The worrying thing about this hack is that the majority of blog owners won’t even know that their blog has been compromised. If you have a WordPress blog, please read on to ensure your blog is safe.

I discovered that the injected code is totally hidden from blog owners as well as their readers. It only affects Google bots and hence can affect your Google search rankings and your bandwidth without you knowing it.

What this hack does is to post pharmaceutical spam posts and pages using your blogs header and footer. These posts are only visible buy Googlebots. They then mass link to your injected spam pages and your site listing on Google can be overwhelmed by these spam posts leading to your Google website being flagged and your rankings severely damaged.

Example of Injected Content

I also discovered that they can post links to other infected blogs. When I tracked the source of these incoming links, I found thousands of innocent blogs where the links can only be found in the source codes. These poor blog owners probably don’t know its happening and it will severely affect their page rankings.

How to Check If Your Blog Has Been Infected

1. Go to Google.com and type “site:www.YouBlog.com”.

This will show you all the pages of your blog that has been indexed by Google. In my case, the this is what I found on page 2:

Because I had already replaced the TimThumb files, when I click on the links, it takes me to my 404 Error Page. I thought that was the end of the story and Google will eventually remove these pages from their index. I was wrong.

2. Go to Google Webmaster Tools and do a “Fetch as Googlebot” Query

If you do not already have a free Google Webmaster tool account set up for all your websites, you can sign up here: Google Webmaster Tools.

In the “Diagnostics” section, choose the “Fetch as Googlebot” link. You can then type in a URL and see what the Google Search Bot will see.

As you can see below, when I typed in the URL of the spam pages from step 2 above, the bot returned a status as “Success”.

Meaning that although normal users will get a 404 page error, the Google Search Bots that regularly scan the site will say that the page is working normally. So these offending pages will never be removed from Google’s index.

3. Install the TimThumb Vulnerability Scanner Plugin

Now, even if you have not been hacked after checking the two steps above, I still recommend this step. Install a plugin that checks your theme files for potential vulnerabilities.

You can download the plugin here: http://wordpress.org/extend/plugins/timthumb-vulnerability-scanner/

Once you run a scan, it will highlight vulnerable timthumb related files and with two clicks you can replace them with the latest secured versions so that your blog theme does not break.

Next, because we do not know which files have been tampered with, we need to clean out ALL the files in our WordPress installation.

How to Clean Out Your Blog Installation

Basically, we’re going to do 2 things. The first is replace all your WordPress systems files. The second thing is to replace all your current theme files. Additionally, you should also check through any remaining files manually to see if there’s any injected code.

I’m not a security expert so I will just run through what I did step by step.

Step 1: Update to Latest Version of WordPress and Backup Your WordPress Database

Since all your content, comments, theme settings and other data is stored in your blog database, the first thing you should do is to make a backup in case something goes wrong during the clean up and you need to restore.

You can learn more about how to backup your database from the WordPress.org tutorial page. For me, I just use the WP DB Backup plugin which allows me to create a backup file with one click.

Next, update to the latest version of WordPress. I just used the automatic upgrade process in the WordPress Dashboard for this.

Using my FTP program, I just saved the wp-config.php file and .htaccess files to my computer as a backup.

Step 3: Put Your Blog Into Maintenance Mode

I use a plugin called “Maintenance Mode” and I activated it so that my blog visitors and Google bots will temporarily be directed to a maintenance notice instead of seeing a broken site.

Step 4: Deactivate Your WordPress Plugins

I actually forgot to do this step and fortunately, it was ok. But all the documentation advise for you to actually turn off your plugins first.

Step 5: Download The Latest Version of WordPress

You can download the latest version here: http://wordpress.org/download/

Then expand the zip file on your computer. You will be uploading all the files except the “wp-content” folder. So what I did was I just deleted the “wp-content” folder entirely.

Step 5: Change your WordPress Database Password

Log in to your cPanel. Go to MySQL databases and find the user for your blog’s database. Just click on the username and you will be prompted to type the old password followed by the new password to have it changed.

