Everything
Annual archive
I wanted everything Claude Code writes for developers to follow the Google developer documentation style guide. A forked skill, a few adaptations, and a local snapshot of all 70 guide pages got me there.
I kept running the same four commands to start work on an issue, so I wrote a script that does it. claude-work gives every issue its own git worktree, branch and tmux session running Claude Code.
Annual archive
So Long, and Thanks for All the Fish
Yesterday, I migrated this blog from WordPress to Hugo. These are the steps I took to do so.
This afternoon's hobby project was to convert my WordPress blog into a static site using Hugo.
Annual archive
Annual archive
Using Composer is a great way of organizing your WordPress project, with WordPress itself, plugins and themes declared as dependencies. However, an issue I’ve often seen is how you install translation files and keep them updated.
If you’re using CloudFlare to host your DNS, there is a plugin for the official Let’s Encrypt client Certbot you can use to easily acquire and renew wildcard certificates from Let’s Encrypt.
This article is not an introduction to neither Xdebug, Local by Flywheel nor PhpStorm, but shows you how you can get started with debugging and profiling your WordPress sites in PhpStorm when using Local by Flywheel as a local development environment. You should already know what Xdebug is before reading this article. This is how you get started with Xdebug in Local by Flywheel.{{ double-space-with-newline }}
When WordPress 4.9.6 launched on May 17, 2018 it came with new tools for exporting and erasing personal data that you may have collected (you know, GDPR and all). But Gravity Forms as of version 2.3.2 doesn’t integrate with these tools. Fortunately, it is really easy to write your own exporters and erasers.
A little sensationalist written blog post by Barak Tawily claims that WordPress is vulnerable to a DoS attack because of the load-scripts.php file which concatenates JavaScript files on the fly.
With HTTP/2 push you can effectively send a web page’s assets to the client before the client even knows about them. Here’s how you can HTTP/2 push WordPress assets to your first-time visitors.{{ double-space-with-newline }}
OMFG, BREAKING NEWS: Thousands of WordPress sites affected by some vulnerability.{{ double-space-with-newline }}
On March 2–4 2018, Friday through Sunday, there will be a great chance to meet WordPressers at the conference WordCamp Oslo 2018.
WordPress translations are compiled from human-readable PO-files into machine optimized MO-files, but still takes a lot of overhead to load. If you only could cache the translation load time, you would save a lot of page load time. We can easily cut 90% of our WordPress translations loading time.
Wouldn’t it be cool if you, in your PHP project could define a package that makes sure that everybody who even tries to commit code is forced to follow the project’s defined coding standards? Yeah, me too. So I created this Composer plugin you can use in your projects.
Generating the menus in WordPress is quite resource intensive. Sites with few visitors and few menu items might not notice this much. But if you have a large amount of menu items, like in a mega menu, in combination with a lot of visitors the menu generation can be a real hog on your server’s CPUs. Let’s see if we can improve the speed with a little WordPress menu cache trickery.
Recently DigitalOcean released [new pricing plans](https://blog.digitalocean.com/new-droplet-plans/) where they basically doubled the RAM for the same price of the old plans. But to get the benefits for your existing droplets, you have to upgrade all of your existing droplets in a process that involves shutting them down, selecting the new plan, waiting for the upgrade to happen and power on the droplets again. I have tens of droplets and had no intention of doing this manually, so I wrote a script to use the DigitalOcean API to automate a mass-upgrade of all droplets.
Annual archive
Whenever you upgrade a plugin, theme or WordPress itself through the WordPress dashboard, WordPress will put itself in maintenance mode and all your visitors will see the maintenance mode notice “Briefly unavailable for scheduled maintenance. Check back in a minute.”
The resources you have available to spend on WordPress security for your website usually vary vastly whether you’re an international corporation or just a hobbyist blogger. But since most attacks are automated by bots looking for vulnerabilities, a lot of the threats are the same. Here are some WordPress security measures that bloggers and small business with limited resources easily can take.
