Category Archives: WordPress

Configuring the bbpnns Reply by Email Webhook

You’ve chosen to use the bbpnns Reply by Email Webhook instead of the WordPress Cron system. Smart choice. Now, every time the Webhook is called, the plugin will check your inbox for the newest replies to be added to your bbpress forums.

[vinyl scratching] Wait, what’s a webhook?

Webhook is nothing but a fancy name for an action taken by a site when a given URL is accessed. In the plugin settings you were given a web address to use.

The trick now is getting that webhook called as frequently as possible without enraging your web host.

Keep reading to learn about our recommended methods of setting up the Webhook calls.

  1. IFTTT
  2. Zapier
  3. Real Cron Jobs

IFTTT

IMPORTANT: On March 30, 2019, Gmail changed their API and IFTTT can no longer offer its service. We’re sorry, but it is not within our control. Please refer to the Zapier or Real Cron JobS steps instead.

IFTTT stands for If This Then That, and is a free service which lets you connect services according to pre-defined rules, called Applets (they used to be called recipes). You can create your own applets or use any of the many available applets built by IFTTT, service providers, or users like yourself.

IFTTT connects seamlessly with Gmail (and Google Apps, which essentially the same thing), and Office 365 (for paid outlook accounts) but currently does not support checking POP3/IMAP mailboxes. If you need POP3/IMAP direct checks, skip ahead to the Zapier and Real Cron Jobs sections below.

For the purpose of this tutorial, we’ll assume you’re using Gmail. Setting up Outlook 365 (if you have the paid service) should be pretty much the same (we haven’t done it ourselves, to be honest, as we don’t have the paid service).

Here’s what you need to do to get bbpnns Reply by Email running with IFTTT:

  1. Create a free IFTTT account just to use with this plugin, if you don’t already have one. Simply go to https://ifttt.com and follow the signup steps. You can also choose to connect with your Google or Facebook account.
  2. Once your account is set up, go to the Gmail service page: https://ifttt.com/gmail (or https://ifttt.com/office_365_mail if you’re setting up your paid Outlook account).
  3. You can only have one connected Gmail account per IFTTT account, so if you already have Gmail connected with your existing IFTTT account, disconnect it *. Then click the big Connect button.This will take you to the Gmail OAuth screen, where you’ll need to log in with the Gmail account you set up in your bbpnns Reply by Email settings screen, and click  ‘Allow’ when prompted.
  4. That’s it for Gmail. Now we need to tell IFTTT that we want to use Webhooks. Go to https://ifttt.com/maker_webhooks and Click connect, just like you did for Gmail.You will not get any Oauth screens or anything. Just the Webhooks screen without the connect button.
  5. Finally, set up your Applet to call our Webhook when new messages arrive. IFTTT seems to check Gmail every minute, so this is by far the best solution you can get. Click My Applets > Create, or go directly to https://ifttt.com/create. You’ll see the new applet screen:
    Click on the big blue “+ this” link (yes, it’s a link – I was a bit lost way back when I first tried it).
  6. Enter Gmail in the “Choose a Service” screen, and click the Gmail icon.
  7. In the Trigger screen that comes up, select the box that says ‘Any new email in inbox’. You’ll be taken back to the New Applet screen with the ‘+ that’ now linked and the Gmail icon replacing the ‘+ this’. Click ‘+ that’ and type Webhooks. Click the Webhooks icon.
  8. Click the ‘Make a web request’ action box (the only one available at the time we wrote this tutorial).
  9. Enter the bbpnns Reply by Email Webhook URL you were given in the plugin’s settings screen in the URL field. Leave the other fields as they are, as they are not important. Finally, click the ‘Create Action’ button at the bottom of the box.
  10. You’re almost there! You can now choose to change the description of your action and whether to receive notifications when the applet runs. Just click ‘Finish’ to complete the applet creation.

Once your applet is created, you can turn it off or on, and also force check the Gmail account.

* You can take a more complicated approach and share a gmail account by setting up labels for messages that contain <you>+usc_ as the beginning of the “to” field, and have the Gmail trigger run when a message gets labeled, but that’s beyond the scope of this tutorial.

