DaGreCo Business Services

Are You Hiding Something-Your Security May Be At Risk

Greg — Mon, 20 May 2013 21:09:08 +0000

English: WordPress Logo (Photo credit: Wikipedia)
Don’t Hide the Fact That You’re Using WordPress – Konstantin Kovshenin

There are quite a few blog posts, plugins and hacks suggesting to hide the WordPress version number, or hide the overall fact that you’re using WordPress. Don’t do it — it’s pretty useless. There are hundreds if not thousands of ways to not only find out the fact that you’re using WordPress, but also find out the exact version number, regardless of any plugins or hacks changing or hiding the “generator” meta tag, the readme file and so on.
So from a security perspective, the secret sauce is to use a strong password, as well as keep your themes, plugins and especially WordPress core up to date. Plugins such as Google Authenticator and Limit Login Attempts can give you that little extra protection.

I disagree, somewhat with this. My recomendation is that the readme.html be deleted. Matter of fact, when I am securing a site, I delete the readme.html file, along with the install.php and a few others before hiding the version. I also recommend a sweet little plugin, TimThumb Vulnerability Scanner for additional security. I do, however agree that a strong password is a very important key to securing your website.

I have found using a password manager, like RoboForm, to be helpful. Not only does it keep my passwords safe and secure, but it fills in the user:pass box for me. I can have different passwords for all the different websites I use. It also has a great password creation feature. Get your RoboForm Free Trial today.

See full story on kovshenin.com
For additional help choosing a secure password that is easy to remember read this post now. There is a video explaining a simple way to choose and easy to remember secure password.

Businesses Are At Severe Risk From Using Poor Password Practices

Greg — Wed, 01 May 2013 02:55:27 +0000

Britain is a sitting duck for cybercrime because employees couldn’t care less about the security of their workplace systems, according to research by Swivel Secure. Almost a fifth (19%) of employees care so little about online security that they reuse the same username and password (UNP) across every single online business and personal application which, for the majority of today’s consumers, amounts to upwards of 25 different sites. Contrary to popular belief,awareness of the dangers of cybercrime amongst workers doesn’t seem to be the problem; over half (55%) of the 1,200 UK employees surveyed claim to actively track online security threats such as viruses, trojans and hackers. Despite this disparity between awareness and action, suggesting that only a direct and personal experience of cybercrime will trigger a change in attitude. three quarters (75%) either write down or have another offline system for recording their passwords.

I am constantly trying to explain the importance of using different Usernames/Passwords. It seems to no avail because the trend continues. I am, often, told it is too hard to remember different combinations. My recommendation is to use a password “Safe” program, such as RoboForm. This allows you to keep all your usernames/password combinations secured with 1 single encrypted password. The software will fill in the user/password fields for you (which helps prevent a keylogger from capturing your keystrokes. It even has a secure password suggestion feature.

For additional information and tips about using secure passwords see these posts:

the-worst-passwords-you-could-ever-choose This one has a great video explaining how to easily choose a secure password you can remember.
people-continue-to-use-weak-passwords
another-security-breach-related-to-re-using-a-password
password-security-a-few-simple-rules

See full story on net-security.org

Non-Geeky WordPress Security Basics

Greg — Mon, 22 Apr 2013 18:50:10 +0000

WordPress is a very secure system, but only if you don’t leave doors open for hackers through misuse. Attacks on websites with password protection, like those running WordPress, are ongoing. It’s just the reality of the Internet ecosystem.
login system to try and get to the other side. Here are the basics of making your WordPress login hacker-proof. With no geekery required.
Quick Tip:
Don’t have a user name that is “admin.”
Always use passwords that would be impossible to guess.
If you have any themes or plugins in your WordPress admin that are not in use, delete them.
Always keep your WordPress updated to the latest release.

These tips are “basics’ and often more is needed, but these are a good start for anyone to do. For more details on each of these tips read the whole article at the above link.
One note I suggest is to NOT update the WordPress core until that version has been out for 7-10 days. Although the WordPress folks do a good job with the updated versions, there is, sometimes, little tweaks that have to be done when a new version is released. Waiting the 7-10 days gives a chance for people to try the new version in the real world and find if there is any conflict with themes and plugins.

