Try it. Enter http://www.yourwebsite.com/wp-config.php and you should see a blank white page (if you see plain text, you’ve got a bigger problem).

Harmless, right? Sure, but imagine for a minute the shared server you’re on somehow gets hacked and the php handler gets changed to txt–you’re in trouble. It’s not very likely but you can make one of the following changes to prevent this which adds another layer of protection and gives you peace of mind.

There are two main ways to easily protect the wp-config.php file from prying eyes and hackers. Both methods require you to have sftp or server-level access. Also turn off any caching plugins you may be using before attempting this steps.

Move your wp-config.php file up one level (image source: theclickstarter.com)

Option 1 – Move wp-config.php up one directory

This is the easiest way assuming you’re comfortable moving files on your server. Essentially this works by taking wp-config.php and moving it outside of the public realm (typically one level above /public_html).

The cool part is WordPress automatically knows to look up one directory if it can’t find wp-config.php in the default location.

Option 2 – Modify your .htaccess or .conf file

This option is a little more advanced and requires that you’re running Apache or Nginx. You’ll need to edit your .htaccess file (Apache) or nginx.conf (Nginx) using a text editor. Be careful not to alter any other code in this file otherwise your site may break.

For Apache, paste the following code into .htaccess at the top:

# Deny public access to wp-config.php
<Files wp-config.php>
    Order allow,deny
    Deny from all
</Files>

For Nginx, paste in the following code into nginx.conf:

# Deny public access to wp-config.php
location ~* wp-config.php { 
    deny all; 
}

Save and sftp it back to the server (if needed). You’ll need to restart Nginx but not Apache.

To test if it works, try visiting http://www.yourwebsite.com/wp-config.php in your web browser again. Instead of a blank white screen, you should see an “Access Forbidden 403″ error message.

What does AppThemes use?

We run multiple WordPress sites (multi site and single instances) so our needs are a bit more advanced. We also keep our sites in a git code repository that run auto-deployments which makes it a little more difficult to accomplish option #1.

Instead, we opted for option #2, albeit a tad more advanced implementation. We’ve got a dedicated server with complete root access so instead of having to manually add the deny block to each .htaccess file, we setup a global directive in httpd.conf. Just paste in the option #2 code, save, and restart Apache in order for it to take effect.

For even more advanced security WordPress tips, check out the “Hardening WordPress” page on the WordPress site.

Sidebar

Previous to Clipper 1.3, a “Share a Coupon” button was hard coded at the top of each sidebar. Starting in version 1.3, this button is now available as a sidebar widget. Now you can decide which sidebars include this coupon sharing button. Just like any other sidebar widget, you can also control where the button appears in the sidebar.

Sidebar Button

To add the “Share a Coupon” button to the sidebar…

• Go to Admin > Appearance > Widgets
• Find the “Clipper Share Coupon Button” widget
• Drag and drop the widget to the desired sidebar
• Add a Title – this will appear as the large text on the button
• Add a Description – this will appear as the smaller text on the button
• Click the Save button

By default, the button does not appear in the sidebar. The widget must be added to a sidebar in order for it to appear in your installation of Clipper.

That’s it. Not sure how widgets work? See the WordPress Codex article on widgets.

Primary Navigation

We have also added a “Submit a Coupon” link to the primary navigation of Clipper. By default, this link is included in the primary navigation but you can easily remove it, change the location and change the text on the link. Even though Clipper 1.3 comes with this link already in the primary navigation, we’ll start the tutorial with instructions on how to add it to the primary navigation, just in case. Here’s how you do it…

Primary Nav Link

• Go to Admin > Appearance > Menus
• Make sure the Clipper Main Menu tab is chosen
• In the Pages panel, check the box next to Share Coupon
• In the Pages panel, click Save
• You will now see that Share Coupon has been added to the bottom of Clipper Main Menu
• Change the position of this item by clicking and dragging it up and down the order of menu items
• Add desired text (IE: Submit a Coupon) to the Navigation Label in the Share Coupon menu item
• Click the Save Menu button
• On the same page in the Theme Locations panel, click the option menu under Primary Navigation
• Choose Clipper Main Menu
• Click the Save button

There you have it. Need help on WordPress menus? Read this article on WordPress menus on the codex.

Below are the instructions on how to enable PDT for your Vantage install:

Note: In order to use PDT, you will need a PayPal business account. Upgrading is easy and free. Just log into your PayPal account and click Upgrade.