Step 6: Edit Your WP-Config.php File

In this step, you will manually edit the new “wp-config.php” file so you won’t need to run the installation or upgrade function on your new files. Go to the new wordpress files that you downloaded, open up the “wp-config-sample.php” file.

In here, you will just change the database name, database user and password. Follow the same format as your previous “wp-config.php” file but make sure you change the password to the new one you created in Step 6.

Additionally, in WordPress version 2.6 and above, you need to add your security keys. You can learn more about the new security keys here: WordPress Security Keys

This are just random numbers to increase security of your blog. You don’t really need to remember them. To make it simple, just use the online generator provided by WordPress to generate these keys. Just copy the all those keys and replace that section in your “wp-config.php” file.

Save the file as “wp-config.php” and you’re ready to upload.

Step 7: Replace All the WordPress Files On Your Blog

Now use your FTP software and just copy all the new WordPress files, including the “wp-config.php” file to your blogs directory. Note, we already deleted the “wp-content” folder so that will not be replaced.

Step 8: Reinstall Your WordPress Theme Files

All your theme settings are saved in your WordPress database so you can delete your old theme and reinstall it again without losing your settings.

Log into your WordPress Dashboard. Change the theme to a default theme and delete the your old theme. Then add a new theme and upload your theme again.

At this stage, you should also check each of the files on folders inside the “wp-content” folder as this folder is not being replaced with new ones. Some sites report that malicious code has been entered into the “images” folder or some of the plugin files.

Step 9: Reactivate All Your Plugins

As mentioned previously, I forgot to remove my plugins and the problem was fixed. However, you should actually delete and reinstall each plugin because some reports have said malicious codes were also injected into the pllugin’s php files.

Step 10:  Check That The Problem is Fixed!

If everything went well, your site is now back up and running as before but the difference is that you have replaced the WordPress system files, theme files and plugin files with fresh and clean files.

So go back to Google Webmaster tools and do a “Fetch as Googlebot” again for the same term.

As you can see in the screen shot below that the same page that returned a “success” status is now showing “not found” . That is great news as now its just a matter of time before Google will remove these non-existent pages from their index.

This also gives me confidence that whatever malicious script that was tricking the Googlebots to see the page is now gone!

Good job.

Now you can de-activate the “Maintenance Mode” and go get yourself a cup of coffee!

This blog was started in 2008 as an experiment as well as a learning tool for me to learn how to blog with WordPress. At the time, I was using the Rapidweaver platform and knew very little about WordPress. I got started writing about stuff I was learning along the way and also on my random personal interests.

Today, I took a serious look at my Google Analytics report and I was blown away. I wanted to share some of the key statistics and my take away action points after my review.

For the year ended 2011, this blog had over 228,601 visits and over 203,460 unique visitors! That’s a lot of people isn’t it?  That’s like communicating with 626 people per day.

And I was also really happy to see that the “bounce” rate was only 3.67% which means that my visitors actually READ what I wrote!

Can you imagine that? More than 200,000 people reading what I write from my desk at home! And all this while I just thought of myself as a hobby blogger.

This revelation also filled me with quite a bit of stress. I suddenly felt the burden of needing to write more often and pay greater attention to each post. Looking back at some of my older posts, I do feel quite embarrassed at some of the meandering posts I made which really didn’t add much value at all to my readers and was kinda all over the place.

So with the new year, I’m also taking on a new perspective as a pro blogger and not just a hobby blogger. My commitment to you, my dear reader, is to create more posts that add value to your life and business.

Presently, I’m working on a newer and more simplified blog design.

My idea is to create a blog that is less about design and more about content. So you can see the logo and design features are stripped down to a bare minimum and that makes the content stand out much more.

I’ve also decided to focus my attention on creating a resource site for individuals and small business owners to be successful online. Why? Well, essentially, that’s what I do for a living and what I’m good at. I run many profitable small businesses from home.

Do let me know if you have any ideas, suggestions or requests on what you would like me to add to this blog. I look forward to continuing the journey in 2012 and beyond with you.

