To read more about what happened, check out the coverage on the WPSecurityLock.com blog.

This hack hit me particularly hard, affecting five client sites — three that were live and two more that were being built.  Fixing the problem was time-consuming but not terribly difficult once I figured out the problem.  I’m not writing this post to compete with other coverage of what happened or how it happened.  What interests me from a PR perspective is GoDaddy’s response to this attack.  Here’s the statement from them that has been posted in many places:

Measures are in place to protect the overall security of the shared hosting server on which your website resides. The compromise of your account is outside of the scope of security that we provide for you. Virus scans are performed on the content that is hosted, but they may not pick up everything, largely due to the fact that hackers tend to upload custom scripts which are not picked up by traditional malware scanners. However, if a virus is detected, you will be notified. The overall security of your password and the content within your account is your responsibility, as password compromises and compromises due to scripting can only be prevented by you.

I don’t know who crafted this statement or who it was even directed to, but it doesn’t appear to me that it was crafted by someone with much experience in crisis communications.  First, it’s all I’ve been able to find from them on the issue.  Second, it reads to me like, “We just host your site … we’re trying to figure out what happened, but it’s really your own fault.”

While I agree that, in the end, the security of a site is the responsibility of the site owner, to say that when hundreds of site owners are really ticked off is not a great idea.  Additionally, there’s nothing that can be easily found on the GoDaddy site that addresses the issue.  My experience with GoDaddy has been that their customer service is quite good and their downtime is minimal, but GoDaddy has many detractors.  Here’s an example of what you see on Twitter right now:

These comments are relatively mild compared to what you’ll see in comments on blog posts about this hack attack.

How would I have handled it?  First, a more sensitive statement would have been issued — something that addressed how the company values its customers and is working very hard to figure out how the sites were hacked.  That statement would have been posted on the front page of GoDaddy, as well as on the company’s popular Twitter account.  Regular updates would have also been posted, even if there’s really no progress to report.  Additionally, instructions like those found at WPSecurityLock would have been made available by GoDaddy.  This is all relatively simple stuff to do.

These days people understand that hackers are out there and it isn’t necessarily the fault of the company that made an operating system or is hosting a web site, AS LONG AS the company responds to it appropriately.

UPDATED 5/3/10: There was another attack this past weekend, one week to the day after the first one.  It hit (it appears) most of the same sites plus some non-Wordpress sites.  The word from GoDaddy is that the non-Wordpress files that were infected were actually part of a site that included some WordPress element.  That’s not the word (pardon the pun) we’re seeing, as many people have come out and said their sites got hit, and WordPress isn’t on their server.  GoDaddy HAS responded this time, with some infection removal procedures.  They’re recommending those who were infected back up their database and customized files, delete WordPress, and reinstall the software.  This doesn’t seem to me like a viable option, as all PHP files on infected sites were affected, and many of the customized files are PHP files.  That said, at least they’re responding publicly now .. however weakly.

I worked the company’s owners from the very start of the process, consulting on the best URL to purchase and where to buy their web hosting.  I even set up email accounts using their new web address!  The site itself was built using WordPress as a CMS, much like I did with my own recent redesign.  The website includes a blog, which they plan to populate with company and vendor news.

Check out the results here: www.corporateapparel-inc.com

And, if you’re looking to purchase corporate apparel for your business or event, please contact them.  In addition to providing great products, they’re great people too!

As you might know, I recently redesigned the EndGame Public Relations website, moving it from being html-based to php-based and using WordPress as its content management system (CMS).  The site was ranking extremely well for the keywords I targeted, falling in the top five on Google and Yahoo for all of them.  Shortly after the redesign, however, I found that every time Google re-indexed my site, a few more of my pages would disappear from the rankings for my keywords.  I figured they would return shortly and made a few moves to speed up the process.

After two weeks of wondering when my site would return to the rankings, I finally figured out the problem.  WordPress was blocking Google and other search engines from actually SEEING my site!  By default, WordPress is set to full privacy mode.  What this means is that your website will be accessible on the web, but Google and other search engines will be blocked by a file called robots.txt.  This “robots” file tells the search engine spiders which pages they should and should not crawl.  It can be useful at times, but in my case it was a massive SEO roadblock in my website redesign plans.

So, if you build a new site using WordPress, or you convert a site like I did, when you’re done go into your WordPress panel, go to settings, select privacy settings, and make sure it’s set so that everyone can see you … including the search engines.  WordPress will then automatically remove the roadblocks from your robots.txt file.

FYI, if you read this and realize you made the same mistake I did, here’s what you can do: First, download a WordPress plugin called Google Sitemaps Generator.  It generates a sitemap in Google’s preferred format, and then notifies the search engines that the sitemap has been updated.  Once you’ve done that, go to Google Webmaster Tools and make sure Google knows your sitemap is there.  Those webmaster tools are quite helpful, letting you know when your site was last crawled and if there were any troubles.  In fact, my check over there was what finally led me to figure out why my rankings were in the toilet!

[Edited to add on 8/25: My rankings are starting to creep back to where they were! Huzzah!]

First, the basics: To turn your WordPress blog into a website, first create a page that you want to be your home page. Then, create a page that you want to be your blog page. The blog page that you create should be blank, because the space where you’d enter information will actually be where your blog posts go. Once you’ve done those two things, go into your admin and go to settings/reading. You’ll see a place where you can designate your site as a “static site”. Use the dropdowns to pick your home page and blog page. That’s it! You’re done! It’s amazing that it’s so easy.