Zapier

Zapier is another service like IFTTT, where you get to create “Zaps”. Like IFTTT, you can connect to service providers and create triggers. Unlike IFTTT, it lets you connect to IMAP so you can use it for free Outlook/Hotmail accounts and even your hosting provider’s email service if you’re using that. The downside of using Zapier is that it only checks your mailbox in 15 minute intervals instead of every minute, so your forum participants are likely to think something went wrong and re-send the replies over and over. Each email reply will be translated into a forum reply, even if it’s a duplicate.

IMPORTANT: The bbpnns Reply by Email plugin requires an email server that supports “plus aliases”, i.e. sending messages to foo+bar@domain.com is the same as delivering to [email protected] To our knowledge, the only large hosting providers that currently support this are Gmail and Outlook/Hotmail. The plugin will NOT work without it. Only go the IMAP route if you tested “plus alias” support manually or via the plugin settings screen. You’ve been warned :). Continuing…

To set up a Zap to trigger the webhook, follow these steps:

  1. Create a free zapier account if you don’t have one;
  2. Search for IMAP by Zapier app and select it;
  3. Search for Webhooks by Zapier app and select it;
  4. Click the ‘Use this Zap’ button in the box that says ‘Create Webhook post from new IMAP emails’.
  5. Follow the instructions to create the Zap. When prompted to connect an IMAP account, use the IMAP settings that your hosting provider gave you;
  6. Click Save+Continue;
  7. Select Inbox when prompted to select an IMAP folder. Click Continue;
  8. Click Fetch+Continue to test the connection;
  9. If the test is successful, click Continue to set up the Webhook;
  10. The only option now is to “Fire off a single POST request as a form or JSON”. Click Continue;
  11. Enter the Webhook URL you were given in the bbpnns Reply by Email plugin’s settings screen in the Zapier URL field. Click Contiue;
  12. Click Send Test to Webhooks by Zapier. Don’t worry if it says that the test was successful but no data was available. That’s intentional.
  13. Finally, click finish.

Zapier will check the mailbox for new messages every 15 minutes and call our plugin to do the processing.

Real Cron Jobs

The Cron system was designed to let people run programs at given dates/times or intervals (called jobs). It is essential in any Unix or Linux environment, and all decent hosts will let you create new jobs.

WordPress tried its best to create a faux Cron system for those who can’t or don’t want to deal with real Cron systems. However, because it needs to keep its performance good, it can’t simply run indefinitely in the background waiting for whatever date/time there are jobs to run. It only runs when someone visits your site, so even if you have a job that was set to run at, say, noon every day, and your site only receives a visitor at 5PM, that’s when the noon job will run.

You can (and, for bbpnns Reply by Email to work effectively, should) replace the Cron functionality that’s bundled with WordPress with a real Cron job. It’s quite simple and jsut requires editing wp-config.php to disable the internal WP Cron before running your own.

There are several tutorials available on how to do that. I like the one at SiteGround.

Feel free to follow that tutorial to the letter if you want to (to replace WP Cron), especially if you chose to not use the Webhook.

To get bbpnns Reply by Email to work as a Webhook, you’ll need to add the Webhook command that you got in the Settings screen as a new job in the Cron Job screen in cPanel – you don’t need to replace WP Cron at all.

Set it to run as frequently as possible without enraging your hosting provider. SiteGround asks that you don’t run any jobs in intervals smaller than 30 minutes. This is obviously not frequently enough for any good user experience (where’s my email reply? should I send it again?), which is why using Cron Jobs is last on our list.

Conclusion

This concludes our tutorial on how to set up bbpnns Reply by Email to work with Webhooks. We strongly believe that setting up IFTTT with Gmail is the best option to get the smoothest email to reply user experience.

If you still don’t have the bbpnns Reply by Email plugin,

 

 

Why You Need Website Care

So you got yourself a car. Congratulations! Now you can commute to work a bit more comfortably and not have to rely on transit timetables. But with the car comes new situations that you didn’t have to deal with before – like taking care of a flat tyre. Sure, you can replace it with the spare, but what do you do with the punctured one? Unless you’re in the tyre repair business, you wouldn’t try to fix it yourself, would you? You could try to Google how to do it and buy the tools, but heck, you have more important things to worry about in your life/work/business than fixing a puncture. You take it to a professional – a person who knows the trade and is quite good at it.

It’s not much different when it comes to your website, WordPress or otherwise.