So it began when I got a Google alert that a few of my blog posts has been picked up by Google’s search bots. “Great”, I thought but wait…those posts looks a bit strange. On closer inspection, they were spam posts for sex performance drugs and using pictures of scantily clad women on my blog!

“How did this happen??” I gasped! The links are coming directly from my blog and the posts uses the same theme as my blog!

Well after much research, I found that there’s quite a few security holes that needed to be plugged by the WordPress updates as well as a common plugin called “Timthumb”. The scary thing is that this plugin can be exploited even if its in a theme that is not active!

Wow! So I updated my WordPress installation using the “automatic update”, and that got me a fatal error with one of my plugins. A double-whammy in one morning! After almost 2-hours of trouble shooting, things are back to normal. I thought that at the very least, I’d make a blog post out of it in case it helps any of you.

So here are the solutions in case any you encounter such a horror one day:

If you encounter a fatal error after upgrading to the latest WordPress build, chances are, its caused by a plugin incompatibility. This effectively locks you out of the admin panel and is quite alarming. But don’t panic! The solution is to identify the offending plugin and deactivate it.

In my case, the culprit causing the fatal error in WordPress was the popular “Popup Domination” plugin.

When WordPress can’t find the plugin (because you renamed it), all it does is deactivate it. This allows you access back into the WordPress admin panel. Then you reactive them one-by-one until you find the plugin that causes the error! When you know which plugin is the offending plugin, you can either delete it or replace it with an updated version if it exists.

Now, about how to fix the “Timthumb” vulnerability. I found a simple solution on this post:

http://ravidreams.com/fix-timthumb-security-issue/

Basically, its just a mater of locating the “timthumb.php” file, and replacing it with this one:

http://timthumb.googlecode.com/svn/trunk/timthumb.php

Now, I can’t say if this has permanently fixed the issue but so far, the offending SPAM posts has been removed and everything seems to be back to normal.

From now on, I will definitely make sure to keep WordPress updated – especially if any vulnerabilities have been found and fixed!

I finally got around to doing it so here is my video walk-through:

If you want to download the work flow diagram, here it is too:

This diagram shows you how I turn a single blog post into about 40 back links. I currently publish about 1 blog post per week on average.

If you were interested to build up the page rank and traffic for your own blog, I would suggest you use the formula above and start publishing 1 post per day on specific keywords.

You can also supplement the strategy above with article marketing. I have a team of people who can handle all my article writing and back links on this service: http://PersonalBrandingTheme.com . Combining blog marketing and article marketing is a very effective weapon to build search ending ranking and traffic.

If you want to know how to set up your Ping.FM account and your Hootsuite account, you can review this related post here:

How To Use HootSuite & Ping.FM to Publish Your WordPress Blog To All Your Social Media Sites

It took me 2 years to learn by trial and error and the steps above is worth it’s weight in gold. Whether you are an affiliate marketer or an income blogger, you can use these strategies to improve your results.

Make sure you subscribe to my blog for more tips and tricks to optimize your online business.

To customize the settings of which blog directories get notified whenever you publish a new post, go to your WordPress Dashboard and click on “Settings”.

Then click on “Writing” and scroll towards the bottom where it says “Update Services”.

In the text field provided, you can enter all the various links to directories that you wish to notify whenever you update your blog.

Here’s the current list of services I update. You can copy and paste this list into your settings if you wish.

http://api.moreover.com/RPC2

http://bblog.com/ping.php

http://blogsearch.google.com/ping/RPC2

http://ping.weblogalot.com/rpc.php

http://ping.feedburner.com

http://ping.syndic8.com/xmlrpc.php

http://ping.bloggers.jp/rpc/

http://rpc.pingomatic.com/

http://rpc.weblogs.com/RPC2

http://rpc.technorati.com/rpc/ping

http://topicexchange.com/RPC2

http://www.blogpeople.net/servlet/weblogUpdates

http://xping.pubsub.com/ping

If you have a better list or recommendations, please share them in the comments below.

