If you’d like to do this, first ask yourself if you feel comfortable editing the code in your theme files, and if you feel comfortable using FTP to upload the edits to your web server. Remember to use a plain-text editor to make all of your edits, not a word processing program like MS Word. If you can do those things without hesitation, you’ve made it over the first hurdle.

The next thing you have to do is decide whether you are going to make the domain name point to your WordPress folder or if you are going to copy the site files from your WordPress folder to the folder that the domain name points to.

• If the domain name is changing, you can often point the new domain name to the WordPress folder when you add it in your hosting control panel, and not have to copy or move any files at all.
• If the domain name is not changing but the path to the site is (e.g. moving WordPress to the root folder), and/or you don’t know how to point your domain to a specific folder at the hosting level, you can simply copy all of your WordPress site files via FTP to the folder that the domain name points to.

Two things to do before you upload your site files

Check the .htaccess file in the WordPress folder: WordPress usually writes entries to a .htaccess file in the main WordPress folder. If you are moving the site from a sub-folder to the root or vice-versa, you will have to edit this file. If your site is in a sub-folder called /blog, the .htaccess file in your WordPress folder will contain these lines:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /blog/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /blog/index.php [L]
</IfModule>
# END WordPress

If your site is going to be in the root folder, the references to the sub-folder need to be removed, making it look like this:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Add two lines of code to the functions.php file of the Default theme: As shown in the WordPress Codex article Changing The Site URL, you can add these two lines of code to the top of your functions.php file to tell the database the new site URL:

define('WP_HOME','http://example.com');
define('WP_SITEURL','http://example.com');

Replace example.com with your actual domain name and any sub-folder name that points to your site. The only reason I suggest doing this to the functions.php of the Default theme is so that you don’t have to mess with your active theme’s files. If you prefer to edit the functions.php of your active theme, that will work too. It is advisable to make backups of your functions.php file and your WordPress database at this time.

If you have chosen to edit the functions.php of the Default theme and that is not your active theme, go to your site’s admin at the old URL and activate the Default theme. If you edited the functions.php of your active theme, you can skip this step.

Now that you’ve done your edits, you can upload all of the necessary files to the proper folder. If the folder is not changing, you only need to upload the new functions.php, and possibly the new .htaccess file. If you are changing the folder, upload the entire site to the new folder.

Now simply go to your site at the new URL. It should work. Assuming it works fine, you can upload the backup version of the functions.php (i.e. one that has not been edited). It is important to remove those extra lines of code. Your site is now ready to go.

Additional considerations:

• If you are using a plugin that references a file in your folder structure such as the Google XML Sitemap Generator or a database backup utility, you may need to change the path in the plugin’s settings to the new path.
• You may also need to change the path to your uploads folder in Settings > Miscellaneous
• You may want to use the Broken Link Checker plugin to make sure that you don’t have any broken internal links or redirects in your site caused by the URL change.
• If you feel brave and have a lot of internal links that need to be changed, you can use the Search and Replace plugin to change them all simultaneously.
• If you have moved your WordPress site to a new folder on the server, remember to delete the old files.
• If you have changed your domain name remember to put in a .htaccess 301 redirect from the old location to the new one.
• It is advisable to put a robots.txt file in your root folder so that search engines will crawl and re-index the site. Google may reject your sitemap if you don’t have a robots.txt file giving them access to crawl the site.

If this seems too difficult for you, you may be interested in my article on Accessing Your WordPress Site From The Root Folder, which explains how a simple .htaccess redirect file can point requests from your root URL to your WordPress folder.

Have fun!

This article copyright © John Nasta 2010 – All Rights Reserved

Related posts:

1. Accessing Your WordPress Site From The Root Folder Update June 06, 2010 – This is an old post and I actually never do...
2. Excluding Your Web Site From Search Engines People often write about how to increase your search engine ranking by using noindex and...
3. WordPress Theme Review – Alternate0 Basically, unless you are a very good coder, you should forget that you ever heard...

It is not widget-ready and the sidebar is not contained within <UL> or <OL> tags.

The single post template (single.php) does not call in the sidebar, so when a user goes to an individual post the navigation disappears.

single.php also contains over a dozen validation problems. The Minima theme that alternate0 is based on does not use the single.php template, so I can only assume that the person who adapted this template was a terrible coder. If you haven’t invested any time in this theme it might actually be easier to start with the Minima theme and customize it to look like alternate0. They are very similar.

It is set to a fixed width of 700px, which wastes a lot of screen space for most users.

The links in the header are hard-coded and need to be manually changed in order to be of any use.

