What Would You Do If Somehow You Lost all Your Blog’s Content?

I hope this doesn’t happen to anyone else but this morning  my blog Tips and Tricks HQ somehow disappeared from the face of this earth! The day started as usual… I woke up in the morning went to my office and started checking my emails and found out that I received an email from  SiteUpTime (SiteUptime is a website monitoring service that checks your website at regular intervals and notifies you via email or SMS if it becomes unavailable) telling me that my site is down.

So naturally I wanted to check if the site is up now. When I entered the site address in the address bar I got the following screen!

WordPress Blog Setup Screen

You can probably imagine that at this point I was pretty scared! I always backup my database and WordPress files regularly so I wasn’t completely in the water but what about all the articles that I have posted after the last backup? Not to mention the traffic that I am loosing now!

Anyway, in my case the damage wasn’t that severe. One of my WordPress database tables ‘wp_options’ was marked as crashed and I was getting the following error that I recovered from the ‘error_log’.

[25-Feb-2009 21:03:32] WordPress database error Table ‘wp_options’ is marked as crashed and should be repaired

I opened a ticked with my web hosting company to address this issue.

Contingency Plan to Recover My Blog Content

After opening the ticket, I started preparing myself for the worst case scenario. So in my mind I was going over the contingency plan to recover my blog content. This is what I planned:

• Restore the Database with the last db backup file.
• FTP all the WordPress files (last backed up) to the server.
• Use Google cache to recover the last few articles that I posted after the last DB backup.

If you didn’t know already… Google, Yahoo, MSN search sites cache the content of each page of your site. So you can recover your blog’s content from the search site’s cache. Google is likely to have the most recent content of a blog already indexed and cached. So I checked out Google to see if it has cached my ‘WordPress PayPal Shopping Cart Plugin’ post which I posted after the last database backup. I was a little happy to find out that Google had my post cached.

Recovering Blog Content from Google Cache

Yahoo also had the post cached:

Recovering Blog Content from Yahoo Cache

Luckily, as I mentioned earlier that my case wasn’t that severe,  my web hosting company repaired the database using the cPanel – Databases – Repair DB function.

How to Restore Your Blog’s Content (Disaster Recovery)

There are quite a few methods to recover a blog’s content in case of a disaster.

Option 1: Using PhpMyAdmin

Use PhpMyAdmin to backup the WordPress database regularly and restore it when you need.

• How to backup your WordPress database using phpMyAdmin
• How to restore your WordPress database using phpMyAdmin

Option 2: Use the Export and Import  Tools in WordPress 2.7 and above

In order to export all your blog’s posts, pages, comments, categories etc in an XML file do the following:

• Go to “Tools” -> “Export”
• Click on “Download export file”.

The resulting XML file contains your posts, pages, comments, custom fields, categories, and tags.

To restore your blog’s content:

• Go to “Tools” -> “Import”
• Choose “WordPress” from the list
• Browse for the previously saved XML file and hit “Upload file and import”

This will import the content.

Option 3: Use the Cache from the Search Sites

If you have never done any backup of your blog and woke up one morning to find out that your blog has been wiped out from the face of this earth then this option is probably your best bet. Search with the option “Site:your-domain-name.com” in the Google search to get all the indexed pages from your blog to show up in Google search result:

Restoring Blog content from Google Cache

Now you can go through each cached page and copy the content over. This manual approach however is not very realistic for any blog with a lot of posts. I would recommend using a script to automate this process.

• How to restore a site’s content from Google’s cache using a Python script
• How to restore your WordPress database from Google Cache through Ruby

Hope this helps some of you sleep better at night knowing that your blog content is recoverable  Please feel free to leave any suggestion in the comment area below.

Essential WordPress Security Tips – Is Your Blog Protected?

I have been revisiting the various security settings of my WordPress blog after the sudden database table corruption of this blog for unknownreason last week. In this post I have highlighted some of the security tips that can help protect your blog from possible outside attacks.

A lot of the security tips covered in this article is offered as a feature in ourWordPress Security Plugin

Also, checkout the following two WordPress security articles that we published:

• Secure Your WordPress Site Against Brute Force Attacks
• Advanced WordPress security tips

Use Strong Passwords for all Entry Points

I was surprised to find out how many of my friends use the WordPress admin password generated by WordPress during install time and thinks that their blog is protected from attacks as they are using a strong password! The WordPress admin password generated during install time is normally pretty strong (consists lowercase and uppercase letters with numbers and symbols) so there is nothing wrong with that. I was mainly shocked to find out that their ftp/cPanel password for that domain is not that strong. It gets even better… one of them were using his partners name as the password (Did I mention that his partner’s name was mentioned on his blog’s ‘About’ page?)! The ftp/cPanel password for your domain is equally important. If someone can access your cPanel then that person can delete your WordPress database from the cPanel->Databases->MySQL Databases. Anyway, the bottom line is to use strong passwords for all entry points not just one.