Technorati Tags: ping, wordpress

This is what my blog looks like on the iPhone before and after installing the WPTouch Plugin

I found two options – the WPTouch mobile WordPress theme and the Wapple Architect. As an iPhone user, I had noticed quite a few blogs that I visit regularly on my mobile device had very nice mobile version. I used to think that it would be quite a pain to create a separate mobile friendly version of my blog.

To my surprise, with the above plugins, creating a mobile friendly site is really quite simple. Just 5 minutes of work really. All you have to do is install the WordPress plugin and make a few simple customizations with the plugin control panel. And you’re done!

I particularly liked the WP Touch plugin because it is a lot easier to install (Wapple Architect requires you to create an API key and register on their site) and has very simple and effective customization options. For example, you can customize the title of the mobile version (I created a shorter version to fit on the screen), create your own custom icons for navigation and for the more advanced, you could create push notifications as well as custom CSS!

I also like the fact that my Disqus comment plugin which I really like is compatible and so are the TweetMeme and Facebook Sharecount buttons. Other smart options built into the mobile theme is the option to add Google Analytics as well as Google Adsense so that you do not lose advertising page views from mobile visitors.

The WPTouch control panel has a section to let you know which other web based plugins are compatible and which are not. Smart feature.

The plugin has a slider button on the footer of the page that allows your visitors to decide if they prefer the mobile version or switch back to the full web version.

With more and more people beginning to surf the web with mobile devices, I do think that this simple plugin is worth installing to give your mobile web visitors a better experience visiting your site. If you have a mobile browser, I guess you’re already looking at the mobile version. If you reading this on your web browser but have an iPhone or other mobile device, load my blog on your mobile at http://brianwong.com/blog and let me know what you think.

Technorati Tags: iphone, ipod touch, plugin, wordpress

So far, I am not convinced that I will be able to use this regularly unless I am posting under very specific circumstances.

I have found it difficult to add long links because I can only use one screen at a time. It’s only ok if I had already copied the link to the clipboard before launching the app. Even so, posting multiple links is still a bit of a hassle.

Photos are attached to the end of the post by default. I can’t arrange them. See in this example of scrrenshots I made.

Attaching videos will also pose a similar challenge.

The preview of the post does not load my theme. So I need to guess what the final output will look like.

Also, I like the idea of mobile comment moderation. But, because I am using Disqus – this feature in the app does not work. I can still read the comments but I can’t moderate them.

On the plus side, it is pretty awesome that I can even do this much. I could blog anywhere with a connection. This is a welcomed option to have.

I’ve yet to fully test other mobile blogging solutions for Posterous and Tumblr. When I do, I do a review too.

Verdict?

I think the app is great for a short post and if you only needed to attach ONE link, photo or video.

I think I would use it in certain conditions. E.g if I was on holiday without my computer or if I took a photo of a real-time event and wanted to share it immediately.

Otherwise, I would stick to using my Ecto desktop publisher as I normally do.

So I started my blog on BrianWong.com. Back in the day, it wasn’t so easy to add Adsense ads to the blog themes that were available. You had to really know your way around the code editor. I’ve lost a great deal of hours just trying to figure out how to create and ad block and how to freaking insert it into the right place on my blog!

Today, there are many free Adsense plugins and widgets and even Adsense-ready themes where you just plug your Adsense ID in the theme and all the ads are added for you.

When I first started out, the Adsense income was pretty pathetic. I used to earn like $3.00 a month. I even tried to create a few dedicated Adsense websites around certain keywords but I could never create any consistent Adsense income from my sites. Mostly because I did not have a passion around the subjects of those blogs.

So in the end, I just left the Adsense model and started exploring other means of online income to see if it was better return for my time. I decided to just blog for fun and for the “therapeutic” value of being able to write of post about something and make it accessible to the world. That was over a year ago.

In the early days, like all new endeavors, I found it hard to maintain a consistent habit of blogging. It was almost a chore to keep it up each week and I was only blogging about once a week.

