Yes... You Know Who You Are

This morning I made the startling discovery that an important WordPress site belonging to one of our clients had been hacked.

A Little History

If you’ve heard me speak in the last 5 years, you know that I’m a huge believer in the power of content marketing. We regularly recommend and teach business blogging basics to our clients. We have no desire to turn them into bloggers per se, but we’ve trained them that producing fresh, high quality content is a fantastic way to achieve visibility online and even provide fodder for social media outlets like Facebook & Twitter.

So… one of our clients who hired us to build out their WordPress site and for whom we’ve provided a fair amount of training and coaching for some time now began to experience a decline in search engine rankings. In their case, WordPress is installed on a separate domain from their main website. Their main website was historically not performing well from a search engine point of view (although it was great from virtually every other perspective when it was built), so WordPress was being used as a way to help prop up the main site. And it worked. Really, really well.

Imagine my surprise, then, when this particular site began to drop in the rankings for no apparent reason. Nothing had changed that we could tell. We did a little research and paid attention to what the competitors were doing and could see nothing significant enough to account for the change. It was very much an anomaly, because all of our other clients who were doing what we trained them to do were doing just fine.

So today, quite by accident, we found the culprit.

The WPRef Plugin

We were reviewing a piece of content before it got published when we discovered that a couple of the links had a rel=”nofollow” attribute. The content writer who was working on it had no knowledge of how to manually create that type of link (we certainly don’t train people to do that… especially for links that are created intentionally for search engine purposes!), so we knew something was up.

I inquired a little further to find out where the link had come from, and the answer was, “I copied it from another post.”

Hmmmm…. well… I assumed at first that something had crept its way into an earlier post and perhaps it had been duplicated a couple of times. I wasn’t looking forward to hunting down the original link. As I heard someone say recently, it’s like looking for a needle in a needlestack! But then I noticed that there was more than one link acting that way. So… I used the WordPress “preview” function to take a look at how the new post would look, and decided to “view source code” to see if the changes I’d made were taking effect.

That’s when I noticed this:

Every link within the content had been modified with a <noindex> and a rel=”nofollow” sitewide.

That would be a problem. The site’s being running for a while and there was a significant amount of content.

Digging a little deeper, I found that a plugin had been installed and given the name “WPRef”

We had backed up and upgraded the site to the latest version of WordPress on February 3rd. So… we checked our backup and found that the plugin was not contained in it. On the server, we found (via FTP) that a file called “wpref.php” had been copied to the /wp-content/plugins folder on February 10th.

Not only had the plugin been placed in that folder, it had been activated.

Checking a little deeper, we discovered that the plugin’s only function was to add a <noindex> tag and a “nofollow” attribute to every outbound link in the site’s content.

This amounts to a very specific, malicious attack. The only purpose of it can be to cause Google (and other search engines too) to ignore the site’s links.

Needless to say, I was infuriated. We’ve taken steps to harden that particular site. All my searching and other efforts to find evidence that others have encountered a hack like this have turned up nothing. It appears that (at least for now) this is a one-off, one-shot hack job. It’s hard not to believe that this site was specifically targeted on purpose.

The amusing thing was that the plugin added an options panel into the “Settings” menu. Within that, it output a bunch of gibberish, including some Russion domain names.  In the “Active Plugins” area, it purported to have “code.google.com” as its “plugin site” and its author was listed as Sergei Brin. I was so distracted by the infuration and frustration of the whole thing that I failed to recognize that it wasn’t just a Russian-sounding name to match the other Russian references… it’s the name of the famous Google co-founder.

Humorous.

So… we’ve saved a copy of this little piece of php code. Obviously, we’ve removed it from the site in question and have tested the site out. Our links are back to normal now. Presumably, this client’s search engine rankings will return back to their prior positioning. Actually, since the rankings were declining, we’ve stepped up the game for this client with some additional efforts and so the rankings should actually move higher than ever. So… if this was, in fact, a malicious attack which singled out this particular business… the plan has backfired.

Thanks. Whoever you are.

Though it’s still in the early stages of getting organized, I’m thrilled to announce the recent discovery of BarCamp Sarasota! Some old friends along with some friends I’ve not yet been introduced to are responsible for making this happen.

Things have gotten underway with a new home on the web and a Ning group which is all accessible at the BarCamp Sarasota website. Already there’s been an organizational meeting and another one is on the calendar.

So… calling all techies, bloggers, social media types, programmers, eggheads, geeks, propellerheads, etc.

Get over there and check out what’s going on… then get involved!

Then perhaps if there are enough WordPress users around the Sarasota area, we can manage to put together a WordCamp too!

(With apologies to all of my Geek friends for the photo… I’d hate to be accused of trafficking in stereotypes! Especially when we’re planning the takeover of the world! Oh… and… for the record, that is NOT a picture of me… from any point in my life!)

Typically, when a new version of WordPress is announced — and particularly when there’s a lot of fanfare around it — I’m prone to delay upgrading. WordPress is, for the uninitiated reader, the software that runs this site as well as countless others that I own and/or manage (I’m serious… I’ve truly lost count).

Since I’m a classic “early adopter,” this behavior might seem a bit odd. I assure you it’s entirely pragmatic. The upgrade process, though not complex, can take time — especially if the number of sites you’re working with is measured in the dozens (at least). Then there are the compatibility issues (or potential compatibility issues) with themes (not usually critical) and plug-ins (sometimes these are dealbreakers).

For example, my favorite statistical tracking plug-in had problems with WordPress 2.5 for months. I found some workarounds, but it’s hard to complain or apply too much pressure to a hardworking developer who writes these plug-ins and gives them away. (Ain’t it great?!)

