Posted on

PublishPress Capabilities Forced Update due to Serious Security Vulnerability

A couple of days ago a serious security issue with the PublishPress Capabilities plugin was discovered. Usually, we always try to protect our customers using our powerful WAF (Web Application Firewall) system and build rules to stop hacking attempts while leaving the update itself to the client’s preferences.

However, due to the nature of the exploit, we couldn’t protect our clients’ sites with WAF rules so, we decided to perform an emergency update on all our active installations of the plugin. Although, we do not expect any problems associated with this update (even the default WordPress system issued an update), if you notice something not working properly, feel free to contact the PublishPress Support for additional assistance!

Who’s Affected?

Only plugin versions between 2.0.0 and 2.3.0 are affected by this vulnerability. That’s why our team has performed the update only on them in order to avoid any problems with the plugin’s normal operation.

UPDATE

PublishPress Capabilities plugin has been successfully updated on our servers. As the vulnerability was reported to affect a few other plugins and themes we have gone deeper with the investigation of the issues and have managed to create a WAF rule that is protecting against possible exploits of this particular vulnerability.

[subscribe_cta]

Posted on

All You Need to Know On WordPress User Roles And Capabilities To Manage Them Wisely

As WordPress has grown in popularity, application, and complexity, we have all discovered something very important, making everyone an administrator isn’t a winning strategy. Thankfully WordPress provides us with a very powerful tool called User Roles and Capabilities that helps us give people just the capabilities they need without giving them too much or too little. This helps us keep our sites secure. 

In this article we will talk about:

What Are WordPress User Roles

As sites become bigger and more complex it takes more people to manage and maintain them. 

Yes, sites still need:

  • Authors to write new content that makes people’s lives better.
  • Editors to fix all the mistakes in the authors contents
  • Administrators to keep everything upgraded and working smoothly
  • Contributors to assist editors in editing posts
  • Subscribers who may or may not have paid us money but they have at least registered with us and given us an email address. (that’s worth something right there)

But these days sites also need:

  • Warehouse staff to log in, print labels, and ship products.
  • Accounting staff to make sure we collect all the money that is owed to us.
  • Social Media managers who can see behind the scenes, but not necessarily change things.
  • Community Members who have paid a premium subscription to access the really good stuff the authors are writing and editors are editing
  • And of course…premium community members who can log in and access the really REALLY good stuff we save for those special few who see our vision and subscribe at the premium level.

The list of needed WordPress user roles is endless. It changes with every site because each site’s needs are different.

The Main Types of WordPress User Roles And Their Capabilities

A WordPress User Role is a collection of capabilities. A capability is a permission to do something. The standard WordPress install comes with around 40 capabilities, as well as with 6 user roles by default, ordered by level of power over those capabilities:

Administrator:

The default administrator role (not to be confused with the administrator account…that you should not have on your site. If you do have one, stop and watch this video) has all of the standard capabilities.

What can a WordPress administrator do?

In a regular WordPress site, there is nothing that the administrator role cannot do, such as:

  • Create or delete users & manage their permissions
  • Customize WP dashboard
  • Update the WP core, themes and plugins
  • Edit and manage posts and categories
  • Upload files
  • Moderate comments
  • …and a lot more.
Who should get the Administrator role?

The administrator role should be reserved for the person that is responsible for the technical aspects of the site. If you don’t manage the security of the site, update plugins, and handle problems, you probably don’t need to be an administrator.

For safety sake, I always create a separate account that I use on my sites as the administrator. My normal account – the one I use to post content and manage users –  is an editor. Therefore, I have to make a conscious decision to log in to do administrator things. 

My administrator level accounts all have Two Factor Authentication enabled (see below) and have very strong passwords.

Things get a little more complicated if you are running a WordPress Multisite, because the admins user capabilities are limited for these types of sites. For this, there is a bonus WordPress user role in WordPress, the Super-Admin role.

Editor:

The editor manages things. The account I normally log into my sites with is an editor. I can do everything except manage plugins, themes, and other technical things that require some serious thought before doing. Having my day-to-day account be an editor keeps me from accidentally disabling or deleting a plugin or theme.

Who should get the Editor role?

Anyone who is managing things on your site (content, users, etc.) is a candidate for being an editor. 

Don’t be fooled by the role name, editor is still a very powerful role and in the wrong hands can cause serious damage to your site. Seriously consider enabling Two Factor Authentication on editors and enforcing strong passwords to keep these accounts safe.

Author:

Next is the author role. The author role is a much more limited role. Out of the box, basically an author can: upload files and create, edit, publish or delete his own posts.

Who should get the Author role?

The author role is great for guest posters on a blog or regular authors whose only function is to write and edit content.

Subscriber:

A subscriber is a guest that has registered with your site. They have no capabilities other than to be able to read content and edit their information. 

Some sites have content that is not visible to users unless they register. The subscriber is a good role to use for that. You will need a plugin to be able to hide content from users who are not of a given role or higher, but those are easy to find in the WordPress Plugin Repository.

Other Roles:

Many plugins you install like WooCommerce will add new roles and new capabilities to WordPress automatically. For instance, When you install WooCommerce, it adds the role “Customer”. A Customer has certain capabilities that mainly deal with them being able to view and change their own data, view their roles, etc. People are moved into the “Customer” role when they purchase something and set up an account on your site.

How to Assign WordPress User Roles to Your Site Users

WordPress does not come with a built in-role and capability editor (more on that below). You can however assign your users to different roles. There are two ways to do that with a standard WordPress install.

