Petersen Media Group

We help you spend less time ensuring your site is there, and more time making it profitable.

When to Use a Plugin in WordPress

WordPress plugins are great — to a point. Too many of them in an install and it looks like a 3-ring circus of a Dr. Frankenstein experiment. A little of this, a little of that, and after 50 plugins, it’s ALIVE! Congratulations, you’ve created a monster. In this article, I’ll explain when to use and not to use a plugin — and why — and discuss those situations that fall in the middle and what I do then.

Don’t use a plugin

I don’t always use a plugin when a simple custom function in the theme’s functions.php file will do the trick. Some advantages to that method are:

  • as long as it’s simple enough, you’ll probably never need to update it, unlike plugins
  • very small footprint and overhead for the system
  • complete control – some plugins just leave you wanting more or different
A good example of when to not use a plugin is the simple task of adding Google Analytics for your site. There are dozens of plugins, including Google Analyticator, that connect your Analytics account to the site, but if you’re going to do that, you’re already in the Analytics dashboard and can simply copy/paste the code into your theme without adding the overhead of a plugin that you need to keep updated.
I’ve seen a plugin installed to remove

Use a plugin

Sometimes you want a function/feature that would take 100, 1,000, or even more lines of code to achieve. Then you’d be on the hook to fix it if WordPress changes enough that the feature breaks. That’s when you use a plugin. Some great examples are the premium plugins such as Scribe, Gravity Forms, Cart66, etc. There are also dozens of top-quality free plugins such as WordPress SEO by Yoast, Digg Digg, and many of the free plugins built specifically for the Genesis framework.

Falls in the middle

In the middle of the pack are things you can do without too much effort, but take 2 minutes via plugin. The MailChimp subscribe widget plugin comes to mind immediately. It’s very little effort to add a subscription form to your site using MailChimp’s pre-made forms (they literally hand you 3 that work from your account dashboard), but it’s also very little effort to add a widget via plugin.
With things that fall in the middle, I decide based on how likely it is that I’ll need to customize something and whether it’s easier to customize my code or if the plugin already has options available. A second factor is reliance on a script. Most remote scripts update and keep things working. If it’s a local script, it can break when WP updates or when a third-party service (like Twitter or Facebook) change the rules.

Open floor discussion

That’s what I do when I’m evaluating a new project or cleaning up an existing site. I’m not a top-tier programmer, though, and I know several devs who have a much bigger bucket for not using a plugin because they just program the crap out of things because they’ve already taken a few hours or days to write custom code for other projects that they can paste into a new site in moments.
Because of that, I’ve begun collecting all of my snippets for use across many projects in an attempt to be consistent. I’m proud of where my collection is now compared to a year ago, but it still has a ways to go. I’m using a few platforms until I figure out what I want to settle on. I’m using: GitHub, Koding, Snippley for Mac, and Code Collector Pro for Mac.

Being an Expert Trumps Being a Freelancer

There is a distinct divide in the professional services industry, yet one term is used to clump everyone into one category: freelancer. I hate the term, even though it may seem like splitting the hairs of intended use of English. While most use the term out of a lack of a better word at the moment, others use it in a condescending tone, much like “the nanny” or “the help.”

Freelancer

Freelancers are frazzled shells of their dream selves when they quit their job to work from home and live a life of freedom. They are worn down, bowing to the illogical demands of many people who want to devalue their work and wring every bit of work out of them for the least amount of coin. All you have to do is spend 10 minutes at the hilarious site Clients from Hell to see how bad things can get if you’re not respected by your clients.

In most cases, a freelancer has just left the corporate world and is just starting out under their own name or they lack the skills or confidence to give themselves a promotion.

Expert

Experts, on the other hand, are respected, in-demand, and generally laid back because they run much more of the show than a freelancer. They are able to offer more to their clients than just delivery of a project to get their money — they improve their clients’ position in the marketplace.

There are several traditional definitions of what makes an expert, but they all agree that it takes time, dedication to their trade/skill, and even some amount of luck being in the right place at the right time with the right tools and support (Malcolm Gladwell – Outliers). Even using the basic “10,000 hour rule,” I surpassed that easily quite a while back, but that’s not all it takes… because some people do jobs poorly for many years without ever expanding their skill-set or improving customer satisfaction.