If you google “functions.php” you get about 7 million results. I bet most of them contain bad advice: “How to add functionality to your WordPress site”. Some of them continue even worse: “\[…\] without using a plugin”. For your own good, don’t edit functions.php to add custom functionality to your WordPress site. You can use mu-plugins to do that.
Since I translate a lot of WordPress themes and plugins, I sometimes come across plugins who try to be clever with their translations. This tends to not work so well in reality.
I’ve been using, and advocating for others to use, Yoda conditions for a long time. Sometimes, I read or hear about someone who doesn’t like them, without actually describing why. From time to time I read a blog post that advocates against it: And it’s always the same reason.
As you may know, WordPress sends out email notifications from time to time. Actually, as of WordPress 4.8.1, there are 24 different occasions when WordPress will send an email message. Don’t you think it would be useful to have a reference of all outgoing WordPress emails?
During WordCamp Europe 2017 in Paris, there was a Q&A session with Matt Mullenweg. I wanted to ask him a question, but due to high demand and restricted time, I never got to ask him. I guess Matt is a busy person, so I don’t expect him to actually answer this question himself. But maybe someone in the WordPress community has answers, insights or ideas? A person is the CEO of one of the most important WordPress-related companies.
UUIDs (Universally Unique IDentifier), also known as GUIDs (Globally Unique IDentifier), is a string that identifies a piece of information in computer systems. WordPress use GUIDs to identify each individual post, but use URLs (kind of) for GUIDs, and thus does not follow the standard definition (RFC 4122) of a UUID (or GUID).
Email is fundamentally insecure. There are such a plethora of issues with it, it is crazy to think about the kind of information sent with it. It is probably even crazier when you realize we’ve had a solution for sending secure email since 1991.
This weekend I was at WordCamp Berlin, met a lot of great people, and watched a lot of interesting presentations. WordCamps are actually quite informal by themselves, but at the afterparties, people are really letting their shoulders down and it often seems like people are long-time personal friends. If you open up to it, it won’t take long until people will give you feedback on whatever you have released in public.
Many ISPs and other DNS providers are slow or inject ads, track you, hijack DNS queries or do other nasty stuff. To mitigate this, you should use a fast, reliable and free service that respects your DNS privacy.
This is the second post in my series of posts on some of the tools I use to stay a little safer and protect my privacy online. With self-destructing cookies, you get a clean sheet even with those who don’t respect the Do-Not-Track header.
WordPress doesn’t use a nonce for the login form, which opens up for you to perform a WordPress session donation attack.
If you’re utilizing the browser cache correctly, you’ll gain huge performance benefits for your users, as well as save bandwidth and server capacity which equals to saving money. To do this right, you must create unique URLs for all versions of your resources, and tell them to never ask for the content again by telling the browsers that the assets are immutable resources.
I’m running a series of posts on some of the tools I use to stay a little safer and protect my privacy online. Here’s how you can get much better secure messaging on your phone using the Signal app.
Tavis Ormandy from Google’s Project Zero contacted Cloudflare to report a security problem with their service. It turned out that in some unusual circumstances, they would bleed memory that contained private information.
Inspired by how Facebook assists their users when they log in, I decided to implement something like the same for WordPress.
More and more users are using adblockers or surfing the web via private browsing with tracking protection. But this also affects your web analytics, as the blockers also will block analytics tracking – not only third party services like Google Analytics, but also self-hosted solutions like Piwik.
So, you’ve launched your WordPress site on a non-www domain, like example.com, but since then found out that running it on on www, like www.example.com, is better and want to move? You’re in luck, because it is really easy.
For 20 years or so, there has been the debate over whether you should use www or not in your web site’s canonical hostname. So should you use www or not?
“ [A healthy Internet needs all of us](https://www.mozilla.org/en-US/internet-health/)”, Mozilla states. And they’re right.
If you have someone’s public SSH key, you can use OpenSSL to safely encrypt a file and send it to them over an insecure connection (i.e. the internet). They can then use their private key to decrypt the file you sent.
Annual archive
[Field Manager](http://fieldmanager.org/) doesn’t have a flexible content field type as [Advanced Custom Fields Pro](https://www.advancedcustomfields.com/pro/) does, but it is possible to mimic the functionality by using a little logic.
