“Pinning” is a new sharing trend which has quickly become popular among online users. Apart from tweeting, sharing, digging or stumbling, pinning has gone more viral and statistics shows that Pinterest – the social platform for pinning images on an online board drives more referral traffic than Google Plus, LinkedIn, StumbleUpon and other social sharing sites except Facebook and Twitter.

If you have a website or a blog that uses WordPress as its content management system, here are a few Pinterest plugins for WordPress which you might want to use. Some of these plugins are paid but it is worth investing the money and create a lasting presence on a new and evolving platform.

Pinterest Marklet – Let Visitors Pin Images From Your Site

The Pinterest marklet plugin for WordPress lets you quickly add a “Pin it” button on your WordPress site, using which visitors can pin images, YouTube and Vimeo videos to their Pinterest account. The best part about this plugin is that you can make the Pinterest button sticky to any corner of your webpage, so the button will stick in one corner even if your readers scroll down the page. Moreover, the plugin allows you to add on-click support so you can turn any element of your page into a marklet.

The plugin supports placement through widgets, so you won’t have to touch any code or tweak your theme if its widget enabled. You can also create custom buttons and customize the “Pin it” button using different sizes and color schemes.

The plugin is priced at $4 but it is certainly better to have more control over your customization, rather than using a free plugin which provides less options and no support.

Pinterest Pin It Button – Free WordPress Plugin

If you are looking for a free and hassle free way to include Pinterest social sharing on your blog, try the Pinterest Pin it button for WordPress. Unlike other premium plugin, this one is absolutely free to use and you can even choose to show the “Pin count” or choose between a horizontal or vertical layout for the button.

This plugin is ideally suited for blogs which have mixed content of all types and you want to show the Pinterest button only on specific posts that contain an image. Additionally, there is a sleek option to let the user select an image on a pop-up window, so this will come handy if your page has an array of images and you want the user to select the image he wants to pin (rather than pre-selecting the image for the user without asking).

Pinterest Pinboard Widget For WordPress

Are you a very active “Pinner” and want to showcase all or specific pins on your website? Do you have different pinboards and you want a simple way to pull your pinboards and drop them on your website? If Yes, this is the plugin you can’t afford to miss.

The Pinterest pinboard widget for WordPress uses the original thumbnails from your pinboards and allows you to display them on your WordPress powered site. Once you have installed the plugin and everything is set, the plugin works in the background, pulls pins from your Pinterest pinboards and displays the same on your site’s Pinterest Pinboard widget. The thumbnails are cached every 15 minutes and nothing is copied or saved on your webserver. The plugin is free, absolutely no strings attached.

Note: If you want to show Pinterest Pins from an RSS feed or want to show the pins of a specific user, have a look at the Pinterest RSS widget for WordPress. This plugin lets you enter an RSS feed or the URL of a Pinterest user, fetches the pins and displays them as a widget on your WordPress site.

WP-Pinner Tracks Pinterest Pins From WordPress

This plugin is for geeks and anyone who wants to have all the pin statistics, right within the WordPress administration area.

Enter WP-Pinner, a free WordPress plugin (still in private beta) which allows you to track Pinterest Pins right within your WordPress dashboard. Using this plugin, you will be able to measure the click through rate of the “Pin it” button, number of re-pins a specific post or page has received and how many users or readers were “reached” because of a “click”, “pin”, “like” or “re-pin”. This is valuable data and any marketer knows how crucial metrics and stats can be.

Once you have installed WP-Pinner, your WordPress dashboard will display the name of the board, clicks, likes, re-pins and date of posts. The best part – you can schedule pins and auto-follow users who interact with your pinboards or share your stuff on the Pinterest site.

In fact, this is the only plugin which supports auto-pinning and provides valuable statistics right within your site’s backend. WP-Pinner will soon go public after their private beta period is over and they will also include more features e.g detailed statistics, tracking non WordPress posts, supporting multiple Pinterest accounts and more, once they release the next updated version of the plugin.

Watch this video demo to learn more about WP-Pinner.