Now, here’s a look at what I’ve learned from my experiences with this site and my client site:

1. Even though it SEEMS like you have to have the same sidebar on each page of your site just because of the way the software works, that’s not the case.  The way I found to get around the sidebar issue is to use different templates for various pages. First off, I think the best way to go is to eliminate the home.php template if your theme comes with one. It creates more problems than it solves. The reason for this is that if it exists, by default your designated home page (the one you set in the WP admin as the home) and your designated blog page will BOTH use that home.php template. If you eliminate it, the blog will default to using index.php as its template, and the homepage will default to the page.php template. You can then make another template for your home page if you want it to look different from other pages on the site. You can then set different templates for different pages, you can build them with different headers, sidebars, etc. To select different templates, use the dropdown at the bottom of the admin when you’re writing a page.

   The only downside of this approach to having different sidebars is that you can’t use widgets on all of your pages … just one. What I did was eliminate the code for including widgets on all except my blog page. Then, I just included in the templates whatever I wanted to put on the sidebar on other pages. The non-blog pages all have the same sidebar in my case, but that doesn’t have to be the case.

2. It is very possible to make a page on your site that looks nothing like the rest of the site. You can see an example of this by looking at this news release for client Save Our Shelters. The page has a different header, no sidebar, and a different background. It doesn’t look anything like the rest of the site, really. I did this because I wanted my news release pages to look more plain and non-fancy. Really, it looks more like my old html site than this one. The way I did this was by creating a new “div” call in the CSS that dictated what that page would look like, and then created a template that uses that “div”. For ease of use, I also included the link back to the EndGame PR News. page, the contact information, and the social bookmarking and RSS details. That way when I want to post a new news release, all I have to do is copy, paste, and format the text. I’m loving it!
3. WordPress does have some limitations that I’m hoping are fixed in future releases.  I had hoped to automate certain things that I had to do by hand with my previous html-based website.  Top on my list is making the front page “Latest Releases” section and my news page update automatically when I post a new news release.  This could be done if I posted my news releases on this blog, but I don’t want to do that because I want to use a custom template for the news release pages, and because I don’t want to clutter up this blog with client news — that’s not what this blog is for.  So, instead, each news release has its own page.  WordPress doesn’t handle pages as well as it handles blog posts, which makes sense when you consider the history of the software. I’ve tried using plugins that allow you to designate categories or tags for pages (which the software by itself doesn’t allow) but the pages aren’t fully tagged or categorize like blog posts. If anyone has a way to do this that will work, please let me know!

Here are a few plugins that you should consider that will help you handle your WordPress website better:

• Pages+ helps you manage a large number of pages better than the standard WordPress admin
• tags4page allows you to use tags on pages, just like you can for posts. While it doesn’t do what I’d hoped it would, it does help quite a bit with organizing your pages for feeds, etc.
• Page Category Plus allows you to use the same categories with pages that you can use for blog posts. Once again, didn’t do what I’d hoped it would, but it helps with organization.
• PJW Page Excerpt lets you control the excerpt used for pages, like you can with a blog post. This is particularly helpful when you’re making a feed from a page tag or category, like I am with my news releases.
• All in One SEO Pack is something you should install for every WordPress website or blog.  It lets you set the page or post name, description, and keywords.  It’s outstanding control for SEO elements.

To sum it up, I’ve learned that using WordPress as a CMS is an outstanding way to build a static website. I’m hoping to create more client pages like this one, and will let you know when I do!

1. This website hadn’t had a true redesign in about two years.  That’s an eternity on the Internet.
2. The original design was done in standard html with no stylesheet.  That means it was a bear to update.  This design is managed using WordPress as a content management system, or CMS.

This design is an improvement over the previous site for several reasons.  First, it’s easier to manage.  Second, content is organized much better because it’s all on the same platform and the front page is a much better design than I had previously.

I’m going to write a post about using WordPress as a CMS in the near future, because it’s very exciting.  For now, however, I’m still working on completely finishing everything on endgamepr.com.  I apologize if you find a loose board or dusty corner here and there, as it’s quite an undertaking to port over a several hundred page site (including news releases).  I hope you enjoy the design, and I encourage your feedback!

[Updated 8/9: I'm continuing to tinker with the design and functionality of the site. One of the main things I'm doing is trying to automate things that I had to do by hand with my html version. The news archives page now updates as soon as a new release is posted. Unfortunately I'm having trouble getting my news page and the news headlines on the front page to do that. WordPress is a great CMS, but it isn't perfect. There's no good way to work with pages like that. If I were to post all of my client news releases on this blog, it would solve the problem, but I really don't want to clog up the blog like that. For now, I have to update those two sections by hand.

Another thing I've done is worked to shorten up the copy on each page of the site, to more closely match the available "white space". I'm quite pleased with my expertise page. I replaced the descriptions of each EndGame PR capability with a small pop up that has that description. As a result, the page is merely a list, but I don't lose the descriptions that some people need.]

[Updated 8/6: The site is more or less completed now. I'm doing some tweaking and trying to figure out how to automate some of the things I had to do by hand on my old html-based website. Now that the database issue is behind me, I'm absolutely loving WordPress as a CMS]

[Updated 8/5: Due to massive slowdowns and database errors, I took the drastic step today of deleting the WordPress database, uninstalling WordPress, and then re-installing everything.  The site is running like a CHAMP now!  I just added what I think might be the last page -- the video podcast client samples page.  I'm going to run through my old site files and see if there's anything I missed.  If not, I can finally remove the "under construction" sign and fully open the site for business!]