Security – Page 4 – Wingrove-Services

Site Speed and Plugins

There have been quite a few issues with the GDPR plugin I have used on many sites over the past 2 months. It was originally released in May 2018 and was trouble free for many months, and then someone decided to enhance it and then there was a large volume of complaints from users.

The GDPR plugin in some cases was requesting a non existent image file, so it caused pages to delay loading which affected the performance of the website. Right now everything is ok, but it has been quite a rocky ride over the past month or so.

There are some plugins that are highly recommended, the form handlers, slider managers, and security plugins are the most important. Others are less important, and sometimes a plugin that you have had on your site for years suddenly starts impacting the site performance.

Here is how to check

If your website appears to be slow to respond, you can check to see if it is a plugin that is causing the problem by going to the plugins page and checking them all and then disabling them.

This means that some functionality will be temporarily lost on your website; security, forms, sliders, etc. But it is only a temporary measure.

Using Chrome, go to the home page of your website, hit F12 and then choose a page. You will see a waterfall graph which tells you the response time of the website. See the image below for this website (with plugins enabled.) If I turned the plugins off, the speed would be slightly faster.

Click on the image to see a larger version

The image shows the time for the first byte TTFB which is the delay between requesting the page and start of the transfer. It is shown as 1.7 seconds, then the rest of the chart shows the elements in the web page being requested in order to render the page in the browser. In this case the time is 2.18 seconds between requesting the page and seeing the page in the browser.

However there is something else happening in the chart towards the bottom, some other process is taking a further 1.65 seconds.

Remember to turn the plugins back on!

After you have finished checking the speed, remember to turn them back on.

What should you expect?

Assuming all plugins are working, and the site is functioning normally, based on my experience the times should be under 5 seconds, typically 2.7 seconds. However the results are dependent on many things. If your site is wildly out; consistently longer than 5 seconds, let me know and I will check it for you.

Over the past month there have been some speed issues on some websites, and some of these have been down to plugins changing. So it is worth investigating first to see if it is plugin related. If you need help just ask.

Unable to upload to the media library?

I thought I would flag this again, as it has happened several times now. If you allow Microsoft Word to name a file based on the content of the document there is a small risk that it may have an apostrophe in the file name.

For example if I created a document and the first piece of text in it said “Fred’s Success Story” and then saved it (without giving the file a name), Microsoft would save the file based on the first few words in the document. It might save it as fred’s success story.docx for example. Ordinarily there is nothing wrong with this until you try to add it to a WordPress website by uploading it as either a PDF or MS Word document. The presence of the ‘ in between the d and s will throw an HTML error on upload.

Is email secure?

I met with an IT friend of mine and we had a discussion about security and email. I have been recommending that everyone uses SSL or TLS to connect to their server when they are reading or writing emails.

Using SSL or TLS secures your connection to your server and ensures that your login details cannot be compromised by a third party. Email programs that do not use SSL or TLS send the login details in plain text. If this was intercepted by a third party, then the password details could be read, and a potential spammer could use your SMTP (sending email server) to send out lots of spam messages. Or read your mail and access your account.

Once your email has reached your sending server, it may then be handled in plain text across the internet over multiple hops (Mail Relays) to the destination server, because that connection is generally not encrypted.

There are several systems out there, and they all need to play nicely together, but the bottom line is we should consider at the worse case all email to be insecure. Even though we may be applying best practices at the send and receive server end of the system.

Have I been Pwned?

No that was not a typo. There is a website that has access to data breach information. It is not clear whether it lists all data breaches in the public domain, or a select few of them. The website asks you to enter an email address into the site, it will check through the information it holds and will respond if a match is found.

I tried one of mine and it returned several results indicating that my email address and an associated password to access an online account is in public circulation. It also shows if your email address is in spam lists as well.

I have seen two sets of results on data breaches, one indicated your email address exists in a list somewhere that is in circulation, (typically a junk mailing list). You cannot do anything about this. The other case tells you the website and your email AND a password is in circulation. In the latter case you should be concerned about it if you were previously unaware.

Password Protected Pages in Divi

On many Home-Start sites, and some of the regional charity websites I have included one or more password based pages. You can add these yourself, it is controlled in the editing view of the page or post on the right handside where it refers to Visibility. You have the following available:

Public
Public (and stick to the front page)
Password Protected
Private

Items are normally set up as Public. If you use Public and stick to the front page, check what it does first. It may not work as you expect it to work because it relates to the template.

Password protected pages in Divi

There is an annoying problem with password protected pages in Divi, if you try to enter one the first time you will see small writing on the left and a button on the right. On a wide screen these look totally disconnected, and not obvious. If you have a non Divi based website, you are unaffected.

GDPR

Following my offer to review and upgrade sites to provide improved security for GDPR (see this item) and the inclusion of a Privacy Statement or Policy from the organisation I have modified 17 sites out of 130 sites.

Many organisations do not appear to have done anything, and one could argue after the GDPR deadline, not much has happened. If you have not taken any action, I would encourage you to do so. Most of GDPR applies to what you do behind the scenes in your internal operations. I cannot help you there. But there are parts that can affect your website which I can help you with.

Contact me for more help.

Google Recaptcha version 2

Personally I use Chrome for most of the work I do from a computer. I may use MS Edge (rarely) or Firefox to test outside of the Google Chrome environment. While doing some of that testing I was surprised to see that it can be difficult to enter some information to get past this Google Recaptcha 2 screen below.

Sometimes I have had to go through 3 iterations to get through. I have noted in Continue reading Google Recaptcha version 2

Check your contact forms

Some time ago I mentioned that my preferred form manager of choice had been withdrawn from the WordPress plugin library. This plugin was called FS Contact Form. At the time I had not found a suitable replacement that did everything that the FS Contact Form manager did. I have resolved that now. If you have it in your installation you can check in the plugins page, or check under Settings. If you can see FS Contact Form you have it on your website. If you can see Contact Manager in your plugins list that is even older. Also should be replaced.

There has been one instance where the FS Contact Manager plugin had stopped working. I am not sure why, it could have been related to another plugin conflicting with it. I want to encourage all of you to test your forms once per month by sending a message to yourself. That way you can be sure it is working. Continue reading Check your contact forms

Securing mail from your website to a mailbox

By default a wordpress installation uses a method of sending mail that does not use a mailbox to send the message and does not encrypt the message. Email cannot be confirmed to be end to end secure unless you know the receiving or sending person is using encryption and is set up correctly; you can encrypt mail in the places where you control email so that it is encrypted from the website to the mailbox. If it is your mailbox, and you know that your mail client is set up correctly with encryption, then you have end to end security. If the website is running over SSL and the address starts with https:// (98% of them are now), then a user entering information into a form is also encrypted. So the path from the users browser, through your contact form, from the website to your receiving mailbox is encrypted and cannot be intercepted as plain text.

How do I make the changes

Log into your website and go to Plugins.
Seatch for WP Mail SMTP, locate it and install it. Continue reading Securing mail from your website to a mailbox

Do You Send Newsletters?

New recommendations for Newsletters

Some of you are using Mailpoet on your websites to generate newsletters. I have run into a lot of problems sending out my newsletter this month, I have had to send it three times. I checked through my logs and found that a very small number came out last month as well. I have been investigating what has happened. The top two entries in the image below show there is a problem because rather than a 65%+ opening rate, there is a 4% opening rate.

Continue reading Do You Send Newsletters?