1. Manually

For each user on your site, you can bring them up in the User Editor and select the role you want them to have.

In the above screenshot, I have selected Subscriber for my site member Bob the Builder. You can assign – and re-assign – roles as often as you like.

2. Automatically

Using an account with the role of Administrator, you can go into the WordPress Admin Dashboard and select Settings > General. There you will find a drop down that allows you to decide what role users will be assigned automatically when they register with your site. This defaults to “Subscriber” but you can set it to any role you like.

How to Manage and Edit WordPress User Roles and Their Capabilities 

As I said, almost all of the capabilities are reserved for the administrator, that doesn’t mean you can’t change things around. There are times when you may want your contributors to be able to moderate comments, a capability usually reserved for Editors. WordPress is flexible enough to allow you to move capabilities around and even create new roles. 

Out of the box, there is no good way to look at what roles and capabilities are set up in WordPress nor create new ones. If you are a programmer, you can of course write code to show them to you and even write code that will create new ones. Where’s the fun in that though? 

Like everything in WordPress, the easy way to manage roles and capabilities is to install a plugin. Also, like everything in WordPress, there are a lot of good plugins to choose from that will help you see, manage, and create user roles and capabilities.

Because there are so many plugins out there, I can’t tell you which one is best. I can, however, tell you which one I use. I use User Role Editor by Vladimir Garagulya and have for a while now. 

The biggest reason I chose this particular plugin is that it does the job. The second biggest reason I chose it was because it’s free and I am cheap. When I say free, I mean that I use the free version. Vladimir has several options out there for those who want the advanced features and this code is well worth the money.

How to Manage WordPress User Roles With User Role Editor

After installing User Role Editor, you will probably notice that it didn’t add yet another menu item to your left sidebar. Instead, it adds a sub-menu item to the “Users” menu, “User Role Editor”.

Click on that and you get a complete list of all the capabilities currently in use on your system.

On the right side of the list are a series of buttons that allow you to add new roles and capabilities.

The screen layout can be a little confusing at first. However, once you begin to poke around and see how things are laid out, you begin to get the feel for it.

As you can see, if you select the “Administrator” role in the dropdown at the top of the screen, it shows you all the capabilities that the Administrator role has access to. (Hint: All of them)

The tree on the left is how the capabilities are broken down and organized. This way you don’t have to scroll through the entire list to find that one you want to turn on or off.

To use the example I used above, if I want my contributors to be able to moderate comments, the first thing I do is select “Contributor” from the list of roles.

Once selected, I see that almost all of the checkboxes disappear. On the tree on the left, each category gives me 2 numbers, the number of capabilities in that category and the number of capabilities this role has in that category. In the case of “Contributor” most of the second number are 0.

Using the tree on the left, we can select “Posts” to find the moderate comments capabilities.

To grant our contributors the ability to moderate comments we just check the box and click “Update” on the right. 

That’s all there is to it. Now any person who logs in and is a “Contributor” will have the ability to moderate comments on posts.

That gives you a feel for how easy it is to manage existing user roles and capabilities.

How to Create New WordPress User Roles and Capabilities With User Role Editor

What about new Roles and Capabilities? Are those as easy? Yes, they are.

On the right, click “Add Role” and follow the prompts.

If your new role is similar to an existing role, it even gives you the ability to clone an existing role to save time. Then you can simply change the capabilities of your new role to suit your needs.

New Capabilities on the other hand are a little more difficult. Yes, you can define them in the interface but unless there is code written to use the new capabilities they won’t have any effect. Before you start adding capabilities, talk to your programmer.

WordPress User Roles Security

So as you’ve seen it’s really easy to add new roles and customize them to fit your needs. Just because it’s easy though doesn’t mean you should add a bunch of them willy-nilly. Before you start, sit down and decide why a new role is necessary. What will this new role be able to do or not do that is different from existing roles. The more roles you add, the more you have to manage.

Also, there are 2 things you can do for better WordPress security in terms of user roles:

Apply The Principle of Least Privilege

Once you have decided to add a new role into your system make sure you adhere to the Principle of Least Privilege. When creating roles, less is more. Only give your new roles the minimum capabilities they need to fulfil their role. If you are setting up an accounting role, don’t give them the capability to Delete Posts. Stick with the minimum, you can always add later if you need to.

Implement Two Factor Authentication (2FA)

For every new role you setup that has significant permissions, make sure you setup and enforce Two Factor Authentication for those roles. 

If the Administrator role is the only significantly powerful role you have, then the SiteGround Security Plugin is a great option. It makes setting up 2FA for the Admin Role very simple. Here is a demo on how it works.

If you have other roles that have significant power or can see Personally Identifiable Information (PII) for other users, make sure they have 2FA enforced as well. There are several good (free) 2FA plugins out there that can help you do that.

Wrap Up

WordPress has a power user role and capability system that is flexible enough to meet almost any site’s needs. Like any powerful tool though, you can do damage to your site. You can lock users out of capabilities they need to access the site or give users the power to do bad things.

Before you start, stop, think, and then act. That is the winning strategy for managing user roles and capabilities in WordPress.

[subscribe_cta]

Posted on

The Best WordPress Backup Practices, Solutions and Plugins

For as long as there have been WordPress, site owners, managers, and developers have worried about how to backup WordPress. Even in the early days, WordPress was a complex system. It could do a lot, but backing it up and restoring it took time, patience, and of course, developers.

