What is CRON and What You Can Use It For?

“What the heck is a cron?” I field this question at least once a month from non-developers. It’s a great question. I’m going to break it into two questions though.

“What is a CRON?”
“What is WP-CRON?”

What is a CRON?

At its heart, a cron is a “time-based scheduler”. It handles tasks that need to be done on a regular basis and at a specific time. As an example, if you want your WordPress blog to display the weather forecast in the header, then each morning you need to go get the weather forecast. Yes, you could hire someone to log in each morning, go get the forecast and paste it into a widget.

A better plan is to have a program that runs each morning and talks to an API to fetch the day’s forecast and update your database for you. The program that runs your weather fetching program is called a CRON. The name is derived from “chronological” which roughly translates into “in order of time”.

Most systems these days have some concept of a cron. Unix based systems (Unix, Linux, macOS, etc.) actually have a version of a traditional cron. While some might put a nice graphical interface on them, they all boil down to a program named cron and a file named crontab.

The program cron is always running in the background and every minute it looks at the crontab and figures out if something needs to be done. If not, it goes back to sleep.

The crontab file contains when a program should be run and which program should be run. Each line represents a different task. They look something like this.

1 0 * * * ~/fetchForcast.sh

While this may look cryptic, all it is telling cron is that at 12:01 AM every day, run a program called fetchForcast.sh. Note that time added in the Cron tool is in UTC by default. Here is an easy guide to reading a crontab.

# ┌───────────── minute (0 – 59)
# │ ┌───────────── hour (0 – 23)
# │ │ ┌───────────── day of the month (1 – 31)
# │ │ │ ┌───────────── month (1 – 12)
# │ │ │ │ ┌───────────── day of the week (0 – 6) (Sunday to Saturday;
# │ │ │ │ │ 7 is also Sunday on some systems)
# │ │ │ │ │
# │ │ │ │ │
# * * * * *
1 0 * * * ~/fetchForcast.sh

Now that you have the key, it’s pretty easy, huh?

That really is all there is to a traditional cron. Most hosts like SiteGround allow you access to the cron for your system. Sometimes you have to edit the crontab manually, but many hosts have a much better interface for you to use. Either way, you have the ability to run programs at a specific time and on a regular basis.

What is WP-CRON

Like most things, WordPress does things just a little differently. Because many plugin authors needed to be able to schedule things to happen regularly, and because many WordPress site owners don’t know where their crontab is, much less how to edit it, WordPress re-invented the cron.

At its core, WP-CRON acts like a traditional cron in that a developer can “schedule” a task to be done on a regular basis. However, unlike a traditional cron, WordPress does not have a program that is always running in the background of your server. So to make this world, WP-CRON is a process that is called every time a page is viewed.

On busy sites, this works fine. However, if your site isn’t busy, a task scheduled for 2:00 AM might be run at 5:24 AM if nobody visits your site until then. Sometimes this is ok, other times this is a problem.

If the tasks you need to run are time-sensitive and have to be run at the time scheduled, WP-CRON is not the scheduler you want to use. If on the other hand, the tasks you need to be done can happen “around” the time you schedule them, then WP-CRON is fine. Again, a lot depends on how busy your site is.

What are the alternatives?

If you have tasks that are time-sensitive and your host does not allow you access to the system’s cron, you have 2 alternatives. First, you can switch to a host like SiteGround that gives you this access. If that’s not possible, then there are several services free or paid that are nothing more than cron services.

They run cron and you can set a job to run via a nice web interface. The job would use a program like curl or wget (think of them as headless browsers) that call URLs on your site to fire a specific task. Most plugins that require a cron will give you the URL to call if you want to use an external cron. All you have to do is paste the URL in, set the time for it to run and you are done.

CRON is a valuable tool and once you understand how to work with it, you will find more uses for it. If you have plugins, then I can almost guarantee that your site has wp-cron jobs running. If you are curious, go to the WordPress plugin repository and search for cron. There are plugins you can install that will show you all the WP-CRON activity on your site. Be very careful though. Plugins set these for a reason. If you decide you don’t like one and delete it, the plugin that depends on the job will stop working.

[subscribe_cta]

Protecting Your Reputation by Protecting Your Email

Your online reputation is one of your most precious possessions. Because of this, you need to do everything in your power to protect it. The problem is that the more powerful your reputation becomes online, the more that people with bad intentions want to take control of it and use it for their own purposes. Nowhere is this easier online than email.

Email started as a trust system. I trust the email server I used to send my email. It trusts any number of servers to help deliver the email along the way. The recipient of my email trusts their email server.

In the beginning, email didn’t necessarily go from you to your server, to your recipient’s server, to your recipient. The internet was still fragile, so email was designed to hand mail to any server and trust that that server would either deliver it, hold it until it could deliver it, or hand it off to another server for delivery. Trust, however, has a price, and once bad people figured out that email was based on trust, they started making us pay that price.

Because bad people figured out they could send emails that look like they are coming from anyone on the Internet, people much smarter than me knew they had to do something to secure our email system. If someone could send you an email that said it was from your mom, and that email contained a link to show you cute puppies, you trusted that it was from your mom, so you clicked the link; thus Phishing was born.