Your website’s importance varies depending on the role it occupies. If it’s just a hobby blog where you write about some of your deepest thoughts and feelings (Facebook pretty much made that kind of site obsolete), then website technical issues really won’t mean much to you. On the other end of the spectrum, if you’re in the retail business and your e-commerce site goes down, that’s akin to locking the doors on a physical store in the middle of the day. You can’t let that happen. But just like in our punctured tyre example, your main focus should be your business, not your website.

It’s a lot of work to put up an effective and pretty website. What many people don’t realise is that once it’s up, it needs to be looked after. What can possibly go wrong, you ask? Keep reading and try not get too scared.

Security

Website Security

The vast majority of people want to make money. It’s part of our survival instincts. Also, everyone wants to have fun, whatever fun may mean to them. Whether it’s for the money or for fun (or in a perfect world, money-paying-fun), some people will try to take advantage of your website. That’s the internet for you. This can go from stealing your client’s credit card information, down to placing their ads on your pages so that your traffic makes money for them.

Back in the early 1990’s, when I was just dipping my toes in the computer world, I asked my then mentor how to keep computers safe. His answer: turn it off, unplug it from the power grid, and store it in a safe. And even so it won’t be 100% safe. The internet was in its infancy then, with no such thing as broadband and the fastest modems you could get would download at a top speed of 5 bytes per second.

The number of users since then has multiplied enormously and with that, the number of hackers (or crackers, or whatever you want to call them). And the sad reality is that there isn’t a single piece of software that can be truly safe from attack. It’s not necessarily because the software itself has flaws, but because it depends on a whole ecosystem for it to work – other pieces of software, hardware, and even users (many attacks are successful because they manage to scam users out of their passwords).

The best we can do is make it hard for attackers to succeed. Software bugs and vulnerabilities need to be fixed as soon as they’re disclosed, as many attackers rely on outdated software to gain access to servers and other systems.

When it comes to website hosting, we also need to choose our host company well. It’s really no use to have your website nice and up-to-date if the server that your files are in has insecure software that you can’t control. For example, if you’re on a shared server that doesn’t have its file permissions set correctly, you’ll be vulnerable from other people’s insecure software. If they get attacked, then your site is as good as dead, too.

So what’s the solution? Besides keeping your site up to date: remediation.

Backups

Back to our flat tyre analogy, you wouldn’t drive without a spare, right? The same can be said for websites, especially those that change frequently, like a blog or ecommerce site.

When things go wrong (and mind you, they will go wrong at some point in time), you’ll be relieved if you have a recent snapshot of your website.

This is what we call a backup and it’s saved many a business’ bacon time and again. When backing up a site, we store a copy of all files and the database on a separate server, so that if the server itself blows up, your backups are safe.

The frequency with which you backup your site can depend on how often your site changes. Daily backups are fine, but some sites can go to extremes like getting immediate file backups and redundant databases (where changes to the database are automatically applied to a secondary database on a different server).

Malware Scanning

OK, so you managed not only to get backups done frequently, but also to recover your lost files and data. Next thing you know, your site is attacked again. You’d be surprised as to how common this really is.

The problem is that when you backup your site, you’re probably doing the attackers a favour and backing up their means of attacking as well. So when you restore the files, they’ll still have the front door wide open for them.

That’s why it’s important to, as well as keeping your site up to date, scan your site periodically for malware and clean it up. Malware are the files and data that attackers are able to embed into your website to let them do what they want.

Security Plugins

There are some handy WordPress plugins that assist in tying up loose ends security-wise – from hiding your admin area behind a custom address, to blocking forced entry attempts, to forcing two-factor authentication, among a plethora of other tactics designed to keep your site safe. The trick is choosing the best one and making sure it won’t conflict with any other functionality of your site.

Pretty daunting, right? Sure, there’s Google to help you take care of all that, but do you really want all that weight on your shoulders when you could be focusing on reaching your quarterly goals? Oh, and speaking of Google, they’re not always your friend! Now you have to also worry about Performance.

Performance

Google is hands down the largest and most popular Search Engine in the world. No argument there. The problem is that businesses are so dependent on getting the best positioning in search results that they have to abide by the ever changing rules that Google imposes (always claiming improved User Experience). A while back, thousands of information-based websites were negatively impacted by Google policy changes (Google gave these changes cute fuzzy animal names, perhaps in an attempt to soften the blow) and these people had to scramble to get back on their feet. Some never did.

Not satisfied, Google decided that sites should be mobile friendly, and then needed to be fast, and recently that sites should be encrypted. I’m not complaining – they’re all perfectly valid requirements when you look at it from a visitor’s perspective. But that also means that you, as a business owner, need to give much more attention to a tool (your website) than to your overall business.