1. Log into your PayPal account
2. Click My Account > Profile
3. Click Selling Tools
4. Under Selling Online, look for Website Preferences and click Update on the far right
5. Website Payment Preferences page
   1. Under Auto Return for Website Payments, click On
   2. Enter a URL in the Return URL field (see extra notes below)
   3. Scroll down to Payment Data Transfer and click On
   4. Scroll to the bottom of the page and click the Save button
6. PayPal will return a message in a green box that reads: “You have successfully saved your preferences. Please use the following identity token when setting up Payment Data Transfer on your website.”
   1. After the message will be a very long string of numbers and letters
   2. This is your ID token
   3. Copy the ID token
7. In the left column menu in the Vantage admin, go to Vantage > Settings
8. Click the Save Changes button
9. Click the Payments tab
   1. Scroll down to Enable Gateways
   2. Next to PayPal, check the box marked Enable
10. Click the PayPal tab
    1. Under Payment Data Transfer (PDT)
    2. Check the box to the right of Enable PDT
    3. Paste your token into the field to the right of Identity Token
11. Click the Save Changes button
12. PayPal PDT is now enabled

Notes for Return URL:

• If you have no other sites that use PDT, you can enter any URL into Return URL. Vantage controls the return URL and overrides any URL entered into Return URL. Regardless, we recommend entering your site’s root URL (IE: www.yoursite.com)
• If you have another site that uses PDT, you should enter the return URL that you prefer for that site. Again, Vantage controls the return URL for your Vantage site and does not use the return URL provided on your PayPal account.

This tutorial assumes you have SSH command line access to your server with super user (sudo) permissions and able to edit using vim (or nano).

Step 1

After you’ve logged in, let’s create the simple sql script that will reset your root password.

vim ~/reset.sql

Once in vim edit mode, you’ll need to insert the statement below. Replace NEW-PASSWORD-HERE with your new root password. You can generate a strong password on this site or use an existing strong password.

UPDATE mysql.user SET Password=PASSWORD('NEW-PASSWORD-HERE') WHERE User='root';
FLUSH PRIVILEGES;

Save and exit out of vim

:wq

Step 2

Next you’ll need to stop the mySQL server. If it’s a production site, you should do this during off hours since it will take down your entire database.

# RHEL, Fedora, or CentOS Linux
/etc/init.d/mysqld stop
 
# optional method 
service mysqld stop
 
 
# Debian or Ubuntu Linux
/etc/init.d/mysql stop
 
# optional method 
service mysql stop

Step 3

Now we’re going to restart mysql in safe mode and execute the script you created in step 1. Note the path (~/reset.sql) and the ampersand (&) at the end.

mysqld_safe --init-file=~/reset.sql &

You should see something like this returned

111226 22:31:42 mysqld_safe Logging to syslog.
111226 22:31:42 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql

Step 4

The root password should have been reset so let’s restart the mySQL server in normal mode.

# RHEL, Fedora, or CentOS Linux
/etc/init.d/mysqld restart
 
# optional method 
service mysqld restart
 
 
# Debian or Ubuntu Linux
/etc/init.d/mysql restart
 
# optional method 
service mysql restart

Now try logging into mysql with your new root password.

mysql -u root -p

If it works, then you’ve done it correctly! Now make sure to write down your password somewhere or save it online in a safe location.

This tutorial assumes you know how to edit your theme’s functions.php file.

Step 1

First, we’ll want to insert the date and time whenever a user logs into your site. This function uses the wp_login hook and will store the data in a user meta field.

// insert the last login date for each user
function insert_last_login( $login ) {
    global $user_id;
    $user = get_userdatabylogin( $login );
    update_user_meta( $user->ID, 'last_login', gmdate( 'Y-m-d H:i:s' ) );
}
add_action( 'wp_login', 'insert_last_login' );

Step 2

Next, we need to add a new user column called, “Last Login”. This will be visible on your “Users” => “All Users” WordPress admin screen. Below the code you inserted above, paste in the following:

// add a new "Last Login" user column
function add_last_login_column( $columns ) {
    $columns['last_login'] = __( 'Last Login', 'last_login' );
    return $columns;
}
add_filter( 'manage_users_columns', 'add_last_login_column' );

Step 3

The last bit of code we need to add will populate the actual user login data in the column we created above. Below the previous code you pasted in your functions.php file, add this:

// add the "Last Login" user data to the new column
function add_last_login_column_value( $value, $column_name, $user_id ) {
    $user = get_userdata( $user_id );
    if ( 'last_login' == $column_name && $user->last_login )
        $value = date( 'm/d/Y g:ia', strtotime( $user->last_login ) );
    return $value;
}
add_action( 'manage_users_custom_column', 'add_last_login_column_value', 10, 3 );

Now visit your WordPress admin users page and you should see the new column. If you already logged in, it should show your last login date/time.

