20 Steps to a Flexible and Secure WordPress Installation

A comprehensive WordPress installation, albeit simple to produce, often requires multiple steps — many of which can easily be omitted accidentally. How many times have you forgotten to customize your permalink structure? How about adding in a sitemap plugin? What about changing your timezone? If you’ve installed WordPress more than once, chances are you’ve missed something. Take the following steps and you’ll never miss anything again.

---

Step 1: Get WordPress from SVN

The number one mistake for a flexible WordPress installation happens right from the get-go. I’ve seen numerous developers manually download, unzip, and upload WordPress to their site. This is not only a waste of time, but it also reduces flexibility.

If you download WordPress from SVN, all you need to do is run the following in command-line:

view plaincopy to clipboardprint?

1. svn co http://core.svn.wordpress.org/tags/3.0 .  

svn co http://core.svn.wordpress.org/tags/3.0 .

Maybe you want the latest developer version. That’s even simpler:

view plaincopy to clipboardprint?

1. svn co http://core.svn.wordpress.org/trunk/ .  

svn co http://core.svn.wordpress.org/trunk/ .

Why is this so useful? For starters, all it takes is one command. Looking at WordPress in a long-term perspective reveals that SVN also provides the simplest, hassle-free way to update to a new stable version (or even downgrade). For example, let’s say you want to update to version 3.0. All you need to do is run the SVN switch command:

view plaincopy to clipboardprint?

1. svn sw http://core.svn.wordpress.org/tags/3.0/ .  

svn sw http://core.svn.wordpress.org/tags/3.0/ .

How easy was that? Note that if you’re using the developer version, updating is even easier:

1. svn up  

svn up

That’s all it takes. If you ever need the URL to a new stable version repository, visit the WordPress Codex. You can also find full instructions on using SVN there.

“Looking at WordPress in a long-term perspective reveals that SVN also provides the simplest, hassle-free way to update to a new stable version (or even downgrade).”

---

Step 2: Secure .svn Directories

Now that you’re using SVN, you must ensure that your .svn directories are protected from the public. One main reason lies in the .svn/entries file, which can give out sensitive information to attackers. For further information regarding this subject, please take a look at Smashing Magazine’s article on the SVN server admin issue.

To secure .svn directories using .htaccess, just apply the following redirect rule:

1. RewriteRule ^(.*/)?\.svn/ - [F,L]  

RewriteRule ^(.*/)?\.svn/ - [F,L]

---

Step 3: Create wp-config.php

As outlined in the famous 5-minute WordPress installation, you’ll need to rename wp-config-sample.php to wp-config.php and add in your database information.

---

Step 4: Add a Unique Database Prefix and Authentication Keys

Leaving your wp-config.php file only with database information and no other configuration is a security issue. Make sure to generate authentication keys, as outlined in the comments. To do so, visit https://api.wordpress.org/secret-key/1.1/salt/ and copy-paste the randomly-created keys into the file.

Note that you should also change the default WordPress database table prefix. This is to secure your installation against hacks, such as the recent outbreak of the Pharma Hack. Visit random.org to generate a random prefix string which you’ll need to set as the $table_prefix in wp-config.php. In addition, make sure to add an underscore at the end of the prefix.

---

Step 5: Install Using wp-admin/install.php

As usual, visit wp-admin/install.php in your browser and follow the instructions. When filling out the form, change the default administrator username (“admin”) in order to increase security. Note that most attackers will target a WordPress installation with default settings. Thus, changing this username is a must.

“Note that most attackers will target a WordPress installation with default settings.”

---

Step 6: Remove wp-admin/install.php

This is a commonly-omitted step which only takes a few seconds to execute. Simply remove the wp-admin/install.php script after installing WordPress for further security.

---

Step 7: Login to the Dashboard and Complete User Profile

Login to your WordPress installation at http://example.com/wp-admin, click your username in the top-right corner, and fill out your user profile.

---

Step 8: Edit Tagline and Timezone

Under the Settings > General tab, make sure to edit your blog’s timeline as well as timezone.

---

Step 9: Review Writing, Reading, and Discussion Settings

Although you might not have to change anything, looking over Settings > Writing, Settings > Reading, and Settings > Discussion is always a good idea. Ensure that the configuration meets your standards.

---

Step 10: Change Permalink Structure

A default WordPress installation comes with query-string permalinks that look like http://example.com/?p=1 for each article. Not only is this not search-engine friendly, but it’s also not even human-friendly. Change this to a permalink structure that contains the title of the post (%postname% if you’re using a custom configuration).

