everything is lost and you can restore from the backups.

* WordPress security whitepaper is a good read. Some of it’s recommendations are automatically done by WP Security scan plugin.

WordPress Security Tips from Ravidreams - WordPress Services

1. Upgrade WordPress software, current theme and plugins to their latest versions.

2. Use W3 Total Cache plugin. This will increase page speed for repeat visitors and non-bouncing visitors.

3. Deactivate and delete as many unnecessary plugins you can. Even the WordPress founder Matt uses only two plugins

I try to keep my plugins count below 10. With so many useful WordPress plugins, it is tempting to use them all. But they slow down your site. Especially, get rid of plugins which query your database. If you can implement a function by directly modifying the theme without using the plugin, then do it.

4. Use smaller sized images in  your posts. Use GIMP or PhotoShop and save the images as File->Save for web.

5. Reduce the number of images / scripts you call from external sites.

6. Reduce the number of Java Scripts called. Place them in the footer if you can. Don’t put them all in the header.

7. Make sure your web host is ok. Check the page loading speed of a non WordPress site and others’ WordPress sites running in the same server. Go for WordPress recommended web hosts.

8. Use a light theme. Try changing to the default theme. If speed increases, then the current theme is the culprit.

9. Check the plugins. Deactivate all the plugins and activate them one by one. Does something make your site slow? Catch it.

10. Reduce the number of posts shown in each page. Show excerpts instead of full posts in the archive, index pages.

11. Use FireBug. Enable support for Network monitoring under the “Net” tab. This will help you understand what actually is slowing down your site. You can also implement the suggestions given by Google Page speed. These may require the help of a good developer.

12. Use a content delivery network service like MaxCDN, Amazon CloudFront.

Not sure how to get rid of your slow loading website yet? Hire me for increasing your WordPress website’s speed !

Slow WordPress? from Ravidreams - WordPress Services

* Bulk delete spam comments
* Category feeds plugin for Feedburner
* How to fix if your stats plugin keeps showing zero visits?
* WordPress page specific header images
* To speed up WordPress, add the following to your wp-config.php:

// Enable the WordPress Object Cache:
define(ENABLE_CACHE, true);

WordPress Tips from Ravidreams - WordPress Services

0. Don’t Panic. So far as your WordPress database and wp-contents folder is fine, you are fine.

1. Switch to the default WordPress template and deactivate all plugins. If you are fine now, switch to another trouble free template or activate the plugins one by one to find out the culprit.

If you still have problem, it is possibly a WordPress problem. Then, there are few places to ask for WordPress help:

* WP support forum for How-To and Troubleshooting. Check other WP help forums too.
* Frequently asked questions for WP troubleshooting
* WP documentation for troubleshooting.
* Tweet your question with the hashtags #WordPress and #help

2. Ask your friends using WordPress for help.

3. Create a test installation of WP in another server and make sure it isn’t a hosting problem.

4. Try all new WP upgrades at the above test installation before you try with your regular blogs.

5. If nothing works, time to hire a WordPress consultant

Related posts:

WordPress Tips

Slow WordPress?

How to Troubleshoot WordPress? from Ravidreams - WordPress Services

Many of my friends have started moving to self-hosted WordPress websites. Most of them think that they need to install it manually. No need. Follow the steps below.

Installation

There are few automatic tools to enable one click easy installation of WP and many other popular software.

Fantastico Deluxe, Simple Scripts are some of the popular tools. Sometimes, your hosting company may have in-house autoinstallers like QuickInstall (Hostgator), Hosting connection (GoDaddy). All or either of these will be available in your hosting cPanel usually.

If you do not any such tools, then you may have to install manually. Download WordPress software, create a database and follow the official instructions on how  to install WordPress.

Location

If you are going to have nothing but a blog in your site, then install WP in your root directory. If you wish to have forums, guest books, content management software etc., then it is better that you install in a sub domain called blog. For example, blog.ravidreams.net . To do this, first go to Control Panel – > Sub domains and create the sub domain name blog and then proceed for the WP installation. Alternatively, you can install WordPress in a subdirectory called blog. For example, ravidreams.net/blog.

Naming

blog.ravidreams.net format URL is seen widely for blogs. Your next preference can be for the ravidreams.net/blog format. Do not install WordPress in a subdirectory / domain called WordPress and have it in the URL. You should do so only if your website is about WordPress. If your site is focused on a topic, then you can also name the site URL upon it. For example, if your website is full of articles about environment, then you can name as environment.ravidreams.net . Sometimes, people have websites in both English and Tamil. If you want to specify the language of the website in the URL, then do so only for the secondary language website. For example, if your whole site is in English, then it is meaningless to name your site as english.englishsite.com . It is also desirable that you specify the language and also the nature of the site explicitly by having a URL like en.blog.orkut.com . The format tamil.something.com or something.com/tamil is mostly used for portals only and you may avoid using formats. If your site is in multiple languages like French, English, Tamil etc., then it is advisable that you follow the international language codes like en.something.com, fr.something.com, ta.something.com rather than naming them as Tamil.something.com . The two letter codes clearly indicate the language version while the full letter version like Tamil.something.com can also be a site in English writing about Tamil.

Uploading

Do not use the file manager in control panel to upload files. Use Filezilla

Editing themes, plugins from dashboard

You can edit the themes, plugins using the theme editor, plugin editor in the WordPress dashboard. If you do not have this editing option then you have to change the file attributes for the themes and plugins folder. Access these folders in Filezilla. Right click on them and choose File Attributes. Provide a numeric value of 755 and choose to apply these changes for all subdirectories and files under these folders. Now you can edit your themes, plugins from your WordPress dashboard.

Backup

Do remember to backup every once in a while depending upon the frequency of changes you make in your website. You never know when you will screw up the installation. It happens almost for everyone. You can use the backup manager in control panel. Also, remember to store a copy of your themes, plugins, uploads folder in your local disk. And backup your WP database by exporting the MySQL database tables every now and then. This table and the uploads folder are the most important ones to backup. Always back up the database and wp-content folder before uninstalling. WP-DB-Backup plugin is best for backing up databases. You can download the wp-content files through FTP. Even if you do not want the blog, it is better to have a copy of the database. Sometimes, you might have hosted more than one blog in one database and if you forgetfully delete the database, all will be gone.

Uninstallation

Control Panel -> Fantastico deluxe -> WordPress -> existing installations -> remove.

No need to remove manually. Sometimes, uninstall / reinstall is lot more easier than bug fixing or making up the mistake done.  If you have backed up everything, then don’t hesitate to uninstall.

Related posts:

Moving FTP Blogger to WordPress

Blogger to WordPress converts – common questions

WordPress.com Vs WordPress.org

How to install WordPress? from Ravidreams - WordPress Services