Still savvy site owners understood that it was worth the effort to back their sites up. Natural disasters, bad actors, and backhoes were all the enemy of web sites, and without a good disaster recovery program, you could lose everything.

In the early days my absolute favorite solution was a plugin that simply backed up my database each night using mysqldump and then emailed it to me. I thought this was the end-all/be-all of backup solutions. It was easy, it was off-site, and I had an email rule that deleted them so in 300 days, they were gone.

The problem that is obvious now is that my database, while important, is only part of what needs to be backed up.

I do not believe that there is a single best backup plugin for WordPress or solution. I believe that different types of sites have different needs and that WordPress site owners should evaluate their needs and options and pick the best solution for them.

That having been said, any WordPress backup solution is better than no solution at all. If you aren’t backing up your WordPress based website on a daily basis, read the rest of this article, pick a solution, and start backing your site up today.

The Best Solution to Back Up Your WordPress Site Without a Plugin

Backing up WordPress via your hosting partner

Most top-tier web hosts offer backup services as part of their monthly fee. This is going to be a little different than a plugin solution because your web hosting partner has access to the underlying infrastructure and can do things that plugins simply can’t do.

Your hosting partner backup solution will almost always operate faster in both backing up and restoring because they don’t rely on WordPress to do the heavy lifting. This means that if you have a large site or large database, backing up and restoring via your web hosting partner means less down-time.

One thing to look out for when utilizing your web hosts backup and restore is to make sure that the backups are stored off-site. This means not on the same server that your site is stored on and hopefully not even in the same geographic region. 

Heaven forbid that a natural disaster hit the region your site is hosted in and the entire infrastructure is out for an extended time. If your backups are also stored there then you are down for the count.

At SiteGround they are aware of that. They create daily backups of your website, make them available on a rolling 30 day basis, and they geographically distribute your backups to better ensure your data is stored safely.

Expert Tip: Just because you are utilizing your web hosting partner’s backup service doesn’t mean that you don’t still have a responsibility to keep a backup of your site locally. If no automated service is available, log in once a month and download the last backup of the month to your local computer as an absolute last resort.

How to Back Up Your Website with a WordPress Plugin

Take in mind these 2 questions by the time you will need to choose a WordPress backup plugin that best fits your needs.

What should a WordPress backup plugin back up?

A good WordPress backup plugin or solution backs up at the very minimum 2 things.

  1. Your database
  2. Your uploads directory

In addition, you may also want to back up:

  1. WordPress Core
  2. Your Themes
  3. Your Plugins

The reason I don’t list these in the must-backup section is that these can usually be downloaded and installed thus you don’t technically need to back them up. Still, it’s a good idea to include these in your backup because it makes restoring a site much easier.

What should a WordPress backup plugin do?

A good backup solution should cover at least these three points.

  1. Backup your site
  2. Store the backup in a different location. In tech, we call this “off-site”. That’s a hold-over term from when we used to back things up on tape and then physically take the tape to a different site. 
  3. Restore your backup. A good backup solution is only 1/2 the problem, you need to be able to USE those backups in case of an emergency. Most plugin based solutions require you to re-install WordPress and their plugin before you can restore. Usually this isn’t a problem, but solutions that are provided by top-tier web hosting providers are better in that they can restore everything.

The Best Backup Plugin for WordPress I’ve Tested

Now that we understand what a backup solution should do, let’s look at the best plugin that I have found for backing up WordPress.

UpdraftPlus

UpdraftPlus is the one I am using on about 70% of my sites and I consider it the best free backup plugin for WordPress. The paid version is even better! 

UpdraftPlus is a “freemium” plugin in that some of the features are free, others cost you money. So far I’ve not needed any of the premium features. That doesn’t mean they aren’t worth the money, UpdraftPlus starts at only $42/year for two sites.

UpdraftPlus doesn’t automatically store your backup off-site. You need to set up where you want them to be stored. If you don’t set up an off-site storage then they are just backed up to your server’s local file storage. I strongly urge you to set up off-site backups.

The good news is that UpdraftPlus will work with dang near anyone when it comes to storing files off-site. 

  • Dropbox
  • Google Drive
  • Amazon S3 (or compatible)
  • UpdraftVault
  • Rackspace Cloud
  • FTP
  • DreamObjects
  • Openstack Swift
  • … and email

My favorite is Amazon S3 and any service that utilizes the Amazon S3 API. Since I already store a lot of things on S3, it was easy for me to set this up and get it running.

Since FTP (and I assume SFTP) is on the list, you can use UpdraftPlus to store your backups anywhere you have an (S)FTP server. That’s most places these days.

UpdraftPlus can be used to migrate sites as well. Each license comes with “Clone Tokens” that you can use to clone a site. 

One of the things I love about UpdraftPlus is that if you are using WP-Optimize by the same company and you have UpdraftPlus installed, before you do any database optimizations or changes, it asks you if you want to back everything up first. I love that they take the time to help me not shoot myself in the foot. 

Restoring a WordPress site via UpdraftPlus is as easy as selecting the menu option and then the backup to restore. 

The plugin will do the rest. Since this requires WordPress and the plugin to already be installed, if you are having to restore from scratch then you will have to install WordPress, install UpdraftPlus, and configure your off-site storage before you can restore the rest of the site. 

Bottom line, as far as plugin backup/restore solutions go, UpdraftPlus is a solid one. It is easy to use and the free version works very well.