Protect the ‘wp-admin’ Directory

Use a .htaccess file in the ‘wp-admin’ directory to limit access to only certain IP addresses (your home, work etc). The WordPress htaccess tips post has more htaccess related tips and tricks. Below is an example .htaccess file that can be used for this purpose (replace ‘x’ and ‘y’ with your IP address)

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName “Access Control”
AuthType Basic
order deny,allow
deny from all
# whitelist home IP address
allow from xxx.xxx.xxx.xxx
# whitelist work IP address
allow from yy.yyy.yyy.yyy

If you don’t have static IP addresses then the above method can be a bit hard to implement. In that case you could the use of AskApache Password Protect WordPress plugin. The ‘AskApache Password Protect’ plugin adds good password protection to your WordPress Blog. Use the Login Lockdown feature of the all in one WP Security Plugin to protect your blog against brute force attack (a brute force attack is a method of defeating a cryptographic scheme by systematically trying a large number of possibilities)

Deny access to your Plugins and other directories

A lot of bloggers don’t protect access to their WordPress plugins directory. What I mean by this is that if you go to the www.your-domain.com/wp-content/plugins/ from a browser it shows all the plugins that you are using. Many wordpress plugins can have vulnerabilities which the attacker can use to harm your blog. So, its a good idea to block access to these directories. You can use a .htaccess file or just upload a blank ‘index.html’ file to that directory to block access to these directories. (download a blankindex.html)

Update WordPress to the Latest Release

As new WrodPress versions are released the security bugs for previous release becomes public information. WordPress could have vulnerabilities as a result of how the program is written that allow an attacker to pass HTTP arguments, bad URI strings, form input, etc, that could cause Bad Things to happen. So always upate your WordPress to the latest version to make sure that you are protected against any known security bugs.

Don’t Show WordPress Version on Your Blog

You should not make the WordPress version that you are using visible to others for the same reason explained above. The specific WordPress version that you are using can give the attacker an upper hand in finding a way to break in.

Backup Your Data

I can’t stress this enough… always keep backups of all the important files. I always backup my WordPress Database and WordPress files in case of emergency. Read my what would you do if you lost all your blog’s content article to find out how backups can help you sleep better at night 

Be careful when you upload something to your site

When you upload a script (example: a plugin, a theme or just a normal script) to your site you need to be extra careful as it can harm your site if it was designed to do so. Only upload authentic content to your site. Neverdownload a plugin or a theme from a warez or torrent or file sharing sites. The content on these sites can be disguised as a plugin or a theme but it will harm your site when uploaded to your server. You can read more on these types of attack from the free premium plugin and theme downloaders beware article.

Advanced WordPress Security Tips

This is a follow-up from the Essential WordPress Security Tips article.

In general WordPress is pretty secure as long as you apply common sense and follow standard security practices. The tips mentioned in this article are for added security (you don’t need to apply them all).

However, if you are in the mood for some advanced tweaking then the following security tips should come in handy 

NOTE and DISCLAIMER

Most of these techniques require you to understand what you are doing.

It is strongly recommended that you first test these techniques on a test or development site before applying them to your live site. Doing some of the tips suggested here can break your site if not performed correctly.

We take no responsibility for any mishaps as a result of your efforts in applying the techniques discussed in this article.

Also note that these techniques assume that your WordPress installation is running Apache and you have mod_alias and mod_rewrite installed.

1. Disable HTTP Trace Method

There is a security attack technique called Cross Site Tracing (XST) which can be used together with another attack mechanism called Cross Site Scripting (XSS) which exploits systems which have HTTP TRACE functionality. HTTP TRACE is a default functional feature on most webservers and is used for things like debugging. Hackers who use XST will usually steal cookie and other sensitive server information via header requests.

You can disable the trace functionality either via your Apache configuration file or by putting the following in your .htaccess file:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

2. Remove header outputs from your WordPress installation

WordPress can often add quite a lot of output in your header pertaining to various services. The following code shows how you can remove a lot of this output.