Can you look at past work and shudder that you used to do that crap months and years ago? If you can’t, then what have you been doing with your time – just running the rat race?

The Difference in the End

In the end, the difference comes down to a few things, while seemingly like nerdy English class exercises, they amount to a big deal.

First, you respect yourself more knowing that you are at the top of your game. Sure, there is almost always (always unless you’re actually the world’s greatest at something) someone better than you, but if you’re an expert and know how to take care of business, you’ll know you’re not at the bottom.

Second, your clients will respect you more than if you’re some $20/hr schlub. Charging those rates doesn’t command respect, timeliness, politeness, or anything a client might be tempted to do if you’re a “dime a dozen” person. You’ll know the difference the first time a client e-mails you for your opinion on something before spending money or backs out of something just because you advised them of dangers.

Third, your peers will respect you. Some industries are cutthroat. My industry can be, but (by and large) the WordPress developer community, especially the Genesis community are cooperative. We share info, tweet for help, discuss new ways to accomplish things, and even team up to complete projects using everyones’ best skill areas. If your peers respect you, then when they’re busy, they’ll send work your way. Be sure you do the same, by the way.

So, what do you want to be? An expert or a freelancer?

Never Keep “admin” as a WordPress User

For years now, the “admin” account has been a well-known entry point to any WordPress site for an unscrupulous hacker:

Go to domain.com/wp-admin, enter “admin” as the user, and just keep trying passwords. You’ll eventually get in.

So, if you’ve got a WordPress site that still has a user named “admin” or even “Admin,” you’re a sitting duck. I’ve seen 750+ login attempts in 5 minutes happen on WordPress sites. A funny side-story, I was in the ER at the time and my iPhone started going nuts with plugin-generated e-mails and I had to insist on grabbing the laptop from my wife while hopped up on morphine to kill the attack.

Here’s a look at the current lockout list of several of my client sites with established histories and good traffic – you’ll notice lockouts of 155, 87, 48, 24, and 20 attempts from one IP address each:

"admin" lockouts

Not looking good for sites who actually use “admin” as a valid user, eh? There is a science to hacking into accounts of all kinds using password lists, tables, and very easy scripts that run through entire dictionaries. It takes no effort to gain access to such sites or accounts if there is only one variable: the password. Password security is a whole other topic for another day, but let’s address killing the “admin” user for now.

Omigosh! I have “admin” as a user! What do I do?

Oh noes! You’re very clever to have checked now, aren’t you? Congrats. Let’s swoop in to the rescue with a very simple procedure to kill off such a glaring hacker welcome mat. To rid yourself of “admin” without losing any posts/pages/etc. you need only take the following easy steps:

  1. Create a new login with a better, less guessable username (to keep the same e-mail address, change the e-mail associated with “admin” first) – I recommend using a 15-20 character password using http://www.strongpasswordgenerator.com – and for goodness sake, make sure you make it an administrator account.
  2. Log out of “admin”
  3. Log in to your new user.
  4. head to the users page and delete the “admin” user
  5. On the next screen, assign all posts/content to the new user you just created.
  6. What? You expected another step? C’mon, I said it was easy.

Update from WordCamp Orlando 2012: if you have access and are comfortable in phpMyAdmin, then this is the command to auto-correct without looking for it:

UPDATE wp_users SET user_login = ‘username’ WHERE user_login = ‘admin’;

More on security

I’m going to be doing many more articles on WordPress and online security in the coming weeks.

Save BIG on WP Engine Managed Hosting This Weekend Only

Most of my clients, soon to be all of my clients, who host with me are on a WP Engine account and thoroughly enjoying the speed, security, and peace of mind that comes with hosting with a company that only deals in WordPress sites.

It’s expensive, though, with plans starting at $29/mo for one domain and $99/mo for 10 domains and $249/mo for 25 domains. With that last package, you get a dedicated IP address and much more of a traffic and storage limit.

A fast, secure website is one of the most important expenses your business has. Skimp there and you look like a goof with a site that’s too slow… which also affects your Google indexing.

You want fast.

You want secure — I lost track of how many sites I was called upon to get off the Google blacklist this year.

It’s well worth the price, but what if you want to save some serious money? Who doesn’t want to save coin, seriously?