---

Step 11: Add .htaccess Rules

An .htaccess file is necessary for your WordPress site to function correctly. To begin, turn on the RewriteEngine:

1. RewriteEngine On  

RewriteEngine On

Disable directory listings for security purposes:

1. Options -Indexes  

Options -Indexes

Add/Remove www to prevent content duplication (replace example.com with your domain):

view plaincopy to clipboardprint?

1. # Add www (change www.example.com to example.com to remove www)  
2. RewriteCond %{HTTP_HOST} !^www.example.com$ [NC]  
3. RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]  

# Add www (change www.example.com to example.com to remove www)
RewriteCond %{HTTP_HOST} !^www.example.com$ [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]

WordPress requires you to redirect all non-files and directories to index.php:

1. RewriteCond %{REQUEST_FILENAME} !-f  
2. RewriteCond %{REQUEST_FILENAME} !-d  
3. RewriteRule . index.php [PT]  

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [PT]

Disable ETags:

1. Header unset ETag  
2. FileETag None  

Header unset ETag
FileETag None

Suppress PHP errors (note that this might not work on all hosts):

1. php_flag display_startup_errors off  
2. php_flag display_errors off  
3. php_flag html_errors off  
4. php_value docref_root 0  
5. php_value docref_ext 0  

php_flag display_startup_errors off
php_flag display_errors off
php_flag html_errors off
php_value docref_root 0
php_value docref_ext 0

Control caching on files to speed up your site:

view plaincopy to clipboardprint?

1. ExpiresActive On  
2. ExpiresDefault A0  
3. "\.(gif|jpg|jpeg|png|swf)$">  
4. # 2 weeks  
5. ExpiresDefault A1209600  
6. Header append Cache-Control "public"  
7.   
8. "\.(xml|txt|html)$">  
9. # 2 hours  
10. ExpiresDefault A7200  
11. Header append Cache-Control "proxy-revalidate"  
12.   
13. "\.(js|css)$">  
14. # 3 days  
15. ExpiresDefault A259200  
16. Header append Cache-Control "proxy-revalidate"  
17.   

ExpiresActive On
ExpiresDefault A0

# 2 weeks
ExpiresDefault A1209600
Header append Cache-Control "public"


# 2 hours
ExpiresDefault A7200
Header append Cache-Control "proxy-revalidate"


# 3 days
ExpiresDefault A259200
Header append Cache-Control "proxy-revalidate"

Secure the .htaccess file:

1.   
2.  Order Allow,Deny  
3.  Deny from all  
4.   

 Order Allow,Deny
 Deny from all

Secure the wp-config.php file:

1.   
2.  Order Deny,Allow  
3.  Deny from all  
4.   

 Order Deny,Allow
 Deny from all

Secure .svn directories, as explained in step #2:

1. RewriteRule ^(.*/)?\.svn/ - [F,L]  

RewriteRule ^(.*/)?\.svn/ - [F,L]

If you would like to add more configuration for your website and are looking for a general tutorial, consider Nettuts’ Ultimate Guide to htaccess Files or Stupid htaccess Tricks on Perishable Press.

---

Step 12: Use gzip

Applying gzip can compress text files up to 80% and greatly save bandwidth. Making it active on your site only requires a PHP file and a bit of .htaccess. Note that the following code is referenced from a gzip tutorial on Lateral Code.

PHP (gzip.php):

view plaincopy to clipboardprint?

2.     if( isset( $_SERVER['HTTP_ACCEPT_ENCODING'] ) && substr_count( $_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip' ) && !preg_match( '/(load-styles|load-scripts)\.php/', $_SERVER[ 'SCRIPT_NAME' ] ) )  
3.         ob_start( 'ob_gzhandler' );  
4.     else  
5.         ob_start();  
6. ?>  

This may look a bit daunting at first, but it really isn’t too bad. The large boolean expression checks whether gzip is available and, if so, it’s applied. Unfortunately, I have found that this gzip method doesn’t function well with WordPress’ load-styles.php and load-scripts.php. As a result, the preg_match is used to exclude them.

.htaccess:

view plaincopy to clipboardprint?

1. "\.js$">  
2. AddHandler application/x-httpd-php .js  
3. php_value default_mimetype "text/javascript"  
4.   
5. "\.css$">  
6. AddHandler application/x-httpd-php .css  
7. php_value default_mimetype "text/css"  
8.   
9. "\.(htm|html|shtml)$">  
10. AddHandler application/x-httpd-php .html  
11. php_value default_mimetype "text/html"  
12.   
13. php_value auto_prepend_file /absolute/path/to/gzip.php  

AddHandler application/x-httpd-php .js
php_value default_mimetype "text/javascript"


AddHandler application/x-httpd-php .css
php_value default_mimetype "text/css"


AddHandler application/x-httpd-php .html
php_value default_mimetype "text/html"

php_value auto_prepend_file /absolute/path/to/gzip.php

This snippet adds the php handler to .html, .css, and .js files so that they can be gzipped. It also prepends the previously mentioned gzip.php file. Make sure to change /absolute/path/to/gzip.php to the correct path.