Adding a last login column to the users admin page.

Congrats, you’ve completed this tutorial!

In this example, we want to change JobRoller to Brazilian Portuguese. Here are the steps you need to take.

Step 1

Download the language file from our language pack page. Unzip the package and inside you’ll find a pt_BR.mo file. Rename that file to “jobroller-pt_BR.mo” and then set it aside. We’ll come back to it later.

Note: If a language pack doesn’t exist for your language, you’ll have to create it yourself. Our How to Translate a WordPress Theme tutorial will explain how to do it.

Step 2

If you haven’t already done so, you’ll need to tell WordPress that it should use Brazilian Portuguese. You declare this in the wp-config.php file usually located in the root on your server. You’ll need to use SFTP or SSH in order to edit this file.

Once you are in edit mode, add the following line anywhere. Make sure this doesn’t already exist, however.

define( 'WPLANG', 'pt_BR' );

Now upload that file back to your server and overwrite the old one.

Step 3

Next you need to upload the .mo file to your server. This file contains the actual text translations for the theme. Before doing so, you’ll need to create a couple of new folders. SFTP/SSH back to your site and go into the wp-content folder.

1. Create a new folder called “languages”
2. Go inside that folder and create another folder called “themes”
3. Copy the “jobroller-pt_BR.mo” file you set aside earlier into this folder

The final new folder structure with the .mo file should look like this.

/wp-content/languages/themes/jobroller-pt_BR.mo

The name of the .mo file is very important. It’s also case sensitive. If it doesn’t match the theme name, language code, and country code it won’t work. Same goes for the define constant in step 2 above. Links to all codes can be found in this post.

File naming format should be as follows:

[THEME NAME]-[LANGUAGE CODE]_[COUNTRY CODE].mo

Now visit your website and refresh any page (clear your cache too if using a caching plugin). You should now see it in Brazilian Portuguese!

FAQ

Why do I have to create new folders for the language file instead of just placing it in the /wp-content/themes/jobroller/ folder?
Because the language file would get deleted if you upgraded to the next version. This wasn’t the case until we moved to two click theme updates back in October, when we had to make this change.

Step 1

How can I tell if other websites are linking to mine without the www? Google has a nifty little feature that will show you which sites and how many are doing this. Enter the following in Google search (replace appthemes.com with your site):

link:appthemes.com

The results will show you roughly how many inbound links and juice you’re losing because they aren’t linking to your www site!

So how can you prevent this from happening? The best way is to channel all non-www links into your www links. This is done with two lines of code that need to be added to your .htaccess file (does not work for IIS Windows web hosted sites).

Step 2

First you’ll want to sftp or ssh into your website. Then go to your WordPress root and find the .htaccess file. Edit the file and be careful not to modify any of the existing contents.

At the top, you’ll want to add the following two lines (change appthemes to your domain name):

RewriteCond %{HTTP_HOST} ^appthemes\.com$ [NC]
RewriteRule ^(.*)$ http://www.appthemes.com/$1 [R=301,L]

Save and upload .htaccess back to your server. Now try loading up your website without the www and it should automatically change to www.yoursite.com.

Within a few weeks, you should notice slightly higher rankings in Google (assuming you had non-www links to your site). It will also handle any new links as well.

Find the Culprit

The first step to improving performance, is to identify what’s causing the slow-down in the first place. There are several great browser plugins which can examine your site such as Google’s Page Speed (online test), YSlow, and Chrome’s built-in developer tools (“View” => “Developer” => “Developer Tools”). After you run these tests, you’ll get a report and recommendation on what you should do to improve your site’s speed.

Poor Web Hosting

There are hundreds of web host providers out there today and it’s difficult to decide which one is best for you. Sure, you can (and should) spend time doing research online but many “web host review” sites are affiliate farms that recommend the web host company that pays them the highest commission. Hover over links before you click on them to see if they point directly to the web hosting site or “redirect” somewhere else first.

