1.0 Installing the theme

1.1 Checklist

To install the Zen Kitten theme, you’ll need the following:

1. A web hosting account with the latest version of WordPress
2. The zip file we send when you purchase the theme.

If you need help installing WordPress, detailed instructions are here. If you get really stuck, head to our support pages and we’ll do our very best to help.

1.2 Installing the theme

You can install themes directly from the WordPress admin area. Just log in to WordPress, click the ‘Appearance’ link in the sidebar, followed by the ‘Install Themes’ tab at the top of the page, and finally the blue ‘Install’ link just below the tabs. Choose the zenkitten.zip file that you downloaded to your computer when you purchased the theme and click ‘Install Now’.

2.0 Zen Kitten theme options

With the theme installed and activated, you’re ready to customise it using the theme options. To get to the theme options page, log in to WordPress and click the ‘Design’ tab, followed by ‘Zen Kitten Options’:

Once you’re there, the following settings are available to you:

2.1 Logo options

To change the height of the logo which appears on the homepage or alter the subtitle, update the information in the fields immediately under the ‘Logo Settings’ heading, then scroll to the bottom of the page and click ‘Save changes’.

The default logo height is 110. The default subtitle is blank. You can include html tags (such as links) in your subtitle. Note that the logo and subtitle appear only on your homepage.

To change the name of your site as it appears on your homepage, update your Site Title, which can be found in your site’s General Settings (click ‘Settings’ in the WordPress admin sidebar).

2.2 Replacing the homepage logo with an image

The text logo on your homepage can be replaced with an image of your choice. To use our easy swap image uploader, you’ll need to have Flash installed and be using a modern web browser. (Specifically, the uploader won’t work in Internet Explorer 6 or 7, so consider updating your browser.)

To upload your logo or image, click the grey ‘UPLOAD LOGO’ button, and select a file from your computer. Make sure that there are no spaces in the file’s name. When the file’s finished uploading, you should see a small preview of it. Scroll to the bottom of the page and click the ‘Save changes’ button. Your logo will now be visible on the homepage.

To remove the logo, click the ‘remove logo’ link next to your logo preview, then scroll down and click the ‘Save changes’ button:

2.3 Homepage Options

Zen Kitten’s homepage can be customised to change the number of posts displayed, what categories are used when fetching posts, and whether or not category titles are displayed above each category.

To change these settings, edit the options underneath the ‘Homepage Settings’ heading in the Zen Kitten options page, then scroll to the bottom and click ‘Save changes’.

Example: Checking “Latest posts [default]” in the ‘homepage shows…’ field, selecting ’20′ from the ‘posts per category’ drop down and choosing ‘No’ for ‘show category titles’ will display your latest 20 posts with no category heading.

If you only see ‘Latest posts [default]‘ in the ‘homepage shows…’ field, you might wish to consider adding some categories and assigning your posts to those categories so that you can display them in different sections on your homepage. Learn more about WordPress categories.

2.4 Adding links to your pages

By default, Zen Kitten displays two small icons on the left side of all pages to help users visit your homepage and to display RSS links. You can add an icon and link to this area for your about and contact pages by filling in the ‘Navigation Settings’ in the Zen Kitten theme options.

First, create your about and contact pages and make a note of the URLs to each one. Type the full URLs into the ‘About Page URL’ and ‘Contact Page URL’ fields, including the ‘http://’ and your site’s domain name. Scroll to the bottom of the Zen Kitten options page and click ‘Save changes’. Your site will now show links to your about and contact pages in the left navigation area.

What about my other pages?
Zen Kitten is deliberately minimal — it’s designed to put your content first, which means that the navigation area only holds essential links.

If you want to make links to your other pages available, we suggest adding the ‘Pages’ widget to your site’s footer area (see ‘Footer customisation’ in section 4.0 ). This lists other pages you’ve created without creating cluttered navigation bars in your header area that can often prove distracting.

2.5 Adding FeedBurner, Twitter, and Facebook links

Zen Kitten includes a subscribe drawer at the top of all pages that slides out when clicked to reveal a list of subscribe options and links to Twitter and Facebook. These links are optional; it’s up to you whether or not you add them.

FeedBurner is a free service from Google that lets you measure your subscribers, learn more about them, and offer an email subscription option. You can set up the Zen Kitten theme to use FeedBurner by pasting the full FeedBurner URL and Email subscribe links in your theme options and clicking the ‘Save changes’ button.

Both fields should begin ‘http://’. By entering your FeedBurner URL, Zen Kitten will also use your FeedBurner feed as your main site feed — this means that visitors who click the RSS button in their browser will still be measured by FeedBurner.