---

Step 13: Apply the 4G Blacklist

Perishable Press’ 4G Blacklist will prevent numerous attacks on your website through .htaccess. I’ve included the code below (edited for WordPress). You can learn about how it works by reading the article on Perishable Press:

view plaincopy to clipboardprint?

1. ### PERISHABLE PRESS 4G BLACKLIST ###  
2.   
3. # ESSENTIALS  
4. RewriteEngine on  
5. ServerSignature Off  
6. Options All -Indexes  
7. Options +FollowSymLinks  
8.   
9. # FILTER REQUEST METHODS  
10. <IfModule mod_rewrite.c>  
11.  RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK) [NC]  
12.  RewriteRule ^(.*)$ - [F,L]  
13. IfModule>  
14.   
15. # BLACKLIST CANDIDATES  
16. <Limit GET POST PUT>  
17.  Order Allow,Deny  
18.  Allow from all  
19.  Deny from 75.126.85.215   "# blacklist candidate 2008-01-02 = admin-ajax.php attack "  
20.  Deny from 128.111.48.138  "# blacklist candidate 2008-02-10 = cryptic character strings "  
21.  Deny from 87.248.163.54   "# blacklist candidate 2008-03-09 = block administrative attacks "  
22.  Deny from 84.122.143.99   "# blacklist candidate 2008-04-27 = block clam store loser "  
23.  Deny from 210.210.119.145 "# blacklist candidate 2008-05-31 = block _vpi.xml attacks "  
24.  Deny from 66.74.199.125   "# blacklist candidate 2008-10-19 = block mindless spider running "  
25.  Deny from 203.55.231.100  "# 1048 attacks in 60 minutes"  
26.  Deny from 24.19.202.10    "# 1629 attacks in 90 minutes"  
27. Limit>  
28.   
29. # QUERY STRING EXPLOITS  
30. <IfModule mod_rewrite.c>  
31.  RewriteCond %{QUERY_STRING} \.\.\/    [NC,OR]  
32.  RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]  
33.  RewriteCond %{QUERY_STRING} tag\=     [NC,OR]  
34.  RewriteCond %{QUERY_STRING} ftp\:     [NC,OR]  
35.  RewriteCond %{QUERY_STRING} http\:    [NC,OR]  
36.  RewriteCond %{QUERY_STRING} https\:   [NC,OR]  
37.  RewriteCond %{QUERY_STRING} mosConfig [NC,OR]  
38. # RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|'|"|;|\?|\*).* [NC,OR]  
39. # RewriteCond %{QUERY_STRING} ^.*(%22|%27|%3C|%3E|%5C|%7B|%7C).* [NC,OR]  
40.  RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]  
41.  RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]  
42.  RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).* [NC]  
43.  RewriteRule ^(.*)$ - [F,L]  
44. IfModule>  
45.   
46. # CHARACTER STRINGS  
47. <IfModule mod_alias.c>  
48.  # BASIC CHARACTERS  
49.  RedirectMatch 403 \,  
50.  RedirectMatch 403 \:  
51.  RedirectMatch 403 \;  
52. # RedirectMatch 403 \=  
53.  RedirectMatch 403 \@  
54.  RedirectMatch 403 \[  
55.  RedirectMatch 403 \]  
56.  RedirectMatch 403 \^  
57.  RedirectMatch 403 \`  
58.  RedirectMatch 403 \{  
59.  RedirectMatch 403 \}  
60.  RedirectMatch 403 \~  
61.  RedirectMatch 403 \"  
62.  RedirectMatch 403 \$  
63.  RedirectMatch 403 \<  
64.  RedirectMatch 403 \>  
65.  RedirectMatch 403 \|  
66.  RedirectMatch 403 \.\.  
67. # RedirectMatch 403 \/\/  
68.  RedirectMatch 403 \%0  
69.  RedirectMatch 403 \%A  
70.  RedirectMatch 403 \%B  
71.  RedirectMatch 403 \%C  
72.  RedirectMatch 403 \%D  
73.  RedirectMatch 403 \%E  
74.  RedirectMatch 403 \%F  
75.  RedirectMatch 403 \%22  
76.  RedirectMatch 403 \%27  
77.  RedirectMatch 403 \%28  
78.  RedirectMatch 403 \%29  
79.  RedirectMatch 403 \%3C  
80.  RedirectMatch 403 \%3E  
81. # RedirectMatch 403 \%3F  
82.  RedirectMatch 403 \%5B  
83.  RedirectMatch 403 \%5C  
84.  RedirectMatch 403 \%5D  
85.  RedirectMatch 403 \%7B  
86.  RedirectMatch 403 \%7C  
87.  RedirectMatch 403 \%7D  
88.  # COMMON PATTERNS  
89.  Redirectmatch 403 \_vpi  
90.  RedirectMatch 403 \.inc  
91.  Redirectmatch 403 xAou6  
92.  Redirectmatch 403 db\_name  
93.  Redirectmatch 403 select\(  
94.  Redirectmatch 403 convert\(  
95.  Redirectmatch 403 \/query\/  
96.  RedirectMatch 403 ImpEvData  
97.  Redirectmatch 403 \.XMLHTTP  
98.  Redirectmatch 403 proxydeny  
99.  RedirectMatch 403 function\.  
100.  Redirectmatch 403 remoteFile  
101.  Redirectmatch 403 servername  
102.  Redirectmatch 403 \&rptmode\=  
103.  Redirectmatch 403 sys\_cpanel  
104.  RedirectMatch 403 db\_connect  
105.  RedirectMatch 403 doeditconfig  
106.  RedirectMatch 403 check\_proxy  
107.  Redirectmatch 403 system\_user  
108.  Redirectmatch 403 \/\(null\)\/  
109.  Redirectmatch 403 clientrequest  
110.  Redirectmatch 403 option\_value  
111.  RedirectMatch 403 ref\.outcontrol  
112.  # SPECIFIC EXPLOITS  
113.  RedirectMatch 403 errors\.  
114. # RedirectMatch 403 config\.  
115.  RedirectMatch 403 include\.  
116.  RedirectMatch 403 display\.  
117.  RedirectMatch 403 register\.  
118.  Redirectmatch 403 password\.  
119.  RedirectMatch 403 maincore\.  
120.  RedirectMatch 403 authorize\.  
121.  Redirectmatch 403 macromates\.  
122.  RedirectMatch 403 head\_auth\.  
123.  RedirectMatch 403 submit\_links\.  
124.  RedirectMatch 403 change\_action\.  
125.  Redirectmatch 403 com\_facileforms\/  
126.  RedirectMatch 403 admin\_db\_utilities\.  
127.  RedirectMatch 403 admin\.webring\.docs\.  
128.  Redirectmatch 403 Table\/Latest\/index\.  
129. IfModule>  

