wordpress on {bjørn:johansen}

Farewell to the WordPress Community

Mon, 21 Oct 2024 21:13:20 +0000

So Long, and Thanks for All the Fish

Migrating from WordPress to Hugo

Wed, 16 Oct 2024 23:07:00 +0000

Yesterday, I migrated this blog from WordPress to Hugo. These are the steps I took to do so.

Goodbye WordPress, Hello Hugo

Tue, 15 Oct 2024 19:11:22 +0000

This afternoon’s hobby project was to convert my WordPress blog into a static site using Hugo.

Install and update translations in WordPress with Composer

Fri, 10 Aug 2018 19:45:23 +0000

Using Composer is a great way of organizing your WordPress project, with WordPress itself, plugins and themes declared as dependencies. However, an issue I’ve often seen is how you install translation files and keep them updated.

Gravity Forms personal data exporter and eraser

Thu, 24 May 2018 00:25:56 +0000

When WordPress 4.9.6 launched on May 17, 2018 it came with new tools for exporting and erasing personal data that you may have collected (you know, GDPR and all). But Gravity Forms as of version 2.3.2 doesn’t integrate with these tools. Fortunately, it is really easy to write your own exporters and erasers.

How to mitigate CVE-2018-6389 – the load-scripts.php DoS “attack” in WordPress

Mon, 12 Feb 2018 22:38:40 +0000

A little sensationalist written blog post by Barak Tawily claims that WordPress is vulnerable to a DoS attack because of the load-scripts.php file which concatenates JavaScript files on the fly.

HTTP/2 Push WordPress Assets to First-Time Visitors

Mon, 29 Jan 2018 23:27:56 +0000

With HTTP/2 push you can effectively send a web page’s assets to the client before the client even knows about them. Here’s how you can HTTP/2 push WordPress assets to your first-time visitors.{{ double-space-with-newline }}

Another day, another “WordPress security vulnerability”

Sat, 27 Jan 2018 00:36:35 +0000

OMFG, BREAKING NEWS: Thousands of WordPress sites affected by some vulnerability.{{ double-space-with-newline }}

Welcome to WordCamp Oslo 2018

Thu, 25 Jan 2018 17:18:42 +0000

On March 2–4 2018, Friday through Sunday, there will be a great chance to meet WordPressers at the conference WordCamp Oslo 2018.

Cut 90% of your WordPress translations loading time

Sat, 20 Jan 2018 20:59:27 +0000

WordPress translations are compiled from human-readable PO-files into machine optimized MO-files, but still takes a lot of overhead to load. If you only could cache the translation load time, you would save a lot of page load time. We can easily cut 90% of our WordPress translations loading time.

Git Pre-commit Hook for WordPress projects

Sat, 20 Jan 2018 19:43:51 +0000

Wouldn’t it be cool if you, in your PHP project could define a package that makes sure that everybody who even tries to commit code is forced to follow the project’s defined coding standards? Yeah, me too. So I created this Composer plugin you can use in your projects.

Speed up the output by 1000x with a WordPress menu cache

Sat, 20 Jan 2018 18:29:37 +0000

Generating the menus in WordPress is quite resource intensive. Sites with few visitors and few menu items might not notice this much. But if you have a large amount of menu items, like in a mega menu, in combination with a lot of visitors the menu generation can be a real hog on your server’s CPUs. Let’s see if we can improve the speed with a little WordPress menu cache trickery.

Customize the WordPress maintenance mode page

Fri, 01 Sep 2017 17:00:17 +0000

Whenever you upgrade a plugin, theme or WordPress itself through the WordPress dashboard, WordPress will put itself in maintenance mode and all your visitors will see the maintenance mode notice “Briefly unavailable for scheduled maintenance. Check back in a minute.”

WordPress security for the casual blogger or small business with limited resources

Thu, 10 Aug 2017 16:37:51 +0000

The resources you have available to spend on WordPress security for your website usually vary vastly whether you’re an international corporation or just a hobbyist blogger. But since most attacks are automated by bots looking for vulnerabilities, a lot of the threats are the same. Here are some WordPress security measures that bloggers and small business with limited resources easily can take.

Use mu-plugins for adding custom functionality to your WordPress site

Wed, 09 Aug 2017 16:35:35 +0000

If you google “functions.php” you get about 7 million results. I bet most of them contain bad advice: “How to add functionality to your WordPress site”. Some of them continue even worse: “[…] without using a plugin”. For your own good, don’t edit functions.php to add custom functionality to your WordPress site. You can use mu-plugins to do that.