Wrap Up

As I said, there is no single best WordPress backup plugin or best WordPress backup solution. The best solution is the one that gives you, the site owner, peace of mind and the ability to get a good night’s sleep because you know you’ve got a backup.

Sometimes that is a paid backup solution, other times it’s a free solution. However, you decide to back up your site, the important thing is that you do backup your WordPress site.

[subscribe_cta]

Posted on

Service in German Now Available at SiteGround

In this highly globalized economy, we believe that offering services customized for the local markets is the best way to deliver better quality and more convenience for our users. That is why we are proud to announce that besides English, Italian, and Spanish, we now start to offer our hosting services in German as well.

In the past few years, we have seen a growing number of customers from Germany, which has led to our decision to provide a data center location in Frankfurt. Now we are happy to attend to another need of the people from this region and we are adding the German language as an option for our site, all knowledge base articles, client interfaces and, most importantly, as a language on which our clients can communicate with our support via chat and ticket. 

Our new German Website: de.siteground.com

To visit our new German website you may go directly to de.siteground.com, or you may choose region Germany in the footer. People visiting siteground.com from German or Austrian IPs will be automatically redirected to de.siteground.com. By ordering a hosting service from this website, you will have your account created by default in our Frankfurt data center and all your client interfaces, including the helpdesk will come pre-loaded in German.

How to switch an existing service to German?

If you are an existing client, you may easily switch your service language to German from the Profile page in your Client area. Thus your Client Area and Site Tools interfaces will be turned to German, you will be able to read all our tutorials and knowledge base articles in our Help Center in German and you will also be able to post your support inquiries and receive the responses from our representative in your preferred language. Please note that for all service languages except English, support communication may be aided by Google Translate.

We also would like to remind you that if your account is not hosted in our German data center, but you wish to host in it, you may have your account transferred to it through our relocation service.

We are happy that our service is now more accessible to all German-speaking customers and we hope that our decision to support their native language will make their hosting experience better than ever.

[subscribe_cta]

Posted on

Website Security Trick or Treating

Website Security Trick or Treat

It’s that time of year again – time to put on the costume, carve the pumpkin, and trick or treat down the block to bring candy back home. While it’s all fun and games, website owners around the world should know that hackers also have tricks on their own and are not afraid to use them on Halloween or any other day of the year. Fortunately, here at SiteGround, we take security very seriously and have a lot of tips on how to protect yourself from malicious attacks. 

Play our simple game to learn a thing or two about some of the most common security exploits and how to avoid them.

[subscribe_cta]

Posted on

SiteGround Optimizer V6

Since the launch of the SiteGround Optimizer plugin, we have been constantly working on adding new features, improving existing ones, and making sure that we use the best technology available to achieve a blazing fast loading speed for all of our users. That being said, we’re happy to introduce a major update to the SiteGround Optimizer plugin – v6. 

Brand New Design and Structure

One of the biggest changes you’ll notice is our brand new design with separate pages and a brand new dashboard. We have been adding more and more features to the plugin recently and we decided that the previous tab structure was not the best interface for the numerous improvements we have in mind. That’s why we have divided the interface into 5 pages, consisting of separate sets of carefully crafted tools, designed to optimize your website, improve loading speed and even decrease your resource usage. 

New Page – The Dashboard

SiteGround Optimizer Dashboard

The entirely new Dashboard offers a quick look at the current optimization status of your website, along with shortcuts to the relevant pages where optimizations may be in order. Since keeping your WordPress application, plugins, and themes up to date is important for your website speed and security, we’ve made sure to add a notification in the Dashboard in case your WordPress and/or plugins need an update.

Recommended Features Tag

Recommended features tag

While we’ve always done our best to explain the different features you can find in the Optimizer, we realise that some of them may still sound complicated to the regular WordPress user and one can find themself struggling to figure out which of the features they need to use. To help you make the best choice for your website, we have added a “Recommended” tag to all SiteGround Optimizer features that we’re certain to speed up your website without breaking something or interfering with other settings.

Improved Image Compression and Image Features

We have significantly improved our image compression technology to ensure that even at the highest compression and size savings, your images continue to look as good as ever. Additionally, we have added a “Preview” option so you can ensure that the compression level you have selected does not visibly affect the quality of your images. You can also choose to do a backup of your original images before you start the compression process – this is a great feature in case you plan to change the compression level in future or you just want to have a piece of mind.

WebP image generation has also been improved and a new option was added for larger images – automatic resizing for all images whose width is larger than 2560px, which is more than enough for most displays where websites appear. 

Code Refactoring

The plugins redesign and restructuring gave us an opportunity to refactor our code and make sure that everything is optimized and tested for the best possible performance. While the whole plugin has benefited from the refactoring, there are two tools where the change was noticeable – the WordPress Heartbeat Optimization (available in the Environment page) which precision and options were improved, and the Automatic Cache Purge (available in Caching) which now includes the option to purge the WordPress API Cache too. 

We have really enjoyed making this brand new version of the SiteGround Optimizer and we’re confident that the tools we have developed will help you serve the fastest and best version of your site. Drop us a comment to say which of the Optimizer features you like most and what would you like to see in future releases. 