For the “do it your selfer” we have a FREE security scanner plugin. Get it today and discover what security holes your site has.

See full story on glopilot.com

6 Basic Tips to Improve WordPress for SEO and the User Experience

Greg — Mon, 22 Apr 2013 05:15:46 +0000

WordPress is one of the most popular content management systems available today. In September 2012, it was reported that WordPress powers 1 in 6 websites.

However, downloading and installing WordPress isn’t enough to make the site successful for SEO, security, and performance. But the following basic tips will improve your WordPress site for SEO and the user experience.
Remove Some WordPress Defaults
Set Your Permalinks
Add Some Update Services
WordPress Homepage: Blog Posts or a Static Page?
Customize Media Settings
Use Google Analytics
Summary
By tweaking some default settings, setting permalinks, adding update services, and customizing media settings – plus installing Google Analytics – you will greatly improve your WordPress site for SEO and the user experience.

WordPress is an amazing platform to convey your ideas or to use for a business website. It is versatile and very easy to use and manage. However, to protect your data, customer information and to provide a meaningful, pleasant experience for your readers there are a few steps necessary. To get the full impact please read the full story on searchenginewatch.com

Illegal Botnets Continue to Attack WordPress Security, The Details and Solutions

Greg — Fri, 19 Apr 2013 00:04:35 +0000

There is a very real, very large ongoing attack against WordPress sites. It has been going on for a while now, but it severely escalated last week.
The Attack
The details of the attack has been covered far and wide. Hostgator was one of the first big names to leak the news about the attack with their Global WordPress Brute Force Flood post. The WordPress security team at Sucuri has as series of blog posts about the topic covering how to protect your site, the reality of the attacks, and the consequences of such attacks. Security blog Krebs on Security has a good post covering the topic in depth.
The short and simple explanation of what is happening is that one or more illegal botnets (a network of hundreds, thousands, or millions of compromised computers that are being exploited to perform attacks, send spam, etc) are being used to ute-force attack WordPress sites. The goal of a brute force attack is to try as many username and password combinations as possible in order to find valid login credentials. It’s as if someone was trying to guess the combination on a combination lock, but rather than being limited to a single guess every few seconds, they could make hundreds or thousands of guesses a second while never getting tired.
The good news is that there is a pattern in these attacks. By finding patterns, intelligent solutions to protect against the attack can be created.
There is also a clear patten in the passwords being guessed. This is natural as. Unfortunately, the things that are easy for us to remember are also quite easy to guess. Looking at the passwords being guessed over the past few days, the following passwords come out on top as the most frequently guessed ones:
admin
admin123
123456
123123
123456789
password
1234
root
1234567
12345
qwerty
welcome
pass
abc123
12345678
1111
test
monkey
iloveyou
dragon
demo
As you can see, there is definitely a pattern of basic English words and easy to type letter or number sequences. The reason that these are being guessed frequently is that they are likely to work on the greatest number of sites. In other words, they are being guessed because people still use such passwords.
The Solution
Brute force login attempts are by no means new. Such attack techniques have been used against WordPress sites for as long as WordPress has existed. In the past, I’ve recommended users install and activate the Login Lockdown plugin as it helps protect against ute force attacks. It protects the site by blocking login attempts by a specific IP once that IP has failed too many times in a row. Unfortunately, as the pattern section above shows, these attacks are coming from a huge range of IP addresses. Simply being able to block specific IP addresses after failed attempts will not protect a site against this botnet attack. This means that a different solution is needed.
