Need a new web host or having a problem with a script? Tips and advice on the best way to design, build and maintain your most valuable asset - your website!

WordPress core vulnerability detected!
nigeljones123
Posts: 24
Joined: 28 Aug 12
Trust:
08 Sep 12 5:19 pm

WordPress core vulnerability detected!

I learned that a serious vulnerability has been found in WordPress. It is VERY important to update as soon as possible. WordPress released a new version 3.4.2 that includes the essential security fixes and has also addressed some functionality bugs.

If you don't update to 3.4.2 you are leaving yourself open to hackers who could distribute traffic stealing malware. Anybody who uses WordPress just needs to login to their /wp-admin/ dashboard and there is a link at the top to update to version 3.4.2 but please make sure you follow the upgrade guideline and make a full backup before proceeding.

If you don't already have a good and easy backup procedure, there is a really great free plugin for WP called Online Backup for WordPress.

I just spent the past week learning and building my first website http://www.photography-internships.com/
I was so busy learning that I totally forgot about doing backups. Crazy really! If I had a big problem or even lost the whole thing I would be devastated.

Full backup done and updated to 3.4.2 :)
  • 0
PremiumMember
kieran
Posts: 75
Joined: 11 Apr 09
Trust:
25 Sep 12 10:22 am

 Another good plugin is WordPress Database Backup, which is what I use.
  • 1
Kieran

www.moneymakingbuzz.com - the Key to Online Wealth
www.buildthingsdirect.com - the Top Site for Home Improvement Projects
 
PremiumMember
jimcoe
Posts: 259
Joined: 13 Feb 12
Trust:
25 Sep 12 4:01 pm

 Actually, you should search the WordPress.org "Codex" (manual) for "backup" and study that.

As it details, there is a lot more to a complete WordPress backup than just using any plugin. And without a complete backup process, you'll have trouble restoring your blog, or moving it to a new host, after a disaster.

If anything is worse than not making backups, it's the false sense of security while making useless or partial backups.

Hope this helps...

_jim coe
  • 1
PremiumMember
kieran
Posts: 75
Joined: 11 Apr 09
Trust:
26 Sep 12 1:27 pm

 Jim, I agree with you that it is easy to have a false sense of security about backing up. I took your advice about re-reading the Codex because it has been probably more than a year since my last visit (it is not exactly on my best-seller list!). As a result I decided to do an FTP backup of all my files to my computer. Again, it has been too long since I did that last. It is chuntering away as I write this!

I am using a plugin recommended by WP but do, from time to time, also do a manual backup as also recommended by WP. But there is always that little bit of nervousness that I might have overlooked something.

For anyone else reading this, I strongly recommend that you read the Codex as Jim says. It is easy to understand and gives you a good feeling about how to restore your files if ever you lose everything. I came close to this recently, and I can assure you that it is not a good feeling when you see that dreaded 'unable to access' message on the screen. Luckily, in my case, my server (Hostgator) was able to sort things out.

Sorry if this sounds like a rant, but Jim's comment spurred me into action! If it helps anybody avoid losing their precious hard work then it will have been worth it.

Kieran
  • 0
Kieran

www.moneymakingbuzz.com - the Key to Online Wealth
www.buildthingsdirect.com - the Top Site for Home Improvement Projects
 
PremiumMember
jimcoe
Posts: 259
Joined: 13 Feb 12
Trust:
26 Sep 12 4:33 pm

 Thanks for your support Kieran!

Because I'm a professional website/blog developer, I have to be sure my client's (and my own) sites are fully protected. And because of the number of sites I maintain, and the way hosting service quality can drop when a good hosting service is bought out by an inferior company, I've had blogs fail due to hosting service errors from that very cause. When that happened, I was absolutely dependent on reliable backups to move the failed blogs to a new hosting service and restore them.

So I've been there and done that. I succeeded in diverting a catastrophe only because I had previously read and followed the WordPress.org Codex on how to backup and restore a WordPress installation. Also, I had fairly recent complete backup (made once-per-month). And I lucked out because the blogs authors hadn't added much (or none in some cases) content recently.

After a successful backup and restore, you might still have to do one thing - edit your "wp-config.php" file, in case you've moved your blog or your WordPress installation can't access your database for some other reason. Your wp-config.php file contains the name, location, password and other info about the database which runs your blog.

As Kieran discovered, most good hosting service support people can do this (or other diagnostics and adjustments) for you. And they also probably have their own nightly backup of your blog which they can restore, if you contact them quickly, before it gets overwritten by a new backup of your failed installation.

But beware, because many web hosts might tell you that they support only their own software and servers and not 3rd party products, like WordPress. And they are probably legally correct (read their Terms Of Service).

Hosting services don't have to help you with WordPress problems. So you really want a hosting service that goes beyond the usual support requirements. Hostgator is one. My favorite hosting service, BlueHost is another. With many hosting services, "you're on your own" with 3rd party software. You might want to check out your own hosting service's TOS as part of your next backup.

So really, for complete security you have few options:
1. You can depend on your hosting service - to at least have a nightly backup, from which they are willing to restore your blog (check their TOS - their backups may be strictly for their own use, not to restore their customer's sites)

2. Or, you can learn enough technical skill to follow the WordPress Codex instructions for making and restoring complete backups and perhaps repairing the restored backup using the Codex instructions for doing a manual WordPress installation or repair. And the WordPress forum's user-to-user support can help. Remember, WordPress is an Open Source project done by volunteers - so there is no official technical support staff.

I don't mean to scare anyone with all this geeky detail. I'm afraid it's just another example of how affiliate marketing is not so simple as some people would like to think - if you want to do it in a professional, business like way, rather than in a risk-prone way.

Hope this helps...
_jim coe
  • 0

This topic was started on Sep 08, 2012 and has been closed due to inactivity. If you want to discuss this topic further, please create a new forum topic.

Topic locked