Of courseif you don’t want to use FeedBurner, it’s no problem — you can leave these fields blank. Zen Kitten just uses the default WordPress feed instead. (We completely understand if you don’t have time to measure things like subscriber counts. Life is short!)

Add links to your Twitter profile or Facebook page under the heading ‘Social Network Links’:

3.0 Adding featured images to posts

Zen Kitten uses featured images on the homepage and under each title on the subpages. You can leave these blank, but it makes things much more interesting if you add a small illustration or photograph. It’s easy to do now that it’s built into the WordPress post editor:

Step 1) In the WordPress admin area, create a new post or edit the post you’d like to add a featured image to.

Step 2) Scroll down to the section labelled, ‘Featured Image’. If you’ve not rearranged the post editor, you’ll find this section at the bottom of the right-side column. When you’ve found it, click ‘Set featured image’:

Step 3) In the image uploader that pops up, choose a file from your computer. You don’t have to worry about resizing or cropping it — WordPress will do that for you.

Step 4) When the image has finished uploading, click ‘Use as featured image’.

Step 5) Save or publish your post in the post editor. That’s it! Return to the post or homepage to see your featured image alongside the post title.

4.0 Footer customisation

The two-column Zen Kitten footer is customised using WordPress widgets. Use it for your Twitter status, Flickr photos, ads, products, calls to action, recent comments and posts, or just about anything you can think of!

There are four widgets in total — two on the homepage (left and right), and another two in your subpage template. To edit and add widgets, click the ‘Appearance’ link in the left navigation area or your WordPress admin area, followed by the ‘Widgets’ link.

You can then drag and drop widgets from the left area of the page to the relevant containers on the right hand side. It’s entirely up to you what you choose to feature in your footers, but we recommend the ‘Pages’ and ‘Search’ widgets as good starting points.

For help with the WordPress widget interface, see this video guide.

5.0 Adding an archives page

Zen Kitten features an optional archives template that displays all of your posts in reverse chronological order. To add it, create a page (not a post) called ‘Archives’ or similar (it’s up to you), then select ‘Archives’ from the ‘Template’ drop down in the ‘Attributes’ box. Save the page and visit its URL in your browser to see your posts displayed in the archive.

6.0 Further help and support

6.1 Where to get help

If you’ve been through the guide and need more help, feel free to
ask us a question on our support page.

If you’ve read the guide and exhausted our support pages too, our email address is help@wordprezzie.com

6.2 Our design and customisation service

We offer a full WordPress setup, design, and customisation service. Whether you need some quick tweaks, want us to customise a theme with your logo and colours, or fancy a full unique design to call your own, we’ll be happy to help.

Get a free estimate today on our hire us page.

The simple WordPress theme that puts your content first

Zen Kitten is a clean, simple theme designed for web writers, lovers of precious white space, and anyone who believes that their content comes first. Grab it today and get all this:

• A gorgeous, refreshingly clean template design
• Easy swap header image — no coding needed!
• Featured images on homepage and subpages
• Customisable drop-down subscription drawer
• Powerful, customisable homepage layout
• An optional custom archive template
• Fully valid code — tested in all major web browsers
• FeedBurner ready (RSS and optional email buttons)
• WordPress 3.0 tested
• Full documentation
• Instant download — now only US$69 by PayPal/card

Take Zen Kitten home with you today. Buy it now for instant download!

Putting your content first

Zen Kitten is a departure from the done-to-death feel that many WordPress themes follow: the cluttered widgets, multiple sidebars, and bunched up text you’ve seen elsewhere have been dumped in the litter tray.

Instead, you’ll find a light, airy design with — shock — simple navigation, minimal distraction, and enough white space to swing a cat. Just don’t grab it by the tail; we’d never forgive you.

Powerful, flexible homepage layout

Zen Kitten shows off your posts in a refreshing homepage layout that’s fully customisable. Choose which categories are shown and how many posts from each category are listed in the handy Zen Kitten Theme Options in your WordPress admin area:

Easy swap logo and theme options

Zen Kitten automatically uses your blog’s title as the header on your homepage, setting it in a crisp and clean typeface called Titillium Title.

If you like, you can swap out the text header for your own logo or image instead. Adding your own image takes just three clicks using our easy swap image uploader.

Instant download — PayPal or card

Zen Kitten now costs just US$69.

Pay with PayPal or card using the “Buy Now” button below and get an email with the download link right away. (Note: If you use PayPal direct bank transfer instead of card or your balance, transactions can take 7-10 days.)

Simple flat fee – no developer tax!

Zen Kitten is only US$69 for unlimited use, whoever you are. Want to use the theme on several sites? Go ahead — without paying more. Check out 10 reasons to choose us to learn about the other benefits of buying WordPress themes from Wordprezzie.

Terms & Conditions

By purchasing themes from Wordprezzie, you agree to abide by our Terms & Conditions.