### PERISHABLE PRESS 4G BLACKLIST ###

# ESSENTIALS
RewriteEngine on
ServerSignature Off
Options All -Indexes
Options +FollowSymLinks

# FILTER REQUEST METHODS

 RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK) [NC]
 RewriteRule ^(.*)$ - [F,L]


# BLACKLIST CANDIDATES

 Order Allow,Deny
 Allow from all
 Deny from 75.126.85.215   "# blacklist candidate 2008-01-02 = admin-ajax.php attack "
 Deny from 128.111.48.138  "# blacklist candidate 2008-02-10 = cryptic character strings "
 Deny from 87.248.163.54   "# blacklist candidate 2008-03-09 = block administrative attacks "
 Deny from 84.122.143.99   "# blacklist candidate 2008-04-27 = block clam store loser "
 Deny from 210.210.119.145 "# blacklist candidate 2008-05-31 = block _vpi.xml attacks "
 Deny from 66.74.199.125   "# blacklist candidate 2008-10-19 = block mindless spider running "
 Deny from 203.55.231.100  "# 1048 attacks in 60 minutes"
 Deny from 24.19.202.10    "# 1629 attacks in 90 minutes"


# QUERY STRING EXPLOITS

 RewriteCond %{QUERY_STRING} \.\.\/    [NC,OR]
 RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
 RewriteCond %{QUERY_STRING} tag\=     [NC,OR]
 RewriteCond %{QUERY_STRING} ftp\:     [NC,OR]
 RewriteCond %{QUERY_STRING} http\:    [NC,OR]
 RewriteCond %{QUERY_STRING} https\:   [NC,OR]
 RewriteCond %{QUERY_STRING} mosConfig [NC,OR]
# RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|'|"|;|\?|\*).* [NC,OR]
# RewriteCond %{QUERY_STRING} ^.*(%22|%27|%3C|%3E|%5C|%7B|%7C).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).* [NC]
 RewriteRule ^(.*)$ - [F,L]