Getting a site to be fast is not usually an easy task. There are many moving parts involved and getting all your ducks in a row can be quite frustrating. Remember the flat tyre analogy? Consider achieving and maintaining good performance as not only fixing the puncture but also balancing and aligning the wheels. And recapping the asphalt while you’re at it!

Professional Help

Taking care of a website shouldn’t be taken lightly. You’re better off hiring a professional who has that as their business so you can focus on your own.

We at UseStrict Consulting take pride in caring for our clients’ websites. With almost 20 years of experience developing websites, and over 5 years customizing and developing WordPress plugins, we know how to secure and optimize your site, and recover it when disaster strikes. It’s a scary world once you know all the dangers, but we’re there to help you through it.

Click here to learn more about our plans.

This post was originally written for TourismTribe.com by UseStrict Consulting.

Fix Hyphens in WordPress Media Titles

Minor WordPress version updates are fairly safe to apply. I had never seen a serious bug being introduced in a maintenance release – heck, that’s what the releases are for, right?

That is, until a friend reached out saying that all Media uploads that had spaces in their file names started getting hyphenated titles. Sure, she could manually fix the titles after the upload, but with image-intensive sites, that’s just not practical.

I did some digging and it turns out that this is a known bug introduced in WP v4.6.1. The fix is ready for WP 4.6.2, but as of this writing there is no date scheduled for that release.

There is, however, a workaround in the ticket, and I’m adding it here for your benefit. Just copy the code below and paste it at the end of your theme’s functions.php file. Make sure to paste it before any closing ?> tag. Actually, if your functions.php has a closing ?> tag at the end of the file, feel free to remove it. It’s bad practice to keep them lying around that way.

Kudos to @SergeyBiryukov for the fix.

function wp37989_fix_encoded_attachment_titles( $data ) 
{
    if ( empty( $_FILES ) ) 
    {
        return $data;
    }

    $file = current( $_FILES );
    $ext  = pathinfo( $file['name'], PATHINFO_EXTENSION );
    $name = wp_basename( $file['name'], ".$ext" );

    $data['post_title'] = sanitize_text_field( $name );

    return $data;
}
add_filter( 'wp_insert_attachment_data', 'wp37989_fix_encoded_attachment_titles' );

Remember to remove it after you install WordPress 4.6.2. It won’t break anything if you don’t, but it’s redundant and will just take up some un-necessary CPU cycles.

Cheers!

Vinny

P.S. Check out our Website Care Services and let us help you keep your site up and running.

The Latest Rumors About WordPress Are Wrong

Calypso has been the hottest topic in the WordPress community over the past week, following this announcement from Matt Mullenweg. While many have praised the development as genius, and a long time in coming, others have been less generous in their comments. In fact, there are some rumors and ideas being fervently discussed in various WordPress groups that are flat out wrong.

It all stems from confusion about what Calypso really is, and how it’s changing WordPress and the future development of that platform. Developers who have invested incredible amounts of time to create themes and plugins that are based on the traditional WordPress platform are understandably concerned that all of that work, and the basis for their businesses, could be going up in smoke.

We’re going to review how WordPress works today, how Calypso changes the platform, and what that really means to developers and site owners alike.

The Players

To understand how WordPress works in the background, let’s think about what happens when you go to a fast food restaurant. You order a burger and a few moments later you’re walking to your table with a tray filled with food. Is it magic? Nope. Behind the scenes, several employees were working hard to get your burger assembled to the chain’s standards. In the same fashion, when you load a web page, several things go on behind the scenes until a few moments later you see the page you requested.

HTTP Requests

There are 2 main actors in play when you access a web page. The first one, considered the front end, is the browser. When you type in the URL or click a link, the browser calls the second actor – the web server – requesting that page. The server identifies the type of file being requested and reads it into memory. Depending on the type of file, it will execute a set of instructions and then spit out the result for the browser to display. Simple enough, right? But where do PHP, MySQL, and JavaScript come into play?

PHP is considered a server-side language. It’s just one of many, but like any server-side language, it has no say whatsoever in what the browser does. The same goes for MySQL, one of many database systems. The web server calls the PHP script, which in turn calls the database, before generating the HTML code that gets sent back to the browser. That’s pretty much all that the browser reads.