What’s new

We’ve added the most requested feature — a blog page template — as well as providing you with two fresh new flavours: blueberry and coconut.

The blog page template

To check out the latest feature, called the “category page template”, visit our demo site or check out the updated documentation in section 4.3 on the docs page.

Even better value

We’ve dropped the price of Ice Cream Dream from US$89 to US$69, so there’s never been a better time to buy. If you’ve already purchased Ice Cream Dream, we’ll be sending the free update and installation instructions out soon. Otherwise, what are you waiting for? Get the scoop on the info page and then buy it now before it melts!

Unfortunately, losing data is one of those things in life that we don’t usually think about until it’s too late. Of course, unless you’re one of those people that has thought of losing data and puts it off because… well, it’s work.

And there are way more fun things to do, right?

For all you people out there that have better things to do than backups, here’s a process that makes backing up your WordPress site a walk in the park.

It ain’t just a copy

First, let’s clarify a few terms: A backup is not just a copy of your site’s template and images. A backup is a backup of your entire database, which includes every single thing on your site down to the very last comma. The WordPress Codex puts it quite nicely:

“Your WordPress database contains every post, every comment and every link you have on your blog. If your database gets erased or corrupted, you stand to lose everything you have written.”

Timing is everything

When you choose to back up your WordPress site is up to you, really. The best way to figure out when you should schedule your backups is by asking yourself this question:

How much work do I NOT want to lose and have to redo from scratch?

If you post once a month, a backup every six months or so might do just fine. If you post to your blog every single day, frequent backups are more important than if you only post once a month. It’s up to you.

The bottom line is that you have to reconcile the headache of doing backups with the headache of redoing lost work. There’s a middle ground somewhere, and only you can decide the point that works best with your workflow.

Quantity over quality?

In an ideal world, you’ll only need one backup: the most recent. You can delete older backups, of course.

But keep in mind that you’ll only need one backup in an ideal world. If that single backup file goes kaput (and yes, it can), you’re done. Like any other file in the world, your backup file can be accidentally deleted, become corrupted, or get lost because of a poor naming structure. Having a few backups handy can really save your butt, and the files won’t make a significant dent in your system’s resources.

Oh, and just as with any other important file, backing up a second time to a CD or external drive certainly doesn’t hurt.

How to backup

The easiest way to back up your WordPress site (we mean the true lazy man’s version) is to use a backup plug-in. Without a plug-in to automate your backups, you’d have to dip into into sections of your site’s database that might not make you feel very comfortable.

We recommend the WordPress Database Backup plugin. Upload and activate this baby like you would any other plugin. Once you’ve activated the plugin, follow the instructions located on the WordPress Database Backup plugin.
Pretty simple, eh?

When you reach step 4 in the installation, it may be a good idea to select the download method. First, you might never receive that backup file via email if your email account has a hiccup. Second, downloading the file allows you the opportunity to burn to a CD or copy to an external drive.

In the Admin panel for the plug-in, there are automatic update options. You can choose to update your WordPress blog as often as you like, and it will all happen automatically. That renders all the great excuses like, “I don’t have time to backup,” and, “I forgot” completely null and void. The problem with that is that you no longer have an excuse not to back up your blog (which is bad for procrastinator junkies).

The big bang: how to restore from your backup

You never thought it would happen, did you? (We told you it would, but you didn’t listen…)

You wake up with a great idea for a post and, still in your underwear, you head over to your computer to log on. Instead of your usual WordPress welcome screen, you see this:

“We came here looking for money but couldn’t find any. So we hacked your site instead. Thanks for nothing. – The Cranky Monkey Crew.”

Good thing you have that backup file. Now you’re going to use it.

But before you dip your feet into the databases of your site, please note that there is no “Undo” or “Undelete” or similar life-saving miracle for your actions. If you delete something, it’s gone.

That said, let’s get rolling on your restore, with thanks going out to the WordPress Codex:

1. Login to phpMyAdmin.
2. Click databases. Select the database where you will import your data. You will then see either a list of tables already inside that database or a screen that says no tables exist. This depends on your setup.
3. Across the top of the screen, there is a row of tabs. Click the Import tab.
4. On the next screen, there is a Location of Text File box and next to that a button named Browse. Click Browse.
5. Locate the backup file stored on your computer.
6. Make sure the SQL radio button is checked.
7. Click the Go button.

Want to see this restore process with screenshots? Just click here.

Good luck – and don’t forget to back up!

Many people snort over SEO. They think it’s a cheap gimmick. Well, more power to you if you feel that way, but good luck with helping people find your blog out of the millions that exist. If people can’t track you down, after all, how will you increase your readership?

Love it or hate it, search-engine optimization is something you need. It doesn’t have to be a long, ongoing keyword-research chore, though.