Get your savings here

This weekend, only, get $25 off each month for the first 3 months – that’s $75 off your first 90 days. Here’s what you do:

  • Go to their site…
  • Pick a plan and enter the coupon code: “blackcyber“
  • Do so by the end of the day Monday the 26th.

Your own account, or with my account

I’m currently hosting 24 clients in my account and I’m upgrading to an unlimited account next week, so if you’re not hosting with me and want to have your own account with your own support — it’s all good, some people just like to hold on to their keys instead of using valet — then you really want to switch to WP Engine.

I’ll be writing more about hosting this week, but this deal will be over before then.

Head on over there for your deal or get in touch with me in the comments or on my contact page if you’d like me to add you to my unlimited plan with dedicated hardware.

I’ve learned a lot about hosting over the past 6 years, and this is the best hosting you can buy and still keep your arm and leg.

Benefits to Using a Theme Framework

Genesis Framework for WordPressBy now, most everyone using WordPress for their website or blog has heard of Genesis, the theme framework created by Brian Gardner and his coders at StudioPress. Most casual users (read, non-geeks) have heard of a framework or two, but don’t really have an understanding for what they are or the advantages to using one. Frameworks have distinct advantages over traditional themes and Genesis has advantages over other frameworks, which is what we’re going to discuss in this article and a later article on Genesis, specifically.

The essential difference of a theme framework vs. a traditional WP theme is compartmentalization. The theme you work with — the child theme — is separated from the core theme — the parent theme, Genesis — and is thus immune from updates to the parent theme. Genesis acts as a gateway to the WordPress functions that evolve over time and eventually make a theme completely out of date. What this means to the basic user is that when they update Genesis and WordPress, they don’t lose the hundreds or thousands of dollars in theme modification because the child theme is untouched.

When WordPress changes

Let’s discuss the “going out of date” issue so it doesn’t sound like a used car sales pitch. WordPress 3.0 introduced custom menus. No longer did you have to go into a theme’s header.php file and edit the code that called the pages or categories into a menu-like arrangement. It was one of the most common requests of devs back then — “How do I add x to my menu?” — and often created very creative code that there was no way the site owner could change it again without paying for more changes.

It’s funny to think back to WP 1.6 or so and remember  the need to populate sidebars with PHP code, themes weren’t “widget-ready,” widgets didn’t have CSS-identifiable IDs and classes, and people spent a fortune on rotating header images because the default Kubrick theme had it, but their premium theme didn’t.

Then WP updated and added widgets, menus, etc. and their entire site was suddenly very lacking in the dashboard abilities that were barren because their themes didn’t know what to do with all of these cool functions. They were up a creek without a paddle.

Introducing child themes

A couple of major theme developers began allowing and instructing their customers about child themes so they could edit certain page templates and the stylesheet without those changes disappearing when they came out with another release of the premium theme they just shelled out $30-$299 for. Mimbo Pro by Darren Hoyt was one of the first successful premium themes to help people out with child themes. I used Mimbo Pro for one of my sites for several years and still have some clients running it because we used a child theme for it and extended its life that way.

A child theme needs 1 file in order to work: style.css. This file points at the parent theme and overrides any styles (the main source of formatting changes to a theme). You can also add a custom functions.php file to override or add any functions to the parent theme and also any template files such as archives, blog index pages, or a custom homepage/front page. All of these files are then immune from updates to the parent theme — that is, in the vast majority of upgrades, nothing will break or disappear when updating the parent theme, usually only new features appear.

Some exceptions

At one point, Genesis changed the syntax of their menu CSS. Thesis, the other major framework, did once, also. What happened when we upgraded the parent themes in those instances is that we lost any customizations to the menu CSS that referenced the modified syntax. So if we edited #nav-menu repeatedly in the child theme, and the menu itself changed to .menu in the parent theme, we then needed to edit the child theme to reflect the new menu CSS. It was a simple matter because so little usually changes that affects the design and functionality. I can only think of a couple of widgets that have gone away over the last 24 months, but the code was still present in depreciated areas of the theme… just in case anyone was still using them.

Moving on with the next article, we’ll discuss Genesis specifically and why I use it exclusively for every project and have for since 2011.