I’ll be covering three things:

1. Why security is important (surprisingly, at WordPress meets, people seem more interested in hearing about plugins than securing their sites–this is why hackers don’t feel bad about ruining their digital lives)
2. Simple things your grandpa can do to lock down his WordPress install
3. DIY WordPress security, for more advanced users who aren’t afraid of a little FTP, htaccess files and tweaking their databases.

Come, join me, and we shall make the Internet a safer, less hackable space!

Custom post types vs. Custom post formats

My WordPress menu for managing comics

What is the difference between a custom post format and a custom post type? Actually, it’s a semantic nightmare. “Custom post types” actually should be called “custom content types” or “custom page types” because they aren’t “posts” per se. They behave more like pages, i.e. they don’t have RSS feeds (without tweakery), they don’t organize like blog posts, etc. “Custom post formats” is more like a distinction granted to your posts. They show in your RSS feed, in your blog archives. It’s a less messy, more intrinsic sort of categorization system. For instance, you could have post formats for “quotes” or “asides”.

Currently I’m using custom post types to organize and upload comics. This means that you manage comics through a “comics” menu the same way you manage posts in WordPress. They are separate, distinct entities on the backend.

But, what if it makes more sense to have comics as a post format? That means when you want to post a comic, you’d do it like you were posting a new blog post, just adding the distinction that this post is a comic. The comic post would then appear in your main RSS feed, lumped in with any other blog posts you might be making. Personally, I want to keep my blog posts and my comics feeds separate from each other, but maybe that’s me?

To settle the matter, I sketched out what the information architecture for both these options would look like.

Comics, blog posts and gallery posts structured with custom post formats

Unorganized WordPress Web Comic theme Information Architecture

This is obviously way too unorganized for me. Look at that long tail of sequentially uploaded content. If you tried to read from one end of it to the other, you’d be interrupted all along the way by unrelated content. Gallery post, blog post, comic post, blog post, ad infinitum. Maybe there will be some nifty way to separate those formats into distinct flow-paths, but this is a new feature in WordPress, which means that it will be six months before I can really do any backflips with it. (I had a helluva time just getting get_terms to paginate!)

Comics, blog posts and gallery posts structured with custom post types

(My) organized WordPress Web Comic theme Information Architecture using custom post types

This is an m-shaped information space. Look at how the blog, the gallery and the comics are separate, each with their own RSS feed, their own archives, and separate “flows”. There’s no way for any of the flows to cross paths. There is no archive page where your art, comics and blog posts are vomited up on the page in chronological order, much to the horror and confusion of a would-be reader.

Why does this matter?

Search Engines

When your site is getting crawled, spiders like to “feel” an underlying structure. “Ahh, this is an archive page for a comics series. Oh, here’s the blog. Yes, I see.” A T-shaped or long-tail content structure doesn’t help search engines form these distinctions.

Data Manipulation

It’s also easier to manipulate separate content types. You can give a custom content type its own RSS, its own archive page, its own search. If you used a custom post format, you’d have to find a way to separate its RSS, its archives, its search from the others. I find subtractive coding way harder than additive, so I personally prefer to build up rather than tear down.

Usability

I also think that the special comics menu item (shown earlier in this post) will make adding and managing comics easier for users.

Conclusion

In the future, I may eat my own words and custom post formats may turn out to be the more robust, intuitive solution. But right now its too new and too troublesome to restructure. I will be using custom post types for the new theme, believe it.

1. Akismet It comes with WordPress and protects you from a lot of spam. An obvious choice, but I thought I would put it here in case anyone new to WP was wondering if they should activate it or not (answer: YES).
2. AskApache Password Protect Helps improve security and pairs nicely with WP Security Scan (which we shall get to below). Edit: I ran into problems with this plugin and permalinks, which ended up causing my entire admin area to generate 404 errors. Be warned!
3. WordPress Automatic Upgrade Upgrading WordPress is a bit of a pain, to put it mildly, but this plugin takes some of the oof out of Upgrade Day by automating most of your work for you.
4. Chunk Urls for WordPress You know when someone posts a long URL in the comments and it breaks your blogs nice design and plain looks ghastly? This stops that. At last. Thank goodness.
5. WordPress Database Backup WP-DBManager Just in case something breaks, it’s always good to keep a backup of your database on hand. With WordPress, all your content, your entries, settings, etc, is kept in a database. Your site’s template or “theme” and administration files are about the only things that are kept on the server as live files. So backing up your files isn’t good enough to restore an entire site . But this handy plugin can be set to email you a copy of you database every night or every week, depending on your preference. Nice insurance against losing everything your wrote last week because you were twiddling with a new set of plugins. Note: I had trouble getting WP Database Backup to work, but WP-DBManager does backups and optimizes your database and lets you run database queries from the comfort of your administration area. Why settle for several slipshod plugins when you can use just one that works?
6. WP Security Scan After you’ve installed WordPress, there are many things you can do to improve your blog’s security, but you might not know what they are. This little fellow is like having someone hold your hand through the securing process. It will tell you what files need changing and where to find them. Perfect for anyone new to WordPress. There’s even a password tool!
7. WP Super Cache WordPress likes to bog down, but caching can help reduce server load and speed page displays. WP Super Cache is pure gold in that case.
8. FeedBurner FeedSmith I partly considered this a “buzz” plugin, but seriously, WordPress comes with so much lovely RSS support, you might as well make full use of it.
9. RSS Feed Signature Adding a little “this article by so-and-so, for more visit such-and-such.com” at the end of your RSS feed is not only a nice touch, but also helps exercise your copyrights by applying credit where it is due.
10. Lighter Menus This plugin only effects the admin end of things. It helps reduce the number of clicks it takes you to get to where you need to go simply by displaying all the administration submenus in easy to reach drop-down menus. No more clicking around in circles trying to find where the settings for some obscure plugin scampered off to!
11. Maintenance Mode I had to use this quite a bit when setting up this site. It provides a lovely privacy screen that only admins can see behind, politely telling everyone that your blog is down for maintenance and that you shall return at a set time. The page displayed is completely customizable, as well, and you can easily turn it on and off for quick touch ups and testing new plugins.
12. Redirection It lets you redirect pages Great if you like to move things around later, and if you know what you’re doing, it comes in handy for SEO tweaking (like redirecting index.html to index.php–a trick I learned about in this handy article regarding WordPress search engine optimization).
13. Search Excerpt An older plugin that still works remarkably well. It highlights the terms users searched for in their search results. I found out about this and the following plugin from Yoast’s excellent article on improving WordPress’s search results.
14. Search Suggest Are you sure you were searching for wrdpress? Would you like to try searching for WordPress? That’s what this plugin does. Fantastic.
15. TinyMCE Advanced I know how to code my entries by hand. I technically don’t need more options on my toolbar when writing a post. I’m a big girl. But then again, why type all that in HTML view when there are buttons that will do the work for you? TinyMCE Advanced gives you many more option when writing a post.

Do you have any plugins that you recommend for a basic install?