WordPress is installed on so many websites now, the global reach is comparable to a company like Microsoft. Hackers, scammers, and phisherman target Windows because it’s installed on millions of computers all over the world. If you’re going to break into computers with malicious intent, you want the biggest target.

You will find (at times) some proponents of other popular open source CMS software (Joomla, Drupal) may try to say “WordPress isn’t safe, look at all the hacked websites”. WordPress is actually very stable, mature, and secure. But by it’s very nature, being software, it must be maintained (or security holes appear over time). If everyone kept WordPress, plugins, and themes updated, and performed just the slightest bit of preventative maintenance and hardening, the amount of compromised WP websites would probably go down by 90%. In this article we’re going to go over the basic steps of how to protect your WordPress website from malware, virus infections, and malicious code and scripts.

First let’s talk about some basics you should know…

What is (website) malware?

You probably already know the word “malware” from PC’s and computers. Computer viruses have been around a long time, as well as virus scanning software. With the Internet age came “spyware” (programs that spy on what you do and send the details to a remove computer), as well as “anti-spyware” computer software. You might also have hard about trojans, and key-logging software as types of computer virii. The term “malware” in conjunction with a computer means something installed on your PC in order to deliver a payload. Like installing a browser toolbar, and having it (on the backend) install a script, program, or trojan without your knowledge as the payload.

Google started tracking malware in websites a few years back as part of Google webmaster tools. Malware (at that time) was known mostly as something installed in your website designed to deliver a payload unknowingly to the website visitor (also like a virus, trojan, program, script, etc.). Now, the term is used to cover nearly any compromised website wither it delivers an actual payload, redirects the user to a rogue website, or just plain contains simple SEO spam.

How do websites get infected with malware?

If you think about the amount of WordPress websites online (more than 73 million and counting), when reports come out that say “10,000 websites hacked from ABC vulnerability” it’s a small percentage in comparison to the whole. Then again, that’s 10,000 broken websites that are either down, redirected, or infested with spam.

Often people have a perception that there are actual people (or hackers) trying to break into websites. That’s not really the case, it’s an automated process. Hackers, spammers, and criminals write scripts to seek out and search for websites with specific vulnerabilities they can use to break in. They watch the latest security holes patched in WordPress itself, as well as themes and plugins. They also look for other software with holes, such as Joomla, Mambo, Drupal, phpBulletin, Simple Machines forum, phpBB, and anything else they can find. Often scripts are written to break in through one hole, and then just infect all PHP files, all sites in a hosting account, or just all WordPress installations at once.

So think about the home you live in and it’s security. You have locks on the doors and windows, and if someone were trying to get in – you’d know about it right away. The bulk of websites online are in shared hosting accounts. Unless you have some alerting or monitoring installed for your website (and even if you do), the only place break-in and hack attempts are stored is the server logs. You don’t know it but your website is being “attacked” night and day 24/7 hundreds (if not thousands) of times. You have no idea that something is constantly trying to break into your website. If you did – you’d actually beef up the security a bit.

Back to how the websites get infected. These automated scripts look for security holes in WordPress itself, themes, and plugins. If your website (or themes or plugins) are out of date – you might be open to one of these attacks looking for a way in. But this isn’t the only way.

Another way websites can be compromised (any website, not just WordPress) is by using an insecure connection to either login to FTP, your wp-admin dashboard, or your web hosting account. Remember when we talked about computer viruses and malware? If your PC is compromised and you connect to your WordPress website, your connection information could be sent to a remove PC by a keylogger or trojan. Even is your PC is clean, if you connect to any of these by an insecure connection such as Starbucks connection, public wifi in a hotel or airport, the same thing could happen (same if your home wireless router isn’t secured).

Yet another way your WP website can be infected is through your webhost itself. Maybe your account is managed with cpanel or Plesk control panel and your webhost hasn’t applied the latest patches for that software. Hackers can get in through those security holes. What if an exiting employee from a webhost steals the password files (which has actually happened) – you could be compromised. What if someone external breaks into your webhost and steals your login information (which has also happened at multiple webhosts multiple times), you can also be broken into.

