Category Archives: News

Does WordPress think it’s Apple or Microsoft?

Infamously, Apple have a habit of thinking they know what you want more than you do. You can search in vain for an alternative way to have your ‘home screen’ on the Apple app store. Apple’s version is officially perfect for everyone and no-one is allowed to have any other. Another example is the way that it took over seven years from the first iPhone before you were allowed to have an alternative keyboard to Apple’s officially perfect one on your device!

Microsoft have been known to do it too: see Windows 8’s move to the main menu that they called ‘Metro’ before someone pointed out they had a registered trade mark on the name. Who cares that you’ve been using the ‘Start’ menu since 1995? At least in that case, it was possible to install alternatives, and they sort of backed down with 8.1 before making things worse with Windows 10.

And now the WordPress developers are at it.

As every YourEscortSite client knows, we use the WordPress software on nearly all of the cheap and simple sites for escorts we host* and for the past thirteen years it has offered two ways to create / edit your website’s pages and blog posts.

There’s the visual editor which shows you roughly what the result will look like. So if you select something, and click the b button, it will appear in bold in front of you.

And there’s the text editor which shows you the actual HTML – the page description language that is sent to web browsers to display your site – and which used to be called the HTML editor. Do the above, and it will look like ‘<strong>it will appear in bold</strong>’.

(You need the latter for doing things like adding directory banners or, as with the message board software SAAFE.info uses, the visual editor will go ‘Oh, a “<” character! I’d better change that to < or it will be treated as HTML and the user will get all confused!’… and the banner code won’t work.)

Places like Wix offer an alternative to those: they have something like a drag and drop editor, and call it a ‘page editor’ or similar.

Well, the people behind the WordPress software have been going ‘Oh noes, if we don’t have a page editor, people will stop using the wordpress.com site we also own and that would be terrible!1!’

So they’ve written one and called it Gutenberg.

That would be fine, except that their great plan is to force everyone using the WordPress software to use it. Why they want to do that, I have no idea, given that the software already powers about 30% of all the websites out there. It’s not a popular idea with existing users of the software: the Gutenberg plugin you can use to try it out now is the plugin with the most one star reviews of the more than 56,000 on wordpress.org.

Mine is one of those, because if you’re used to how it’s worked for the past it’s horrible.

It’s particularly horrible if you’re using it on something other than a superwhizzo fast PC because all the code is being run by your browser. That can be ok if you’ve got a superwhizzo PC or Mac, but if you’re trying to use it on an old laptop or your phone, it becomes very very s.. l.. o.. w.. and you end up dropping things in the wrong place because of the lag between where your mouse / finger is and where the software thinks it is.

Gutenberg also makes various assumptions about your site’s theme and, if it’s wrong, it can cause problems. I suspect that will include couple of YES templates.

So we’ve installed the ‘Disable Gutenberg’ plugin on YES sites (including this one!) It will keep the ‘classic editor’ you know and love (or at least tolerate) even after WordPress 5.0.0 is released with Gutenberg as the editor.

If you’ve got your own site using the WordPress software, do feel free to try Gutenberg – I strongly suggest you only do so on pages that stay as drafts, at first – and if you like it, great. (Feel free to tell me what you like about it too.)

Otherwise, you can find the Disable Gutenberg plugin here. Highly recommended.

* A couple have been made by clients using other software, and they just send us the output of their webpage design program.

Two new sites

Leave a Reply

The WordPress software comes with several default designs, and for the past few years they’ve been called ‘Twenty Ten’, ‘Twenty Eleven’ etc etc according to when they were introduced.

After some design choices that aren’t suitable for any YES site (and most others!) the latest, imaginatively called ‘Twenty Seventeen’, can work well.

For two examples, see DeepTissueSensual.co.uk’s site for ‘massage with a happy ending in Belfast, Dublin, Glasgow, Aberdeen, Inverness, York, Chester, Preston, Euston and many other areas in the UK and Ireland’ and MatureIndian.co.uk’s site for very naughty times in London, Hertfordshire, and Bedfordshire.

In both cases, there was a picture that worked as the featured image on the front page and not too complicated a menu for other pages. Speaking of which, one of the disadvantages is the way that new pages are not added to the menu in their correct order – they’re always added at the end, so you need to move them manually if that’s not what you want. As the new default theme, it may also become overused by other people.

But at the moment, it’s a quick and easy (and therefore cheap) way of having a good looking site that adapts very well to different screen sizes.

Not all ‘upgrades’ are good

1 Reply

WordPress software is behind a large chunk of the web – over a quarter of the top ten million sites, apparently. The good thing about this is that you can find easily someone who knows WordPress and can at least to try to help with any problems. The bad thing about this is that breaking into WordPress-based sites is a very popular activity for hackers and the attempts are both endless and automated.

It would help if the authors of WordPress software took security a bit more seriously: unless you do something about it, anyone can attempt to login to your site as many times as they like, as fast as they like – they even made it easy for attackers to try hundreds of user names and passwords at the same time* – with nothing to go ‘Hang on, you’ve tried a thousand different user name and password combinations in the past minute, I don’t think you’re really a human with legitimate access to this site…’** Allow this and eventually the right combination will be found, and the attacker can do anything they like on your site.

So there’s a bit of software on Your Escort Site websites that looks out for repeated failures to login and blocks access to the site for a while if that happens. The ‘try hundreds at once’ attack is blocked too.

But just trying a user name and password involves the software remembering how to check them, looking through a database and doing some maths to see if they’re correct. When this is happening hundreds of times a second, it can slow everything down for real users.