[subscribe_cta]

Posted on

New and Improved SG Site Scanner Security Service

Our SG Site Scanner service has been one of the most valued tools by our clients since we launched it back in 2017. It has helped tens of thousands of site owners to protect their sites from destructive hacks, data theft and reputation damages via early detection of malicious software. For the last four years, sites subscribed to our SG Site Scanner service had their URLs crawled for suspicious code and their domain reputation checked daily. Now, our clients using the service will also be able to run a thorough file scan of their site directly on the host server with a single click. Read below to learn how this new scanning method enhances the existing site scanner functionality. 

Daily URL scans and domain blacklist status checks 

As always, we will continue to scan the publicly available URLs of any site that is subscribed to our SG Site Scanner on a daily basis. This is a powerful method for detecting malicious code and infected file locations by scanning your public website source code. Additionally, we do reputation checks of the website domain by looking for it in the blacklists of security authorities like Google, PhishTank, McAfee and more. If a Site Scanner-subscribed domain is present in any of them, the owner gets an immediate notification.

NEW: Comprehensive file scans on demand

Apart from the automatic daily checks described above, the SG Site Scanner service also includes the option for an on-demand scan to be initiated by the customers in their Site Tools. Now on top of the Daily URL scans, these on-demand scans include a new scanning method, developed in-house by our DevOps team. The new method is a deep file scan done directly on the server. It can detect malware that is not publicly accessible and thus can be missed by the external URL scans. For example, if the malicious code is located in a password-protected folder, it will not be found by the URL scan, but the new file scan will easily detect it.

An additional benefit of the file scan is that it uses its own comprehensive definitions about what is malicious code and thus can catch threads that may be missed by the URL scan. Another big advantage of the file scan is that it can give you valuable information about the location of a problem that has already been detected by the URL scan. This information can make cleaning a hacked website much easier.

How to take advantage of the extended scanning capabilities?

All clients who already have the SG Site Scanner activated can log in to their Site Tools > Security > SG Site Scanner and click to run an on-demand scan. If domain is pointed to our servers, the scan will include the new files checks too, on top of the URL scan and the blacklist status checks.

We strongly recommend that each site have an active SG Site Scanner at all times. The service has proven over the years to be essential for keeping sites safe and preventing data loss and downtime. It now has an unmatched value thanks to the unique additional scanning method available. If you don’t have it yet, you can find it in your Client Area > Marketplace > Hosting Services.

[subscribe_cta]

Posted on

21 Useful WooCommerce Plugins To Boost Your Woo Store Functionalities Out Of The Box

WooCommerce, built on top of WordPress, is one of the most popular eCommerce platforms on the web. By every metric available, it is the cheapest platform to get started with as it can be installed on any WordPress website and the basic functionality is free.

If the basic functionality is all you need then it is absolutely free. Beyond the basic functionality though, WordPress – like all of WordPress – is extendable via plugins. In all my years of working with WooCommerce I have never been able to just install it and launch. I’ve always had to install a series of WooCommerce plugins. 

Choosing a Plugin

Price and budget are always a consideration when setting up an eCommerce site but that shouldn’t be the only consideration when selecting plugins. Other things you need to consider when selecting a plugin are:

  • Feature set
  • Developer (or company’s) reputation
  • How current is the code

A plugin that does exactly what you want done but hasn’t been updated in three years or tested with a recent version of WordPress will usually end up costing you more time and money than it is worth. If you are a programmer and have time to spare, yes, you can bring the plugin up-to-date if it is open source. However that means that you are now on the hook to keep it current.

Paid vs. Free WooCommerce Plugins

All WooCommerce plugins fall into two basic categories:

  1. Free WooCommerce plugins
  2. Paid WooCommerce plugins

In all the plugins that we talk about here, I will note whether the plugin is free or commercial. Being the cheap person that I am, I always gravitate towards the free WooCommerce plugins wherever possible. That having been said, if you are going to be making money, you are going to have to spend a little to get the more useful functionality.

The plugins I list here are what I consider to be the top WooCommerce plugins, regardless of whether they are free or commercial. If they happen to be free then that’s a win for everyone.

The Most Useful WooCommerce Plugins

There are a lot of lists of WooCommerce plugins out there on the web. Some of them look like people just went through the plugin directory searching for the word WooCommerce and listed them for you. The plugins I’ve listed here may not be the shiniest or the ones that sparkle and get the most attention. They are however the ones that I have found the most useful in building my WooCommerce sites. I hope you find them useful as well. 

So let’s take a look at my favourite WooCommerce plugins.

A security plugin to keep WooCommerce safe

WordPress and WooCommerce go a long way to ensure your site stays safe and secure but it never hurts to add another layer or two of security. Of course the first layer of security is always making sure you have a hosting partner that is focused on the security of your site. Second though are a series of small steps you can take to make it more difficult for bad actors to get into your site. This plugin solves that problem.

Security Optimizer

Author: SiteGround

Price: Free

This has become only the second plugin I have ever put on my “must install” list. When I am setting up a new WordPress site for myself or for friends, family, or clients, Security Optimizer is always installed. I don’t always use all of the options, but that is one of the things I love about it, everything is optional. I can use one or two features, or I can use them all.

Make sure that your site is as secure as it possibly can be by installing the Security Optimizer plugin. Good news: If you are hosting with SiteGround, this is automatically installed and activated for you when you install WordPress.

If you are hosting with another hosting company, you can still use 100% of the features of the Security Optimizer plugin. It does not require SiteGround hosted sites.