More often than not what we do see, are large webhosts with shared webservers where hackers break into as many sites as they can on one box at once (bad neighborhood or guilt by association break-ins). Hosts that do stupid things like leave directory indexing on by default – don’t help matters much.

How to Protect WordPress from malware?

Now that you know what malware is, and how websites get infected, it’s time to find out how to protect your own website from malware (infections). While we can’t give you complete step by step instructions, we can give you some great points to follow which will make your website more secure and hardened than it ever has been.

• Reset your password(s): regularly reset your WordPress admin, FTP, and web hosting control panel passwords every 30-60 days. Be sure to use a 12+ character strong password from somewhere like strongpasswordgenerator.com. Never use the same password at multiple websites or for multiple accounts.
• Update everything: as previously mentioned, be sure to keep WordPress itself updated, and all plugins and your theme as well at all times. Check to see if your theme has an update available if you purchased it from a developer or a theme house. Have it reviewed by a competent WordPress developer once per year for vulnerabilities if it was custom coded.
• Remove unused and outdated items: The worst security holes are the ones that you forget about. Always remove all themes and plugins that are unused and inactive. In addition be sure to remove (or at least have an expert check out) any plugins that haven’t had an update in 12-18+ months or more.
• Get rid of common WordPress elements: Your WordPress installation shows what version you are running in the meta generator tag of every HTML page it displays sitewide. Use a security plugin like Secure WordPress or Better WP Security to suppress this from being displayed in your public pages. You can also remove, hide, or limit access files like readme.txt which also display WP version information.
• Limit Access: Limit and give admin access to only those with a “need to know” basis within your WordPress website. You should be able to count full site admins on one hand (preferable one or two fingers). Give the rest lesser user roles as needed.
• Setup alerting and monitoring: There are all kinds of free services (some by web hosting companies) that will alert or monitor you if your website is down (or if certain pages have changed in content)
• Register with Google Webmaster Tools: If you register with Google Webmaster Tools and they find malware in your website, they will notify you via email. Keep in mind (in our experience) by the time they notify you, your website could have been infected for days or weeks (or longer)
• Monitor changed files: There are many free plugins that will monitor your website for changed files, Better WP Security is one of them.
• Update wp-config security salts: Since before version 3.0 the wp-config.php file of every WP installation has contained “security salts” and a URL to get random ones to update the file with. Be sure to update your wp-config file.
• Install and configure a security plugin: Setup and configure an all-inclusive security plugin, something like Better WP Security or Secure WordPress
• Setup and test a backup solution: By all means, make sure that in the event something does happen you have a disaster recovery plan. You can use a free plugin, premium solution, or web based service to backup your website to an offsite location for recovery in case you are hacked, or something at your web host goes down. This is even protection against issues if you upgrade WordPress or plugins and a conflict takes your website down. At least with an option like this, if you are taking regular versioned backups, you can easily revert to the last known good version

With just these few bullet points, your website security can be improved by nearly 95% (or more). While much of this can be done by any website owner with a small amount of effort and little technical knowledge, if you need help quickly for a compromised website JTPratt Media does remove malware and secure WordPress websites.

A couple of weeks ago, I read a post on WPLift “Build A Plugin (Twitter Widget) into your WordPress Theme)“ which in turn was inspired by a post on WPCandy from a couple of months ago “How to create your own WordPress functionality plugin“.

The WPCandy post was advocating that theme designers should stop bundling WordPress plugins and other functionality which limits how easily users can switch themes, something which I feel is absolutely a good idea. But that’s not what I want to talk about in this post — I want to focus specifically on the issue raised in the WPLift post — building plugins directly into themes.

The post shows you how to add the DP Twitter Widget into your theme; it’s literally a case of copying a pasting the plugin’s code into your functions.php. In fact it’s so easy that there’s no reason not to build every single widget and plugin you can think of under the sun into your theme, right?

Unfortunately it’s a little more complicated than that and for the rest of this post I’ll set out exactly why that’s the case.