These days, email is a lot more secure. The smart good people have figured out ways to build technologies like Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). These systems help protect emails by protecting who can send emails for a given domain. If you have SFP and DKIM setup, most email servers will recognize them and use them to make sure that the email it just received that SAID it was from you, actually IS from you.

The biggest problem with SPF and DKIM is that they are not easy to setup. To configure them, you need to understand DNS and how to create specific types of records. This has hampered the widespread adoption of these concepts in the past.

Thankfully, these days, there are good hosts like SiteGround.com out there that set them up for you automatically. When you set up a domain on a good host, one of the things they do is not only set up your mail system but also set up SFP and DKIM to protect others from fraudulently sending emails that look like they come from you.

If your host does not automatically set up DKIM and SPF for you then all is not lost. There are many good tutorials available and with some time, you can set them up yourself. There are even online checkers you can use to make sure you have done it correctly.

Or, if you’ve got better things to do with your time than figure out DNS, you can host with a host like SiteGround.com. Your call.

[subscribe_cta]

Securing User Passwords with “Have I Been Pwned”

securing passwords

Most developers are familiar with the website “Have I Been Pwned?“. Most non-developer and non-techie people have probably never heard of it. That’s ok, that’s what this blog post is for – to not only tell you about it, but to show you how to use it to keep your WordPress site safer.

First, the term “Pwned” originated in a game. It was a typo because the letters “P” and “O” are so close to the keyboard. Like many good mistakes in gaming, it was appropriated and now is common slang in technical and gaming circles for “Owned.” Depending on the context, it can mean that someone really beat you bad in a game, or that someone has compromised your server and now has access to it. Either way, you’ve been pwned. Pwned is never a good thing. 🙂

What’s “Have I Been Pwned?”

The website “Have I Been Pwned?” is more tech than a game. It was set up by Troy Hunt because, after every major data breach, he would do a post breech analysis of the data released over and over again, and see the same credentials and passwords being used. When a data breach occurs, the attackers will sell or release any user credentials they obtain.

Most users have the bad habit of reusing logins and passwords, so the credentials that work on one site may also work on another site. Thus if a user’s data is released from one site, it can be potentially disastrous for a user because the attackers can try their login and password on a multitude of other sites and gain access to more and more sites and data.

How to Use It?

So Troy gathered any data he could get from a data breach and put it all in one big database. Then he built a website where you can enter your email address and see if it was included in any of the breeches he has access to. Just for fun, go ahead, click the link and check your email address. You’ll probably be surprised, and not in a good way, pwned is never a good thing. 

These days the website also provides an API that other websites can use. The main function of this website is to prevent a user from reusing a password that has already been compromised. WordPress has several plugins that hook into the registration process and check the password a user is trying to use against haveibeenpwned.com’s API. The API takes a prefix of a “hash” of the password. The password itself is never sent across the wire. It returns all the hashes that start with that prefix.

The plugin then looks for its exact hash. If it finds it, it will give the number of times that password has been released, regardless of the site that was breached or the user name. The plugin then makes a decision on whether or not to let the user use that password.

This, by itself, will not make your site safe. As I discuss in “Is My Website Safe”, there is only one way to secure a computer from the Internet – turn it off. However, adding this layer to your security stack is one more way to make it more secure. Add enough layers of security, and your site is not an easy target, so attackers move on to another one.

[subscribe_cta]

Archive Your Instagram Photos on a WordPress Site

add your Instagram photos to WordPress

Instagram has become one of the indispensable tools for marketers worldwide. Everything from hiring influencers to hawk their wares, to posting stories about how things get made or how they got where they are, if it can be expressed as a photo, Instagram is it’s home. Recent articles in marketing journals have flat out stated that Instagram is the social network. 

But Instagram, like all other social media networks, is ephemeral. Content has a very short shelf life on social media and given the time that it takes to craft great Instagram photos, that’s a shame. 

There is no need for you to lose your juice once a photo has been buried in the feed, give it new life by posting it on your WordPress site. Archive all of your Instagram photos on your site and link back to them giving them life both on and off of Instagram.

This doesn’t even require a plugin. All you need are three things.

  1. an Instagram account
  2. a WordPress powered website
  3. an If This Then That (ITTT) account.

If you are reading this, my guess is you already have the first two. You may not however have heard of ITTT. ITTT has been connecting web services for a long time. You can connect a WordPress site to:

  • Twitter
  • Instagram
  • Pinterest
  • Reddit
  • Telegraph
  • Youtube
  • Slack
  • …and more

All with the click of a few buttons on a website.

While Instagram is an Instagram → WordPress integration, there are several of the integrations that take WordPress content and share it out to other services. For instance, you can notify Twitter and a Slack channel that you have new content on your site automatically.

Since most ITTT integrations are written by users, there are usually multiple integrations for any given combination that you want, each with a unique feature set that you can tap. One of the WordPress → Twitter integrations will post the title of your latest post, a link to it, and a link to your bio page on WordPress each time you post.