It does not contain any RSS links.

The comments.php file has Google ads hard-coded into it and you’ll have to know how to remove them.

comments.php also contains a hard-coded link to a subscription management page on the author’s site and a “subscribe to comments” checkbox that doesn’t work. Both have to be removed.

The sidebar contains hard-coded links to the author’s sites under “Good Reading” and the “Alternate0 is based on…” credits. You’ll also want to remove the “Your Google Ads Here” text while you’re at it. The sidebar is full of junk that you’ll want to get rid of, yet doesn’t include things that would be desirable such as Recent Posts, Links, Pages, and Meta sections.

The sidebar Categories drop-down has a hard-coded /blog/ path, so if your WP installation is not in a folder called “blog” the drop-down will not work.

The footer.php also contains hard-coded links to other sites.

The CSS does not contain several required classes including alignleft, alignright, aligncenter, and wp-caption.

The theme comes with files called templates.php and testimonials.php that appear to be there for no reason other than to promote the author’s other themes and socio-political agenda.

The authors did not respond when I tried to reach them by email, and a comment on the ThoughtMechanics web site in which I politely asked for some help with this template was apparently deleted from the moderation queue without being published or responded to.

In short, it looks nice but be prepared to do a lot of hacking to make it usable.

I am working on fixing this theme because I have a client who likes the way it looks. I’ve gotten all of the above fixed except for the disappearing navigation on single posts, which I am having trouble getting to line up properly (that’s what my question to the authors was about). I also have not made it widget ready because so far my client hasn’t had any need for that, and I have to concentrate on what they do need first. Once it’s fixed I will make it available to others. In the meantime this theme is not one that you can expect to simply unzip and use. I will also try to work some of the WP v.2.7+ features into it such as comment threading. This template was written in 2005 and I have to assume that the author has abandoned it.

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. Advanced Customizing of Atahualpa WordPress Theme Atahualpa from Bytes For All just might be the most impressive free WordPress theme available...
2. Arinesce Free WordPress Theme Beta 3 Now Available Arinesce is a simple fixed width two column, left sidebar, widget ready WordPress theme that...
3. Changing The URL Of Your WordPress Site WordPress web site owners often come to realize that they want to change the URL...

Noindex is fairly self explanatory. Simply put, a noindex tag tells the search engines not to index this page.

Nofollow is a similar tag. It tells the search engines not to follow any of the links on the page.

That’s just the beginning…

By adding this code to <head> section of all of your pages:

<meta name='robots' content='noindex,nofollow' />

you can tell the search engines not to do either of the above.

You can also create a plain text file called robots.txt containing this code:

User-agent: *
Disallow: /

Upload it to the root directory of your site. This will tell all “user agents” (a.k.a. search engines) to disallow indexing of all pages in the root directory as well as any directory within it.

So, what happens if you found this article too late and your site has already been indexed. How can you get it de-listed?

There are two answers…

The first is to upload the robots.txt file as described above. The next time your site is crawled, it will be removed from the index.

If you want your site removed from Google, and you can’t wait until the next time it’s crawled, sumbit a Google Urgent Removal Request. Google says that this process will take 3 to 5 business days.

Is there more to the story? Of course there is!

You can also use this tag in the <head> section of your pages:

<meta name="robots" content="noodp,noydir,noarchive" />

noodp – Prevents all search engines from using the DMOZ description for your site in the search results.

noydir – Prevents Yahoo! from using the Yahoo! directory description for your site in the search results.

noarchive – Prevents sites like archive.org and Google from putting copies of your pages into their archive or cache.

What about WordPress sites? You may have already noticed that you can click Settings > Privacy and choose the “I would like to block search engines, but allow normal visitors” option. This will add noindex and nofollow tags to all of your site’s pages EXCEPT the Login and Forgot Password pages. A nice way to add these tags to those pages is to use the Robots Meta plugin by Joost de Valk. This plugin actually does more than just that. Read the instructions for a better understanding of the plugin’s features.

So, now your site is not being indexed, but people can still link to it from other sites or manually type in the URL. What can you do about that?

WordPress users have the option of marking their pages and posts Private, which means that only those subscribers whose Role allows them to see those pages and posts can access them. There’s also the User Access Manager plugin that allows you to assign which subscribers can read selected pages and/or  posts. You can even assign people who are not subscribed and/or logged in by IP address or IP range.

Static sites can be password protected by putting a .htaccess file in the folder. If you don’t know how to create a .htaccess file, most commercial web hosts will do this for you via your Plesk or Control Panel interface.