WooCommerce payment plugins

WooCommerce Payments

Author: WooCommerce

Price: Free

WooCommerce is the latest of the payment processors. It’s powered by Stripe as the payment processor, but you do not need to have the Stripe extension on your site nor an existing Stripe account prior to installing and using WooCommerce Payments. This plugin is more tightly integrated into WooCommerce than any of the other payment gateway plugins and it’s a fully integrated solution, meaning that merchants can manage everything to do with payments from one central place – their own site’s WooCommerce dashboard.

It should be noted that one of the biggest selling points of this plugin is that eligible merchants can get almost immediate access to their funds.

WooCommerce Payments also enables Apple Pay and Google Pay.

Stripe Gateway

Author: WooCommerce

Price: Free

If you don’t want to process your money through WooCommerce and then through Stripe, you can use the Stripe plugin. As with WooCommerce Payments, you will need to set up a Stripe account to be able to use this plugin. 

Stripe is a well documented system and a safe bet for anyone who isn’t sure which payment gateway to use.

Paypal Payment

Author: WooCommerce

Price: Free

Paypal is probably the oldest of all the online credit card gateways. Their interface is kind of clunky but it still gets the job done. Because it’s been around so long, it is accepted in a lot of different countries where some of the newer gateways may not yet be available.

If Stripe isn’t available in your area, PayPal is a solid second choice.

Amazon Pay

Author: WooCommerce

Price: Free

A newcomer to WooCommerce, Amazon Pay has been rolling out over the past few years. The upside is that if your customers have an Amazon account, they can pay for your goods and services with that account. Since most customers trust Amazon to keep their information private, this trust is transmitted down to you if you offer Amazon Pay.

Amazon Pay does support subscriptions.

Square for WooCommerce

Author: WooCommerce

Price: Free

If you work in the real world and in cyberspace, Square is a great choice for a payment processor. As far as a normal eCommerce payment gateway goes, Square is as good as any of the rest but they are the only one that also integrate your real-life payments in the same account.

WooCommerce shipping plugins

These days shipping isn’t something that every store owner has to deal with. If you are selling virtual products or information then you probably aren’t shipping anything./ For everyone else there are a few plugins that you are going to have to consider installing.

JetPack

Author: Automattic

Price: Free with commercial options

JetPack has some core functionality that helps with the shipping and tax collection plugins, so, even though it is not technically a shipping plugin, you’ll need it for that purpose. The good news is that as of this writing, you don’t need any of the paid options to get shipping and tax functionality working.

WooCommerce Shipping

Author: WooCommerce

Price: Free

If you are shipping via United States Postal Service or DHL, install this plugin. It gives you the ability to print out labels for your packages for both of those services. 

UPS Shipping Method

Author: WooCommerce

Price: $99/year

This plugin will calculate UPS shipping for you by talking with UPS’s API. It will calculate both domestic (United States) and International shipping for you.

Please note that this plugin requires that you have the PHP extension SimpleXML installed. This extension is installed by default on SiteGround. If you are using another hosting parter, you will need to contact them to make sure it is installed before you can install this plugin.

This plugin calculates shipping rates but does not print labels.

FedEx Shipping Method

Author: WooCommerce

Price: $99/year

Like the UPS plugin, the WooCommerce FedEx Shipping Method plugin allows you to talk to the FedEx API and accurately estimate shipping costs for your customers. 

Like the UPS plugin, the FedEx plugin requires that you have a PHP extension installed. This one requires the SOAP extension. As with the SimpleXML plugin, this is installed standard on all SiteGround plans. If you are not hosting with SiteGround, make sure and consult your host to make sure this extension is installed before you install the FedEX Shipping Method plugin.

This plugin calculates shipping rates but does not print labels.

Canada Post Shipping Method

Author: WooCommerce

Price: $99/year

If you live in Canada or you ship a product to Canada then you will want the Canada Post Shipping plugin. This calculates shipping costs for your orders using the Canada Post API.

This plugin calculates shipping rates but does not print labels.

Royal Mail Shipping Method

Author: WooCommerce

Price: $99/year

For those in the United Kingdom, you will want the Royal Mail Shipping plugin. This calculates shipping for your orders based on the 2021 posted price guidelines. This plugin does not talk to an API therefore will not affect the speed of your cart pages. (Some API can slow down the display of pages)

Shipment Tracking Plugin

Author: WooCommerce

Price: $59/year

Regardless of what shipping service you use to ship your product to your eager buyers, you want to give them a way to track those orders to their doorstep. The WooCommerce Shipment Tracking Plugin does just that. It supports all of the shipping method plugins we have discussed here plus many others.

WooCommerce plugins to sell different kinds of products 

Since selling things is the actual point of an eCommerce website, let’s look at a few plugins that will help you actually sell subscriptions, event tickets, custom printed items and arrange bookings.

WooCommerce Subscriptions

Author: WooCommerce

Price: $239/year

There are a lot of subscription plugins out there for WordPress. However, if you are using WooCommerce for selling other products, consider the WooCommerce Subscriptions plugin before you look at the others. This plugin is going to be better integrated into your overall solution than anything else out there. 

The WooCommerce Subscriptions plugin will work with all the payment plugins to handle recurring payments, the trickiest part of selling any subscriptions.

WooCommerce Subscriptions will allow you to sell subscriptions to both physical or virtual products. It is good whether you are selling coffee by the month or your monthly newsletter about coffee.

FooEvents

Author: FooEvents

Price: Starting at $139/year

If you are selling tickets to events, using WooCommerce you have several options. I’ve tried most of them at one point or another and off all of them, I like FooEvents the best. FooEvents makes it easy to sell tickets and manage your events. If you are selling tickets to a physical event, you even have the option of a seating chart to sell individual seats.