So Your Escort Site websites have another check to see if someone attempting to login is real. The web server expects a password before it will show the web page used to login to your site. Get it wrong, and the WordPress software never knows it happened. It’s proved very useful whenever there’s a major attack on WordPress-based sites.***

As merely having a password on this page defeats the vast majority of ‘bots’ trying to break in, it doesn’t need to be a good one. So it’s a simple three letter word. But even that can be forgotten, so the web server sends a message to the browser telling the visitor what it is! This should be displayed in the small pop-up asking for the password. (Bots tend to be very stupid and can’t read the message.)

Different browsers show this login different. Here’s Firefox getting it right:

Firefox gets it right – can YOU guess what the user name and password are?

Chromium, Google Chrome and Opera (both of which are based on the Chromium software) used to show the message in a slightly different way, but since a recent upgrade no longer do so:

Chrome not showing the message from the web server

Chrome gets it wrong

Why this was thought to be an improvement, I don’t know.

Either way, once the short user name and password are entered, the user gets to the real login screen which looks like..

The real login page

.. and that’s where the real user name and password is entered.

* The feature that allowed that is used in another bit of software they wrote, but there is zero legitimate use for this aspect of it. It’s still there, sigh.

** They have, finally, stopped suggesting sites have one particular name for an account that can do anything on the site, with the result that it was the one that most hack attempts tried. It only took several years of pointing this out before the change was made too, sigh.

*** Every few months, basically.

Amazon gift certificates no longer anonymous to send

Leave a Reply

As far as we know, they’re still anonymous to receive for things like deposits – all the sender needs is your email address – but Amazon have just changed things so that when they’re redeemed the recipient is invited to ‘Send a thank you message to (what Amazon thinks they’re called)’.

Argh.

Buying one from a shop and sending the string of letters and digits (something like CL86-3UP8WF-XM7Q) will still be anonymous, but those only come in specific denominations.

New templates

Leave a Reply

Someone recently asked about having all their blog posts on the front page of the website. (Usually, they’re accessible from a special page of the site that displays the blog posts.) One of the advantages of using WordPress is that changing how a site looks is easy and this got me looking at themes that do that in a nicer way than usual.

After some tweaking,* there are now three more options for YES sites:

Cards on the table – ideal if you have plenty of pictures you are happy with, this uses a horizontal scroll on wide screens and a vertical one on phones etc.

All up front – again good for showing off your pictures. They are slightly smaller but scroll nicely up and down, including on mobiles, and there’s a menu to the right.

Coin – circles this time! The square picture on the top left is optional.

In all of them, the font and colours can be changed as desired…

* The changes to the themes these are based on available on request.

Using Yahoo! for mail?

Leave a Reply

There’s yet another rash of emails from hacked Yahoo! accounts today. What happens is that the hackers build up a stock of passwords for accounts over a month or two, then spend a day or two using them to spam people with assorted crap. They typically CC random names from your contact list to cut down on the number of emails necessary to spam everyone.

So if you don’t want to bother people, including outing clients / contacts to each other, change the password now, and ideally every month or so. You may also want to consider where you access your webmail from. Computers in libraries are usually ok because the terminals are reset between users (but they typically block escort-related sites) whereas random web access points may not be.

The same applies if you’re using Hotmail / Live /Outlook /whatever Microsoft are calling it this month. Interestingly, it is much rarer with Gmail and their optional two-stage authorisation can eliminate it entirely*.

* _{Whenever your Gmail account is accessed from a new device, you get a text on your phone with a code. Without the code, you – or anyone else – doesn’t get in. It can be a pain if you’re just having a quick email check on someone’s laptop, but that may be the one that’s reporting every key press to someone nasty.}

Plugin policy

Leave a Reply

If you log into your site with your admin account* you will see that there’s a menu item called ‘Plugins’. These are small programs that add functionality to a WordPress site.

Some do it behind the scenes (like the one which is installed to help stop your site being hacked by limiting the number of times anyone can get your password wrong without being prevented from accessing your site for several days) and some are more visible, providing assorted superwhizzo features (but like much other shiny stuff, you almost always don’t actually need them!)

Or at least that’s the promise. In practice, some of them are a complete pain: plugins installed by some of the people who have used YES have..

o Deleted all their pictures (something that promised to help optimise them)

o Slowed their site to a crawl (it was continually trying to back it up)

o Completely locked them – and us – out of their site entirely (an overzealous security plugin). Update: this has now happened twice.

Some plugins also carry a nasty payload: plugins can do almost anything, including turn your site into a toxic mess. Ones you install via your site come from a WordPress-run resource that means they should be ok in that regard, but people still make mistakes and one of the basic rules of computing is ‘never be one of the first people on your block to try a new program’ – let other people find out it’s a buggy pile of crap!

So we suggest** that you talk to us before installing any of them, especially if the authors want you to pay for them.

Now that two people have been screwed over by it, we recommend*** that you do not install the plugin ‘Better WP Security’.

It may be a good time to remind people of one of the aspects of the YES support policy: if you mess things up, it may cost you money to have it sorted out. Specifically people who ignore the above recommendation will be charged****.

Update: A rather neat trick means that you won’t be able to install Better WP Security now, even if you try :)

Update2: The same applies to WordFence, a similar ‘security’ plugin which looks just as dangerous if you don’t know the implications of what it does.

* _{Which obviously isn’t called ‘admin’ – that’s the one 95% of hackers try when looking to break in!}

** _{Remember, this is consultancy speak for ‘Have a very good reason for not doing it this way’ :)}

*** _{.. similarly, this means ‘Do it this way or else!’}

**** _{Told you.}

Email to and from Hotmail/Live & Yahoo!

Leave a Reply

For some reason, the ~~usual suspects~~ two popular but troublesome webmail services seem to be ~~worse than usual~~ having problems at the moment.

If we don’t reply to an email within 24 hours (usually sooner) we probably haven’t got it. If this is affecting you let us know (for example via a PM on SAAFE) and we can sort out another way to communicate.