# CHARACTER STRINGS

 # BASIC CHARACTERS
 RedirectMatch 403 \,
 RedirectMatch 403 \:
 RedirectMatch 403 \;
# RedirectMatch 403 \=
 RedirectMatch 403 \@
 RedirectMatch 403 \[
 RedirectMatch 403 \]
 RedirectMatch 403 \^
 RedirectMatch 403 \`
 RedirectMatch 403 \{
 RedirectMatch 403 \}
 RedirectMatch 403 \~
 RedirectMatch 403 \"
 RedirectMatch 403 \$
 RedirectMatch 403 \<
 RedirectMatch 403 \>
 RedirectMatch 403 \|
 RedirectMatch 403 \.\.
# RedirectMatch 403 \/\/
 RedirectMatch 403 \%0
 RedirectMatch 403 \%A
 RedirectMatch 403 \%B
 RedirectMatch 403 \%C
 RedirectMatch 403 \%D
 RedirectMatch 403 \%E
 RedirectMatch 403 \%F
 RedirectMatch 403 \%22
 RedirectMatch 403 \%27
 RedirectMatch 403 \%28
 RedirectMatch 403 \%29
 RedirectMatch 403 \%3C
 RedirectMatch 403 \%3E
# RedirectMatch 403 \%3F
 RedirectMatch 403 \%5B
 RedirectMatch 403 \%5C
 RedirectMatch 403 \%5D
 RedirectMatch 403 \%7B
 RedirectMatch 403 \%7C
 RedirectMatch 403 \%7D
 # COMMON PATTERNS
 Redirectmatch 403 \_vpi
 RedirectMatch 403 \.inc
 Redirectmatch 403 xAou6
 Redirectmatch 403 db\_name
 Redirectmatch 403 select\(
 Redirectmatch 403 convert\(
 Redirectmatch 403 \/query\/
 RedirectMatch 403 ImpEvData
 Redirectmatch 403 \.XMLHTTP
 Redirectmatch 403 proxydeny
 RedirectMatch 403 function\.
 Redirectmatch 403 remoteFile
 Redirectmatch 403 servername
 Redirectmatch 403 \&rptmode\=
 Redirectmatch 403 sys\_cpanel
 RedirectMatch 403 db\_connect
 RedirectMatch 403 doeditconfig
 RedirectMatch 403 check\_proxy
 Redirectmatch 403 system\_user
 Redirectmatch 403 \/\(null\)\/
 Redirectmatch 403 clientrequest
 Redirectmatch 403 option\_value
 RedirectMatch 403 ref\.outcontrol
 # SPECIFIC EXPLOITS
 RedirectMatch 403 errors\.
# RedirectMatch 403 config\.
 RedirectMatch 403 include\.
 RedirectMatch 403 display\.
 RedirectMatch 403 register\.
 Redirectmatch 403 password\.
 RedirectMatch 403 maincore\.
 RedirectMatch 403 authorize\.
 Redirectmatch 403 macromates\.
 RedirectMatch 403 head\_auth\.
 RedirectMatch 403 submit\_links\.
 RedirectMatch 403 change\_action\.
 Redirectmatch 403 com\_facileforms\/
 RedirectMatch 403 admin\_db\_utilities\.
 RedirectMatch 403 admin\.webring\.docs\.
 Redirectmatch 403 Table\/Latest\/index\.

A few of these rules are commented out or edited because they interfere with WordPress. If you are having problems with certain URLs, fix them by prepending a “#” (comment) to the corresponding rule.

---

Step 14: Activate Akismet

“Activating Akismet is a must in order to prevent comment spam.”

Activating Akismet is a must in order to prevent comment spam. Do so by registering for an API key at akismet.com. Note that a WordPress.com account API key will also work.

Once you obtain a key, visit Plugins > Akismet Configuration in your dashboard and paste it in the corresponding box.

---

Step 15: Download Plugins

The following plugins are a great help to any WordPress blog:

• All in One SEO Pack
• Google XML Sitemaps

For further security, these plugins, referenced from DigWP’s WordPress lockdown article, are also important:

• WordPress File Monitor
• WP Security Scan
• Ultimate Security Check
• Secure WordPress

To make installation easy, you can run the following in command-line under your plugins directory:

view plaincopy to clipboardprint?