However, a basic HTML page is dull and isn’t very useful by today’s standards. So browsers also have the ability to style the HTML output using CSS (Cascading Style Sheets), as well as execute predefined instructions that it gets from JavaScript blocks or linked external files.

For example, here’s what the wordpress.org site looks like with- and without CSS styling.

WordPress.org Site with CSS WordPress.org Site without CSS

 

Bottom line – JavaScript is for browsers, PHP and MySQL are for servers (with the exception of Node.js which is a mini web-server that runs JavaScript in the back end. Calypso runs on a thin layer of Node.js to generate the initial page, but has not dropped PHP/MySQL altogether). More on this in a moment.

REST API

REST means Representational State Transfer. It is an architecture style that relies on regular HTTP requests from the front-end to the back-end. In short, it’s basically a one page load that calls several other mini page loads during the same run. Each mini call loads a piece of information.

WordPress

WordPress is a Content Management System; system being the operative word. Its strength comes from the ability to extend it with plugins and themes. All WordPress plugins and themes are written in PHP and use MySQL to fetch and store data. In WordPress.com, the number of plugins and themes are limited and users do not have the power to install new ones – only to turn on those already vetted by WP.com. Self-hosted WordPress.org users have over 10,000 plugins to choose from, again, all of which are built in PHP/MySQL.

The Problem

Now, let’s get back to Calypso. I saw a slew of incorrect reports and conclusions because of this statement on Calypso’s home page:

“The new WordPress.com codebase, codenamed “Calypso,” moves WordPress.com away from MySQL and PHP. It’s built entirely in JavaScript, and communicates with WordPress.com only using our REST API.”

This statement led people to believe that WordPress.com no longer uses any PHP and MySQL. If that were true, it would mean that either they broke hundreds of plugins and themes that relied on the database, or modified them all to work with the new technology. Neither are likely. Especially since they say they use REST API.

It’s also a very confusing statement. The new WordPress.com codebase communicates with itself using their REST API? If you’re running from inside a single codebase, there’s really no reason to make an external HTTP request to yourself.

The fact is that Calypso, WordPress.com’s new Admin Interface is mostly just that – an Interface – a Client Side interface. Using our fast food analogy, to suggest that WordPress.com would no longer use PHP/MySQL is like you asking yourself for a burger, not using any bread or meat, and still expecting to get a tray filled with the same exact food as a result.

The PHP server language, and the MySQL database structure, is still a very necessary element to WordPress’s ability to deliver filling content.

This has been confirmed by WordPress:

The old WordPress.com page (or any web page, for that matter) never had any PHP and MySQL to begin with – just a ton of HTML, CSS, and lots of JavaScript. Is Calypso better than the original admin interface? Sure, it looks better and runs faster, but the announcement had misleading statements that essentially blows it out of proportions.

WP.org and Security Concerns

Calypso is the new Admin interface for WordPress.com. It can, however, work for self-hosted WordPress sites. (We recommend self-hosted WordPress, where you can use the SBI! for WP plugin. If you’ve installed WordPress from cPanel or downloaded it directly from WordPress.org, you have self-hosted WordPress.) If you have Jetpack installed and its Manage module enabled, you can use the new Calypso admin interface. However, if you follow the basics of WordPress security, then you’ll find that it won’t work at all. This is because it relies on the XML-RPC API, which many WordPress professionals agree should be turned off at all times as it has been the target of extensive attacks. WordPress 4.4 will be releasing an improved REST API, and hopefully Calypso will adopt that for communicating with self-hosted WordPress sites.

Alternatives to Calypso

So, you saw that you can manage multiple sites with Calypso and you really want to be able to do that without putting your self-hosted site at risk by enabling XML-RPC? ManageWP, InfiniteWP, and WPDash, just to name a few, provide good alternatives.

WordPress User Impact

What does Calypso mean to the average self-hosted WordPress user? Absolutely nothing. Maybe in the future, but not now. So there’s no need for alarm or action. But you should be aware of it, because it may create some changes for self-hosted WordPress in the future. And we don’t want you to be caught off guard. Trust us to give you up-to-date, ACCURATE information, without hype.

This article was written by Vinny Alves for SiteSell and originally appeared in the SiteSell Blog and has been republished with permission.

A Technical SBI! for WordPress Review

SBI! for WP

It’s no secret that I spend my days working for SiteSell. I joined the SiteSell developer team as a Perl programmer in 2010 to work on their SBI! product. This was shortly before starting to develop WordPress plugins during my free time.