Publishing open source software or articles for free is very giving. Not only does it give you a warm fuzzy feeling inside when someone appreciates what you release, but it can also have [other indirect consequences](https://www.ostraining.com/blog/wordpress/giving-back/) that give you a happier life. But when something is free – as in no cost – people will also often turn to a mindset where they don’t appreciate your effort, time or value as a human being. For some reason, some people forget all about being polite and demands that I give them professional support because they can’t read instructions, don’t know what they are doing, or just feel like their time is much more important than mine.
I very much appreciate comments that bring new insights, corrects my errors, or leaves a thank you note. But even so, it is a bit tedious to moderate comments. Though logging into WordPress – even with [two-factor authentication](https://www.bjornjohansen.com/two-factor-authentication-for-wordpress) enabled – isn’t much of a hassle, it is still a nuisance when you just want to approve or trash a couple of comments.
Nginx is an extremely efficient and quite flexible web server. When you want to do a redirect in Nginx, you have a few options to select from, so you can choose the one that suits you best to do an Nginx redirect.
With the advent of the fully automated and free of cost certificate authorities Let’s Encrypt and StartCom there is no doubt that the future of CAs are changing.
Enabling uploads of SVG files in WordPress is quite easy, and there is a tonne of posts on the Interwebs explaining how you do it. Usually along the lines of: ``` function add_svg_to_upload_mimes( $upload_mimes ) { $upload_mimes['svg'] = 'image/svg+xml'; $upload_mimes['svgz'] = 'image/svg+xml'; return $upload_mimes; } add_filter( 'upload_mimes', 'add_svg_to_upload_mimes', 10, 1 ); ``` And that’s pretty much it. Except it is not.
Uploading SVG files to WordPress when you’re behind the Sucuri CloudProxy Web Application Firewall isn’t that straightforward, but it is possible.
Let’s install an SSL-certificate from Let’s Encrypt for Nginx.
Annual archive
Running a real cronjob is much more reliable than WordPress’ built-in “maybe-will-trigger” solution. But if you’re running a multisite network, you have to add a crontab entry for every site you set up – which is tedious. Thanks to WP-CLI, we can use a small bash script instead, which will run all due events for all sites for us. Oh, and it works for single sites as well.
Depending on your time zone, PHP 7 was finally released on 3rd/4th of December 2015. Even though the general recommendation for production servers is to wait for a little bit and gather some experiences before upgrading, some of us want to jump right on and upgrade to PHP 7.
Security vulnerabilities are often exploits of software that fails when trying to deal with unexpected input. Other times they are exploits of a misconfiguration or a service that unintentionally was open to the public. For the above reasons, we should limit as much as possible what services are exposed to the public and limit as much as possible what they do and accept from the visitors. To follow those security principles, we should only allow the HTTP methods for which we, in fact, provide services. Under all normal circumstances, that would be the methods `GET`, `POST` and `HEAD`.
In your WordPress site, there are directories that include PHP files that visitors should never be able to access directly. They are only there for WordPress to function as an application that runs on your server. But because of WordPress’ directory and file structure, they are kind of accessible to the public. All of them are meant to be part of a larger application – WordPress, that is – and should not cause any harm if called directly – that we know. Some of the files execute some code even when ran standalone. An attacker might know of a clever way to make that code run in an unexpected manner, causing harm. To be on the safe side, we should deny access to all these PHP files from the outside world. Since we block access to them in our Nginx configuration, PHP will still run them as usual and WordPress will work just fine.
If you have a static IP address, like from your office, or [your own private VPN](https://www.bjornjohansen.com/setting-up-your-own-pptp-vpn), you can increase your security tremendously by restricting all logins to that IP address. The effect is that even if an attacker knows your login credentials, they will not be able to log in or access any part of the WordPress Dashboard.
