🍑 It’s June already. Time flies. Here’s the highlights of what happen in my life in the past six months. Read More 2015: Half Year Review
Archives
48 Hours Theme Challenge
Explorer
A beautiful WordPress theme inspired by file explorer. I create this theme in 48 hours (well, actually 12.5 hours).
So, a few days ago Sami Keijonen create a challenge to build a WordPress Theme in 48 hours. He mention that he need several months to build a WordPress Theme.
Well, for myself, the challenge is not really hard. I usually build a theme in 2-4 days for simple custom theme. As long as the client already have a design (PSD/design inspiration/example) I can build it in less than a week.
I only charge $300 – $500 for a very simple theme. So, I need to work fast 🙂
HP Stream 7 Review: Things I Wish I Knew Before Buying 7 Inch Windows Tablet
Around a month ago, I decided to buy a cheap Windows tablet from eBay, HP Stream 7. This model is not available here in Indonesia. Here are several things I wish I knew about this tablet before buying it.
How much it really cost?
Well, if you are in America, you can buy it for $80 at Microsoft Store. But they can’t ship it here so I purchased it from eBay:
$100 – Normal price
$30 – Shipping (it took around 1 month to get here using USPS)
$10 – Tax, administration, etc
So in total around $140 (almost twice the price)
I also bought 32 GB MicroSD Card ($15), so I spent around $155 for this device.
Is it sucks?
Yes, kinda. But is it worth the money? (probably not)
Read More HP Stream 7 Review: Things I Wish I Knew Before Buying 7 Inch Windows Tablet
How to Test Your Code in Multiple PHP Version (only $10/year)
WordPress is a Global CMS, with very minimum requirement to install:
PHP: version 5.2.4
MySQL: version 5.0
I’m sure most of us have better server configuration than the minimum. I think most hosting have at least PHP 5.4 installed. but as a freelancer, sometimes we get a client with older version of PHP in their server. And for whatever reason they cannot/do not want to upgrade to better hosting.
If you don’t have multiple PHP version in your server, you can always install multiple PHP version in your server and pollute your server with outdated script.
Or you can spent $10 and have a separate server where you can test your code for whole year.
$10 / year, that’s only $ 0.83 / month Read More How to Test Your Code in Multiple PHP Version (only $10/year)
How to Sanitize Image Upload?
Today I updated my plugin f(x) Favicon (no longer available, WordPress now have “Site Icon” feature), and I would like to share in how I sanitize image URL in the plugin uploader.
Why sanitize image upload?
Basically what we need is to make sure that the input is an image URL. So, we don’t want user to input other file such as document file, video file, mp3 file, etc.
And this is to make sure our plugin/theme working correctly. We also need to do this check before loading the file.
Wanted result:
<link rel="shortcut icon" href="http://siteurl.com/path/favicon.png"/>
Unwanted Result:
<link rel="shortcut icon" href="http://siteurl.com/path/some-random-file.doc"/>
How to use $this in Anonymous Function in PHP 5.3
Yesterday I wrote a WordPress Login Notification Plugin. And I use Anonymous Function (introduced in PHP 5.3) in the settings. It work well in my server but when I install it in my client site, the settings page is truncated even though my client use PHP 5.3.
After some googling, I found that we cannot use $this in anonymous function in PHP 5.3, we can use that only in PHP 5.4 +. Thank god I didn’t get fatal error 🙂 Read More How to use $this in Anonymous Function in PHP 5.3
How To Add Background Color (Highlight) Option in WordPress Editor TinyMCE
WordPress Visual Editor only have text color option. But sometimes we need to highlight the text by changing the text background color. TinyMCE (the editor script) actually have this feature, but WordPress hide it to make the visual editor simpler. But if you need this feature, you can activate this feature using very simple code.
Read More How To Add Background Color (Highlight) Option in WordPress Editor TinyMCE
How to Fix Google Apps “Send mail as” : “Functionality not Enabled”
- Login to Google Apps for Work Admin Panel.
- Go to “Apps” settings: Manage Apps and their settings.
- Select “Google Apps“: Gmail, Calendar, Drive, & more.
- Select “Gmail“.
- Scroll to the bottom and click “Advanced Settings“.
- Uncheck option “Allow per-user outbound gateways” and Save.
- Wait for 1 hour.
- Check (reactivate) “Allow per-user outbound gateways” option and Save.