Who would have thought that there’s as much involved in keeping people out of your site as there is in getting them to find it and come in?

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. SEO Google Search Ranking Optimization Tips – Titles and Title Tags Here is a Google SEO optimization technique that anyone can employ on just about any...
2. SEO – Avoiding Duplicates with Canonical URL Tags You may have seen my article about the Ultimate Noindex Nofollow tool for WordPress, but...
3. Changing The URL Of Your WordPress Site WordPress web site owners often come to realize that they want to change the URL...

In your WP Admin, click Settings > Permalinks

Click the “Custom Structure” radio button

Copy & paste this code into the box to the right to show the year, category name, and post name in the Permalink (this is probably the most popular link structure):

/%year%/%category%/%postname%/

Note that it is a good idea to START your permalink structure with a numeric value to avoid database problems, and END it with the post name (or I.D.) to make sure that it points to a unique post. The WordPress documentation on this topic can be found here.

The full list of “tokens” that can be used is:

%year% – The year of the post, four digits, for example 2004

%monthnum% – Month of the year, for example 05

%day% – Day of the month, for example 28

%hour% – Hour of the day, for example 15

%minute% – Minute of the hour, for example 43

%second% – Second of the minute, for example 33

%postname% – A sanitized version of the title of the post (post slug field on Edit Post/Page panel). So “This Is A Great Post!” becomes this-is-a-great-post in the permalink URL

%post_id% – The unique ID # of the post, for example 423

%category% – A sanitized version of the category name (category slug field on New/Edit Category panel). Nested sub-categories appear as nested directories in the URI.

%tag% – A sanitized version of the tag name (tag slug field on New/Edit Tag panel).

%author% – A sanitized version of the author name.

In the category base box, enter a simple word like categories or topics. This will alter your category links to include the word you entered as well as the category name.

Likewise, enter a simple word like tags into the tag base box.

Click “Save Changes”

You’re done!

A couple of nice side effects of doing this are that your page links will also be modified to include the page name, and when editing your posts you will now have a button that will allow you to enter any words you like into your permalink for that post. Note that if you change a post’s title, the permalink will continue to show the old title unless you edit it as well.

Amazing, and amazingly simple!

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. WordPress SEO Plugin – The Ultimate Noindex Nofollow Tool Now that my blog has been up a few weeks I feel like I finally...
2. SEO – Avoiding Duplicates with Canonical URL Tags You may have seen my article about the Ultimate Noindex Nofollow tool for WordPress, but...
3. Changing The URL Of Your WordPress Site WordPress web site owners often come to realize that they want to change the URL...

WordPress versions 2.7 and higher have an automatic upgrade option built in. The plugin interferes with the native upgrade routine and vice versa, so neither of them will work.

If you’ve got a WordPress version older than 2.7, by all means use WPAU to upgrade it, but once you’ve arrived at 2.7 or higher you’ll need to deactivate and delete the WPAU plugin.

Always keep your WordPress installation and plugins up to date. Updates typically include security enhancements. Mixing old & new versions of WP and your plugins also doesn’t always work well.

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. WordPress Security – Protection Against Hackers There are a bunch of things you can do at no cost that will make...
2. WordPress.com vs. WordPress.org Finally, a post about Wordpress for people who have never used it. Are you "wp-curious"?...
3. Changing The URL Of Your WordPress Site WordPress web site owners often come to realize that they want to change the URL...

You may have read my previous article about how I set up a web site for a private club with three levels of user access by using Peter’s Login Redirect, WP Hide Dashboard, Role Manager, and New User Email Setup plugins.

I’ve since discovered the User Access Manager plugin, which allows you to create user groups and give them access rights to selected posts and/or pages. You can even assign separate admin and user permissions within the group. Great for project sharing regardless of whether your WordPress site is public, private, or a mixture of the two.

Older versions of this plugin came with this warning:

“If you activate the plugin your upload dir will protect by a ‘.htaccess’ with a random password and all old downloads insert in a previous post/page will not work anymore. You have to update your posts/pages.”

The latest version of the plugin allows you to unlock these files so that they don’t appear broken. It also allows you to delete the .htaccess files if you should decide to deactivate the plugin. If you are using this plugin, make sure you have the latest version.

This plugin may be able to replace Role Manager, especially if all you want to do is control read access to posts and pages. Keep in mind that if you uninstall Role Manager your roles & capabilities will be left however you last set them. They will not be returned to default. At the moment there is some discussion among WordPress developers (including myself) about the possibility that modifying the default user roles causes conflicts with other plugins that use the Role feature (like Profiler and WordPress Users, both of which do not seem to work for people who have used Role Manager). We’ll see if either of the plugin authors can come up with a fix that takes modified roles into account.