1. wget http://downloads.wordpress.org/plugin/all-in-one-seo-pack.zip  
2. wget http://downloads.wordpress.org/plugin/google-sitemap-generator.3.2.4.zip  
3. wget http://downloads.wordpress.org/plugin/wordpress-file-monitor.2.3.3.zip  
4. wget http://downloads.wordpress.org/plugin/wp-security-scan.zip  
5. wget http://downloads.wordpress.org/plugin/ultimate-security-check.1.2.zip  
6. wget http://downloads.wordpress.org/plugin/secure-wordpress.zip  
7. find . -name '*.zip' -exec unzip {} \;  
8. rm *.zip  

wget http://downloads.wordpress.org/plugin/all-in-one-seo-pack.zip
wget http://downloads.wordpress.org/plugin/google-sitemap-generator.3.2.4.zip
wget http://downloads.wordpress.org/plugin/wordpress-file-monitor.2.3.3.zip
wget http://downloads.wordpress.org/plugin/wp-security-scan.zip
wget http://downloads.wordpress.org/plugin/ultimate-security-check.1.2.zip
wget http://downloads.wordpress.org/plugin/secure-wordpress.zip
find . -name '*.zip' -exec unzip {} \;
rm *.zip

This will retrieve zip files for the plugins, unzip them, and delete the .zips

These download links may not be correct later on due to plugin updates. As a result, you can visit the wordpress.org plugin pages listed above in order to find the updated links.

After you finish installing the plugins, make sure to enable them through the WordPress dashboard.

---

Step 16: Configure All in One SEO Pack

Before All in One SEO Pack becomes active, you’ll need to configure it. Go to Settings > All in One SEO to do so. Make sure to mark the “enabled” radio button. In addition, add in a home title, description, and keywords. Finally, set the rest of the options to your liking.

---

Step 17: Generate a Sitemap

Visit Settings > XML-Sitemap to generate your first sitemap that will be sent to search engines. Before doing so, ensure that the options on the page are what you desire. For example, I often edit the change frequencies, as my posts are modified quite often.

Once you are ready, scroll to the top of the page and click the build link (“Click here”). You might have to create two blank files—sitemap.xml and sitemap.xml.gz—in your root directory depending on the directory permissions. Nevertheless, once you finish building it for the first time, it should automatically update as long as you have “Rebuild sitemap if you change the content of your blog ” checked.

---

Step 18: Add Security

At this point, you’ve already installed four security plugins. You should now put them into use.

Visit Settings > WordPress File Monitor and add wp-content/uploads in the exclude path. Change the other information if necessary. Note that this plugin will inform you whenever it notices a change in your file system.

Under Settings > Secure WP, check Error Messages and Windows Live Writer for extra protection.

Note that there is a new “Security” tab created by WP Security Scan. Fix items in red under Security > Security and Security > Scanner. When you visit Security > Scanner, make sure to chmod all of your individual plugins with 755 as well. Furthermore, you can use the password tool to generate a strong password.

Finally, fix the errors under Tools > Ultimate Security Check and ensure your site receives an A.

---

Step 19: Customize Theme and Sidebar

Now that you’ve setup a flexible, secure WordPress installation, you’ll need to make it comprehensive by customizing the theme and sidebar to fit your site’s needs. Of course, there is no set method to accomplish this; each site is unique in it’s own way. Make a theme that appeals to both you and your readers.

---

Step 20: Write Content

All that’s left now is to write genuine content that appeals to your user base. You now have a flexible, secure, and comprehensive WordPress installation. Use it wisely.

---

Congratulations! You now have a flexible, secure, and comprehensive WordPress installation. Use it wisely!

The Icon Directory For Designers

Icons are necessary in web design to convey messages, create mental images, and to establish a visual connection between your content and your readers. Whether you are attempting to design your own icon, find the perfect set for your website, or implement the icons into your design successfully, finding the perfect resource can be a daunting task. Welcome to the complete Icon Directory For Designers.

This post is a complete directory of icons for Web designers. Featured are hundreds of icon sets that will be continually updated, dozens of icon design tutorials, as well as dozens of examples of successful uses of icons in web design.

Bookmark this page so you will always have a growing resource for icon information at your fingertips!

Simple PHP Ban IP Address Script

// IP to ban
$banned_ip = "1.2.3.4";

// user's IP is held in the $_SERVER variable
$user_ip = $_SERVER['REMOTE_ADDR'];

// check if user's IP matches banned IP
if($user_ip == $banned_ip) {
    echo "Access denied";
}

// multiple IP addresses?
$banned_ips = array("1.2.3.4", "4.3.2.1");

// check for match
foreach($banned_ips as $ip_ban) {
    if($user_ip == $ip_ban) {
        echo "Access denied";
    }
}

?>

Create Beautiful Abstract Female Art in Photoshop

Final Product What You'll Be Creating

Sometimes, all it takes to create a stunning piece of art is a stock photo, a bit of creativity, a great idea, and some time. Today, I will demonstrate how to create a piece of art that I created titled, "Beauty of Gold." Let’s get started!

