WordPress getting a face lift

[The Buzz]

VentureBeat says that the new version of WordPress to be released soon is to be the "best WordPress yet."

(Automattic founder Matt Mullenweg) said WordPress 3.7 will be coming out in October with security and language features, and 3.8 development starts tomorrow with a release scheduled for December. The Twenty Fourteen theme, a magaziney visual extravaganza, should be released before the end of 2013 and will feature a lot of premium-like features.

http://venturebeat.com/2013/07/27/br...wordpress-yet/

[LukeC]

Sounds promising but hopefully it won't cause too many compatibility issues.

[ocreditor]

Hope so.

[rak]

please.. please.. please.. keep the same hooks for plugins. I really don't want to spend time re-writing my custom plugins, widget and themes.

With every major update, they usually change the database structure somehow.

I got a feeling, there might be some social media integration with this release. Possibly blog stats as well.

[edgarf76]

please.. please.. please.. keep the same hooks for plugins. I really don't want to spend time re-writing my custom plugins, widget and themes.

With every major update, they usually change the database structure somehow.

I got a feeling, there might be some social media integration with this release. Possibly blog stats as well.

I do not get why they keep making these updates. The last update helped the photos a bit but it really did not do much. If there is social plugins that is good but almost every wordpress user has 3rd party plugins already. I think it would be bettor to keep the same version if there is nothing wrong with it.

[DaftDog]

I do not get why they keep making these updates. The last update helped the photos a bit but it really did not do much. If there is social plugins that is good but almost every wordpress user has 3rd party plugins already. I think it would be bettor to keep the same version if there is nothing wrong with it.

It's called evolution. Imagine if we had stopped evolving once our ancestors had invented fire.

[ocreditor]

By the way, to anyone using wordpress beware of the link spammers that knows how to hack to the wordpress admin and plant in the site header a bulk of fishy outgoing links. Its hidden and the only way to find it is by doing view source.
There are several solutions for this problem on the web.

[DaftDog]

If you have the current version of WordPress this should not be a problem. Sometimes dodgy plug-ins have a backdoor that allow hackers in. Any semi experienced affiliate who uses WordPress should be aware by now that using "admin" as a user-name, along with a weak password, is a grave security threat.

[AffMike76]

That's right!!!

[ocreditor]

...WordPress should be aware by now that using "admin" as a user-name, along with a weak password, is a grave security threat.

Not sure its enough, always good to have a strong pass but you also need to get rid of the dodgy plugins and maybe block access to admin by IP and leave several or single approved.

[rak]

Not sure its enough, always good to have a strong pass but you also need to get rid of the dodgy plugins and maybe block access to admin by IP and leave several or single approved.

Agreed! Ideally you'd want admin login to work via IP. If admin enters correct user and pass, from a different IP as its last IP - sends an email to add that IP to the "accepted" list. User clicks link on email to add IP to the database.

But the dodgy plugins is where its at. You just need to find one which is poorly coded, doesn't use the hooks, sql injection, and you're in all sorts or trouble.

[edgarf76]

Agreed! Ideally you'd want admin login to work via IP. If admin enters correct user and pass, from a different IP as its last IP - sends an email to add that IP to the "accepted" list. User clicks link on email to add IP to the database.

But the dodgy plugins is where its at. You just need to find one which is poorly coded, doesn't use the hooks, sql injection, and you're in all sorts or trouble.

How can you tell where the last IP login was?

[rak]

How can you tell where the last IP login was?

Store in a custom table in Wordpress.
Eg

If admin logged in successfully - thats check #1

Check the current users IP against one stored in the database for user admin
if they match.. continue successfully to admin panel - check #2

if not match, send an email to email address associated with the account with link to add the new IP Address.

Admin user clicks on link in email - it adds the users IP to some custom table in WP.

Admin user now tries to log into the panel, and it should be successful, as their IP is in the table, it matches their IP.

Thats what WP should be doing. I'm not sure if its possible to create a plugin which adds a step for check #2 - but with how flexible WP has become, it wouldn't surprise me.

[universal4]

You could probably just as easily protect the admin folder with a username and password.

In that manner you couldn't even access the login page without the webserver authenticating the user. I guess you could also possibly do an ip check, although I would have to think about how to do that.

Rick
Universal4

[Pmig]

I give up wordpress long time ago, switched to drupal and never look back again (on all my network only have 2 wp sites).

drupal have a huge learning curve, but once you learning it worth every single second you take studding...

[universal4]

Here are a few plugins that might do the trick.
http://wordpress.org/plugins/limit-login-attempts/
http://wordpress.org/plugins/restricted-site-access/
http://wordpress.org/plugins/whiteli...ogin-attempts/

Please understand I know nothing about any of those plugins and am not endorsing any of them, but offered as something that might work. If anyone has any personal experience with them or others, let us know.

I am a firm believer in using security methods that are server-based when possible, instead of depending on a third party plugin or program since that adds more overhead.

Making a few quick searches I see it is fairly easy to do in IIS 7, and workarounds available in IIS 6. (this means no database queries are needed, and if the ip doesn't pass, you won't even see the page requested) My guess is you could do something similar with ht access on a Apache server.

Rick
Universal4

[sweetbet]

I'm looking forward to it. I love wordpress.

[ocreditor]

Here are a few plugins that might do the trick.
http://wordpress.org/plugins/limit-login-attempts/
http://wordpress.org/plugins/restricted-site-access/
http://wordpress.org/plugins/whiteli...ogin-attempts/
...

Thanks for sharing !

[xecutable]

Finally took the step to update after a few days of that message showing up. Nothing got broken, various plugins were updated and all worked out fine. To be honest I didn't see much difference.