Firstly, the second you build a plugin into your theme, you’re assuming responsibility and are obliged to support the plugin, so if anything breaks in future updates, you’ll need to be able to fix it. Say the plugin used Ben’s timthumb and updating was an absolute necessity, the onus would then be on you to provide the update by offering an entire theme upgrade rather than just a simple plugin update independent of the theme.

Second, what’s the point? The functionality you’re providing already exists and unless you’re significantly changing the plugin, I’m struggling to see the point of just duplicating functionality. Sure, you get to brag about how your theme has thousands upon thousands of built in widgets and it makes everything really fun and it’ll do everything you’ve ever wanted, but by just adding a plugin that already exists into your theme, you’re just adding something I can do already by installing plugins. Plus, I’ll not lose everything in two years when I decide I need to overhaul the look of my site! And hey, there are sites like mine out there which show you how to do things like building a WordPress powered email newsletter without plugins anyway!

I’m not just wagging fingers from the rooftops — this was a mistake I made when I launched my ill fated theme site, WPShift nearly two years ago. At the time having a ton of functionality in a theme was the way to go and we made a decision that we would go down the route of essentially just bundling plugins with the theme.

I’m glad to say this isn’t all the range any more, so please don’t do it, it’s just making a mess in the long run.

Over the past couple years it has been impressive to see Facebook craftily grow its influence beyond the Facebook.com domain and expanding all throughout the internet.  For example, it seems just about every major website now allows you to login using Facebook.  With Facebook’s growing influence over the internet it isn’t surprising many WordPress developers have really stepped up, providing a number of great free and premium WordPress plugins to help improve WordPress and Facebook integration.

Once of my most recent Facebook plugin discoveries came from the developers at Premium Coding, a website which builds quite a few things, including a series of premium WordPress plugins.  The plugin I want to talk about today is called Facebook Page Themes, and the title pretty much sums up what this plugin does.  With this premium WordPress plugin users can generate a custom designed theme for your Facebook page, giving your business a professional look that promotes your product or service. [Continue Reading...]

As we transition to a new era of computing where people are getting their information via mobile phones, you are starting to see just about every high profile website or blog making their own iPhone app.  But what about the average WordPress user who doesn’t have the time and/or budget to make their own custom iPhone application?

Not long ago I covered a free WordPress plugin called WPTouch which creates a mobile-friendly version of your WordPress blog to display for mobile web browsers.  The unfortunate truth, however, is that outside of clicking on a link from Twitter on their phones, most iPhone, Android, or mobile users in general do not use the mobile web to view a webpage.  In order to maximize convenience for your readers you really need a custom iPhone application.  This is where an app I recently discovered, Wiziapp, comes to the rescue.

What is WiziApp?  Wiziapp is a WordPress plugin that automatically turns your WordPress blog into a native iPhone app in real time, giving easy access to the following within the application: Posts, pages, comments, categories, tags, links, images, videos, and audio files. And if that wasn’t enough, Wiziapp even offers a push notification service to notify iOS users when your website has new content available!

Here is a complete list of the features provided by the Wiziapp team:

• Create and personalize your iPhone application from your WordPress dashboard using the plugin’s wizard.
• Deliver all of your blog content directly to your App in real time.
• Notify your readers about new posts via push notification service.
• Your readers can easily read and post new comments directly from your App.
• Your App will display your images and galleries in native iPhone style.
• All the media you have posted will be collected to video or audio libraries.
• Your readers can easily search your blog directly from your App.
• Playing video and audio using Wiziapp’s advanced players.
• Enable your readers to navigate between posts by categories, tags or author name.
• Integrate with your login system.
• Your readers can easily share your posts and images via Facebook, Twitter, Email or SMS.
• Monetize your App by displaying ads using your own AdMob account.
• Your readers can easily save your posts to their ‘favorites’ list.
• We publish your App to the iTunes App Store and save you time & money dealing with an Apple developer account.
• See daily stats of your App visits and downloads.
• Stay up to date with all iOS and WordPress new features.
• Check out the Wiziapp tour here.

[Continue Reading...]