One caveat, for integrations that post to WordPress, it will ask you for a user name and password. ITTT stores these credentials in their database. While they have never had a reported data breach, if they do, you will need to make sure that you change the password on that account immediately. It is highly recommended that you not use one of your administrator accounts for this, the Editor level should be sufficient. In case you’re interested to learn more about user access in your WordPress, we strongly recommend that you read the article on the Principle of the Least Privilege in WordPress.

Don’t lose your valuable content to the merciless timeline, archive, and even republish your beautiful pictures elsewhere using WordPress and If This Then That.

[subscribe_cta]

When Do You Need to Hire a Programmer

UPDATE: In case you’d like to learn more about what goes into planning, building, and deploying a website, we strongly recommend that you watch our “Web Developer AMA (Ask Me Anything) webinar”. In this webinar, our panelists – popular experts Cal Evans, Michelle Schulp, David Bisset, and Mario Peshev – will answer various web development questions and share their own experience on the topic. You can also listen to our podcast episode “Do I REALLY need to hire a developer” where host Cal Evans talks more on communication with your developer, defining budgets, reporting on the task, and so on.


If you are thinking of building a website, a web application, or a web-based store, at some point, you are going to ask yourself the question, “Do I need to hire a programmer?” The short answer to that question is “It depends.”

Three Scenarios

The real answer to that question will depend on who you are and what you are trying to build. Let’s take a look at three common entrepreneurs.

Alice

  • Alice owns her own hand-made widgets store but wants to branch out into selling her widgets online.
  • Alice understands the intricacies of hand-crafting widgets of high quality. Alice understands to a great extent who her market is and how to reach them.
  • Alice knows what she wants her website to look like but doesn’t have the skills to stand up the site, design the site, and maintain it.
  • Alice plans on managing all of the content and products on her site. She just needs someone to deal with development and design.

Alice needs both a developer and a designer to work with her to get her site up and operational. After that, she will need her developer partner on a retainer to handle monthly maintenance, and deal with issues as they arise. She will need her designer only when she wants to re-skin her site or add new graphical elements.

Bob

  • Bob has an idea for a new service that is web-based.
  • Bob understands how his idea will work.
  • Bob knows what he wants the website to look like and how the application will flow.
  • Bob is not planning on selling multiple products or services, just this single idea.

Bob needs a development partner for the long haul. Bob should seriously consider hiring a developer either part-time or full-time until the product has shipped. Bob will need a designer to develop the graphical elements, but since there is a single service involved, the relationship with the designer will be temporary.

Mary

  • Mary wants to set up a webshop to sell her photography.
  • Mary is a power-user. She understands computers and knows a little about programming.
  • Mary is comfortable with computers and has always wanted to learn programming.
  • Mary has a steady permanent income, and this project will not be her primary source of income in the beginning.

Mary probably does not need to hire a developer. Given that she is a photographer, a creative pastime, she may not even need to hire a designer. Mary can start with existing plugins and themes and customize them as necessary, using the WordPress admin interface.

If Mary chooses a good hosting partner like SiteGround, that will take care of WordPress and plugin upgrades, as well as routine backups and scanning her site for malware, she doesn’t need to immediately invest in a developer retainer to manage all of that. She can set these things up herself.

Mary may need to hire a developer in the future if she needs the functionality that does not currently exist in plugins she can download or buy. She may also want to eventually hand off the management of her infrastructure to a developer partner so that she can focus more on her photography.

Seriously, It Depends

As we’ve seen in these three different scenarios if you need to hire a developer, and at what stage of the project, largely depends on the project, and on you. If you are unsure about whether you need a developer, chances are good that you do.

Invest a little in your project by hiring a developer to sit down with you and do the “discovery phase” of your project. This is where the developer listens to your idea, asks you a LOT of questions, and then presents you with a detailed plan on how to build out your idea. They will most likely also present you with a quote for what it would cost for them to build it out.

The great thing about paying for the discovery phase though is that you now own the documentation that comes out of it. If you have any doubts about the developer you have chosen, you can shop the project around to other developers who can take the documents and give you an estimate without having to go through another discovery phase.

Don’t wait until you’ve gotten into the weeds of your project only realize that you are in over your head. Make the decision on whether to hire a developer early on in your planning phase. Then, invest the time necessary to find one with whom you feel comfortable working. Your project will go a lot smoother in the long run.

[subscribe_cta]

Santa’s Got a Bag Full of PHP 7.4 Goodies

PHP 7.4 is already available on all SiteGround servers and we have invited our great friend Cal Evans, who is also one of the most admired people in the PHP community, to share which are the best things in the new PHP version. 

It’s that time again. Time for Santa to hitch up the ElePHPants that power his sleigh and deliver that present all good developers have been waiting for, the newest release of PHP. I took a quick peek in Santa’s bag and here are my top three features coming in PHP 7.4.

PHP 8.4: Stay Updated! 🚀 Check out our latest blog post to explore the newest features and enhancements in PHP 8.4.

Continue reading “Santa’s Got a Bag Full of PHP 7.4 Goodies”