All login credentials transferred over plain HTTP can easily be sniffed by an MITM attacker, but is is not enough to encrypt the login forms. If you are visiting plain HTTP pages while logged in, your session can be hijacked, and not even [two-factor authentication](https://www.bjornjohansen.com/two-factor-authentication-for-wordpress) will protect you. To protect all info sent between your visitors – which includes you – and your web server, we will redirect all requests that are coming over plain HTTP to the HTTPS equivalent.
WordPress requires write access to one directory, and that one directory only: the directory returned by `wp_upload_dir()`. By default, this is `/wp-content/upload`, but it can be configured to anything that is beneath your document root, like `/media`, if you want to.
Logs are nice and all that, but sometimes certain entries are there just to fill up the logs or are cluttering them. Here’s a few ways to exclude requests – by URL or visitor IP – from the Nginx access log.
Using Postfix with specialized, transactional email services like SendGrid or Mandrill is excellent for not only for optimizing email deliverability, but they usually also offer some nice features.
If you’re using a strong password, brute-forcing is a very inefficient way of breaking into your WordPress account, and if it is really strong, dictionary attacks won’t help much either. However, there are are other, easier, ways for a mischievous person to get their hands on your login credentials e.g. with phishing, keyloggers or a MITM attack. By using a two-factor solution, you will increase your login security by an order of magnitude.
SSH timeout due to inactivity is annoying. Here’s how to keep your SSH sessions alive and prevent the SSH timeout:
To be honest, I don’t exactly know too much about Big-IP, but I’ve come across someone who use it. They terminate HTTPS in Big-IP and WordPress runs on plain HTTP on port 80 on the backend nodes. By default, this makes WordPress confused, so you can’t login to the WordPress dashboard.
Experimental support for HTTP/2 became available in Nginx version 1.9.5 (mainline). It is really easy to enable, and I’ll show you how.
[Using HTTPS](https://www.bjornjohansen.com/securing-nginx-ssl) helps preventing someone from snooping your username/password or hijacking your sessions. [Using HSTS](https://www.bjornjohansen.com/optimizing-https-nginx) makes sure the connection stays on HTTPS, even if a MITM tries to redirect you to the plain HTTP version of a web site. But it is easier than you might think for a MITM to use a rogue certificate, making you believe everything is fine. HTTP Public Key Pinning (HPKP) helps the browser check that everything actually is fine.
Here are my slides from WordCamp Belgrade 2015: [HTTP/2 is here – Unlearn your optimization skills](https://www.bjornjohansen.com/wcbg15-slides/) If you’re having issues with the HTML version, you may [download a PDF here](https://www.bjornjohansen.com/content/uploads/2015/04/HTTP2.pdf).
As I’m writing this, the calendar shows April 14 2015. According to the [PHP 7.0 timeline](https://wiki.php.net/rfc/php7timeline), it has a projected release date of November 2015. But if you want to try it out (to check out the speed), you can already do so.
Annual archive
HHVM can really speed up your PHP-based web site. Most reports are somewhere in the range of 2–4x faster. Unfortunately, HHVM isn’t very stable and will suddenly die, just of the blue, from time to another. Fortunately, if you’re running Nginx it’s really easy to set up PHP-FPM as a fallback.
Fail2ban works by filtering a log file with a regular expression triggering a `ban` action if the condition is met. After a preset time, it will trigger an `unban` action. Without much effort, we can have WordPress log all authentication events and have fail2ban react on them.
If your fail2ban is on a host behind a Rackspace Cloud LoadBalancer, you’ll want to block the offending IP addresses directly in your LoadBalancer. If your LB is acting as a reverse proxy, you’ll HAVE to block in the LB, but it is also nice to protect all other nodes behind the LB and offload the lifting.
Since version 3.9, WordPress have been 100% compatible with [HHVM](http://hhvm.com/ "HipHop Virtual Machine") and I have begun replacing PHP with it on a few of my servers to experiment.
Any organization where multiple developers cooperate on a regular basis needs some guidelines to assure optimal quality of the end result. Most of these rules applies to freelancers as well.
OK, so you might have been at a WordCamp listening to talks or reading a few blog posts and you get that you should really get your WordPress site speed optimized. Starting all over isn't either tempting nor something you have the time for. Don't despair, you'll get a long way by installing 5 plugins.
