WordPress Archives - Sysadmins of the North

A plea for WordPress plugin developers to stop supporting legacy PHP versions

Jan Reilink on 21 March 2018

“A plea for plugin developers to stop supporting legacy PHP versions” (hear! hear!), Jeff Chandler writes on WP Tavern. Iain Poulson has published a thoughtful request on the Delicious Brains blog asking WordPress plugin developers to stop supporting legacy PHP versions. He covers some of the benefits of developing with newer versions of PHP, what Delicious Brains is doing with its plugins, and using the Requires Minimum PHP Version header in readme.txt.

Fatal error: Uncaught Error: [] operator not supported for strings – PHP 7.1

Jan Reilink on 2 March 2018

With PHP 7.1, some PHP web applications fail because of deprecated code usage. This may result in an error message like [] operator not supported for strings for various Joomla! components. Here’s how to fix this code for PHP 7.1+.

Set WP_MEMORY_LIMIT value correctly in wp-config.php

Jan Reilink on 26 February 2018

WordPress developers: please stay away from WP_MEMORY_LIMIT and PHP memory_limit settings! We see this done wrong over and over in WordPress plugins and themes. One of such themes is the premium theme Jupiter by Artbees, or WPML as plugin. WordPress users: don’t touch these memory limitation settings either! They’re imposed for a reason. Here’s some explanation:

The need for speed: Google dedicates engineering team to accelerate development of WordPress ecosystem

Jan Reilink on 6 February 2018

Search Engine Land writes that Google’s partnership with WordPress aims to jump-start the platform’s support of the latest web technologies — particularly those involving performance & mobile experience. And they’re hiring WordPress experts.

How to: Protect WordPress from brute-force XML-RPC attacks

Jan Reilink on 2 June 2017

The WordPress XML-RPC API has been under attack for many years now. Back in August 2014, WordPress released version 3.9.2, fixing a possible denial of service issue in PHP’s XML processing. There are brute-force amplification attacks, reported by Sucuri, and so on. So, how do you protect WordPress from xmlrpc.php attacks, but still being able to use (some of) its functionality like Jetpack? This post gives you some insight.

Remove Jetpack email sharing service

Jan Reilink on 19 May 2017

Recently the WordPress Jetpack email sharing service is often abused by spammers. They use the Send to Email Address for sending spam. All these kind of “Tell a Friend” scripts are abused a lot. Here is how to disable email share service in WordPress Jetpack.

Quiet WordPress 4.7 RC2 available

Jan Reilink on 3 December 2016

Helen Hou-Sandi writes on Make WordPress Core that there is a quiet RC2 now available – it is a fair number of commits (50+), so please take a look through those and test as you can.

Clear PHP opcode caches before WordPress Updates: ease the updating process

Jan Reilink on 19 October 2016

In various hosting environments, WordPress core-, plugin- and theme updates sometimes fail because of enabled opcode caches. Popular PHP opcode caches are OPcache, WinCache and APC. This little WordPress Must Use Plugin tries to flush opcode caches. Making your live a bit easier when updating WordPress Core, Plugins and Themes.

Benchmarking WordPress, simple load & speed testing with ApacheBench

Jan Reilink on 9 October 2016

WordPress load testing with ApacheBench. ab is a small benchmark utility that comes with Apache. It’s a really simple HTTP load generating tool, ideal for a simple WordPress load & speed test. How fast does your WordPress site respond? How many HTTP requests per second can your server handle? These are questions on which ab can shed some light.

Measure WordPress loading time and queries

Jan Reilink on 9 October 2016

How to measure WordPress’ loading time and executed database queries? During an HTTP request, WordPress executes a lot of queries on your MySQL database. Not just the database queries take time, also loading and executing PHP takes time. How do you measure this?

Tips to speed up WordPress, serve gzip compressed static HTML files

Jan Reilink on 5 September 2016

Who said WordPress is slow on Windows Server IIS? Gzip compress and serve WP-Super-Cache or Cache Enabler static HTML files, to supercharge your WordPress blog. Here is how to serve gzip compressed HTML files through Windows Server IIS: create smaller, compressed, static HTML files, that are downloaded faster. This works with WP-Super-Cache and Cache Enabler on IIS!

WordPress advisory: Akal premium theme XSS vulnerability & abandonded

Jan Reilink on 22 August 2016

Over the course of one week I had the opportunity to audit two hacked WordPress websites. I could quickly discover two vulnerabilities: a Cross Site Scripting, or XSS, in a premium WordPress theme Akal, and a ~~SQL injection~~ Denial-of-Service in a later to be disclosed plugin. This post describes the Akal premium WordPress theme XSS vulnerability.

SSL in WordPress: how to move WordPress to HTTPS? The definitive guide

Jan Reilink on 15 July 2016

Having an SSL certificate in your WordPress is the de-facto standard nowadays, did you know that? Google ranks sites having HTTPS higher in their SERP. But in WordPress, how do you configure an SSL certificate and HTTPS URL? You’ll learn the important steps to move WordPress from http to https in this post.

17 Valuable WordPress snippets you never knew you couldn’t live without

Jan Reilink on 30 May 2016

17 valuable WordPress snippets for a site-specific plugin and functions.php that give you a better WordPress experience. Enhance your WordPress site with these small PHP snippets: WordPress filters, actions and functions. Quickly add or extend the functionality you need for your WordPress website! Read on…

Breaking into a WordPress site without knowing WordPress/PHP or InfoSec at all

Jan Reilink on 30 May 2016

Someone posted to notehub.org an article on how he broke into his college’s WordPress website, without having any prior knowledge of WordPress, PHP, and without any experience with hacking web servers. The attempts were spread out over a month, but effectively totaled a day maybe. The author said to have learned a lot of things while doing the research part which accounted for most of his time, though. On NoteHub, he shares some of the relevant details and how he went along doing this.