Don’t be “clever” with the translatable strings in your WordPress plugin or theme

Sun, 06 Aug 2017 09:30:00 +0000

Since I translate a lot of WordPress themes and plugins, I sometimes come across plugins who try to be clever with their translations. This tends to not work so well in reality.

A reference of all outgoing WordPress emails

Thu, 03 Aug 2017 18:53:30 +0000

As you may know, WordPress sends out email notifications from time to time. Actually, as of WordPress 4.8.1, there are 24 different occasions when WordPress will send an email message. Don’t you think it would be useful to have a reference of all outgoing WordPress emails?

The bus factor in the WordPress project

Sun, 18 Jun 2017 19:19:01 +0000

During WordCamp Europe 2017 in Paris, there was a Q&A session with Matt Mullenweg. I wanted to ask him a question, but due to high demand and restricted time, I never got to ask him. I guess Matt is a busy person, so I don’t expect him to actually answer this question himself. But maybe someone in the WordPress community has answers, insights or ideas? A person is the CEO of one of the most important WordPress-related companies.

Proper RFC 4122 UUIDs as GUIDs in WordPress

Sat, 10 Jun 2017 15:05:02 +0000

UUIDs (Universally Unique IDentifier), also known as GUIDs (Globally Unique IDentifier), is a string that identifies a piece of information in computer systems. WordPress use GUIDs to identify each individual post, but use URLs (kind of) for GUIDs, and thus does not follow the standard definition (RFC 4122) of a UUID (or GUID).

How to perform and mitigate a WordPress session donation attack

Wed, 22 Mar 2017 15:16:56 +0000

WordPress doesn’t use a nonce for the login form, which opens up for you to perform a WordPress session donation attack.

Immutable assets with unique URLs in WordPress for enqueued JS and CSS files

Tue, 21 Mar 2017 19:47:48 +0000

If you’re utilizing the browser cache correctly, you’ll gain huge performance benefits for your users, as well as save bandwidth and server capacity which equals to saving money. To do this right, you must create unique URLs for all versions of your resources, and tell them to never ask for the content again by telling the browsers that the assets are immutable resources.

Giving users a helping hand when authorizing them in WordPress

Tue, 24 Jan 2017 07:17:14 +0000

Inspired by how Facebook assists their users when they log in, I decided to implement something like the same for WordPress.

Move your WordPress site from non-www to www domain

Mon, 23 Jan 2017 18:49:14 +0000

So, you’ve launched your WordPress site on a non-www domain, like example.com, but since then found out that running it on on www, like www.example.com, is better and want to move? You’re in luck, because it is really easy.

Flexible Content Fields in Field Manager

Fri, 02 Dec 2016 19:42:06 +0000

Field Manager doesn’t have a flexible content field type as Advanced Custom Fields Pro does, but it is possible to mimic the functionality by using a little logic.

SVG uploads in WordPress (the Inconvenient Truth)

Thu, 26 May 2016 20:02:07 +0000

Enabling uploads of SVG files in WordPress is quite easy, and there is a tonne of posts on the Interwebs explaining how you do it. Usually along the lines of:

function add_svg_to_upload_mimes( $upload_mimes ) {
	$upload_mimes['svg'] = 'image/svg+xml';
	$upload_mimes['svgz'] = 'image/svg+xml';
	return $upload_mimes;
}
add_filter( 'upload_mimes', 'add_svg_to_upload_mimes', 10, 1 );

And that’s pretty much it.

Except it is not.

Allow SVG uploads to WordPress when behind Sucuri CloudProxy

Wed, 25 May 2016 19:29:02 +0000

Uploading SVG files to WordPress when you’re behind the Sucuri CloudProxy Web Application Firewall isn’t that straightforward, but it is possible.

Run all due cron events for WordPress with WP-CLI

Wed, 09 Dec 2015 15:45:48 +0000

Running a real cronjob is much more reliable than WordPress’ built-in “maybe-will-trigger” solution. But if you’re running a multisite network, you have to add a crontab entry for every site you set up – which is tedious. Thanks to WP-CLI, we can use a small bash script instead, which will run all due events for all sites for us. Oh, and it works for single sites as well.

Block access to PHP files on your WordPress site with Nginx

Mon, 19 Oct 2015 20:43:56 +0000

In your WordPress site, there are directories that include PHP files that visitors should never be able to access directly. They are only there for WordPress to function as an application that runs on your server. But because of WordPress’ directory and file structure, they are kind of accessible to the public. All of them are meant to be part of a larger application – WordPress, that is – and should not cause any harm if called directly – that we know. Some of the files execute some code even when ran standalone. An attacker might know of a clever way to make that code run in an unexpected manner, causing harm. To be on the safe side, we should deny access to all these PHP files from the outside world. Since we block access to them in our Nginx configuration, PHP will still run them as usual and WordPress will work just fine.

Strict file ownership for your WordPress installation

Tue, 13 Oct 2015 17:08:28 +0000

WordPress requires write access to one directory, and that one directory only: the directory returned by wp_upload_dir(). By default, this is /wp-content/upload, but it can be configured to anything that is beneath your document root, like /media, if you want to.

Two Factor Authentication for WordPress

Wed, 07 Oct 2015 07:56:02 +0000

If you’re using a strong password, brute-forcing is a very inefficient way of breaking into your WordPress account, and if it is really strong, dictionary attacks won’t help much either. However, there are are other, easier, ways for a mischievous person to get their hands on your login credentials e.g. with phishing, keyloggers or a MITM attack. By using a two-factor solution, you will increase your login security by an order of magnitude.

WordPress behind Big-IP

Mon, 28 Sep 2015 17:09:42 +0000

To be honest, I don’t exactly know too much about Big-IP, but I’ve come across someone who use it. They terminate HTTPS in Big-IP and WordPress runs on plain HTTP on port 80 on the backend nodes. By default, this makes WordPress confused, so you can’t login to the WordPress dashboard.

Using fail2ban to block WordPress login attacks

Fri, 07 Nov 2014 19:31:38 +0000

Fail2ban works by filtering a log file with a regular expression triggering a ban action if the condition is met. After a preset time, it will trigger an unban action. Without much effort, we can have WordPress log all authentication events and have fail2ban react on them.

WordPress Quality Guidelines

Thu, 27 Feb 2014 18:53:22 +0000

Any organization where multiple developers cooperate on a regular basis needs some guidelines to assure optimal quality of the end result. Most of these rules applies to freelancers as well.

«Slap-on» speed optimization of your WordPress site

Thu, 30 Jan 2014 15:23:00 +0000

OK, so you might have been at a WordCamp listening to talks or reading a few blog posts and you get that you should really get your WordPress site speed optimized. Starting all over isn’t either tempting nor something you have the time for. Don’t despair, you’ll get a long way by installing 5 plugins.

Optimize your JS and CSS loading in WordPress

Sun, 22 Sep 2013 22:04:51 +0000

When you get into page loading optimization, you will quickly find these «must-dos»: Combine your CSS and JavaScript files (respectively), minimize your CSS and JavaScript, load CSS before JS, load JS in body footer and then even some. Without much effort, we can make WordPress do all of this automatically.

Make Gravity Forms' JavaScript load in the footer

Thu, 19 Sep 2013 17:32:28 +0000

Gravity Forms is not only THE way to create and manage forms in WordPress, but is also pretty awesome when it comes to extensibility and flexibility. However, as most software, it has its issues. One of those is how it outputs some of the JavaScript, which in certain cases will break your site. This is how to fix it.

Why use WordPress as your corporate CMS?

Fri, 23 Aug 2013 15:42:20 +0000

There are now several years since WordPress was considered a blog platform only. Today, it’s a full blown CMS and perfectly capable of powering corporate web sites. Here I provide you with 5 non-technical reasons why WordPress is well fit for a corporate CMS.

Publishing WordPress site from development to production server – or moving your WordPress installation from one host to another

Mon, 12 Aug 2013 21:20:25 +0000

You have finished that WordPress site, and want to deploy it – move it from your test server to the production server where it goes live. But how? WordPress have a famous 5-minute-install, but there is no 5-minute-go-live-script*. I’ll show you how in these 5 easy-to-follow steps.

Restricting access to WordPress login by IP address

Sat, 20 Apr 2013 20:15:34 +0000

If you have a static IP address, like from your own VPN, it is very easy to increase your security tremendously. Simply restrict all logins to that IP address.