---

Step 1

Let’s start by creating a new document in Photoshop, I used A3 format but it doesn’t really matter what size you use. I always find it easier working in high resolution because it’s easier to add the details. After that, search for a nice piece of stock art. I bought mine on Dreamstime.com but you could also try DeviantArt or any other site. Place the stock on your canvas as shown below.

---

Step 2

Now, have a good look at your stock, this technique is always easier when you have a stock with a lot of highlights and shadows. I have circled these areas in red and green below. It’s not necessary to draw the lines yourself. I just wanted you to understand what I meant.

---

Step 3

Take out your ‘Ellipse Tool’ and begin to create circles that will form the shading.

---

Step 4

Set the opacity of the ‘Ellipse Tool’ to about 20%. Now start filling in the dark and light areas with white and black. Don’t worry about the details yet, just create the basic shading like I did. (I set my stock to 50% opacity so that the circles are visible).

---

Step 5

Work from large size to small size! This might seem a bit boring but in the end you will get the best results! As you can see below I’ve already added some very small details on the face just to show what it will look like on a later stage. (The stock is on 10% so that the shading is more visible).

---

Step 6

Repeat this same step again, but this time add some circles around you stock to create some flow, this will be used for effects later in this tutorial. If some parts don’t look great, don’t worry, it can be fixed later on. Create a new layer and add more circles. I changed the opacity of the stock to 0% this time so its easy to see what I did and how much detail I added.

---

Step 7

Now, we’re going to add some color. I decided to go for a golden/brown color which is about the same as what my stock had. Using the ‘Ellipse Tool’ start adding light colors on the light parts and dark colors on the darker parts.

---

Step 8

Reduce the opacity of the color layer to 35% to bring down the colors a bit, after add more black and white shading on a new layer.

---

Step 9

Our composition is finally starting to take shape, but its still a bit hard to recognize some parts of the stock. Take out your brush tool and apply these settings.

---

Step 10

Now start brushing on the darker and lighter areas that we showed in Step 2. Make sure you don’t go outside the lines of the stock. Set the opacity of your brush to 30%, only use a black or white brush.

---

Step 11

Here is what your layer stack should look like.

---

Step 12

Duplicate all the layers above the stock, after that, merge them. Now duplicate the layer of your stock and place it at the very top. Now, create a clipping mask on the layer below it (this should be the merge of all the circles).

---

Step 14

After this I merged the top 2 layers and set the result to overlay (20% opacity), then I duplicated that layer and set it to soft light (80% opacity).

---

Step 15

As you can see there are still some areas that need more details. See the image below to understand which parts I’m referring to.

---

Step 16

For this step we have to take out our ‘Ellipse Tool’ again, we’re now going to zoom in on each part we just highlighted and work on the detailing, add black and white where its needed! Keep repeating this step on the same layer until you are satisfied. (Our Ellipse Tool is still on 20% opacity).

---

Step 17

After this we want to start working a bit more on the flow. As you can see when looking at my artwork, the main highlights are on the top left of the stock, so we’re going to add a gradient (black to white) where the bottom right is black and the top left is white. After that, set it to soft light and keep the opacity on 100%.

---

Step 18

Things are starting to come together now but the background is still really boring. Since we want to keep the focus on the foreground we’re going to add a really soft background. I usually do this by taking a big stock photo and blurring it, then setting it to soft light. This time I used the stock of a desert which I bought on dreamstime.com (you should also be able to find good stocks on sxc.hu). Place it as shown below.

---

Step 19

Now go to Filter > Blur > Gaussian Blur and set the radius to 65. Set this layer to soft light (100% opacity), now duplicate that layer and set it to 15% opacity.

---

Step 20

Now, we’re going to add more effects, at the moment all we have are flat circles which are a bit boring. I created some special circles with gradients etc. which I’m going to randomly place in the artwork. Its best to experiment with creating circles because it depends on what fits the artwork best.
Note: I put a gray background behind the effects in this screenshot so they are all visible. These are not on the same layer because then I wouldn’t be able to move them around and duplicate them.

---

Step 21

Some parts still look a bit flat. We’re now going to add highlights but also darken the dark areas a bit more. A very simple way to do this is by soft brushing on a new layer and setting it to soft light. I did this with a 550px soft brush (black and white), which I set to soft light 50% opacity.