2.7: A Big Fat Exception

Like many, I’ve been paying attention to the previews and the news about the 2.7 release candidates. Like I said, typically this pre-release “hype” doesn’t move me.

I have, however, been seriously looking forward to the re-write of the user interface for the backend of the system. What that means in plain English is that the WordPress developers have given you — as the owner or author of the site — a completely new system to look at and work with. The whole experience of writing on and managing your site is new. Most significantly, they engaged in significant usability testing that incorporated laser eye-tracking and other sophisticated ways of measuring whether or not we’re all going to like it and find it easier to use.

By the way, you can find a nifty preview video posted here to take a look at the new management console.

So… after noticing that the final release had been posted yesterday, I decided to go out on a limb and upgrade one of my newest sites. It’s a personal blog for me (David Johnson) and it’s brand new and doesn’t have many plug-ins installed — nor complex customization — so it seemed likely to be be a good place to test. Very little stuff to break.

The upgrade process was quick and painless. I always back everything up first (good habit), which was what took the longest. And aside from an annoying message about my favorite tagging plug-in which told me I’d have to switch (and which thankfully turned out to be false), there were zero complaints. Initially, I had problems with all the nifty new Ajax features, none of which seemed to work in my browser. After rebooting and otherwise trying to make the problems go away, it occurred to me to empty my browser’s cache. Since I’m a Firefox user and have the nifty “web developer toolbar” installed, this was a mere mouse-click and a few seconds of waiting — not nearly as painful as doing the same thing in Internet Explorer. Voila! Everything worked as pictured in the video.

The result? Let me tell you… it’s gorgeous. It’s delicious. It’s easy to use. It’s very well done.

I’ve not yet tested every single plug-in I use and recommend for compatibility yet, but I’ve now upgraded 3 of my sites. I’ll be shooting a training video on the upgrade process for members of our marketing training program, so let me know if you’re interested in getting your hands on that video (we’ll have a new enrollment opportunity coming up shortly). The members of that program that are currently in training will have the luxury of finishing their training using this delightful new version of WordPress. It’ll be good!

How ‘Bout You?

What?! You don’t have a WordPress-based website yet? Hmmmm… that probably explains why you’re not ranking well in the search engines for your real prospects’ actual searches. Stay tuned for help on that! Or better yet… subscribe to updates over at the Epiphany Marketing site!

If you’ll pardon the self-indulgence, Epiphany Digest, our Sarasota business blog turns 2 today! 

It just wouldn’t be right to let the day go by without throwing a little web party.  Have a look at that chocolate cake, will ya?

As for the site itself, we couldn’t have done it without WordPress, BigStockPhoto, and a bunch of great readers like you!

For an amusing trip down memory lane, here’s post #1 from September 9, 2006!

Why do small businesses build websites, anyway?

I’ve come to believe that most of them (the businesses) are suffering from dysfunctional strategy.  Perhaps hypo-strategy is a better way to look at it — a sort of neglect where it comes to developing any overall business philosophy or vision.

Why would I say this?

Most small business websites do just about everything except what they should be doing.

Websites should do 3 4 things for a business:

1. Get you noticed
2. Turn prospects who notice you into raving lunatics who will stop at nothing to buy your products or services.
3. Give those prospects multiple ways to: contact you, interact with you, buy from you, and (depending on your business) receive their purchases immediately
4. Get you noticed some more.

If I were to reverse engineer the strategies behind most of the websites put up by small  businesses, I would conclude that the driving business goals were (in no particular order):

• Duplicate our print brochure (from 4 years ago) in HTML
• Show our competition that we can do do that (have a website) too
• Throw uncle/cousin/nephew/grandchild/friend-of-a-friend who “knows about the internet” a bone
• Show the world our lack of taste by giving us a crack at designing (rather than paying for real design work)
• Set it and forget it
• Make it as hard as possible for anyone who might need or product(s) and/or service(s) to actually find us
• Create yet another piece of marketing for which we have no means of measuring effectiveness and ROI

Hey… if you don’t need any more customers or any additional revenue, then by all means, build your website with some of these goals in mind.

But if you’d rather get some results, then there are a couple of things you need:

• Your own self-managed hosting account running Linux or Unix with Apache, PHP, and MySQL
  • There are lots of hosts, but I recommend 1and1.com
• WordPress
• A couple of hours to download, upload, install, and tinker

Why WordPress, you ask?  Two Three reasons:

1. It will get you noticed (as long as you have decent content)
2. It is user-updateable
3. It will get you noticed

Full disclosure:  it would be impossible for me to own any stock in WordPress, because it’s open-source (and they give it away), and the link to 1and1 is an affiliate link (meaning after you buy your account with them, they’ll issue me a small credit).

 ”But David, we don’t have anything worth putting into a blog… and we don’t want to have to keep writing all the time.”

Then just do us all a favor:  close your doors now.

Plus, you can use WordPress as a “content management system” in addition to using it to publish your frequent blog posts.

There’s a lot more to internet marketing than what we’ve mentioned, of course, but in a world where content is king, where frequently-updated content is the supreme king, and where everyone who needs what you’re selling will search for you (most likely using Google), you absolutely must turn on a customer magnet… or watch as your competition gets your future customers instead of you.

By the way, here are some snazzy examples of businesses using WordPress:

• Michael Pink at Selling Among Wolves
• Mountain Lighting Galleries, Hiawassee, Georgia
• Nourish The Dream (OK… a little shameless self-plug)
• Justin DeStoppelaire at C Service Consulting
• Dr. Kassicieh at Sarasota Neurology

There are lots more, of course.  But the main thing to look for is whether a particular business is getting noticed!

Are you?