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. WordPress Plugins – User Access Manager vs. Role Manager Do you want to control access to your pages & posts or your admin features?...
2. WordPress CMS – User Access Levels The more I use WordPress the more I like it. Recently I’ve been asked to...
3. WordPress Plugins – Caveats for Emptors Here’s a list of WordPress plugins that didn’t work out for me and why. Keep...

Keep WordPress and all of your plugins up to date – Many upgrades include security enhancements. WordPress 2.7 and higher versions offer automatic updating of your WordPress installation as well as your plugins.

Do not use the default wp_ as your table prefix – Read about the WP Security Scan plugin below for information on how to fix this.

Make sure your WordPress version is hidden – You can delete the name=”generator” line from your theme’s header.php or you can use the WP Security Scan plugin to automatically hide it.

Make sure DB errors are turned off – This is the default setting on the current version. If you are using an older version you should upgrade.

The WP ID META tag should be removed from WordPress core files. The easiest way to do this is with the WP Security Scan plugin.

Delete the default “admin” log in if you have one. Create a new User ID with full admin permissions first.

Use a strong password – The WP Security Scan plugin has a password generator that will create very strong passwords.

Create a .htaccess file in your WordPress folder – Open a new plain text file. Leave it blank. Save it as .htaccess. It should have RW-R-R or 644 permissions on the server. WordPress will add lines to this file.

Create a .htaccess file in your wp-admin folder – Open a new plain text file. Paste this into it and save it as .htaccess

IndexIgnore *

then upload it to your server as a plain text (ASCII) file. This will prevent the index of files from being displayed.

Hide your plugins – If you can see the contents of your plugins directory in your web browser (at yourdomain.ext/wpfolder/wp-content/plugins) you are allowing hackers to look for exploits. Upload the above .htaccess file to wp-content/plugins.

Hide your backups – If you have a plugin that periodically backs up your database and saves the backup files to your server, upload the above .htaccess file to that folder as well. Otherwise people will be able to download your entire database.

Noindex / nofollow – You may have read my previous article about using noindex and nofollow tags to help your search engine ranking by preventing them from indexing pages and following links on pages that contain duplicate content. You can also go into your WordPress admin’s Settings > Privacy page to mark your entire site noindex/nofollow if you don’t want the search engines to list it or spider it at all. This is useful for private organizations.

Security Scanner

WP Security Scan – will check your installation for security risks and provide you with corrective tools, such as the one for renaming your table prefix if it’s currently the default wp_ and the one that hides your WordPress version mentioned above.

Firewalls

WordPress Firewall SEO – This is the one that I use. I like the fact that it sends me emails with details of the attack and the attacker’s IP address, as well as blacklist & whitelist capability. It also has a set of hard-coded criteria that it rejects and prefitted whitelist to make it work out-of-the-box.

WPIDS – The WPIDS plugin offers protection for your Blog from malicious code injections. Any Request considered as malicious is logged into a database for later analysis. You can also set up email notification for attacks with very high impact. The back-end pages of the plugin will notify you if new filter rules are available and you can check a list of latest intrusion attempts.

Maximum Security – includes a powerful server analysis tool that shows you exactly what kind of server your site is running on along with its hardware configuration, current operational status (memory usage, disk space, CPU load, etc) and software capabilities. It also scans your entire WordPress configuration to detect potentially dangerous settings, such as using the default table prefix, using a “generator” tag in your site’s page headers, leaving the default “admin” account enabled, and more.

Database Backup & Maintenance

WP-DBManager – gives you options to schedule backups and optimization of your database, as well as drop tables from deleted plugins, and repair database errors.

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. WordPress User Access Management What’s the most fun you can have with a program that’s written for information sharing?...
2. Changing The URL Of Your WordPress Site WordPress web site owners often come to realize that they want to change the URL...
3. WordPress Plugins – User Access Manager vs. Role Manager Do you want to control access to your pages & posts or your admin features?...

Recently I’ve been asked to do two web sites that have multiple access levels. One is for a graphic designer who wants a public site as well as things only her clients can see and things only her employees can see. The other is a private club that wants to give a very small amount of information to the public, and also wants separate access to information for two levels of membership. In both cases I used WordPress.