Is your host provider in the same state or even country as you? If not, that could be a problem. If you live in China and your web host provider is in Texas, of course performance will be slow. But what’s more important is where does your customer-base live? They are the ones who should have the best experience so you want your web server closest to them.

You get what you pay for. If you’re paying only $2.95/month for web hosting then you’re sharing the same server with dozens of other people. We pay over $200/month for a dedicated server which is expensive, but well worth it for the amount of traffic and load we deal with. In other words, find somewhere in between like $20 – $50/month for web hosting. A good question to ask is, “How many other customers will also be on the same server?”. VPS (virtual private server) is a good choice since you essentially get your own server (albeit virtually).

Too Many Plugins

How many plugins to you have running? There’s no limitation or recommendation but our rule of thumb is only have a handful installed at a time. Less is always better. Believe it or not, your site could be running slow due to just one plugin. Here’s how to find out if that’s the case. Disable your plugins one at a time and then try reloading your website after each one has been disabled. Notice a speed difference after disabling one? That’s the culprit. Surprisingly, many plugins are poorly written and can bog down your site. Always check the author, number of downloads, and rating of the plugin before using it. If it’s not highly rated, chances are it’s not very good.

Poorly Written Theme

There’s a right way and a wrong way to build themes for WordPress. Unfortunately, most people do it the wrong way. WordPress has a great API with a ton of high performance functions and if theme developers don’t know how to leverage the API, they end up coding something entirely new (and usually slower) solution.

Our themes have been highly optimized to work well with the WordPress API but we can’t speak for all the other themes out there. A quick way to tell if your theme has been written well is to install the WordPress Theme Check plugin and see how the results end up. It won’t necessarily tell you if it’s been coded using the best standards, but rather audit the theme and make sure key components aren’t missing.

Caching and Compression

Make sure your web server has gzip compression and caching turned on. This is a quick and easy way to see a significant performance increase on your site. Not all shared host providers allow this (they should) and you can run a quick Google page speed test to figure this out.

There’s also some really good caching WordPress plugins that handle a lot of this automatically. By far, the one we recommend most (and use ourselves) is called, W3 Total Cache. It’s free and provides a ton of options such as caching, compression, cdn integration with Amazon (and others), .js and .css minify, and more. It takes some time to get everything configured but once you do, you’ll love it.

Another more simple solution is WP Super Cache. It’s also a caching plugin but with less options. If you don’t feel like tinkering with dozens of options, this is the plugin for you. It will instantly speed up your site (cached pages vs database calls on each page load).

MySQL, PHP, Apache

For those of you who are really technical, you can further improve your website performance with tweaks to MySQL, PHP, and Apache. Those go beyond the scope of this article but there are other guides out there which can assist you. Access to these sort of tweaks is usually only available to those with a VPS or dedicated web server since they are low-level adjustments.

Step 1

Open and edit your theme functions.php file or child-theme functions.php file. If you don’t have functions.php, just create an empty file and save it. Then paste in the following code:

<?php
/**
 * Use the asynchronous code to download 
 * in parallel and speed up page load time
 */
function insert_plusone_script() {
?>
  <script type="text/javascript">
  // <![CDATA[
  window.___gcfg = {
        lang: 'en-US'
  };
 
  (function() {
    var po = document.createElement('script'); po.type = 'text/javascript'; po.async = true;
    po.src = 'https://apis.google.com/js/plusone.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(po, s);
  })();
  // ]]>
  </script>
<?php
}
add_action ( 'wp_head', 'insert_plusone_script' );
 
 
/**
 * Insert the button on each page/post
 *
 */
function insert_plusone_button( $content ) {
    // if ( is_page() ) return; // uncomment to not show button on pages
    $content = $content . '<div class="plus-one"><g:plusone size="tall" href="' . get_permalink() . '"></g:plusone></div>';
    return $content;
}
add_filter( 'the_content', 'insert_plusone_button' );
?>

Changing Parameters

If you wanted to change the size of Google +1, you just need to change the size="tall" to one of the following: small, medium, or standard. To see what the different buttons would look like, check out this page.

If you wanted to change your language to something other than English, you would just swap out the lang: 'en-US' with different language value. A list of available languages can be found here.

Lastly, we wrapped the button with a div tag so it could be styled. Just add some css to your style.css child-theme file to control the button position, etc. For example, div.plus-one { float:left; padding: 10px 0; }.

When it comes to localizing/translating any of our themes, we recommend using PoEdit.

You can find full details on how to do this on our How to Localize a WordPress Theme blog post.