Remove the admin Username
Looking again at the pattern details, the first thing that all WordPress site operators must do is remove the username “admin” from the site. By far, this is the biggest vulnerability that is being exploited in this attack.
The easiest way to rename the user is to replace it with a new user. This can be done in the following sequence of steps:
Create a new user with the same role as the “admin” user. This is typically the Administrator role. You may have to use a different email address when creating this user as each user must have a unique email address.
Log out.
Log in as the new user.
Delete the “admin” user.
When asked what to do with the posts and links owned by the “admin” user, select the “Attribute all posts and links to” option, choose the new user from the drop down list, and click “Confirm Deletion”.
Once the user is removed, you can change the new user’s email address if a different one was used to create it.
Use a Better Password
I really debated if this should be first or second. The reality is that removing the “admin” username will almost certainly protect you from malicious logins from this attack. However, a bad password makes you very vulnerable to just about any other attack. If you have any users that have a password that is listed above or that have a password that is similar in simplicity to those listed above, go and change those passwords immediately.
So, we need passwords that are 1) not short, 2) not simple, 3) simple to input repeatedly so we’re not tempted to violate the first and second rules, and 4) able to be unique for every site we use. There are all sorts of tricks I’ve seen to get past the fourth rule. The common one is to use the name of the site in the password, such as “password123youtube“. While this will indeed make the passwords unique to each site, all it would take is someone looking at the password to figure out the pattern and apply it to other sites. So, the fifth rule is 5) ensure that in following 1-4 that we don’t create passwords that can be easily guessed if someone sees the pattern.
While struggling with this myself a while ago in my quest to have better passwords, I found that we humans just aren’t good at this. To make good passwords, we basically need random noise turned into a decently-long sequence of characters. This is not something that we do well at.
The solution I ended up going with was LastPass. LastPass is a password service. It centrally manages all of your passwords and has tools to easily create very complex passwords. It even has browser integration features that allow you to have LastPass automatically fill in the login details for you (no typing required). LastPass also offers apps for mobile and tablet platforms and has a web interface in case you need the password and can’t get it any other way.
Using LastPass allows me to have extremely complex passwords that I could never remember and would hate to type in on every site I use. I vary the length of my passwords that it generates, but they are always more than 25 characters as long as the site allows it. 25+ characters of more or less random characters… Good luck brute force guessing that in my lifetime.
The key to using LastPass is having a good password to authenticate your user there. This is the only password you will need to remember; so make sure that it is a good one. Don’t do yourself the disservice of having your one weak password give full access to all your strong passwords.’
There are alternatives to LastPass. I don’t have personal experience with any of them, so I can’t give a recommendation. The ones that I’ve seen most often are:
KeePass – An offline, cross-platform password manager. Basically, this is an encrypted local copy of your passwords as they aren’t stored on any server. I’ve seen people use Dropbox to allow their passwords to sync to different systems.
1Password – A paid password manager with option to sync to the cloud. I know at least one person in the office uses this software.
Keeper – Seems to try to compete directly with LastPass in terms of feature set.
RoboForm – Another service similar to LastPass. (My Favorite…It’s what I use).