If you’re someone who doesn’t want to work hard on SEO but recognizes its importance to help people locate your blog, here are some lazy-ass solutions that you can apply. It’s the best of both worlds.

The All-in-One SEO Pack

The All-in-One SEO Pack plugin lets you input settings that help your blog work harder for better search-engine results. Configure once, then forget about it all and let the plugin do its job.

The All-in-One SEO pack lets you generate automatic meta tags, optimize titles for better results, and nix the common duplicate content penalty that damages rankings. Highly customizable, this plugin handles most of your SEO needs in one fell swoop.

Looking Good with SEO Friendly Images

Many bloggers neglect to optimize photos for better image search results. No, people aren’t looking for your content, but a relevant picture you have posted could bring them over – and they may want to stay.

The SEO Friendly Images plugin allows you to optimize image titles and alt tags automatically. You don’t have to do a thing.

Heading Off Traffic at the Pass

Search-engine crawlers pay more attention to headers, the text you indicate is important stuff. Headers say, “Pay attention to me,” and crawlers do. Why not take advantage of that potential?

Your page title, categories, post titles, keywords, sub-headers and more could use some love. Don’t just use bold and italics to make important words stand out; use the header 1 or header 2 code instead. Assign some weight and show crawlers what to look at first.

Oh, by the way – headers also have levels of importance. An H1 header screams louder than an H2 or an H3 header. H6? Forget it.

Better SEO Titles for Better Traffic

A great plugin to help you optimize titles and tags even further is the SEO Title Tag plugin. It lets you customize a whole bunch of tags for better search-engine visibility.

Alright, it’s true. With this plugin, you’ll have to sit down for a few hours to do a little keyword research and customize the settings. The good news is that you’ll only have to do this once. Then you can walk away knowing your work here is done.

Comments Kill Your Content

The more comments you have, the healthier your site appears. The healthier your site appears, the more commentators will comment. The more comments they leave, the less keyword density you have for your search-engine optimized post – and the less search engines notice your post, the less traffic you receive.

In short, it ain’t easy being big.

If you have a great article, some flagship content or a keyword post that you want to use to attract SEO traffic, publish it as a page or shut off the comments for that post.

Still want comments? Write a blog post that discusses your content or announces it to the crowd. Link to the page where readers can find your locked-down content, and give them a place to comment where they can’t dilute your SEO.

A Fast, Clean SEO Machine

Speed is of the essence. That goes double with search-engine crawlers. They have a lot of work to do in a day. Why not make it easier for crawlers to get into your site, scan it and give your blog the stamp of approval?

Clean up your blog. Cut down the loading time. Sweep the dust away, reduce the clutter and get an edge.

Don’t know how to clean up code and fix broken plugins? Hire a coder to perform the housekeeping – it’s well worth the expense.

Want to know how dirty your coding might be? Check the errors of broken code using a site validator. This tool gives a good indication of whether your blog needs a good spring cleaning.

Want more great tips on rocking your SEO the fast, easy, lazy way? You’ll find them here at WordPress SEO: The Definitive Guide to High Rankings for Your Blog.

WordPress offers the capacity to add great plugins that maximize your blog to its fullest potential – and beyond. There are plugins for just about anything you’d like to do with your blog. 

Here are some essential plugins you should have installed, and some extra plugins worth including in your setup as well:

Askimet Anti-Spam and its Auntie

Spice is nice, but not on your blog. Unless you want links to questionable sites peppering the bedroom of your comment section, you need protection. 

The Askimet plugin compares comments to Askimet’s database of no-nos and sends undesired comments to moderation instead of publication. You have the option of agreeing and marking the comment as spam or allowing the comment to pass through. 

Want to make spam moderation even easier? Load up the Firefox browser, install the Greasemonkey extension and add the Askimet Auntie Spam script.

All-in-One SEO to Go

You can build it, but no one will come unless you make sure people can find your site. 

Make it easy for search engines to find and return your blog’s URL to searcher and surfers with the All-in-One SEO Pack plugin. This plugin lets you set your title text, add meta descriptions to your posts, generate keywords from your content and helps you avoid the duplicate content penalty. 

If you’re moving your blog to a new domain, optimize the chance people will find you by adding the Redirection plugin, a handy little tool that helps you redirect visitors arriving at your old site to your new site. The plugin also helps you monitor those nasty 404 page errors.

Burning Feeds with Feedsmith

Blogs are all about gaining readers, so you need to let people to get your content the way they want it. Adding RSS feed capacity helps visitors sign up and read your latest posts in their feed reader.

Opt for Feedburner, the most popular feed burner out there. It’s easy to use, quick to set up and handy to have on your blog. But you’ll need to install the Feedburner Feedsmith plugin to make your feed deliver properly.

Getting Sociable

The more people love your blog, the more they’ll tell others. Make it easy for people to spread the good news by offering social media options on your blog. 

The Sociable plugin puts nice little social media buttons beneath each of your posts. Readers can enjoy and then click a button to tell their favorite social media friends to come take a look. 

Many bloggers swear by StumbleUpon to send huge spikes of traffic, and this nice little plugin encourages readers to click and share. 

Digg users like to have their own button, too. The Digg This plugin lets you post up those shiny gold squares to highlight some Digg shoveling. 

Subscribe to Comment Heaven

The more comments your blog receives, the healthier it appears. People love vitality and want to get in on the action of a great discussion. Help them do that with comment options that increase conversation in your comment section.

Start by installing the Subscribe to Comments plugin, a nifty little checkbox that commentators click to receive new comments via email. It lets people stay on top of discussion, read what others have submitted and click through to come back and add more thoughts. A must!

Show a little love to your commentators, too, and help discourage link dropping. The Comment Luv plugin picks up the title of the person’s last post on their blog and displays it with their comment. 

A typo? No problem. The WP Ajax Edit Comments plugin lets commentators have a few minutes to correct typos of published comments, clarify a sentence that could be misunderstood or choose better words to say what they mean.

Sidebar Savvy

Your sidebar offers plenty of potential to make your WordPress blog more functional, interesting and most importantly, sticky. After all, you want readers to hang around longer, don’t you? Try these plugins to encourage traffic to stay.

Keep readers reading by installing the Recent Posts plugin. This handy plugin displays links to your latest posts and gives readers choices of what to read next. 

Put another brick in your wall with the WP Wall plugin, a must for people who love graffiti. This plugin lets people scribble a quick word on your wall to make it a lovely collection of compliments and kudos. (And in case they leave nasty words on the Wall, you’ll have moderation powers to wipe the writing away.)

Everyone loves being tops. The Top Commentator plugin highlights the commentators that say the most on your blog. It also adds a little competition, too, as top commentators jostle to win first position.

Put comments in the spotlight too, by adding the Get Recent Comments plugin. It lets you capture recent comments, control display options and shows your blog is full of vitality and great conversation.

A Little More Action, Please

When you’re blogging for business or need to turn hits to sales, make it easy for people to contact you. People need to be able to reach you with questions about your products or hire you for your services, after all.

The cForms II plugin lets you install a super contact form on your blog. You can stylize it for great looks, optimize it to help filter questions and create dynamic forms for your needs. In a word, it’s awesome.

WordPress Upgrade Away

Change is inevitable, and usually, it’s for the better. WordPress engineers are constantly tweaking the platform and releasing new versions that just get better each time. 

Stay on top of changes by installing the WordPress Upgrade plugin, a neat little friend to help you upgrade your WordPress version in five quick steps without having to fiddle with any files. Now how easy is that?

You get changed. We promise not to peek.

We’re proud to announce the release of our first free WordPress theme, Changing Room.

The theme displays a friendly holding page to let visitors know that you’re busy getting dressed up. It also gives them the chance to subscribe to your feed before you’ve launched. Changing Room features:

• Colour switcher (choose between red or blue)
• Customisable “please excuse us” text.
• FeedBurner RSS and Email support
• Fully valid code (would you expect anything less?)

Wave goodbye to “coming soon” text on a boring white background. Download Changing Room today for free and get dressed in style.

Support Wordprezzie

Our Changing Room theme is free — we don’t even include a nasty link to our site in the page footer.

If you like the theme, please consider supporting our hard work by writing about us on your blog or site, or purchasing one of our growing number of pro themes. Thanks! We really appreciate it.

A note about the illustration

The positively pedantic among you will notice that the sign illustration we use in this theme came from a collection of icons on iStockPhoto.com

Don’t worry – we paid the big fat tax for unlimited electronic distribution so that you don’t have to buy the image to use it. (We’re lovely like that.)

Go forth and get changed! A quick installation and settings guide follows.

Changing Room Theme Guide

This quick guide should tell you everything you need to know. If you’re stuck, head over to our support page for help. 

1.0 Installing the theme

1.1 Checklist

To install the Changing Room theme, you’ll need the following:

1. A web hosting account with the latest version of WordPress
2. An FTP application to upload your files
3. The zip file containing the Changing Room theme files.

If you need help installing WordPress, detailed instructions are here. 

1.2 Uploading the theme

Unzip the “changing-room.zip” file we sent when you, and upload the “changing-room” folder to the /wp-content/themes/ directory using your FTP application.

1.3 Activating the theme

To activate the theme, log in to WordPress, click the “Design” tab, followed by the “Changing Room” icon.

In WordPress 2.5 or below, the theme is now active. In WordPress 2.6 or higher, you’ll see a preview of the theme first. Click “Activate Changing Room” in the top right corner to make the theme live.

2.0 Choosing your colours

Changing Room comes with a choice of two simple colour schemes — red or blue. To switch between them, follow these steps:

1. Log in to the WordPress admin 
2. Click the “Design” tab, followed by the “Changing Room Options” link.
3. Where it says “Choose a colour”, select red or blue from the drop down.
4. Scroll down and click “Save changes” near the bottom of the page. 

3.0 Customising your message

All of our themes include easy-to-use options that let you customise your site with little to no programming knowledge.

Changing Room lets you edit the header text, title, and body copy on the page, as circled in the image below:

The “Changing Room WordPress Theme” text comes from your blog title. To change it, log in to your WordPress admin, click the “Settings” tab and change your “Blog Title” text. Remember to scroll down and click “Save Changes” when you’re done. 

The “Please excuse us…” and “While you’re waiting…” text can be edited in the theme options. Click the “Design” tab, followed by the “Changing Room Options” text. Edit the “Heading Text” and “Body Text” fields, before scrolling down to click “Save changes”.

4.0 Adding FeedBurner links

Changing Room lets you add your FeedBurner links and invite visitors to subscribe by RSS or email. This step is optional: if you don’t use FeedBurner, Changing Room simply uses your default feed and hides the Email feed option.

4.1 Where to find your FeedBurner URLs

You can find your RSS URL by logging in to FeedBurner, clicking “My Feeds”, clicking the name of your site, then clicking “Edit feed details” and looking for the “Feed Address” box.

To find your email URL, log in to FeedBurner, click “My Feeds”, click the name of your site, then click the “Publicize” tab followed by the “Email Subscriptions” heading on the left. You’ll see a “subscription management” page containing code with a “feedID” link which looks like this one:

http://www.feedburner.com/fb/a/emailverifySubmit?feedId=1234567

This is the link you’ll use for the “FeedBurner Email URL” in step 4.2.

4.2 Adding your FeedBurner URLs

To add your FeedBurner links click the “Design” tab on the WordPress admin page, followed by the “Changing Room Options” link. Then add your full FeedBurner URLs to the “Feed Settings” boxes before clicking “Save changes”.

Make sure that both URLs begin with “http://”

Crackers are people too.

Unfortunately, they’re the wrong type of people; the ones who’ll look for ways to break a site and suck all your hard work into oblivion, all because their imaginary girlfriend dumped them for a PlayStation 3 while they were busy zapping goblins with their level 32 Warlock.

If you’re using the latest version of WordPress, you’re already more secure than many, but there are still ways to be safer. Use these 8 tips to keep your self-hosted WordPress site safe. Note: most of these tips apply to general web development too.

1) Prevent directory listing

The problem

In many cases, the default WordPress installation allows hackers to use their web browser as a file browser to look through the contents of the folders on your server.

Why is this bad?

Normally it’s pretty harmless – some web hosts don’t even bother to turn off directory listing by default. Sadly, this means that there are several things hackers can do:

a) If plugin and theme authors have made mistakes in their code that allow unexpected access, hackers can use your directory listing to find out if you’ve got those vulnerable files and then attack your site.

b) Nosey people can browse the non-WordPress contents of your web server to discover folders and projects that you might not be ready to announce, or which contain files that you thought weren’t accessible to the general public.

c) Many directory listings feature a line in the footer telling visitors your server version. Hackers can cross-reference these version numbers with lists of known vulnerabilities and bring your site down or gain illegal access. (Yes – there are other ways to find out what server software you’re running, but lets not make it too easy!)

Check if your site’s affected

Type your WordPress URL into your browser address bar, followed by
“/wp-content/plugins/” like this:

http://wordprezzie.com/wp-content/plugins/

If you see a blank page or get redirected to a 404 (file not found) page, you’re almost certainly safe. If you see a list of filenames displayed as links, get out your bandages and use one of these two fixes:

The weak fix: add a blank index.html file

Note: This simple fix is for non-geeks only. If you’re happy editing .htaccess files, skip to “the geek fix”.

To do the weak fix, simply create a blank file in both your /wp-content/plugins/ and your /wp-content/themes/ folders using your FTP application, and name it index.html. Now visit those locations in your web browser – you should see a blank page instead of a list of files.

It’s good, but it’s not flawless. While hackers won’t be able to see what’s in your /themes/ and /plugins/ directories any more, they’ll still be able to see the contents of any folder that doesn’t have a blank index.html, which includes subfolders and other areas.

You could just put a blank index.html file in every folder on your server, but it’s a bit of a pain, isn’t it? Wouldn’t it be great if you could prevent people seeing inside all your folders using one line of code? Want the good news? You can!