SBI! is a suite of tools to help entrepreneurs build online businesses, regardless of the niche – from cat pictures, to everything asphalt, birthday cakes, costumes – you name it, I’ve seen it! And they’re all very happy campers. SBI! offers them the Action Guide (a huge online book containing steps to follow to get their business up and running), hosting, a site builder, and a ton of other support tools. Perhaps one of the most important is Brainstorm It! – a keyword tool that helps people find their niche and decide which keywords to use in their content, based on interest (monthly searches) and competition (number of sites using the keyword).

One thing SBI! wasn’t prepared to do, however, was help struggling WordPress users with their own sites. So I took it upon myself to try and convince management to address this problem, due to my love of WordPress and its plugin interface.

Fast forward a few years and I find myself as the lead developer for SiteSell’s WordPress division, working on SBI! for WP, an adaptation of the tried and tested SBI! product.

Mike Allton, Susanna Perkins, and myself made up a team tasked with using The Lean Start Up methodology to find out how to best supply SBI! tools to a WordPress audience. After several months talking to bloggers and infopreneurs, we came to the conclusion that adapting Brainstorm It! to work within WordPress would be the best way to get started. And so SBI! for WP was born.

Review of the SBI! for WordPress Initial Process

When a user signs up for SBI! for WP, they get access to a fully revised Action Guide (aka the AG), especially tailored for WordPress users – from choosing hosting to how to select the best plugins . The AG was structured as an online course for ease of use, with completion progress and even a points system.

Once the user is familiar with the steps he needs to take, he can go to the Brainstorm It! tool (on SiteSell’s servers) to set up his niche and Master Keyword List  (the MKL) – a list of up to 5000 keywords related to the business, along with the numbers for interest, competition, and potential.

Review of the SBI! for WP Technical Background

The next step is to download and install the SBI! for WP plugin on their own site (my pride and joy). It’s hard not to get too technical, but this is a technical site so bear with me. I used the MVC Starter Plugin for WordPress (by yours truly), so the code is clean and concise, neatly separated into Models, Views, and Controllers. Communication with SiteSell’s servers is done via back-end API calls, and only when absolutely necessary.

For performance purposes, and as this is purely an Admin tool, it doesn’t even get instantiated on the front end. Once the user installs it, they receive a Welcome admin pointer with the option to take a tour of the settings. When the user connects to SiteSell’s servers, their MKL is downloaded to their site so that they have quick access to the keywords while writing posts or pages (or whatever other Custom Post Type they choose to use the keywords on).

If they want to use a keyword that is not in their MKL, they have the option to add it from the WordPress admin, and both systems are kept in sync. For larger systems that have multiple roles creating/editing content, the admin can choose which roles will have access to the keywords.

When using the keywords in the Edit Post/Page screen, the user also has access to Competitive Insights – a list of sites that use the selected keyword, offering opportunity to reach out and make partnerships. We also keep track of all posts and pages using that keyword within the user’s site.

All in all, SBI! for WP is an awesome service/plugin and I’m tremendously proud to be a part of it!

How to Identify Good WordPress Plugins in 4 Easy Steps

How to Identify Good WordPress Plugins in 4 Easy Steps

Over the past few months I’ve been working with Mike Allton and Susanna Perkins on a project that will try to give info-preneurs using WordPress an edge on creating content for their audience. On one of the less busy days, I wrote the post below detailing how I choose plugins for my clients.

 

How to Identify Good WordPress Plugins in 4 Easy Steps

 

So you’ve finally decided what the focus of your website should be and are ready to set up your WordPress install. You now need to select your theme and a series of plugins to build upon the core functionality you get from WordPress out of the box. With thousands of options to choose from, getting a plugin or theme that will not blow up and bring your site down is a challenge.

There are a few steps you can follow to ensure you have good quality WordPress Plugins for your site. Even if you aren’t a developer and can’t understand a single line of code, using these guidelines as a rule of thumb will give you some level of security.

These are the steps I take when helping my clients decide whether to adopt a plugin or not.

1. Check What Others Have To Say

With close to 40,000 plugins at the time of this writing, WordPress.org offers the ability for users to rate plugins. In the early days, it was possible to select the number of stars for a plugin without commenting on it. To make things fair for authors, people now have to state why they are casting their votes and the authors have the chance to defend themselves, if needed. Plugins with too many low-star ratings should raise a red flag, as long as the comments actually make sense. Be careful of detractors that are only out to troll authors without actually trying to provide constructive criticism.