These are just a few of the steps you can do to secure your own site. Read the full story, to get all of the tips, by clicking the link below.

See full story on ithemes.com

Video Marketing Beyond YouTube |120+ Video Site Alternatives to YouTube

Greg — Fri, 08 Mar 2013 21:38:40 +0000

Video marketing is perhaps the “hottest” tactic in internet marketing, providing numerous search engine optimization, user experience, and conversion optimization benefits. and generate more traffic to your website from video hosting sites, instill more confidence in your visitors and help you pre-sell services and set client expectations…

So now that you have your professional video, you just upload it to YouTube, fill in some details, and your done, right? I mean after all, YouTube is the world’s second largest search engine and has over 4 billion daily global online video views! Wrong! While YouTube is an absolute quintessential part of any video marketing campaign, .

Uploading to more than just YouTube is an excellent idea. To realize that all we have to do is look at the success of those who have used services, like Traffic Geyser. I have seen a site move onto the first page of Google very rapidly and soon taking the number one spot. All of this happening after a video has appeared on several video sites. Make sure you get the list of 120+ video sites you can upload to, after reading the full article.

See full story on avvo.com

How to Write Articles That Go Viral | Social Media Today

Greg — Thu, 07 Mar 2013 11:02:14 +0000

Do you ever wonder why some people have articles that are always widely read, but your’s are not as popular? Here are 10 tips to getting your writing to go viral. One tip is very much like getting an opt-in or making a sale… Ask. Yes that’s right just ask for your readers to share and give feedback. For more of these read on…

What does it take for something to go viral? Have you ever written an article that got a ton of shares on social media sites? If you haven’t, you’re going to learn 10 tips for writing content that will increase the likelihood of your posts going viral on social media. If you have, you’ll be able to review these ideas and potentially further improve your writing in order to provide yourself with even more exposure, visibility, and popularity around the subject and topics your’re trying to introduce. By understanding the key concepts that will be listed below, you’ll likely be a force to be reckoned with in social media!

See full story on socialmediatoday.com

Is Your Social Media Accounts Presentable-Scrub Your Facebook Clean!

Greg — Wed, 06 Mar 2013 23:28:18 +0000

More often than not we are judged by what we post on the web. This “judgement” comes from many people, potential employers, clients, school admissions personnel and new friends.

Is your Facebook account becoming a mess? Does your Timeline have embarrassing photos, inappropriate tags, awkward posts? Is your Facebook cluttered with game requests? Have you given permission to dozens of Facebook apps you don’t use anymore?
Polish the tarnish off of your Facebook account. Using these tips, tools and tricks, you can clean up your Facebook account in just a few minutes. Find out how…

See full story on wonderoftech.com

Reclaim Lost Link Juice by Capturing 404 URLs | Search Engine Journal

Greg — Tue, 26 Feb 2013 23:16:02 +0000

We have all had this happen. When checking Google Webmaster tools we see there are pages not found. This article gives some fantastic tips to find the pages and get them redirected back to the correct url.

This has happened to most of us at one point or another: We start optimizing a website’s URL structure or permalink slugs to be more user- and SEO-friendly, and we end up forgetting about an old URL that dozens of websites were already linking to. Since your old page no longer exists, Google will likely drop it from the index, and you will lose all traffic and authority that your old URL has acquired since it has been published.
Making this mistake can be as easy as modifying your WordPress permalinks incorrectly and forgetting to check if your old URLs are being 301 redirected to your newly modified slugs, or perhaps you changed the filenames or paths within your website.
Thankfully, with the help of a select few technologies, we can start to track down the links that are turning up 404 errors, 301 redirect them to their new permanent home, and reclaim the traffic and link juice that your original post had. What’s more, there are a couple solutions to help identify which of your URLs are turning up as 404 to your visitors and to search engines:

See full story on searchenginejournal.com

5 Characteristics of a Budding Entrepreneur – WP Daily

Greg — Wed, 20 Feb 2013 23:36:56 +0000

They say that entrepreneurs are a rare eed, that if everyone could be one then everyone would be one.
I understand why people would believe this to be true but I believe that entrepreneurship can actually be taught instead of just inherited like a magic gene or something else as equally cosmic.
Many people, yes, people just like you, dream of having their own business; one that they can call their own. They find that being salaried at a 9-to-5 job isn’t satisfying enough and hope that one day they can strike out on their own.

With the idea that most everyone, if not everyone, would like to be in business for themselves, these 5 guidelines are a fantastic beginning to becoming your own boss.

See full story on wpdaily.co

DaGreCo Business Services

Are You Hiding Something-Your Security May Be At Risk

Other Posts Of Interest:

Businesses Are At Severe Risk From Using Poor Password Practices

Other Posts Of Interest:

Non-Geeky WordPress Security Basics

Other Posts Of Interest:

6 Basic Tips to Improve WordPress for SEO and the User Experience

Other Posts Of Interest:

Illegal Botnets Continue to Attack WordPress Security, The Details and Solutions

Other Posts Of Interest:

Video Marketing Beyond YouTube |120+ Video Site Alternatives to YouTube

Other Posts Of Interest:

How to Write Articles That Go Viral | Social Media Today

Other Posts Of Interest:

Is Your Social Media Accounts Presentable-Scrub Your Facebook Clean!

Other Posts Of Interest:

Reclaim Lost Link Juice by Capturing 404 URLs | Search Engine Journal

Other Posts Of Interest:

5 Characteristics of a Budding Entrepreneur – WP Daily

Other Posts Of Interest: