First, this is NOT a WordPress security issue. It is all about malware being inserted by third party ad services. For my fellow WordPress folks, this is not the same issue dealt with at that hosting company that will remain unnamed.

The Red Screen of Death

When Google crawls a site and detects malware, they issue a warning which results in that red screen. They also add a warning within their search results right under the link to your site that says ‘This site may harm your computer’. All pretty scary stuff for a visitor finding your site for the first time.

So,assuming at the time that it came from Google, it seemed strange to me that Google could stick a red screen on a site. How could they do that? Well, they can’t of course. So I looked into the code of the warning itself and saw that it was coming from mozilla.org, the company that makes Firefox, meaning it was something in the browser itself.

Checking the security settings, I saw a check box for ‘Block reported attack sites’. So I unchecked that and tried the site again. It loaded just fine. No warning. Same in Safari. They have a setting to block sites and send a warning. Problem was these were defaults, so essentially everyone is seeing these red screens.

Removing the Red Screen

The only way to get rid of the warning screen is to remove all the malware, and get Google to re-crawl your site. You can either wait for that or re-submit your site using Webmaster Tools Reconsideration. Even with both myself and the client submitting for reconsideration, the process took about 18 hours which I feel is pretty quick form stories I have heard. In fact we were getting ready to redirect the domain to a clean url if the warning hadn’t gone away within another hour or two.

All said, it was about 48 hours of the site being blocked with this red screen.

Then after it was fixed, we had to clear the cache in our own browsers to make the warning go away, meaning that anyone who saw the site in the last day or two was most likely STILL seeing the warning even though Google had removed the warning and the site had been totally clean for close to 24 hours. And who knows when everyone’s cache would reload the cleaned pages?

The Hypocrisy of Google

Here is the problem… The malware appeared after a third party ad service started using Adsense of all things. The stunning thing to me is the possible hypocrisy of Google Adsense sending malware and then using its malware warning to essentially shut down a site for close to 48 hours.

When you see that red screen do you ever click ignore? Probably not since it warns you that your computer may be harmed. After I fixed the problem, the warning was still there and I still felt cautious about clicking, feeling that maybe it was still detecting something I didn’t find.  This is when I figured out that it was the browser settings I described above.

So… The timeline went something like this:

• Site is infected with malware at some point. This could have gone undetected for a while. Hard to tell.
• Google detects it and adds the warning.
• Browsers see that warning and visitors get the warning screen.
• Regular readers of the site start sending emails and tweets to the client.
• About 24 hours AFTER all this, the client gets an email from Google telling them about the problem.
• Client contacts me and within a number of hours we clean the site and submit for reconsideration. This is only because I was out at the time. The actual process of fixing took about an hour.
• 18 hours later the site is recrawled and put back to normal.
• Visitors whose cache is not emptied are still receiving the warning.

So…

• 24-36 hours – site is down before being able to fix it.
• 1 hour – fixing time
• 18 hours – re-crawl and remove the warning.

Ignore Bad advice from the Hosting Company

The client’s host was saying that the process might be 2-3 weeks! Not only that… They recommended removing the URL from Google because of that little warning, suggesting that people shouldn’t see that because it made the site look bad.

Remove the URL form Google? That would lose all search ranking and everything, I have never heard of worse advice. The site was back up within an hour or tow of getting that advice and if the client had listened they could have lost all their search rankings.

How to fix it

As with any changes to a site – BACKUP EVERYTHING first.

• Export your WordPress content from the backend.
• Backup your database.
• Backup you wp-content folder

Finding the Malware

This can come in a few forms:

• It can be added to files you already have.
• It can be added as new files that were not there before.
• It can be injected into the database.

But is actually fairly easy to spot once you know what to look for. It is almost always something known as obfuscated javascript or something embedded in an iframe. Obfuscated javascript looks like a bunch of random letters, numbers and symbols, like this: ‘JGs9MTQzOyRtPWV4cGxvZGUoIjsiLCIyMzQ7MjUzOzI1MzsyMjQ’. It is totally meaningless until decoded. An iFrame is used to embed another page into a site. It is used by Facebook and any other number of legitmate sites, so iFrames are not by themselves bad. On the other hand any apperance of that obfuscated javascript is cause for concern, especially in an open source project like WordPress where all code must be readable.

To find the bad code:

• Search your files for the word ‘base64_decode’ where you find something like this ‘<?eval(base64_decode(“JGs9MTQzOyRtPWV4cGxvZG…’ and that string of characters will go on for a while and end with something like ‘==”));?>’
• Delete all occurances from the opening ‘<?’ to the closing ‘?>’
• Search your database for ‘base64_decode’
• Delete that same line (it will probably not have the ‘<?’ or ‘?>’, just the ‘eval(base64_decode)’
• Search all your pages for ‘iframe’
• Search the database for ‘iframe’
• Before deleting any iframes, look at the content and see if it is something you recognize. It might be fine.

Specifically in this case, there was a series of files that were somewhat easy to spot, since they were in the main directory and not part of the core WordPress files. Here are the names:

• A folder called ‘.files’ which will be hard to spot unless you are able to view hidden files because of the ‘.’ at the beginning of the folder name.
• The folder contained a huge number of files, all ending in .html, all with spammy search titles.
• A file called ‘hobard_ebeneser.php’ whose only contents were the javascript described above.
• A file called ‘spite_kerk.php’ whose only contents were the javascript described above.
• A file called ‘vhfjp.php’ whose only contents were the javascript described above.

Another post about a similar set of files they called the ‘Movie Review’ infection and how to fix it. Essentially the same as here.

After the Malware is Gone

So the malware is gone and 18 hours later Google has approved the site again. According to Webmaster Tools no malware was found.

BUT… we are still getting the warning until emptying our browser’s cache and refreshing a few times. This is a problem since most people who saw the site with the warning will still see the warning but would not bother refreshing or deleting their cache. So there needs to be a way to FORCE the visitor to load a new version of the page.

I used the php function called header() which must be called before anything is output to the screen. To make sure of this I placed it right in ‘index.php’. Not the one in the WordPress theme, the main index.php of the whole site, the one contains about 3 lines of code and opens WordPress itself. I wanted to make sure this was the very first thing a browser saw when opening the page.

Here is exactly what I used:

header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past

I pasted that right above the line:

define('WP_USE_THEMES', true);

Now eventually we will remove this. Pages are cached for a reason. It speeds up page load time, etc. So we don’t want to make everyone lodd a new version indefinitely, but for a couple days we are going to make sure everyone gets the clean version.

Final Note – AVOID AD SERVICES that use javascript

There have been a HUGE number of ad services compromised by these attacks lately. Unless you are making enough to justify going through this, I would recommend not using these ad services that place javascript on your site. The same goes for affiliate links that use javascript. Most will offer an HTML version that is just an image and a link. If you see the word ‘javascript’ in the line of code they want you to copy, I would stay away.

© marty for Marty Thornley, 2010. | Permalink | No comment | Add to del.icio.us
Post tags: google, malware, WordPress

Feed enhanced by Better Feed from Ozh

Now, you know how proud we are of our Search Engine Optimized, WordPress powered, custom portfolio blogsites. What if there were an entry-level, template-driven, DIY, portfolio blogsite available? No more updating your blog at one address and your portfolio at another. No more calling your webmaster to make changes to your site, update your entire site as easily as creating a blog post. You can even customize the site to match your brand.

Now, what if it was affordable to everyone and included installation and set-up? Interested?

Sign up here for more information.

Here’s a blurry sneak peek…

Some added details of my own:

There are a lot of sides to this project, including some exciting resources for anyone, whether they use the new BlogSites or not…

• There will be an FAQ and tutorial site, complete with screencast videos for everything WordPress.
• There will be support forums for plugins, and technical issues.
• SEO Image Galleries. This new site is also the home of a plugin currently released in Beta called SEO Image Galleries. It is available at the WordPress Repository, or can be installed directly through the plugin browser on any self-hosted WordPress site.

Plus lots more…

Sign up for our Beta list here: Photographyblogsites.com

You can also follow us for updates on Facebook and Twitter.

© marty for Marty Thornley, 2010. | Permalink | No comment | Add to del.icio.us
Post tags: photography, photography blog, photographyblogsites, WordPress

Feed enhanced by Better Feed from Ozh

The new Identity Kitchen site was not just a face-lift or simple redesign but a complete rethinking of everything. By combining the formerly separate portfolio site and blog all into one WordPress installation, the content and structure of the site was improved, the search engine optimization was improved, and the backend became one place to add and edit all the content.

We were also able to use some new image gallery techniques to ensure everything on the site is HTML and CSS based. This means no Flash, even for the image galleries, providing a seamless user experience for those without the ability to view Flash, most importantly iPhone (and now iPad) users. Not using Flash also improves the SEO, by using keywords in the image’s ‘ALT’ attribute.

Home Page

The most complex page on the site, the home page pulls the latest post from the blog, has links to social marketing sites, a newsletter signup, a section highlighting some products from the store (Identity Cafe) and features a fading slideshow of images.

click for full size view

Case Studies

The first style of image gallery is shown on the Case Studies pages. The images are attached using custom fields in the backend, thanks to the WordPress plugin Flutter. Usually each page has a simple text area, where images can be inserted. But by adding some custom areas we were able to upload extra images and then display them in any way we want. In this case, by displaying them in a gallery, with thumbnail previews along the bottom. A second custom area was used to add a series of ‘services’ as the pink text at the bottom of the right-hand column.

click for full size view

Work Pages

Similar to the Case Studies pages were the Work pages, which were more specific looks at a single website, a single brand, and one page with 30+ examples of logos. The backend for these pages worked almost identically to the Case Studies pages, but we displayed the info in different ways. The descriptions, list of services and link to the live websites needed to display under the images so that we could have a menu on the right hand-column. To make room for that we needed a second image gallery design, using smaller thumbnails and new navigation buttons. The gallery is actually the same exact HTML markup. But thanks to a few changes in the CSS, they display differently.

click for full size view

Questionnaire and Contact Forms

Some aspects of a site can only be appreciated by the owner of that site. One of those things on this site would be the Questionnaire page. I used the ‘Contact Form 7‘ plugin for all the contact forms on this site. This is my favorite contact form plugin because it is easy to use, even for a non-programmer and it allows complete control over all the fields and customization of the look. By adding a Questionnaire page, it will now be easy to send new clients a simple link where they can fill out all the needed info online and hit send. Pro-active clients could even find it on the site and take the initiative to fill it out themselves. Everything is sent in an email seconds later. Compare this to a written form that is left with a client or snail-mailed, or even the process of needing to send a .pdf file to someone, possibly forgetting and hoping they will print it out and send it back.

click for full size view

Blog

Last but not least is the blog section, otherwise known on this site as ‘Fresh’. While it matches the main site’s design, it has its own thing going on, practically a reverse of the look, with a mainly white page and dark text, compared to the dark background and white text of the main pages. As far as programming, this was the most straight-forward of the whole site, just a matter of scaling back to the built-in blog platform that WordPress is made for.

click for full size view

© marty for Marty Thornley, 2010. | Permalink | No comment | Add to del.icio.us
Post tags: custom wordpress, web development, WordPress

Feed enhanced by Better Feed from Ozh

For their Projects, Personnel and Facilities pages, we needed a way to display images, information and links without being confined to the normal block of text. To accomplish this in a way that added to the design, made the information more readable and was still easy to edit from the backend, would not have been possible without the Flutter plugin, which allows you to create custom content types and then display those different content areas anywhere on the page.

The Home Page

The overall concept is meant to be a clean, modern design that would properly represent a professional production company.

click for large view

The Personnel Pages

The main focus of this site is to showcase the personnel and sound stages that are available to be packaged. The personnel are categorized by their positions from Post Production Supervisor to Composer to Sound Mixer and everything in between. Each person would need a quick bio, a headshot, a list of credits and an area to highlight some past projects. Each highlighted project would also need an image and a series of links.

Here is a look at one of the composers:

click for large view

The News Section

The standard blog abilities of WordPress were put to use in the News section where I was able to try out the new Post Image functions available in WordPress 2.9. In previous versions, giving each post a thumbnail required adding plugins and a decent amount of code. Now it is as easy as uploading an image and adding one simple line to the template files. The use of thumbnails really added a lot, especially to a basic clean design like this one.

click for large view

To view large scale images, I used the same plugin you see on my site as you view these images, the Shadowbox JS plugin. It automatically adds this effect to any image that links to itself in a post. Really easy to use and adds a lot to the final product.

© marty for Marty Thornley, 2010. | Permalink | No comment | Add to del.icio.us
Post tags: clients, custom web design, web clients, web design, WordPress

Feed enhanced by Better Feed from Ozh

Their website had been a static HTML site, difficult to update and lacking the ability to comment or interact in any way. Producers JC Pohl and Erahm Christopher asked their original designer, David Richards to update his original design and brought me on to program the site using WordPress as a backend. David’s new design stayed true to the original idea and maintained the well-established brand of Teen Truth, while modernizing it, bringing some greatly improved navigation and adding some moving pieces that really bring the site to life. By moving from a static HTMl site to a site powered by WordPress, they now have the ability to add content at any time, allow their fans to comment on articles, and will benefit from the amazing SEO powers of a properly configured WordPress site.

Visit the Live Site

Here are some Highlights:

The Home Page

The home page is a good look at the overall design and is probably the most complex page on this site. It contains an embedded video, a fading slideshow gallery, sliding panels across the center of the page, a rotating series of sponsor images, two separate categories of news feeds, a Facebook Fan Box, and small section of ‘Upcoming School Events’ which pulls the next three upcoming events from the calendar section.

The Sliding Panels

The sliding panels across the middle of the home page provide not only some color and movement to the page, but easy access to the three main programs that are the focus of the Teen Truth project – the three videos. Each slider contains a brief description, which is editable from the WordPress backend and links directly to the page for the given video.

The News Sections

There are two separate news sections that take advantage of the traditional blog functions of WordPress. Both sections are highlighted on the home page and have their own section of the site that act like traditional blogs, with categorized posts and the ability to comment.

The Store Page

Because there are only a few products and the payments are being processed with Paypal, the store page was simply hand coded as is using Paypal’s shopping cart system, rather than use a separate e-commerce site or one of the WordPress e-commerce plugins, which I have found to be fairly buggy and unreliable.

The Calendar

The most complex single aspect of this site was the calendar. To add dates, I used the Flutter plugin to create a custom post type, organized by date. Within each date, any number of events can be added for each of the four Teen Truth Live event types. Those events are then displayed on the calendar page, in order and month-by-month, each with the proper color code for that event. On the home page, the next three upcoming events of any type are displayed. You can see this working in the two screen grabs below. Because this is these were taken on Jan. 12, the event from 01.12 on the calendar page is not on the home page but the next three from 01.13 are shown. The fourth event, on the 15th, is not shown.

Behind the Scenes

Like most WordPress sites, this one relies heavily on some plugins made available for free by talented programmers who deserve credit. I also made use of a new toy – jQuery Tools, which provided the code for the sliding panels.

• Flutter - Adds custom fields to any post and creates custom post types. Used to create the variety of page layouts, including the calendar section.
• jQuery Tools – An incredible source of ready-built yet customizable user-interface tools that can be used to enhance the usability and navigation of a site.
• And, as always, I used my Recommended Plugins for optimizing the site and improving SEO.

© marty for Marty Thornley, 2010. | Permalink | No comment | Add to del.icio.us
Post tags: clients, custom web design, web clients, WordPress, WordPress Themes

Feed enhanced by Better Feed from Ozh

With all of our sites, we try to incorporate some level of social media interaction. Custom blogs generally get a Twitter feed with a custom design and prominent links to any other sites the client wants to feature. This could be Twitter, Facebook, Myspace, etc.

Here is a look at a few of the projects:

TheUnbride.com

The Unbride is a blog that covers unusual wedding ideas, from all of the different vendors, to interesting venues, etc. Building the site took a lot of advanced Customization of WordPress using different views depending on which category we are viewing. See it in action here: http://theunbride.com/

TheUnbride.com

Click Image for Full Size

EclecticAudio.com

Eclectic Audio is a bit of a different project for me. The site is entirely (sort of) in Flash, built by Ellen’s assistant, Mandee Astuti, a talented designer herself.