The geek fix: edit your .htaccess file

This is the safest and fastest fix, which requires a tiny bit of geekery.

You need to edit the .htaccess file that lives in your WordPress root directory. (Make sure you’ve set your FTP app to “show hidden files”. If you still don’t see an .htaccess file, create it now in the WordPress root, which should contain a file named wp-config.php).

Next, open the .htaccess file in a text editor, add the following two lines to the bottom, and save the file.

# Prevents directory listing
Options -Indexes

That’s it! You’re done. Browse to the /wp-content/plugins/ or /wp-content/themes/ URL in your browser again. You should find yourself redirected to a 404 page instead of seeing a list of your files.

Why doesn’t WordPress block directory listings by default?

It’s a good question. The answer is that it’s down to webmasters and web hosts to secure their own sites and servers. That means you.

But not everyone’s a web whiz. We think there should at least be a blank index file in the plugins and themes folders by default. We’ve submitted the suggestion in the WordPress ideas forum. If you want to support it, head over there and give the idea a rating to make your voice heard.

If you don’t have a WordPress.org forum account, you can register for one here. Alternatively, you can send the developers an anonymous note on the WordPress kvetch page. (Keep it polite! They’re a great bunch who give up their time for free.)

2) Use SFTP instead of FTP

The problem

Plain old FTP isn’t secure. If you use an FTP application to connect to your site, you’re sending your password in plain, human-readable text every time you log in. Hackers have ways of ‘listening in’ to intercept that information, which they can use to gain access to your site via FTP.

The fix

Start using the Secure File Transfer Protocol (SFTP) in place of FTP when you access your site. Connecting by SFTP is simple, and good web hosts (like Eleven2) will have it turned on by default. All you need to do is ask your hosting company which port number to use, then change the settings in your FTP application.

If your host doesn’t support SFTP (or something called FTP over SSH), or if they require you to jump through burning hoops to switch it on, just change your web host. FTP is unsafe, and it’s over 23 years old. In computing terms, that’s ancient! It’s time to update to a new standard. That standard is SFTP.

3) Stay up to date

It’s important to keep your themes, plugins, and WordPress installation up to date. If you’re using WordPress 2.6 or higher, updating your plugins is easy. For your theme, make sure you’re subscribed to the theme developer’s site — they should announce any updates that affect security.

To keep WordPress itself up to date, we recommend the automatic upgrade plugin, which streamlines the process a little.

4) Learn the correct file permissions

You probably shouldn’t be messing around with file permissions once WordPress is installed, but just in case you’ve meddled with them and want to double check, here’s a quick primer:

WordPress permissions

All folder permissions should be set to 755. Files should be set to 644. Files that you want to edit in the WordPress Theme editor should be 666. Never use 777 for WordPress permissions – you’re letting all users on the server do whatever they want with your site. On a shared or badly configured server, that can mean trouble.

If that was gobbledygeek to you, move along. Your life is probably better off without this stuff.

5) Keep WordPress visitor registration turned off

By default, WordPress installations don’t allow visitors to register for a guest account on your site. While there are advantages to this if you’re building a community site, it’s best to keep registration turned off if you can, since some of the latest exploits use it to hack WordPress. (It’s fixed in the latest version.)

To check that you’ve got registration turned off, log in to your admin area, click “settings” and be sure that “anyone can register” is unchecked next to the “Membership” heading.

6) Limit WordPress admin access by IP address

The problem

Right now, anyone with web access can visit your WordPress login page and take a guess at your admin password. If they get it right, they’ll have full control of your site.

The fix

Restrict the WordPress admin folder to allow access only from your computer, or a small group of computers. To limit access by IP, create an .htaccess file in your /wp-admin/ folder (not directly in your WordPress root!) containing the following code:

order deny,allow
deny from all
# allow my home IP address
allow from XX.XX.XXX.XXX
# allow my work IP address
allow from XX.XX.XXX.XXX

Don’t forget to replace the Xs with your IP address, which you can find using a site such as What’s My IP when you’re at the computer you want access from.

Once you’ve done this, visitors without the allowed IP address will see a 404 message if they try to access your admin area or login. Try accessing the Wordprezzie admin area to see it in action. You should see an error page (unless you’re on our computers, which are kept at the bottom of a well). Credit where it’s due: I adapted this tip from Matt Cutts’ suggestion, which is here.

You should know that IP addresses can be reassigned by your ISP without warning, so use this tip with caution unless you’ve paid for a static IP. Don’t worry, though – if you find yourself locked out, you’ll still be able to gain access by SFTP (you are using that, right?) to delete or edit the .htaccess file with your new IP.