Event management and ticket sales are not trivial endeavors so I encourage you to look at all your options before making a decision. Make sure though that you include FooEvents in your list of potential solutions.

Printful Integration for WooCommerce

Author: Printful

Price: Free

If you’ve ever wanted to have a store selling custom printed T-Shirts, water bottles, beach towels, etc. Printful is a good place to start. I looked at five different vendors before I selected Printful for my project and have never regretted the decision. Their products are top-notch and their integration with WooCommerce is seamless.

WooCommerce Accommodation Bookings

Author: WooCommerce

Price: Free

The accommodations industry is not one you traditionally think of when you think of setting up a WooCommerce/WordPress eCommerce site. That doesn’t however mean that WooCommerce has left them out. In the category of WooCommerce booking plugins, the standout is WooCommerce Accommodation Bookings. 

You can set things like check-in and check-out times and it allows you to sell by the quantity of nights stayed.

Given the money to be made in this industry, I find it very interesting that WooCommerce currently offers this plugin for free.

Product and cart plugins to help you sell more stuff

Once you have a customer lined up and ready to buy, wouldn’t it be nice to be able to sell them a little more stuff while they are here? These product plugins will help you do just that.

Product Add-Ons

Author: WooCommerce

Price: $59/year

Whether you want to sell personalization or gift-wrapping, this plugin will help you add options to make your sale even more valuable. This is one of the most popular WooCommerce product plugins available for WooCommerce. 

AutomateWoo

Author: WooCommerce

Price: $119/year

If you’ve ever wanted to hire an assistant to help you run your WooCommerce store, you are in luck. AutomateWoo is almost like having an assistant.

AutomateWoo is all about getting things done. 

  • Follow-up Emails
  • Personalized Coupons
  • Text Messaging
  • …and so much more

AutomateWoo allows you to define triggers. These are events that kick off a series of events that you define, called a workflow. A workflow has rules to make sure that the events triggered are the ones you want done, and if they are, then the action you define takes place.

A simple example would be:

TRIGGER: The date changes. (every morning at midnight) 

RULE: Find all the customers whose birthday is today. 

ACTION: Send an email wishing the customer a happy birthday

That’s a very simple one and yours can be much more complex. The thing is, once you define a workflow, it runs until you turn it off. You don’t have to remember to do things, AutomateWoo remembers what you want done and takes care of it for you.

Check out this great plugin and see how easy it is to get an assistant to help you with your store for only $99/year.

WooCommerce Cart Abandonment Recovery

Author: Addify

Price: $79/year

Abandoned carts don’t do anybody any good. Most good merchants will chase after them. After all, if someone took the time to visit your site and show interest in a product, why just let them walk away?

This plugin allows you to configure and automatically send recovery emails. You can add incentives and relevant coupons as well.

Don’t let your customers just walk away, take a look at the Card Abandonment Recovery Plugin for WooCommerce.

WooCommerce coupon plugin to create great deals

Smart Coupons

Author: StoreApps

Price: $129/year

WooCommerce comes with a pretty good system for creating coupons for your store. It is built into the basic core. However, if you need something a little more, check out Smart Coupons by StoreApps, the most popular of WooCommerce coupon plugins available.

It builds on the basic functionality of WooCommerce’s coupon system and allows you to do things like:

  • Offer free shipping
  • Store Credit
  • Gift Certificates

And several other things that make this plugin nice to have.

*Disclaimer: Prices mentioned in this blog post are subject to change. For accurate and up-to-date information on pricing, we strongly recommend checking the official page of the respective plugin.

Wrap Up

WordPress and WooCommerce are a powerful and extendable platform for eCommerce. There are hundreds of plugins out there that will help you sell, track, market, and report. I’ve only scratched the surface here. I’ve tried to narrow my list of plugins presented to you to the ones that will be most useful to you right out of the box. Once you get some experience, you will undoubtedly start to experiment with many of the more complex plugins and systems available to you. 

Good luck and I can’t wait to see what you build!

[subscribe_cta]

Posted on

Joining Forces with London West Ham United Premier League Club

West Ham United x SiteGround Official partnership

Today is the first day of the official partnership between SiteGround and one of London’s most beloved football clubs, West Ham United, part of the English Premier League. To add to the enthusiasm from their winning streak, here is a bit of background on how this whole partnership started and, most importantly, why.

Why Football?

True to our European hearts, we actually have a lot of football, or soccer, as it’s known outside of the old continent, fans at SiteGround. We even have our own in-house team, which regularly ranks in the top 3 in the local IT football league (yes, we may be geeks, but we do like our sports!). Since we’ve always made a point to support initiatives we love and are passionate about, a football club was a natural choice, embraced and celebrated fully by our own staff. Moreover, football is a dynamic game, it’s all about speed, securing your base, and the effort you put in advance, so that you can give your best performance on the pitch. This matches perfectly the main pillars of SiteGround’s hosting services: speed, security, and support.

Why West Ham United?

West Ham is a team that always strives for top performance to the benefit and enjoyment of the fans. It originated in 1895 as the team of the workers at Thames Ironworks & Shipbuilding Company. Known as The Academy of Football, the east London club has an extremely strong legacy and deep-rooted traditions, and has been represented by some of the finest players in the history of English football. The Club also competes in the Premier League, one of the most prestigious sporting leagues in the world, synonymous with the highest-quality football and professionalism. It’s this shared passion for excellence and strong experience in delivering outstanding results that made us look forward to working together.