- Wait for 1 hour.
- Try to set “Send Mail As” feature in your Google Apps Gmail Settings again.
If it’s a success you will see SMPT outgoing setting after you submit the “Send mail as” email address and no longer see “Functionality not Enabled” message.
How to Display Multiple Location in One Google Map
This is how I Display Multiple Marker Location in One Google Map. The trick is how to make all marker visible (make the map range/area to fit all marker) using maps “bound“. Read More How to Display Multiple Location in One Google Map
Create WordPress Settings Page With Meta Boxes
In this tutorial I want to explain Step by Step How To Create WordPress Settings/Options Page With Meta Box, like what you see in this screenshot:
WordPress have a decent Settings API and it offer a lot flexibility in design. Several plugins do “wild” things in their Settings Page, However for better user experience it’s best to use seamless design (blended) with other admin UI design.
One of my favorite admin UI element is Meta Box. Not only because meta box have an easy to use Meta Box API (so we can easily create meta boxes), but it also have user preference options where user can reorder (drag-and-drop) the position, toggle open/close meta boxes. and even changing Screen Layout to 1 or 2 column using “Screen Options”.
Benefit in using Meta Box in Settings Page:
- Nice UI : Neatly Group Complex Settings.
- Minimum Design Time : WordPress already have the design.
- Easy to use : because user already familiar with how the panel works.
- Extend-Ability : Other developer can easily extend our plugins and add options with familiar API.
So Let’s Start ! Read More Create WordPress Settings Page With Meta Boxes
Fighting Brute Force Attack in WordPress
Brute Force Attack is a daily problem for WordPress sites. What’s interesting is that you cannot prevent it from happening. It’s unavoidable. You can only make harder for the attacker to attack your sites.
If we use CMS with login feature to manage our content, we cannot remove/disable the login functionality because we need it to get access to manage the site.
You can use the strongest password, two factor authentication, etc. But it will not stop the attack to your site.
Every single login attempt will cost you server resource. You cannot cache this page to reduce the impact because WordPress need to validate each login attempt.
They can try to get access to your site, and fail. But they still can make your server collapse.
( or make you pay a lot of money if you use hosting that calculate price by pageviews )
But, we can try to discourage attacker by blocking IP addresses they use. If you use relatively good hosting, you probably have firewall system installed in your server to log and block attacker. But you can also install security plugin to add another layer of security. Several plugin for WordPress brute force protection:
- Limit Login Attempts : un-maintained plugin, if I’m not mistaken WP Engine auto-activate this plugin for sites hosted there.
- BruteProtect : Use their server to log IP addresses, kinda like Akismet for brute force attack. You need to register to their site to get API key for each of your site. Currently owned by Automattic.
- Login Security Solution : similar with limit login attempt, maintained. And have multi-site support. This is the plugin I’m using.
- And a lot more alternative…
It will reduce their attack, but because they seem to have unlimited number of IP Address, it’s actually (kinda) useless method to try to discourage them.
Quoting from Matt Mullenweg:
Supposedly this botnet has over 90,000 IP addresses, so an IP limiting or login throttling plugin isn’t going to be great (they could try from a different IP a second for 24 hours).
You can also read other sources to understand the scale of the attack:
- WordFench : Large distributed brute force attack underway at 40,000 attacks per minute.
- Sucuri Blog: Understanding Denial of Service and Brute Force Attacks – WordPress, Joomla, Drupal, vBulletin
Every single day in each sites I got hundreds of failed login attempt. Probably tens of thousands if it’s not protected by firewall and security plugins. It happen in every single site. Not even one site is free from brute force attack.
Several days ago, I ask for advice at Theme Hyrid Forum (private forum replies). I got several response. And from their response I create a custom solution for my sites and my clients sites.
I tested it in 10 different sites for 24 hours, the result is amazing. I got almost zero login attempt.
Even though it’s still premature to say that this solution is working. In this post I would like to share the custom solution I build to solve this problem. Read More Fighting Brute Force Attack in WordPress
My WordPress Journey
I started my online life just as a hobby. The idea to make money online is interesting to explore. Almost no reason, just ’cause.
I created my first blog on blogger and purchased my first domain from Google Apps. Register to Google Adsense and think that I’ll start making $$$. I was wrong. It’s tough, need a lot of dedication. I need to learn SEO, content research, etc. Read More My WordPress Journey