Note: If you travel a lot, then this tip’s probably not for you. Consider password protecting /wp-admin/ at the directory level instead so that you’ll be able to access it wherever you are using an additional password. Most hosting control panels have an option to add a password to a folder, or you can search the web for “htpasswd”.

7) Encrypt your web browsing session

This tip is for security nutcases and the ultra-paranoid only. You can encrypt your entire browsing session so that your WordPress login info is sent over the net as a scrambled message when you log in to your admin panel, rather than in plain text.

It’s a little fiddly to set up, but it’s probably the strongest way to make sure your password isn’t intercepted by those nasty packet-sniffing web addicts who lurk in dark alleys on the net. To get started, check out this guide on Lifehacker.

8) Use your common sense

Finally, three points of common sense:

Don’t use stupid passwords. We help a lot of people tweak their established WordPress sites, and we’re still amazed by the number who use terrifyingly simple passwords.

One high-profile blogger was using their domain name as the WordPress admin password. (We changed it for them – no point trying to guess who or what it was!)

To change your password, go to the “users” tab, click the username that you use to log in with, scroll to the bottom of the page and fill in a new password, then click “update profile”.

Be careful in public places. I once watched a blogger accidentally type his password into the username box whilst live on a 5 metre screen and presenting to 200 people. If you’re out and about, be careful. Likewise, don’t leave a logged-in machine unattended; you’re asking to get stung.

Back up often and have a recovery plan. We’ll be writing more about this soon, so subscribe and stay tuned!

If you only have time for one

Don’t have time to do everything in this list? Take our advice: change your password to a stronger one (see point 8 for the instructions). It should be at least eight characters long and include numbers mixed with characters in uppercase and lowercase.

If you can find it in a dictionary, you’re using the wrong password. If it’s the name of your dog, daughter, or dentist, you’re using the wrong password. “Secret” is a poor choice. So is “letmein”. So is “motherducker”. Even if you think it can’t be guessed, chances are that you’ll be unpleasantly surprised. Choose a mixture of random letters and numbers and you’ll be much safer. Can’t remember all your passwords? Try PassPack.

Need help? Just ask us

Don’t forget! We offer design, coding and security help if you need it, starting at only US$80 for quick fixes, tweaks and code help. (That includes messing around with your .htaccess files if you don’t feel brave enough!) Hire us here.

Add your own tips below

Got a WordPress security tip you’d like to share? Help us all stay safe by adding your comments below.

Your blog comment section doesn’t have to be boring. In fact, all the action happens down there, and the more discussion going on, the better.

Make that section a fun place for readers to hang out and kick back. Trick out your comment section with these easy plugins and cool comment styling tips for some color, a little interior design and a touch of flair.

Go on. We dare you.

Comment section plugins

Let’s start with the easy stuff. If you don’t want to touch the theme coding but you’re happy to upload a few handy plugins, these two popular plugins are the best choices for you:

Highlight Author Comments lets you stylize the author’s comments so they become easily distinguishable to readers when he or she comes down to hang out in the comment section.

Gravatars are personalized avatars that show up next to each comment, letting commentators feel special and have a unique look. They also let people scan the discussion quickly to see who is participating.

Stylizing your theme coding

If you’re feeling brave (come on, it’s not that bad), you can delve into changing a little bit of the theme coding for some extra bling.

Note: It’s a good idea to backup your original code before you change anything – you never know when you might need it.

Get the beginner’s A to Z with Nettuts. They unravel the secrets of the comment.php file to show you everything you ever wanted to know about comment sections. You’ll be a comment-coding whiz by the time you’re done reading!

Nettuts also covers some of the most popular code tricks for comment sections, including Gravatars, numbered comments and alternate colors.

5ThirtyOne is next on the list, with coding tweaks to identify comments and stylize author comments or author and guest comments. Highlighting more than one author’s comments is perfect for multi-author blogs.

If you want an extra-special comment section, Darren Hoyt gives easy instructions for css styling tricks for three fun looks. Go for Green Gravatars (or choose another color), the Speech Bubble (a fun choice) or pick Alternating Arrows that each point down to the next comment.

Extra plugins for extra comments

Don’t stop there. Give your comment section some tender-loving care with these extra plugins that come in handy:

Threaded Comments helps to keep conversations on track with comment threading. (If your blog has many comments, though, this may get a little messy. Try Comment Remix for easy “@reply” links instead.)

Show some love for your commentators with Comment Luv, a popular plugin that displays a link to the commentator’s last blog post.

Last but not least, don’t forget the Subscribe to Comments plugin, a feature that lets commentators stay updated on new comments to keep them participating in the discussion!

Don’t miss out — subscribe now!

Got ideas for free themes?

If you’ve got an idea for a theme design that you’d love us to release for free, we’d love to hear from you. Leave a comment below.