For the private club, I used the Role Manager plugin to create a Subscriber level that has access to pages marked Private, and another that has access to pages and posts marked Private. Thereby I created two levels of private access. See my article titled “Caveats for Emptors” for warnings about using the Role Manager plugin. You may prefer to use the User Access Manager plugin instead. I used it on the graphic designer’s site and will probably never use the Role Manager again.

To augment that, I added Peter’s Login Redirect plugin to both sites. This plugin allows you to redirect users to any page on the site by user name, role, numeric admin level, or “anyone else” (i.e. anyone not defined by the preceding criteria). The really nice thing about this plugin is not terribly obvious. If you have created a page or post that you only want one person or a defined group to see, you can send them there directly. Note that by default, links to pages marked Private will not appear in your WP navigation, and category links will only appear if there is at least one public post in the category. So, now you have a way of “hiding” information within your site. You could (for example) give your employees access to a category that contains protected posts about several projects and your clients a direct route to a specific page where their project is posted. Search  the WordPress plugins directory for the words login redirect and you will find similar plugins that may better suit your specific purposes. Beware of Weasel’s Login Redirect as it requires the Role Manager plugin to work.

Finally in both cases I used the Hide dashboard plugin and removed the Meta links from the sidebar so that Subscriber-level  visitors won’t mess with the login profiles.

Thanks WordPress!

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. WordPress User Access Management What’s the most fun you can have with a program that’s written for information sharing?...
2. WordPress Plugins – User Access Manager vs. Role Manager Do you want to control access to your pages & posts or your admin features?...
3. WordPress Plugins – Caveats for Emptors Here’s a list of WordPress plugins that didn’t work out for me and why. Keep...

Today I’m checking out The Ultimate Noindex Nofollow Tool plugin by Jonathan Kemp.

This plugin allows you to add “noindex” and “nofollow” tags to your WordPress blog pages.

Right now some of you are thinking “Great! Why?”.

The reason this is desirable is because by default, WordPress creates a lot of duplicate content. For example, you can read the same post on the home page as you can by clicking the link for the category that the post is in, or the one for the month that it was posted, or by finding it with the on-site search, etc. This actually hurts your site’s ranking, so it behooves you to install this plugin or something very much like it. What I like about this plugin is that it lets you check off the common pages that you would like the tags to be placed in, and also lets you type in the page IDs of any others that you’d like to add. What more could you want?

BTW, this is also why you should assign your posts to only one category. Assigning them to more than one is another way of creating duplicate content, and thus hurting your site’s ranking.

Since most bloggers rely on the idea of building up traffic and statitics in order to gain clients or sell advertising, blogging without this plugin is like… well, let’s just say that you get what you deserve if you don’t use one.

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. SEO – Avoiding Duplicates with Canonical URL Tags You may have seen my article about the Ultimate Noindex Nofollow tool for WordPress, but...
2. Excluding Your Web Site From Search Engines People often write about how to increase your search engine ranking by using noindex and...
3. WordPress SEO – Permalinks Options and Structure A great way to increase your blog’s search engine friendliness is to customize your permalink...

What this plugin does is monitor your visits to your WordPress admin and notify you and/or the person(s) that you choose if you haven’t visited in a definable number of weeks. So, it will basically let the chosen person(s) know if you have been ignoring your blog.

Taking it one step further, if you still don’t visit your blog a set amount of time after receiving the first warning, it will send  a second email to your contact(s) of choice as well as a separate email that you have written to your “next of kin” (again this can be more than one person) to let them know that you haven’t been checking in.

After another set interval it will send a final email to let the recipients of your choice know that you have completely stopped checking in, and may in fact be incapacitated or deceased.

The idea is that you could send someone your blog’s admin password or any other information you’d like them to have in the event of a tragedy. For security reasons, I personally think it’s better to direct them to a place or places where they can find the information physically than it is to store the information on a web server and email it.

This may seem a bit morbid, but for those who live or work alone, or don’t keep in touch with the outside world very often, it can let those near and dear to you know that something is wrong, and give them information so that they can follow up with your wishes. A bit creepy, but it does serve a legitimate purpose, even if that is just to make sure that your blog continues to be maintained.

Live long and prosper (did I actually just quote Mister Spock from Star Trek?)

This article copyright © John Nasta 2009 – All Rights Reserved

Related posts:

1. WordPress Plugins – Theme Test Drive A WordPress plugin that’s well worth checking out is Theme Test Drive by Vladimir Prelovac....
2. WordPress CMS – User Access Levels The more I use WordPress the more I like it. Recently I’ve been asked to...
3. WordPress Plugins – Caveats for Emptors Here’s a list of WordPress plugins that didn’t work out for me and why. Keep...