Honestly, I’d much rather spend my time doing search engine optimization, marketing, or coding new themes, but when I get a panicked email from a hack victim, I understand that getting their blog up and running again is (naturally) their number-one priority.

This post explains why WordPress blogs get hacked and how to keep it from happening to you.

How bloggers discover they’ve been hacked

Many times the hackers are pretty slick, and you might not even know you’ve been hacked until you start to lose traffic or see a weird error. I had a few blogs hacked about a year ago and it took me a while to notice because I wasn’t regularly monitoring my traffic.

Some symptoms I’ve seen (on my own blogs or on my clients’ blogs):

• Delisting, a dramatic drop in rank, or a “caution” page from Google. You’ll usually find out about this a while after the hack, either when you search for yourself on Google, or (if you usually get a lot of traffic from Google) when you notice your traffic go down. Sometimes you’ll get an email from Google that alerts you to the situation.
• Strange links in your posts that just “appeared.” You’ll usually only spot these if you go back and edit an existing post, so many bloggers don’t notice these right away, either.
• Weird blog behavior, like blank pages or “secret” pages that only show up if you try to go to a page that doesn’t exist. Not all of this points to being hacked (for instance, an out-dated plugin can cause a blank page) but it’s often the first clue that something’s wrong.

Why isn’t it easier to spot? The hackers purposely hide most of the evidence from you, and intentionally set it up so that search engines (like Google) see the new “content” they’ve added, but regular visitors (including you) do not. That makes it harder to catch the hack right away and makes it more likely the hackers will accomplish their goals.

What’s in it for the hackers

Most of the hacks I’ve seen have one goal: promoting spam sites. No doubt there are some purely malicious hackers who simply enjoy damaging blogs, but most seem to use hacking as a means to an end.

When they hack your blog, the most common thing they do is put in links to other sites, often porn, pharma, or other lucrative targets that are presumably paying for the effort. Why? Because when your site (presumably a respectable blog that Google knows is not a spam site) links to their site, they get a little boost with Google.

Google knows this happens and actively tries to stop it, but until they recognize that the linked sites are spam, those sites get some benefit. Google usually catches on pretty quickly, though, and when they do, your blog gets penalized right along with the spam sites it’s linking to.

This doesn’t bother the hackers much, because they’re already automatically hacking the next unsuspecting blog (and they sure as heck don’t care that their gain is your loss).

How they hack your blog

By far, the number one cause of hacked WordPress blogs is not having the most recent version installed. WordPress is software, and like any software, the people who wrote it try their best to make it as secure as they can, but occasionally there’s a bug. Sometimes these bugs, if not fixed, can allow hackers into the software.

With desktop software, like Windows or Photoshop or Firefox or Word, when a bug is discovered, the software company creates an update that fixes the bug and the software asks you to upgrade. This is the purpose of services like Windows Update—to make sure you have the latest version of the software, and all known bugs are fixed.

With software like WordPress that’s installed on a web host, it’s a little more complicated. Just like desktop software, when a bug is discovered, an update is created and the software prompts you to upgrade. However, the actual process of upgrading involves downloading and uploading files, backing up your database, and other tasks that non-techies find similarly intimidating. So many bloggers just don’t upgrade.

Though the bloggers often assume that they’re only missing out on new features when they don’t upgrade, the much more important fact is that they’re also leaving known security flaws wide open for hackers. Just like Windows, you only get the protection of the update if you install it. That’s why it’s so important to always have the latest updates (both with Windows and WordPress and any other software you use).

How you can avoid getting hacked

After that last section, this will be obvious, but it bears repeating: always install WordPress security upgrades.

How do you know if you need to upgrade? Log into your WordPress blog’s admin panel and go to the very bottom. It will have a version number, something that looks like 2.3.1 or 2.5 or 2.5.1 (or some other number—but it will follow the basic pattern).

If the number is lower than 2.3 (for instance, 2.2 or 2.2.3 or 2.0.1), you definitely need to upgrade.

If it’s 2.3 or higher, you’ll see a line near the top of your WordPress admin panel that notifies you when it’s time to upgrade:

That’s a good clue that it’s time to upgrade.

What if you don’t want to do the upgrade?

This is the root problem for many bloggers. They don’t have the time or the technical skills (or the time to learn the technical skills) to do their own upgrades, so upgrades don’t get done.

Trust me when I tell you that it’s almost always more expensive to fix a hacked blog than to keep up on upgrades, even if you have to pay someone to do it.

And that’s the answer: if you don’t want to do them yourself, pay someone to keep your blog up-to-date. We offer upgrades as a monthly subscription service, or you can talk to the person who set your blog up for you, or you can hire someone on oDesk or Elance when you need an upgrade. No matter which route you take, the temporary relief of ignoring the upgrade is not worth the much bigger headache of dealing with a hacked blog.

A few other precautions

While out-of-date versions of WordPress are far and away the primary cause of hacks, there are also some other things you can do to help protect yourself and recover in the event of a hack.

If you’re a DIY-type, check out this excellent list of WordPress security tips. These are additional things you can do to secure your blog (we do them by default on blogs we set up).