Normally the URLs of a flash site would look like http://ecleticaudio.com the whole time because it is actually one page, with a Flash movie inside of that one page. But we split every ‘page’ of the Flash site into a separate Flash file, so that we could end up with standard links to each page. This means you will be able to see and link to ‘http://ecleticaudio.com/about’, ‘http://ecleticaudio.com/contac’t, ‘http://ecleticaudio.com/music’ etc. This is very important for SEO purposes but we are also planning ahead for a soon to come WordPress version of the site which will wrap the flash files for the main site and also incorporate a blog. One other step was to use URL re-writing to make sure the URLS show up as ‘/about’ and not ‘/about.html’, which is what they actually are. Again this was for SEO purposes and to plan ahead for WordPress, which does not end their URLS in .html.

And if all that wasn’t programming geek enough for you… I was also able to develop a little PHP function that allows me to now easily embed a Flash file using a few words of code rather than typing in the entire things each time. If you don’t know what any of that means, just enjoy the site…

See the site in action here: http://eclecticaudio.com

EclecticAudio.com

Click Image for Full Size

LAStylistMom.com

LAStylistMom was a fairly straightforward blog on my end, but features some nice logo work and site design by Identity Kitchen.

See it in action here: http://lastylistmom.com

LAStylistMom.com

Click Image for Full Size

TriciaBPhoto.com/blog

This is another custom blog, this time for a photographer. It features custom logo work and site design by Identity Kitchen.

See it in action here: http://triciabphoto.com/blog

TriciaBPhoto.com/blog/

Click Image for Full Size

© marty for Marty Thornley, 2009. | Permalink | 2 comments | Add to del.icio.us
Post tags: clients, custom web design, programming, web clients, WordPress

Feed enhanced by Better Feed from Ozh

A Look At the Site

Click for larger Image

A Look At the New Blog

Click for larger Image

Details: Social Media Links

Details: Custom 404 Page

As I explained in the post about another site, the 404 error page is one of the most overlooked aspects of any site. A site should be able to handle when something goes wrong. If you have ever reached a site that said something like ‘The Page you are looking for can not be found,” you are looking at what is called a 404 error page. 404 refers to the numerical code thrown back to the browser by the server. Generally, these pages are ugly and not very helpful. The standard WordPress 404 will simply provide a serach box, if anything and will probably be a plain page. But wouldn’t it be more helpful to provide suggestions for what the visitor might be looking for?

It is possible to add an instant search result to these pages, using the url that the person was looking for. Rather than saying the site can not find that page, we have the site do a quick search and see if it finds anything close. This is great because a lot of these errors are just misspellings or typos. But the search will probably find it. Just in case the search fails, I also have it list the categories and archives links.

To see it in action try this link http://plumtreestudios.com/blog/ wedding photograph. You can see that there are blank spaces in the link and there is definitely no URL there. But instead of an error, the site offers several posts that relate to those locations.

Details: Custom 404 Page

Click for Larger Image

Details: Custom Site Options

Across the top of most blogs, you could display the title and description of the blog, have a single image as the header (possibly an image that includes a logo, or the title of the site), or you could do something fancy like a fading slideshow of images. Picking any one of these would mean being stuck with it unless you know how to edit code yourself or want to hire your web guy again for changes.

So I have started including an options area in all my sites where the user can select any of the three options at any time. Not only that, the fading slideshow I use reads any image you put in a folder. All you have to do is upload images to the folder to change your slideshow. If you ever get sick of the fading images, just change the option and upload a single image right in the WordPress admin area.

Details: Custom Site Options

Click for Larger Image

© marty for Marty Thornley, 2009. | Permalink | One comment | Add to del.icio.us
Post tags: clients, custom, custom blog, custom web design, photo, photography blog, web clients, WordPress

Feed enhanced by Better Feed from Ozh

A while back, I had also done a custom splash page for the main site, with links to all of her sites and the blog.

A look at the Splash Page

Click for larger image

A look at the portfolio site

Click for larger image

A look at the Blog

Click for larger image

Details: Post Titles

There were lots of little details that added to the finished blog, a combination of design elements and custom programming to add some life to the site.

With a long list of posts in a blog-style layout, there is an opportunity to add imagery between the posts or surrounding the titles as a way to help separate one post from the next. I used a combination of things for Jules’ blog. Behind the title, I added a version of the swirl design and flowers that make up the background of the site.

To the left of each post is a set of icons that change depending on the category – cake for weddings, camera for photographer related posts, a house for portraits and a dog for dog portraits.