2. Authors Should Provide (Fast) Support

WordPress.org also offers support forums where users can ask authors for help. Some authors choose to provide support on their own sites. Personally, I think this is valid for paid plugins, but free plugins support should be kept where the free plugins are downloaded. Look for how many resolved topics there are in the recent past, and the time it takes for authors to reply. Authors get notified of new topics immediately, and should have a good reason to not reply within a reasonable time frame.

3. Plugins/Themes Should Be Updated Frequently

Let me take a poetic license here… Code is a Living Entity. There’s seldom such a thing as writing a plugin and never touching it again. It is virtually impossible for any piece of code to not need updates from time to time. With the wide variety of environments out there, there’s bound to be a scenario where a bug patch is needed. Also, WordPress.org is always releasing new updates to the core, and plugins and themes need to keep up. The plugin page will tell you when it was last updated, and up to which version of WordPress it has been tested with.

4. Check For Coding Best Practices

Granted, this part is a bit harder to do if you are not a developer. There are, however, a few things you can look for to identify a well written piece of software. You can find the source code in the “Developers” section of the plugin page in WordPress.org.

Code is like a house – Keep it clean or it’ll become full of bugs. Proper spacing and indentation helps developers to easily understand what each part of the code does, as well as the intention of the previous developer when writing that piece. Another thing that helps understand code is commenting. If you look at the core WordPress files, you’ll see that they went to great lengths to properly document what each piece should do. No author remembers EVERYTHING they had in mind when writing code. If they say they do, run away – they’re either lying or they’re dangerously smart and might try to take over the world.

Object Oriented code is a Good Thing– Gone are the days when people could write code without structure. If you see words like class, static, public, private, protected, or extends, it is quite likely that the developer knew what s/he was doing. For the simpler plugins, this might be overkill as it usually comes hand-in-hand with more files and folders and it might be like killing a fly with a shotgun, but the danger of PHP is that it is so easy to use that it becomes easy to write BAD code.

Closing PHP tags are tricky – PHP comes with open and close tags, <?php and ?> respectively. Any white space after a close tag will be rendered by the web server, many times prematurely. If you see errors such as ‘headers already sent’, the culprit is likely to be white space after a closing PHP tag. Using closing tags at the end of a PHP file is not only unnecessary, but frowned upon. It’s better to see a comment indicating the end of file, than an actual closing tag.

Code should be tested – There are several techniques to test software. WordPress comes with a suite of test files that run via phpunit, a robust PHP testing tool. Plugins and themes should be tested, too. Look for a directory called ‘test’, or simply ‘t’ containing at least one PHP file.

Conclusion

Even if you follow all of these steps to the letter, you might still come across a bug. However, it is much less likely to happen and, if it does, you should be able to get fast support from the author. After all, you did follow step 2, right?

MVC Starter Plugin for WordPress: Parent Class Overview

Inheritance with MVC Starter Plugin for WordPress

Except for Models, all classes in MVC Starter Plugin for WordPress are extensions of the Parent Class, defined in plugin-name.php. This makes it possible to call methods like load_lib() from anywhere in the child classes. This is important also because MVCSP works with singletons whenever possible.

Yes, I’m aware of the war regarding singletons, but when you look at debug logs and see that WordPress reloads your plugin at least twice in some cases, you really want to make sure that you’re not doing things more often than you should. If you still want to avoid singletons in load_lib(), you can. Refer to the section on that method to know more.

Support for PHP < 5.3

MVC Starter Plugin for WordPress comes with a bootstrap() method that instantiates/serves singletons. It relies on the native function get_called_class(), which was made available in PHP version 5.3. For those few who still run on PHP 5.2 and under, I strongly recommend that you have your hosting company upgrade or switch hosting companies to a more serious one. If that’s not a possibility, you can still use this Starter Plugin because it implements its own get_called_class() if the native one doesn’t exist. Like all methods, it is slower than native calls, so it really is better if you upgrade to a modern PHP version.