Having good backups on hand (of both your files and your database) can make it less painful to restore your blog to its former glory if you do get hacked.

Another precaution you should take is to create some “standard” email addresses for your site. When Google detects that your site may have been hacked, they usually try to contact you at the following email addresses:

• contact@yourdomain.com
• info@yourdomain.com
• support@yourdomain.com
• webmaster@yourdomain.com

If you don’t have at least one of these set up, you’ll probably be the last one to know if you do get hacked. This won’t prevent a hack, but it will give you a good shot at fixing things before too much damage is done.

If you need more details on any of the above, leave a comment; I’m considering covering these topics in future posts.

What if you’ve already been hacked?

Because there are different types of hacks and different levels of blogger expertise, there’s no one-size-fits-all fix. Usually it involves upgrading, digging into the files, and searching for any remaining hack code. Honestly, it can be tricky if you aren’t a WordPress code buff (because you don’t know what “normal” looks like).

Your best bet is to get a pro to do an upgrade and once-over. If you don’t want to pay, and you’re feeling adventurous, a much-cited post called “Has Your WordPress Been Hacked Recently?” is a good place to start. When you are confident that the hack has been undone, you can request reconsideration of your blog from Google as a first step in getting it back to normal.

What else?

I hope this post has helped you understand a little more about blog hacks and how to prevent them. I know there is a lot of ground to cover here, and I’ve just scratched the surface, so please share your questions, experiences, and tips in the comments!

What’s the best way to make it so that my initial post, “Stir The Pot,” stays on the first page of my blog? How did you make it so that your findableblogs.com first page stays the same…like a website? I thought that posts automatically get archived as you continue to update and write new posts. I’d like what I said in the beginning to stay on there for at least awhile, but I want to add new material as well.

First, a confession: the only reason the front page of this blog hasn’t changed for a while (prior to this post and a change I’ll talk about in a moment) is that I haven’t written anything for a while! Between client work and an ebook I’m about to release, I’ve been a complete slacker where this blog is concerned.

If you’d rather not do the slacker thing (like Reonne, you have posts to write!), you have three options.

Use a Page as the home page

That probably sounds cryptic if you don’t understand the difference between Posts and Pages in WordPress, but a Page is designed to stick around without changing, while Posts tend to appear and disappear from the homepage, archives, and search results relative to how many other Posts you have.

You create a Page in the same way you do a Post, but instead of going to “Write” → “Post” (or just “Write”, since “Post” is the default sub-tab), you go to “Write” → “Page”. If you want the whole front page to stay essentially the same for a while, this is a good way to do it; just create the page here.

Once you’ve created your page, go to “Settings” → “Reading” (“Options” → “Reading” in pre-2.5 versions of WordPress) and switch the “Front page displays” setting to a “static page” of your choice. For instance, if I was going to change the front page of this blog to my “About” Page, I’d set it like so:

In fact, this is exactly what I’m going to do when I finish coding the new design for this site. In that case, I’ll create a special “Home” Page that will have the front page content, and that will be the first thing new visitors see.

The potential downside to this approach? Your front page is the Page you set up, not a list of entries. That might suit you just fine (like I said, that’s exactly what I’m planning on), but if you want your front page to automatically update with new posts, keep reading.

Use the WordPress time stamp magic

With WordPress, you can easily change the dates on your posts. The newest post shows up at the top of your front page (unless you’re using a very unusual theme), so all you have to do is make sure that the post you want at the top is always dated after the other posts.

This can be a bit of a pain, because you’ll need to change the date on the “top” post every time you create another post, or back-date your new posts to make them “older”, which is just confusing (if I was choosing between the two, I’d change the date on the “top” post each time).

Clearly, this isn’t as passive as the first method, but if you’re only talking about a few weeks or a few posts, it’s not that bad and accomplishes the goal nicely.

Use the sidebar

If the content you want to feature is really a kind of introduction, it might make sense to put it in the sidebar using a Widget. That way, it’s always readily available in a place where people look when they’re searching for context, but it’s not in the way of your content and doesn’t require any particular maintenance effort on your part.

All things being equal, this is probably the route I’d take in most cases, if it suits the content.

Advanced options

You can actually combine some of these ideas if you’re comfortable editing your theme. For instance, if you know your way around The Loop, you could show the content of a Page first thing, directly followed by the regular Posts. You could also just manually edit your theme’s home.php or index.php file to show a certain message before the regular content.

However, neither of these options are as easy or convenient as the previous three “out-of-the-box” options, so I tend to avoid them for short-term changes.

Based on the response from Wendy Piersall’s Problogger post, I realized that many bloggers want to use a search engine optimized theme but don’t know how to evaluate the code. I also got many requests to review specific themes. Instead of writing “Best themes for SEO” posts forever, it seemed like a better idea to create a site for this, and that’s the basis of WordPress Theme Review.

The site offers thumbnail images of the theme in use, as well as info on whether or not it supports tags and widgets, if there’s a cost, etc., but the main feature is that each theme is assigned an SEO score (out of 100) that helps the average user know how optimized the theme is.