---

Step 22

After that, we’re going to add very small details. I did this with a soft brush and hard brush with a small diameter. Set the scatter and spacing to high and brush in random areas. Do this with different colors but also with varied blending modes such as screen, overlay and soft light.

---

Step 23

We’re coming to an end here, I took out my pen tool and a very large soft brush to create lines around some places of my main model. Also, I added some subtle effects to it. Check out the screenshot below what I mean. (Make sure you set it on simulate pressure).

---

Step 24

Go to Filter > Blur > Gaussian Blur. Erase all the areas you don’t want blurred to improve the focal point.

---

Step 25

We’re almost done now. I applied my image on a new layer and sharpened it. After that I played a bit with the colors/brightness and contrast/hue and saturation. This is my final result.

---

Final Image

I flipped the image horizontally because for me, it looked better. After that I also added my logo.

It’s evident from all the amazing entries that patterns do surround the world around us. From the obvious and obsure to using macro and wide angle, you really did a brilliant job to capture some amazing images in this week’s Creative Challenge: Patterns. We were very impressed with the variety of subjects submitted this week. See the top three winners below! For those who weren’t selected, stay tuned because we have set aside a few for future features across the site! #1. Member antaver59’s use of soft lighting and a tight composition highlighted the subtle hues beautifully of this patterned prickly plant. Congrats to member antaver59 —we’ll feature you’re photo on the homepage tomorrow! #2. Member volvob12 focused on the textured patterns in this architectural detail of a Singapore rooftop. The vibrant contrast between color and texture in the frame makes for an intriguing study. #3. The tonal range in this organic nature study from member denidab beautifully highlights the reticulated patterns formed from dried mud.

Final Image Preview

Create a new document (Ctrl+N) in Adobe Photoshop with the size 1280px by 1024px (RGB color mode) at a resolution of 72 pixels/inch. Use the Paint Bucket Tool (G) to fill with black color the new background layer.

Find a stock photo with a model represented on it, I used this photo from deviantart. I would like to thank the author of this photo.

Remove the background using your favorite tools like Pen Tool (P), Magic Wand Tool (W), Magnetic Lasso (L) or even a simple Filter>Extract and insert it on a new layer in our main document. The Free Transform (Ctrl+T) command may be helpful in changing the girl’s sizes.

Press D to set the default foreground color in black, and the default background color in white. Create a new layer and go to Filter>Render>Clouds to generate a soft cloud pattern using random values of the foreground and the background colors. Place the layer under the girl’s one.

Click on the same layer on the bottom part of the Layers panel on Add layer mask icon. Next select the Soft Round brush of black color (set the Opacity to 30% in Options bar).

Use this brush to hide the clouds around the girl. Place the layer under the girl’s one.

Next we have to copy the made layer and apply on it: Filter>Sharpen>Unsharp mask to increase the contrast along the edges.

We’ve got the next result:

Select the Custom Shape Tool (U) in the Tools bar, in the Options bar click the Shape to open the selection menu. Find Triangle shape at the bottom of the menu, and then double-click a shape thumbnail to select it.

Click and drag to draw the shape. Sizes and placement may be changed if applying the Free Transform (Ctrl+T) command. Place this layer under the girl’s layer.

Set Fill to 0% for this layer and click on Add a layer style icon from bottom part of the Layers panel and select Inner Glow.

Add Stroke

We’ve got the next effect on the shape.

Using the Custom Shape Tool (U), we can add many shapes around the girl.


Their Layer Styles should be the same with the triangle’s ones. Change their sizes and placement with Free Transform (Ctrl+T) command. Place the layer also lower than the girl’s one.

Create a new layer and select on it the Hard Round brush.

Use this brush to draw a tetrahedron of white color, hold down SHIFT to draw a straight line between the two points. Place the layer under the girl’s one.

Draw another three tetrahedrons around the girl.

On the next new layer we’ll apply the Soft Round brush.

Use this brush to represent many dots with white color, changing its Master Diameter and the Opacity value. Place this layer under the girl’s one.

Next we have to create a new file (File>New) with the size 20px by 20px (RGB color mode) at a resolution of 72 pixels/inch. Select the Custom Shape Tool (U) in the Tools bar, in the Options bar click the Shape to open the selection menu. Find Diamond Card shape at the bottom of the menu, and then double-click a shape thumbnail to select it.

Click and drag to draw the shape of black color.

Choose Edit > Define Pattern. Enter a name for the pattern in the Pattern Name dialog box.
Get back to the girl’s document and use now the Ellipse Tool (U) to represent a ellipse of white color.

Click on Add a layer style icon from bottom part of the Layers panel and select Inner Shadow.

We’ve got the next result: