The following SQL can be used to delete the old post revisions and free up some space for your database.

DELETE a,b,c
FROM wp_posts a
LEFT JOIN wp_term_relationships b ON (a.ID = b.object_id)
LEFT JOIN wp_postmeta c ON (a.ID = c.post_id)
WHERE a.post_type = 'revision'

Of course, it’s a good idea to back up your database prior to deleting anything.

If you don’t want or need post revisions, you can add this line to your config.php to turn them off completely.

define('WP_POST_REVISIONS', false);

Here are some relatively simple steps that should help ‘toughen up’ your WordPress installation:

Don’t use the “admin” account.

Either change the username via MySQL

UPDATE wp_users SET user_login = 'username' WHERE user_login = 'admin'

*where “username” is whatever you want to call it.

Or, create a new/unique account with administrator privileges and delete the original admin account.

From WordPress 3.0 you can set the administrator username and password during the installation process, which is a good step forward.

Use secure passwords.

Use strong passwords to protect your website from dictionary attacks. WordPress will tell you when your password is strong (the admin interface for users has a password strength indicator).

Don’t restrict your strong passwords to the WordPress installation, do the same for FTP, SSH and MySQL as well.

Update the folder permissions on your WordPress files.

A good rule of thumb is to set the following permissions:

Files should be set to 644
Folders should be set to 755

If these settings are too restrictive, i.e. you can’t upload files, change the permissions to increase the privileges (e.g. 775 or even 777).

Remember, permission levels vary depending on your specific server configuration, but you can generally set them to the desired level quite easily via FTP or SSH clients.

For example, with SSH:

find [your path] -type f -exec chmod 644 {} \;
find [your path] -type d -exec chmod 755 {} \;

Move the configuration file (wp-config.php).

From WordPress 2.6 it became possible to move the configuration file up a directory and out of the WordPress root folder.

For example, if WordPress is located in the following directory:

public_html/wordpress/wp-config.php

You can move it to the following directory:

public_html/wp-config.php

WordPress automatically checks the parent directory if the configuration file is not found in your website’s root directory.

This makes it nearly impossible for anyone to access your configuration file as it now resides outside the website’s root directory.

Move the wp-content directory.

Like the configuration file, WordPress 2.6 added the ability to move the wp-content directory to another location.

Once moved, make two additions to the configuration file to identify the new location:

define('WP_CONTENT_DIR', $_SERVER['DOCUMENT_ROOT'] . '/blog/wp-content');
define('WP_CONTENT_URL','http://domain.com/blog/wp-content');

You may also need to define the new location for plugins:

define('WP_PLUGIN_DIR', $_SERVER['DOCUMENT_ROOT'] . '/blog/wp-content/plugins');
define('WP_PLUGIN_URL','http://domain.com/blog/wp-content/plugins');

If hackers can’t find your wp-content folder’s location, clearly it becomes far more difficult for them to hack it.

Stay current with all updates.

The main WordPress installation files, plugins and themes can be updated easily via the admin interface. Make sure you do so each time a new version of either are released.

For plugins, the plugin change log makes it easy to see what has changed and therefore ensure compatibility with your version of WordPress.

Remove the WordPress version information from your header.

Viewing source on most WordPress websites will reveal what version of WordPress the website is running.

<meta name="generator" content="WordPress 3.0.1" /><!-- leave this for stats -->

This helps hackers find vulnerable blogs or determine ways to hack a particular version.

To remove, find the code shown below in your header.php file and delete it:

<meta name="generator" content="WordPress <?php bloginfo('version'); ?>" /><!-- leave this for stats -->

The wp_head function also includes the WordPress version in your header. To remove, include the following line of code in your theme’s functions.php file:

remove_action('wp_head','wp_generator');

Use secret keys.

A secret key is a hashing salt, which makes your website harder to hack by adding random elements to the password. These secret keys are found in the WordPress configuration (wp-config.php) file.

Visit the following URL to get the secret keys: https://api.wordpress.org/secret-key/1.1/salt/

Replace the following in the configuration file

define('AUTH_KEY','put your unique phrase here');
define('SECURE_AUTH_KEY','put your unique phrase here');
define('LOGGED_IN_KEY','put your unique phrase here');
define('NONCE_KEY','put your unique phrase here');
define('AUTH_SALT','put your unique phrase here');
define('SECURE_AUTH_SALT','put your unique phrase here');
define('LOGGED_IN_SALT','put your unique phrase here');
define('NONCE_SALT','put your unique phrase here');

With the generated keys (example only):

define('AUTH_KEY','*QCT0a,T+3hxeg)ti7k}#~<AQSmm&x+ff=*$d:)<-;+!a?yS{ArmuR-#*GyLCgI)');
define('SECURE_AUTH_KEY','[)|y._i~B5js,h3@4%M[<l:DJ&]Ou$2|n(e?DJ`+R4pk6um/6zS%6@@i{^N-6(4]');
define('LOGGED_IN_KEY','@+l2X{3wvy/1K[zRm|P_r;WixJ:,>V&JL![gyJq ?b[Wf.W|U_MKutdrL*$l][-S');
define('NONCE_KEY','T$R>#*2)2kO?NIr&o|>[L>T5%YGd^yJ+eE$7wkcL-?1v]-X*{f`Pg)NZqKU}^e8R');
define('AUTH_SALT','<8JD%+O!t.F%]6RaO9L_MI<w2Lw_-Bc5u_(WDdPoO0D;j9zwu*?1i{%nH/RBjF6J');
define('SECURE_AUTH_SALT','oS|EP&Pm`bf8iG!C<X8#yFG%8J)x G+3M`wRBtp#]7)&hj}ZV/p> yh-BtbBRbTk');
define('LOGGED_IN_SALT','tW4|J/m|habEJ+BTvF0PfpuiOgf-6,dIav-5K|FTM$&Agy;FqDjp|5Ci7>nJFD/#');
define('NONCE_SALT','T-v&f++w!c%5zs2t8qH?,n,/WE&uWd--o4t{FL49/4e~|e+HV+.~A?JYZ1Ev<5)u');

You can add or amend the secret keys at anytime. This will invalidate all existing cookies and require users to login again.

Change the WordPress table prefix.

You can define the WordPress database table prefix in the WordPress configuration file. By default, the prefix is set to:

$table_prefix = 'wp_';

Change this to whatever you prefer.

If you already have a version of WordPress installed, you will need to manually amend the database table names in MySQL, or do a clean install and data import.

Force SSL on login and admin access.

Set the following option in the WordPress configuration file to force SSL (HTTPS) on the login and admin screens.

define('FORCE_SSL_LOGIN',true);
define('FORCE_SSL_ADMIN',true);

Use IP lockdown on the wp-admin directory.

Create an .htaccess file in your wp-admin directory with the following lines of code:

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "Access Control"
AuthType Basic
order deny, allow
deny from all
#IP whitelist
allow from 72.14.207.99
allow from 216.239.51.99

Where the IP address lines are whatever your chosen IP addresses are. Only users with these IP addresses will have access to the wp-admin folder and hence the admin part of the blog.

Resources:

• http://codex.wordpress.org/Hardening_WordPress
• http://codex.wordpress.org/Changing_File_Permissions
• http://codex.wordpress.org/Editing_wp-config.php
• http://codex.wordpress.org/htaccess_for_subdirectories

If you have any more suggestions, that don’t necessitate plugins, feel free to comment.

If you want — and this is the default setting for WordPress, themes and plugins — you can just download jQuery, put it on your server and link to it from your header.php file in the <head> section.

However, it is better to use the proper wp_register_script() function, which can be achieved in your functions.php file:

if( !is_admin() ) {
   wp_deregister_script('jquery'); 
   wp_register_script(
   	'jquery',
   	("http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"),
   	false,
   	'1.4.2'
   ); 
   wp_enqueue_script('jquery');
}

The reason we use the wp_register_script() is to ensure that WordPress and its themes and plugins are aware that the script has been loaded and therefore not to load an additional copy.

I have also used the is_admin() function to prevent conflict and therefore errors, in the WordPress administrator.

Of course, this method is not only restricted to jQuery, you can do the same for other popular JavaScript frameworks such as Mootools.

Further information on the wp_enqueue_script can be found on the WordPress Codex.

Commandments 1. Thou Shalt Blog (like crazy)

Blogging, although possibly now considered old school is a first priority. Set up a blog, a personal blog, a business blog, says Safko, It’s easier than you think. There are a multitude of Blog providers and software for self-hosting. My clear favourite is WordPress, which provides a hosted solution much like Blogger.com or GoingOn.com, or in my case, the software to setup and manage your own blog.

Commandments 2. Thou Shalt Create Profiles (everywhere)

Create profiles on the websites that interest you; do it now before someone else takes them. Once they are gone, they are gone forever. That’s commonly called cyber squatting. So get out there. If you have a personal brand, set up all the profiles you can against that brand, alternatively just use your name. For example, You can see my Google and Facebook profiles, the later of which has allowed me my own distinct URL. You can see more of my profiles via the links in the footer of my website. For the technically-minded, you can use Open Social to make filling in your profiles as easy as a click of a button.

Commandments 3. Thou Shalt Upload Photos (lots of them)

Upload photographs. You’ve got them, afterall you probably own the latest and greatest digital SLR from Canon or Nikon. Don’t upload the one with you with a lampshade on your head, that’s somewhat counter-productive; but other photographs? Absolutely; show your creativity and interests. Customers want to see and participate. You want to give people a face to go with your company. Sites such as Flickr, known for hosting some stunning photographs, are regularly used as a private area through which not only photographs, but product designs can be discussed and developed with clients. Photobucket is another example, albeit more consumer orientated.

Commandments 4. Thou Shalt Upload Videos (all you can find)

Safko, like many others, sees videos becoming an important part of business interactions: You all have got videos. I don’t care whether it’s training videos or customer videos, grab your video camera and go interview some of your customers. What’s better than seeing your customer’s smiley face on your Web site? And it doesn’t cost anything. Fortunately, much like the plethora of photo sites, there are some really great video websites out there. My favourite is Vimeo, but you could also use the more familiar and popular YouTube.

Commandments 5. Thou Shalt Podcast (often)

In my opinion this is a tricky one, much like video. Safko suggest if you’re too cheap to get a camera, use the free audio software that’s in your computer. That’s what I did. I created 48 audio podcasts. If you take the podcasts I did for my book and played them back-to-back, they run 24 continuous hours of interviews. You can do that. It’s free. It just takes time. But like video, people don’t necessarily have the time, budget or talent to produce relatively decent Podcasts. If you’re going to create decent Podcast, however, put them on iTunes where they can easily be found. If you have a smart phone, you could also try the AudioBoo and Qik, they are simply awesome at recording and publishing Podcasts and Videocasts respectively.

Commandments 6. Thou Shalt Set Alerts (immediately)

Set alerts. People are talking about you. You probably need to know what they are saying and you want to participate. A simple approach would be to use Google Alerts or Technorati and the soon-to-be-released Twitterati. If you have a greater concern, companies like Brandwatch dedicate their lives to spidering the web and garnering what they call company sentiment based upon conversations.

Commandments 7. Thou Shalt Comment (on a multitude of blogs)

Commenting is like going to a cocktail party says Safko, You wouldn’t walk into a networking event, walk up to a group of people talking, and tell them your name and what you do in your business. That would be rude and unacceptable. Listen first. Read the blogs and add comments. You can be controversial, that’s okay. But participate. Get involved. Many blogs allow comments and there is also a 3rd-party services, such as Disqus, that help you keep track of all your comments.

Commandments 8. Thou Shalt Get Connected (with everyone)

Get LinkedIn. Put it in your email that you have a LinkedIn account, you have a Facebook account, and that you have a Twitter account. Make it a part of your heading on your letterhead, because that’s how you propagate. That’s how you sell it.

Commandments 9. Thou Shalt Explore Social Media (30 minutes per week)

Explore social media. Safko suggests give it thirty minutes a week, that’s all I’m asking. Friday morning grab your coffee, lock yourself in your office, and give it thirty minutes. Just Google something. I promise you within the first 30 days you will be excited. You’ll be as excited as I am. You will get excited because of the ROI. I would contend that 30 minutes per week isn’t enough. Spend 30 minutes per day, exploring and keeping up-to-date with what is happening out there in the big-bad-world.

There are tools that make this a lot easier; they’re called social media aggregation or lifestreaming. FriendFeed is one of the best social media aggregation and discussion tools available, with numerous widgets and 3rd-party applications. It currently supports more than 40 social media websites. SocialThing allows you to see everything that’s going on with your friends on all of your social networks and allows you to interact with multiple sites at one time. Importantly, SocialThing interacts with the 3rd-party APIs, so data is sent to the source service, unlike FriendFeed. Alternatively, Flock is a web browser with a built in social aggregator, which allows you to interact with sites such as Facebook and Twitter. It is not as wide reaching as its online rivals, but does boast a blog editor, drag-and-drop image uploading and an RSS aggregator.

Commandments 10. Thou Shalt Be Creative (go forth and create creatively)

Safko’s final commandment is all about creativity; And the most important commandment is creativity. That’s all. It’s just creativity and having fun. But you know what, that’s what your customers want. They want to see transparency. They want to see authenticity. They want to see you having fun. They want to be able to relate and communicate.

In the dim and distant past, the job of publicising yourself was extremely difficult. Can you imagine life without the Internet, mobile telephones and email? How did people ever do business? With the advent of the World Wide Web and in particular search engines and blogging, this all changed and a wealth of opportunity has become available, especially to the freelancer.

But where do you start?

Create a Brand

Creating a brand is a great way to market yourself. This does not have to be the same as your company, and through time you may set up different brands for different sectors or ideas you may have. Brands serve to create associations and therefore, expectations of products you create, so a good brand name is a great way to get recognised in your community.

You can register the brand in the UK, Europe and the US, although the latter requires a US address. It is also not a given that your brand registration will be successful, making it a costly exercise. Careful consideration is what is needed here.

Create an Avatar

Avatars are images or icons that represent you in the online world. They are an extension of your brand. For example, the header of my website is also my favicon and avatar on various online services. It is a great way for people to draw an association between your online presence and you.

Create a Blog

Blogs are a great way to get yourself known and therefore heard amongst your peer group. Your blog should really be an extension of your brand and is a great avenue to showcase your skills, demo example applications, code and designs, or simply give your opinion on a subject.

I use the excellent WordPress blogging application, in a self-hosted environment. You don’t need to do this since there is a hosted version at WordPress.com, or you could use Blogger, another popular blogging platform, provided by Google.

The key to blogging is talk about what you enjoy, don’t just keep it technical. Blogs should be an extension of you, not an avenue for pretentious comment; you’ll soon be found out!

If you go the self-hosted route, you’ll need a domain name, hosting provider and obviously a blog application. I have listed a few below that can get you started.

Domain Names:

• Nominet
• Easily
• EuroDNS

Hosting Providers:

• HostMySite
• Titan Internet
• Flint Hosts
• UKHost4U
• 1and1

Blog Applications:

• WordPress (free)
• Moveable Type (free)
• ExpressionEngine (free)
• TypePad

If going the self-hosted is all too complicated for you or you simply don’t want the hassle that is associated with self-hosting, all is not lost. WordPress.com and Blogger are for you.

Blog Hosting Providers:

• WordPress.com
• Blogger

Both services take the onus away from the user when it comes to management (backups, plugins etc). At the simplest level, all you need to do is create and publish the content.

Join feed aggregators

To get noticed in the blogosphere, you can’t simply rely on the Google, Yahoo! and Microsoft search engines ranking your site. You will need to alert your peers to the fact that you’ve created some content that is worth reading. You can achieve this with feed aggregators.

Below I list a few that I use:

• Adobe
• Full-as-a-Goog
• ColdFusionBloggers
• Feed Squirrel
• London Bloggers

If you use WordPress, then you’re in luck. WordPress has a service called Ping-o-matic, which updates different search engines when your blog has been updated. You can also add your own services to ping and therefore notify the service of new content.

Comment on Blogs

Commenting on blogs is another great way of getting yourself known as well as offering an opinion. Since comments allow you to include a link back to your website, try and comment as your brand.

One tip, try not to be defamatory towards the blog owner, or others unless you have a strong justification for doing so. It’s all about the karma!

Join Micro-Blogging Services

If blogging is not your thing or you don’t have time to write articles, there are a number of blogging and, more importantly, micro-blogging services available to you that allow you to get your thoughts out into the wide-world.

Such services include the not-always-venerable Twitter, the feature rich Pownce, the new kid on the block Plurk and the blogging service, Tumblr.

Building a following will allow you to announce to your followers important events and ask questions of them.

What’s Next

In the next part of this series, I’ll talk about networking, a natural extension to publicising yourself on the web.

But there was something missing in my toolset; a WordPress app. Typepad have long since had one, so it was about time my favourite blog platform upped the ante!

Well, I’m glad to say, as of today an app has finally reached the Apple App Store that allows me to write posts: thank you Automattic.

In fact, just for good measure, this blog post has been written from the app.

The interface is intuitive and easy to use, although it does lack admin features, which for some may be a concern.

I’m sure I’ll get RSI if I continually blog via my iPhone, but for those moments when I’m caught away from a computer and desparately want to offer my 10 pence worth to the blogosphere, it’s a good tool to have.