Now that you have secured [Nginx with HTTPS](https://www.bjornjohansen.com/securing-nginx-ssl) and [enabled SPDY](https://www.bjornjohansen.com/enabling-spdy-nginx) [enabled HTTP/2](https://www.bjornjohansen.com/enable-http2-on-nginx), it's time to improve both the security and the performance of the server.
Annual archive
Recently, I've done some WordPress load optimization with Thomas Bensmann (read his post « [Full score on Google PageSpeed, Pingdom and GTMetrix](https://bensmann.no/full-score-google-pagespeed-pingdom-gtmetrix/)») and to achieve full effect, you do have to load the Google Analytics tracking script, ga.js, from your own server.
When you get into page loading optimization, you will quickly find these «must-dos»: Combine your CSS and JavaScript files (respectively), minimize your CSS and JavaScript, load CSS before JS, load JS in body footer and then even some. Without much effort, we can make WordPress do all of this automatically.
Gravity Forms is not only THE way to create and manage forms in WordPress, but is also pretty awesome when it comes to extensibility and flexibility. However, as most software, it has its issues. One of those is how it outputs some of the JavaScript, which in certain cases will break your site. This is how to fix it.
There are now several years since WordPress was considered a blog platform only. Today, it's a full blown CMS and perfectly capable of powering corporate web sites. Here I provide you with 5 non-technical reasons why WordPress is well fit for a corporate CMS.
SPDY is this new, cool, fast protocol created by Google that "replaces" HTTP (the first draft of HTTP 2.0 is using SPDY as the working base). It is [supported in all the major browsers](http://caniuse.com/spdy "Compatibility table for support of SPDY networking protocol in desktop and mobile browsers.") – yes, even Internet Explorer – with the exception of Apple's Safari.
Adding a certificate and using the HTTPS protocol is a good improvement to the security in the communication between the browser and the server, and should be in place on all sites that have a user login. Contrary to what many (older) guides say, it doesn't add much load on your server and is fairy easy and cheap to set up right.
I always run the latest LTS version of Ubuntu on all my servers. Unfortunately, the Nginx versions tend to be quite the bit behind the current release. So how do you get an updated, current version of without resorting to having to maintain the packages yourself? Luckily, the Nginx team have their own Ubuntu apt repository so it’s easy to keep current with the latest version of Nginx.
I always run the latest LTS version of Ubuntu on all my servers. Currently the latest LTS is 14.04 which comes with PHP version 5.5, but as of November 2014, the latest stable version is 5.6. So how do you get an updated, current version of PHP without resorting to having to maintain the packages yourself? The answer is in PPA.
You have finished that WordPress site, and want to deploy it – move it from your test server to the production server where it goes live. But how? WordPress have a famous 5-minute-install, but there is no 5-minute-go-live-script\*. I'll show you how in these 5 easy-to-follow steps.
If you have a static IP address, like from [your own VPN](https://www.bjornjohansen.com/setting-up-your-own-pptp-vpn), it is very easy to increase your security tremendously. Simply restrict all logins to that IP address.
When it comes to VPNs, there is the choice between PPTP and OpenVPN. PPTP is pretty quick to setup and works out of the box with most (all?) OSes and devices.
These are the first steps you should perform on your shiny, brand new VPS to set out on a safe journey on the internets. You don't actually have to understand each of the steps here, but this post is intented for people who have some clue of what they're doing. If there is such a thing as a «VPSes for dummies», it should not be read. VPSes are not intended for dummies.
TL;DR: Varnish lacks support for SSL and SPDY. Nginx handles it just fine, and has very fast cache with either memcache or disk storage (ramdisk). Both can serve stale cache if your backend is down. But Nginx can not write to the memcache storage directly, it has to be done by the application. Also, Nginx can not purge the cache itself, without you compiling your own package.
OK, so I was ready to give Jekyll another shot today. But one thing I’m not that happy with is the need for specifying the YAML front matter on every post. At this point, I’m not really using it for any practical matter.