Warning: This can break some functionality if you are not careful. Eg, if you’re using RSS feeds then you may want to comment that line out.

Add the following code to your theme’s functions.php file:

remove_action('wp_head', 'index_rel_link');
remove_action('wp_head', 'feed_links', 2);
remove_action('wp_head', 'feed_links_extra', 3);
remove_action('wp_head', 'rsd_link');
remove_action('wp_head', 'wlwmanifest_link');
remove_action('wp_head', 'parent_post_rel_link', 10, 0);
remove_action('wp_head', 'start_post_rel_link', 10, 0);
remove_action('wp_head', 'adjacent_posts_rel_link_wp_head', 10, 0);
remove_action('wp_head', 'wp_generator');
remove_action('wp_head', 'wp_shortlink_wp_head', 10, 0);
remove_action('wp_head', 'noindex', 1);

3. Deny comment posting via proxy server

You can reduce spam and general proxy requests by attempting to prevent comments which are posted via a proxy server. Use the code below (compliments of perishablepress.com) in your .htaccess file:

RewriteCond %{REQUEST_METHOD} =POST
RewriteCond %{HTTP:VIA}%{HTTP:FORWARDED}%{HTTP:USERAGENT_VIA}%{HTTP:X_FORWARDED_FOR}%{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION}%{HTTP:HTTP_PC_REMOTE_ADDR}%{HTTP:HTTP_CLIENT_IP} !^$
RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]
RewriteRule .* - [F,NS,L]

4. Change your default WordPress DB prefix

You may already be aware that WP uses a default prefix value of “wp_” for the DB tables. This can in turn be used by malicious bots and hackers to guess your DB table names.

In general, changing your WP DB prefix value is much easier to do at installation time because you can set it in your wp-config.php file.

Conversely if you already have a live WP site and you wish to change your DB prefix, then the procedure is a little more complicated.

A basic guide for changing the DB prefix after an install for those who are curious is briefly outlined below:

1) Do a full DB backup and save the backup somewhere offboard. Using something like BackupBuddy can useful.
2) Do a complete dump of your WP DB using PHPMyAdmin into a text file and save 2 copies – one for editing and the other as an original just in case.
3) Using a good code editor, replace all instances of “wp_” with your own prefix.
4) From your WP admin panel, deactivate all plugins
5) Using PHPMyAdmin, drop your old DB and import your new one using the file you edited in step 3.
6) Edit your wp-config.php file with the new DB prefix value.
7) Re-activate your WP plugins
8) Perform another save on your permalink settings by going to Settings->Permalinks in order to refresh your permalink structure.

Caution:

Sometimes plugins add their own prefix after the wordpress prefix where both are identical.

example, you might have a table name from a certain plugin has a name like the following: wp_wp_abc_table_name.

Be sure when replacing the “wp_” instances in step 2 above that you only replace the first “wp_” prefix and not the one following it.
For instance if we take the example we just mentioned we would replace the first prefix with our new prefix which for this example might be called “trx_”.

The new name would look like:

trx_wp_abc_tablename

Note that there are also WP plugins out there which can achieve the above steps for those who are not prepared to get their hands dirty.

5. Deny Potentially Dangerous Query Strings

You can put the following code in your .htacces file to help prevent XSS attacks.

BEWARE: Functionality of some plugins or themes could break if you are not careful to exclude strings which are used by them.

# QUERY STRING EXPLOITS
<IfModule mod_rewrite.c>
RewriteCond %{QUERY_STRING} ../   [NC,OR]
RewriteCond %{QUERY_STRING} boot.ini [NC,OR]
RewriteCond %{QUERY_STRING} tag= [NC,OR]
RewriteCond %{QUERY_STRING} ftp: [NC,OR]
RewriteCond %{QUERY_STRING} http: [NC,OR]
RewriteCond %{QUERY_STRING} https:   [NC,OR]
RewriteCond %{QUERY_STRING} mosConfig [NC,OR]
RewriteCond %{QUERY_STRING} ^.*([|]|(|)|<|>|'|"|;|?|*).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%22|%27|%3C|%3E|%5C|%7B|%7C).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127.0).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|config|localhost|loopback).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).* [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>

6. Apply PHP hardening to your system

You can install and enable Suhosin which is a PHP hardening system on your server. This can further increase the security of your system by protecting against various vulnerabilities.

Suhosin typically installs on most PHP installations and is sometimes included by webhosting companies by default. (Check with your hosting provider)

If you can read more about Suhosin here.