Bottom line, if you’re interested in getting an off-the-shelf theme (which are usually free or inexpensive), you can easily browse the best WordPress themes for SEO purposes and find one that fits your style and will help you in the search engines.

The idea is to walk viewers through the process of essentially recreating our Speedy Start blog package.  Frankly, many people prefer that we take care of it, but if you’re a DIY type, or just want to know how it all works, or have tons of time and no money, the WordPress Quick Start videos videos are just what you need.

Right now there are only a few videos, but enough to help you sign up for hosting, install WordPress, and get started blogging.  Future videos will cover how to install plugins and themes.  I’m also interested in answering your questions, so if there’s something you’d like to see a video discuss, let me know through the comments (here or there).

1. Clarify the business goals for your blog
2. Commit to blogging goals for long-term success
3. Why create an “ideal reader”?
4. How to identify your ideal reader

Beyond goals about what you want to get out of blogging, it’s a good idea to set goals for what you’re going to put into your blog.

You can’t force readers to come, or to subscribe, or to buy your product, or to call you for an interview. Those are areas you can influence but ultimately, they’re out of your control.

What you can control, though, are the actions you take to create an online environment that increases the probability of success and influences your readers, potential and existing clients, and the media.

The big benefit your “blogging input goals” will provide is a structure for the consistent small actions that will build a solid base for long-term success. Blogging is like any other type of marketing: if you put serious effort into it only when you’re not getting results, but abandon it when you get busy, you’ll create a feast-or-famine situation, a roller coaster of unpredictable results.

Steady actions result in steady growth, and that’s the goal—steady doesn’t have to mean “plodding.” Everything is accelerated online. You can see results quickly and experience continued success by having a plan and following it.

So what kind of goals should you set? Consider things like:

• How many posts you will write each week
• What day(s) you will write them
• How many blogs you will read (more is not always better!)
• What other kinds of topical information you will consume (magazines, books, etc.) and how often
• How many comments you will leave on other blogs
• How much time you will spend per week on other kinds of promotion (be specific!)

You’ll probably develop a better idea of what these tasks will require when you read my book, but I encourage you to write down your initial goals.

Start on the conservative side; you can always increase later if you want, and it’s much better to consistently meet less-ambitious goals than to be overwhelmed and do nothing. Your goals need to be sustainable to make any difference.

My other advice for input goals: raise your goal only after a couple weeks of exceeding the goal you already have. It’s very common for new bloggers to get caught up in the excitement of blogging and be very prolific—the normal result of thinking about something regularly. But as blogging becomes more routine and other duties press in, it can be surprisingly difficult to maintain the initial pace.

Before you move on to something else, write down your starting goals. It will probably take less than five minutes, so do it now.

XV – Revised

We like this theme’s code because it:

• validates
• has better-than-average code structure
• emphasizes your post titles
• emphasizes your blog name
• emphasizes your blog’s description
• uses unique page titles

Hemingway for Wordpress

We like this theme’s code because it:

• validates
• has better-than-average code structure
• emphasizes your post titles
• uses unique page titles

Hemingway reloaded

We like this theme’s code because it:

• validates
• has better-than-average code structure
• emphasizes your post titles
• uses unique page titles

Rounded Blue V2

We like this theme’s code because it:

• comes very close to validating
• has better-than-average code structure
• emphasizes your post titles
• emphasizes your blog name
• emphasizes your blog’s description
• uses unique page titles

Freshy 1.0

We like this theme’s code because it:

• comes very close to validating
• has better-than-average code structure
• emphasizes your post titles
• emphasizes your blog name
• uses unique page titles

Now, I’m a little biased , but I think one of the best ways to get a great theme with great code is to have it built that way; you get the best of both worlds: a custom theme that represents you perfectly, and great, search-engine-friendly code.

However, I’m also a realist, and know that many bloggers can’t/don’t want to put cash into their blogs, so I wanted to take this opportunity to highlight some beautiful WordPress themes that also feature excellent, search-engine-friendly code. Read on to see the first five selections (in no particular order). (Hold your mouse over a “reason” to see a slightly longer explanation.)

Iceburgg

We like this theme’s code because it:

• validates
• has better-than-average code structure
• emphasizes your post titles
• uses unique page titles

Gridlock 1.4

We like this theme’s code because it:

• comes very close to validating
• has better-than-average code structure
• emphasizes your post titles
• emphasizes your blog name
• uses unique page titles

Fresh (Compact) 1.2

We like this theme’s code because it:

• validates
• has better-than-average code structure
• emphasizes your post titles
• emphasizes your blog name
• uses unique page titles

Time Manager

We like this theme’s code because it:

• comes very close to validating
• has better-than-average code structure
• emphasizes your post titles
• emphasizes your blog name
• uses unique page titles

Fluid Solution

We like this theme’s code because it:

• comes very close to validating
• has better-than-average code structure
• emphasizes your post titles
• emphasizes your blog name
• emphasizes your blog’s description
• uses unique page titles

This will be an ongoing series, so if you want to know about a particular theme, leave a comment and we’ll consider the theme for future evaluation.