Details: Custom Images for Post Titles

Click for larger image

Details: Custom Comments on the Home Page

Usually comments are made on the permanent page for a single post. When you are looking at a long list of posts, you first have to click onto another page and wait for it to load before making a comment. But with a little bit of trickery, WordPress can list the comments for each post anywhere, including right under each post on the home page.

You can also have some fun with the text area where you type in the comments. Adding the three information boxes across the top helped save space and the little flower makes another appearance as the background of the textarea.

Details: Custom Comments

Click for larger image

Details: Custom Social Media Links and Welcome Area

One of the most important aspects of building a web presence is to connect all of the different parts to each other and make sure they are easy to find. Right across the top of the site, just under the fading slideshow header area, there is an area with a picture, the most recent Twitter status, easy to find links to Twitter and Facebook, a series of links to Jules’ other important sites, and a little link for her book, Olive Goes to Hollywood. Another interesting twist was to make the image of Jules randomly change on each page load. Try refreshing the site and the image will change every time.

Details: Connecting

Click for larger image

Details: Custom 404 Error Page

This is one of the most overlooked aspects of any site… What happens when something goes wrong? If you have ever reached a site that said something like ‘The Page you are looking for can not be found,” you are looking at what is called a 404 error page. 404 refers to the numerical code thrown back to the browser by the server. The technical aspect is one thing, but generally, these pages are ugly and not very helpful. The standard WordPress 404 will simply provide a serach box, if anything and will probably be a plain page. But wouldn’t it be more helpful to provide suggestions for what the visitor might be looking for?

It is possible to add an instant search result to these pages, using the url that the person was looking for. Rather than saying the site can not find that page, we have the site do a quick search and see if it finds anything close. This is great because a lot of these errors are just misspellings or typos. But the search will probably find it. Just in case the search fails, I also have it list the categories and archives links.

To see it in action try this link http://julesbianchi.com/blog/Four Seasons & Il Cielo . You can sse that there are blank spaces and an ampersand in the link and there is definitely no URL there. But instead of an error, the site offers several posts that relate to those locations.

You can see another example of this in my post about the custom blog for Plum Tree Studios.

Details: Custom 404 Page

Click for larger image

© marty for Marty Thornley, 2009. | Permalink | No comment | Add to del.icio.us
Post tags: clients, custom, custom web design, photography blog, web clients, web design, wedd, wedding photography blog, WordPress

Feed enhanced by Better Feed from Ozh

For a new user, however, it can be a little overwhelming once they log in for the first time. The WordPress backend is a little bit heavy and offers so many tools that it can be confusing for those new to the system.

At first I was spending a lot of time on the phone talking clients through the same basic issues over and over. How do I add a new post? How do I create a new category? While these were new issues for them, I had to repeat myself over and over. So I put together a document that provides basic instructions for using WordPress and I have been providing clients with a .pdf version to help guide them through their new site.

Now I am making it available through DocStoc. Feel free to share it, embed it, pass it on, whatever you want.

Keep an eye out for my next one, a .pdf version of my Optimizing WordPress post.

Basic WordPress –

© marty for Marty Thornley, 2009. | Permalink | 3 comments | Add to del.icio.us
Post tags: custom web design, how to, Resources, web design resources, web design tips, WordPress

Feed enhanced by Better Feed from Ozh

I was brought on to ‘Another Harvest Moon’ in order to develop the website and build the social media component of the marketing campaign. This is an exciting opportunity for me to combine my interests in the film and web worlds. You can see the current website and trailer here: http://anotherharvestmoon.com/, although one of the first steps in the project is going to be a complete redesign of the site by Sauce Creative Group. Sauce will provide all the design elements and I will be programming the site using WordPress.

This is a small indie film with a very small promotional budget but we are trying to create as much buzz as possible in order to help them get distribution. So we were looking for help with organizing and implementing an ambitious social media strategy.

Please check out their sites:

Official Webite: http://anotherharvestmoon.com

Facebook: http://facebook.com/harvestmoonfilm

Twitter: http://twitter.com/harvestmoonfilm

Youtube: http://youtube.com/harvestmoonfilm

© marty for Marty Thornley, 2009. | Permalink | No comment | Add to del.icio.us
Post tags: Film, how to, marketing, SEO, social media, WordPress

Feed enhanced by Better Feed from Ozh