After sticking to it for a while though, things started to change. Today, it’s a lot easier and its just something I do once a week or whenever I have the time. I blog about anything I like really. There’s no plan or schedule for when and what I blog about.

Now in the meantime, I’ve noticed that over the last year, I’ve seen my Adsense income starting to grow. I was earning about $50 to $70 a month which was a welcomed income. Then I started earning over $100 a month.

The last check I received came to just over $180.00. Although its just a small amount of money, I never play down any source of income. It’s all good.

So, I think the take away point of the story is this:

1. Start a WordPress Blog and Host it On Your Own Domain

It does not cost much to host your own blog on your own domain, so go ahead and buy a domain name and install a WordPress blog. It doesn’t matter what it looks like or even if you have nothing “great” to say. Just get started. If you don’t start, you can’t learn and if you don’t learn, you can’t progress.

2. To Build and Audience, Passion is FIrst

If you have an interest in a particular area, just start a blog about it. There are many “gurus’ who tell you to do all kinds of market research before you choose a topic. While I think there’s valid reason to that bit of advice, I also believe that if you don’t have a strong passion around a subject, you will never create a big enough audience to make money from blogging about that subject.

3. Monetize

Adsense is just ONE of many ways you can monetize your blog, if you don’t have any product to sell or have any initial sponsors (might be hard get sponsor for a new blog), you could at least put up some banners to affiliate programs or add Adsense to your blog.

Finally, just enjoy the process of blogging. At the very least, if will help you to improve your writing and communication skills and to connect with other people from all over world. If you have any questions about blogging, leave and comment and I will try and help out if I know the answer.

Technorati Tags: adsense, google

This tutorial will you how to add a customized “Adsense for Search” block on your WordPress Blog to add another channel where you can earn income.

What this means is that when someone uses the search box on your WordPress blog, the results will be a Google search results and has Google Ads on the site. For example if someone searches for “baby” on the blog…

…the result is this..

Notice the results appear within a page in my blog with all the theme and styling elements that is consistent with the site.
Here’s a step-by-step guide on how to do it:

Step 1: In your Adsense account, create a new “Adsense for Search”

Step 2: Under “Search Type” select “Only sites I Select” so that the search only returns pages within your blog. Under “Selected Sites”, type the URL of your blog. Leave the rest of the settings and click “Continue”

Step 3: In my case, I want a very discreet appearance so I chose the watermark version of the search box. I also changed the search box length to 20 so that it fits on my blog sidebar. Then, click “continue”.

Step 4: For the search results, I selected “Open results within my own site”, and I specified the exact page to display the result. For example, my son’s blog is at http://jdwong.com/blog and so I want the search results to appear here: http://jdwong.com/blog/search. We’ll be creating this page in the later steps.

Next, I changed the width of the display area to 550 pixels so that it will fit within the content area of my blog and not overflow to the sidebar.

For “Ad Location”, I chose “Top and Bottom” because the width is small and therefore I would prefer for the ads to appear only at the top or bottom.

You can also customize the color and style of the search results. I left them as the default.

Click “continue”.

Step 5: Click the checkbox to agree to the terms and conditions and give your Adsense for Search a name and click “continue”.

Step 6: You are now almost there. Just copy the two blocks of code for the search box and for the search results and head on over to your WordPress admin panel of your blog.

Step 7: Create a new Page on your blog and call it “Search Results”. Make sure that the permalink address says “http://jdwong.com/blog/search” because this is the URL we specified in Step 4.

Now just paste the “Search Results Code” as the content for this page.

Step 8: Now all you have to do is to add the search box into your blog. I added it to the sidebar with the sidebar widget. Go to your WordPress “Design” section and select “Widgets”. Add a “Text” widget to the sidebar, and paste the “Search Box Code” in the content area.

And that’s it! Congratulations! You’ve just added a completely customized Google Adsense for Search on your blog and can now earn money by showing relevant Google Ads to your blog visitors.

Technorati Tags: adsense