Best practices

In order to keep my code easily maintainable, I tend to follow these guidelines:

  • Place add_action and add_filter calls in the __construct() of Controllers
  • Make sure to check that admin-related logic is indeed running under the admin with checks to parent::is_admin().
  • Do the same for front-end logic, checking that parent::is_admin() is false.
  • Avoid having calls to non-controller methods inside the Parent Class constructor, with the odd exception of an abstract class that needs to be loaded beforehand.
  • NEVER have a closing PHP tag at the end of any file. Nobody likes to deal with “headers already sent” errors caused by extra space or newlines that shouldn’t be there. Instead, use a comment to indicate that the file has finished.
/* End of file file-name.php */
/* Location: plugin-dir/file-name.php */

Let me know if there are any other best practices you’d like me to add here.

MVC Starter Plugin for WordPress: Set Up

Template Variables

After you download the MVC Starter Plugin for WordPress, you’ll need to replace a few template variables across all existing files with values of your choosing. They are:

PLUGIN_NAME, PLUGIN_DESC, PluginClass, and <plugin-dir>

  • PLUGIN_NAME: The actual name of your plugin. This will appear in the Installed Plugins screen and in the Admin -> Settings submenu.
  • PLUGIN_DESC: The description of the plugin. This will appear in the Installed Plugins screen.
  • PluginClass: The overall class of your plugin. MVCSP is Object Oriented and all Controllers, DAOs, and Views should extend the parent class.
  • <plugin-dir>: MVCSP borrowed the end-of-file style from CodeIgniter, in the sense that it does not close PHP tags but instead has a comment to indicate that the file is not truncated. The <plugin-dir> tag is only used as part of that comment.

The Set-Up Helper Script

There are several methods to replace the template variables with your desired values. I personally like to use grep or find piped into a Perl one-liner. To make things easier, I included a setup.pl script which takes a few parameters and runs some shell commands in the background. This only works for people using Mac or Linux machines, or probably Windows with Cygwin (not having used Windows in years, I haven’t had a chance to test it). Run it without any parameters and this is what you get:

Usage: perl ./setup.pl --long-name="The Plugin Name" --desc="Full Plugin Description" --class-name="DesiredPHPClassName"

All 3 parameters are required. Use a valid class name or your plugin will throw an error during activation.

The parameters are self-explanatory.

Note: Once you’ve run the setup.pl script, the file plugin-name.php will be renamed to whatever name of the domain is. So suppose you extract the Starter Plugin zip file contents in to a directory called my-plugin, the file plugin-name.php will be renamed to my-plugin.php. WordPress will then have my-plugin/my-plugin.php as the plugin signature.

That’s all there is to setting up the Starter Plugin. You can now activate it in your Admin -> Installed Plugins.

If you want to set up your plugin to run tests, refer the Running Tests section.

MVC Starter Plugin for WordPress

A Little Background

This is the seventh anniversary of UseStrict Consulting. It was born out of my passion for Perl, long before I ever thought of writing plugins for WordPress.

A lot has changed since then – I fell in love with building WordPress plugins in 2011. Like with Perl back in 1998, it started as an itch that needed scratching. My first plugin wasn’t a simple task. I wanted to get live shipping rates from Canada Post to use on my wife’s online pharmacy running eShop. The end result was messy, but it worked… and still does!

Fast forward 4 years. Enter the MVC Starter Plugin for WordPress.

MVC Starter Plugin for WordPress

The MVC Starter Plugin for WordPress is the result of best practices adopted from CodeIgniter, Catalyst, and of course, the WordPress Codex. It is a robust Object Oriented Model/View/Controller framework for WordPress plugins. I haven’t released it to Github yet, as it’d be nice to get some peer feedback before I do that.

The framework comes with a few handy methods and classes, as well as test files which can serve as templates for your own tests. They are designed to work with the WordPress Unit Test Suite and phpunit. I’ll be adding the documentation below as time permits, but feel free to download MVC Starter Plugin and play around with it!

Documentation

  1. Download
  2. Set Up
  3. The Parent Class
    1. Overview
    2. Method: bootstrap()
    3. Method: __construct()
    4. Method: is_admin()
    5. Method: load_lib()
    6. Method: load_all()
    7. Method: render_template()
    8. Method: set_env()
    9. Method: get_env()
    10. Method: log_msg()
  4. Admin Notices Controller
    1. The Notice Pool
    2. Method: set_notice()
  5. The Settings API
    1. Setting Controller Class
    2. Settings DAO and Model Classes
    3. The Settings View
  6. Ajax
    1. The Ajax Controller
    2. The Ajax Request Model