WordPress/Website tip for small business owners

[Hoofy]

If you're going to outsource your website design, then make sure you're willing to pay the outsourcer to update stuff especially if they use something "user-friendly" like WordPress. Thanks to some bizarre choice of plugins etc to make everything look "responsive" (read: you have to stand at the far end of the office to view it on a normal PC), when trying to add my own links, I wondered why WP was stting itself. Turns out I can't enter the URLs in the form "http://" because some fknut has forgotten to make their plugin parse "/" and ":" properly. So I've had to enter them as fking hexadecimal ascii stuff. But I had to figure that out myself. I should invoice the s. Or kill them. fkers.

As the phrase goes, Keep It Simple, sthead.

[Hoofy]

Oh, and if you are a large business owner, make sure whoever in your business is responsible for updating the site is clued up enough - so don't rely on your marketing assistant or junior secretary who has never seen HTML before. Took me about 1 hour by wading through gobbledecode to figure out that someone who is supposedly cleverer than me because he can code C++ or some st is actually a fking time-wasting moron.

If the web designer had followed KISS then adding a page with a few links would have only taken 10 minutes not an hour.

[NorthDave]

I know what you mean. Not sure I would have gone Wordpress in retrospect. I've literally spent months trying to make mine efficient. Once you think you have it a plugin update comes along which conflicts with something else or changes a setting. Painful.

[Hoofy]

NorthDave said:

I know what you mean. Not sure I would have gone Wordpress in retrospect. I've literally spent months trying to make mine efficient. Once you think you have it a plugin update comes along which conflicts with something else or changes a setting. Painful.

Oh Christ, hadn't even thought of that.



WP is ok if you keep it simple. A basic theme, no smart-arse plugins so you can make amazing looking designs that are a PITA to maintain or update. K-I-S-S!

[crmcatee]

Also - run a child copy if you're making any changes so it won't be overwritten by the next update.

[buggalugs]

I think that adverts on TV for £10 DIY websites create unrealistic expectations of how easy web development is...

[akirk]

Hoofy said:

Thanks to some bizarre choice of plugins etc to make everything look "responsive" (read: you have to stand at the far end of the office to view it on a normal PC)

that is not responsive
responsive means it responds to the device and works at optimum size on each...
so it should look PC like on a PC and simpler and re-flowed / re-structured on a tablet or phone...
Also, you shouldn't really be using plugins to make WP responsive - that is the job of the template itself - it is the underlying CSS (with perhaps a bit of JS magic) which detects the device window size and reflows the content...

web design like anything else has professional and not-quite-so-professional people operating businesses...
sadly though it is an industry where anyone who can talk a bit of jargon and has set up a WP website (read - non-technical!) calls themselves a web-designer...

[Hoofy]

akirk said:

that is not responsive
responsive means it responds to the device and works at optimum size on each...
so it should look PC like on a PC and simpler and re-flowed / re-structured on a tablet or phone...
Also, you shouldn't really be using plugins to make WP responsive - that is the job of the template itself - it is the underlying CSS (with perhaps a bit of JS magic) which detects the device window size and reflows the content...

web design like anything else has professional and not-quite-so-professional people operating businesses...
sadly though it is an industry where anyone who can talk a bit of jargon and has set up a WP website (read - non-technical!) calls themselves a web-designer...

TBH I couldn't care less how it's made "responsive". It looks like it should be responsive yet the text is massive on my screen. The site looks very good and providing I don't touch it then all is fine. Yet, things always need updating over time.

I guess they're two separate issues (responsive and whether it's well-designed or not... and whether it's a PITA to do anything beyond look at it and say, "That's nice.").

[Tonsko]

That and wordpress is like the holy grail to any would-be hacker who stumbles across your site. It can be worse than gruyere cheese (swiss cheese is too common these days. It needs to be hipster.)

[Hoofy]

Oh goodie!

[akirk]

Assuming that you have the one main website then it is absolutely fine on pc / tablet / mobile - ie it is working responsively - no big text here

On the other hand you might have some issues with the way it uses opacity to give the image changes when you hover - seems to break in some situations

[Hoofy]

FuUuuuUuUuuuuUUUuCK!

Been updating the page.

Tip for businesses: if you get someone to build the site for you so it looks amazing, make sure you pay them to maintain it so that you can tell them to update basic things like links using pretty buttons that fk up when you try to change it because the plugin code is st.

[Batfink]

If its a basic site get it designed so its easy to maintain by your staff, and plan in the training so they know what they are doing..

[Hoofy]

Batfink said:

If its a basic site get it designed so its easy to maintain by your staff, and plan in the training so they know what they are doing..

Well, that's precisely the advice I'd give to anyone getting a WordPiss site done from scratch now.

Problem with this site is that there are LOADS of plugins. I mean it looks fantastic on the face of it. Properly responsive with all that parallax slidey st going on and funky designer graphics. But fk me it's a hassle to update.

[Tonsko]

Which plugins Hoofy? The more you have, the greater your attack surface.

This site is a great resource that I use on testing engagements:

https://wpvulndb.com/

The guys who run that started by writing WPScan - worth running an updated version against your WP site, will give you a heads up on any potential security issues.

http://wpscan.org/

Apologies for banging on about it, but it is my job and I have a passing interest :P

Hope it helps you out. Can PM me if you have any questions.

[944fan]

Tonsko said:

That and wordpress is like the holy grail to any would-be hacker who stumbles across your site. It can be worse than gruyere cheese (swiss cheese is too common these days. It needs to be hipster.)

Yep. Wordpress still (despite everyone telling them) gives a different error if your username is incorrect to if your password is incorrect. Making username enumeration very easy. If they can't the basics right you can imagine what other holes there are in it

[Hoofy]

Thanks. Don't worry, Tonsko, I find it useful. Will have to run that scan.

Is there a site I can bang a URL into that will scan my site?

[Tonsko]

Google tells me that there are a few, but I can't recommend any of them I'm afraid as I've never used them. I'm wary of unverified checking sites.

[Hoofy]

Tonsko said:

Google tells me that there are a few, but I can't recommend any of them I'm afraid as I've never used them. I'm wary of unverified checking sites.

Because they could be a site set up and used by hackers?

[Tonsko]

Hoofy said:

Because they could be a site set up and used by hackers?

There's a chance. Like those sites that claim to tell you how secure your password is - just enter it here, we'll tell you if it's any good, honest.

Now - why would someone target your site? Well, first off, they wouldn't have to, you'd be going to them! Zero effort, making it easy. I had an email from PH about my car that I was selling - inside the email was a link to PH. The link took me to a PH login site - except it was a fake email, fake login page. The site it was sitting on was some Brazilian Wedding Photographer's wordpress site with not one, but two different remote access shells on it, and buried in the directory structure was a few different pretend login pages, with a text file that populated in plain text when people entered their login details. Ofc, I informed the PH team, but there's not a great deal they can do other than warn folk to be on their guard.

Now, I'm not saying that those sites that purport to check your WP site will do that - they might be legit. But you're always safer keeping information like that local. After all, someone doesn't have to go to the trouble of actually attacking you if you go to them!

I've just tweeted some contacts to see if anyone can point me in the direction of a reputable one.

Edited by Tonsko on Friday 23 October 20:49