But perhaps most importantly, West Ham United has a very strong bond with their fans. It’s this unique identity which sets West Ham United apart and very much resembles SiteGround’s own. As one of the very few remaining independent web hosting companies with our long-lasting values, still led by the principle to always give our best- to the benefit of our users and community. Both SiteGround and West Ham United put significant focus into giving back to those around us, always remembering our long-lasting values of care, commitment, doing everything with purpose and mutual respect.

There’s still a lot to come from our joint efforts, and fans can expect some exciting initiatives. Follow us on Twitter, Facebook, and Instagram, because we’re certain we are in for an exciting season, both on the pitch and on the web.

It’s a win-win for all. See you at the next game!

[subscribe_cta]

Posted on

Our Client Area and Site Tools Turn Two!

Client Area and Site Tools Turn 2

Exactly 2 years ago we launched our new Client area and Site Tools. It was a huge moment for us not only because it completed a 2.5-year long software development cycle, but also because it set our hopes high on the infinite opportunities for service enhancements that opened ahead. To celebrate the anniversary of our new tools, we decided to recap which of those opportunities we turned into reality and what were the reactions and impact from all those improvements altogether. Oh, we’ve decided it’s time to stop calling them “New” Client Area & “New” Site Tools since any software that has successfully crossed the two-year and 5000 bug fixes and feature requests mark is officially proven and tried-and-true into maturity.

Revamping Our Technical Setup For a Faster & More Redundant Service

Once we completed the development cycle and perfected our migration scripts to transfer all existing accounts from the old to the new server setup and interfaces, our DevOps resources got fully directed into platform improvements. The three major and most essential projects that we completed, which were possible thanks to our new Site Tools server infrastructure, were focused on the key components of our service: PHP, MySQL, and DNS services. No website could run on any server without these 3 (and the actual web server software of course), so they lay the grounds of how your website will perform even before you have selected an application or put it live.

UltraFast PHP for Up To 30% Faster Page Loading

Running a PHP service is not a challenge. Many webmasters do it on their home machines. But if you want a fast, stable, and secure PHP, while supporting Apache and the variety of .htaccess rules defined by a multitude of users and apps which run on a large platform like ours, things get complicated. After several iterations, our DevOps managed to overcome the biggest “speed over security” challenge and delivered an amazingly fast PHP with our Web Application Firewall and account isolation integrated, getting better performance results without compromising on security. You can read the full post about our Ultrafast PHP here.

Customer commenting on UltraFastPHP

Faster MySQL Setup, Faster Sites

Since we had started on the essentials, it was only natural that we reevaluated how the MySQL worked after the PHP had been optimized. MySQL is especially important for the performance of websites with large data bases, which are usually e-commerce sites, quite widespread on our servers. The new MySQL setup that we crafted allows for a considerably higher number of parallel requests to be processed simultaneously. This affects the effective handling of heavy MySQL queries and leads to a significant drop in the number of slow queries on our infrastructure.

Clients commenting on new MySQL setup

Centralizing the DNS Service

Next on the list was reworking our DNS (domain name system) service. The DNS essentially translates domain names into IP addresses, so people can actually open a particular website. In order to make this process faster, more secure and reliable we just introduced our new centralized DNS service which operates in 5 geo locations and on multiple instances. Webmasters will witness faster domain resolving, enhanced resilience and availability of the DNS service, better protection against DDoS attacks and simplified DNS management among other advantages. All this translates into faster websites with added safety and ease of management.

Clients commenting on new centralized DNS service

Collaboration & Reselling Made Easy On Our Platform

One of the main reasons we were not happy with cPanel was that it was blocking us from creating our own Access control system the way we believed it should be. One of the things that we launched together with the new Site Tools and Client Area was a new user role – the “Collaborator”, already available on all our plans. This user role made it possible for our clients to invite their designers, developers, and friends to collaborate on their sites without sharing logins and creating any security risks.

Over time we also made it possible to add a “Client role” to our GoGeek and Cloud plans together with the option to create custom hosting packages on our Cloud plans, especially useful for people building websites for their clients. The Client role is a more sophisticated way of controlling the access you grant to your clients by defining which parts of the Site Tools they can access.

Client commenting on the Client role

Improved Web Accessibility

Our team also put significant effort into integrating features that make our service easier to use for everyone, including people with different levels of motor or visual disabilities. Our Site Tools came with a high-contrast theme, screen reader support and keyboard handling, and eventually Easy read font which is designed to improve readability for users with symptoms of dyslexia, but can be used by anyone who prefers it and finds it easier to read.

Clients commenting on improved web accessibility

New useful tools and features in Site Tools

Of course new and useful tools kept coming….

Multisite SFTP Key for Easy Multiple Site Management

More recently we introduced the option for Multisite SFTP access with a single SSH key which empowers users to easily and safely manage multiple sites. The Multisite SFTP access can be used for all the sites our clients own or have been added as a collaborator in a single Client Profile. This option provides multisite owners with the convenience and security to manage more than one site.

Clients commenting on multisite SFTP key

Search and Replace Tool for Easy WordPress Management

Our team introduced a WordPress Search and Replace advanced tool designed to enable WordPress admins and developers to replace all occurrences of a certain string within their WordPress code in a single click.

Enhanced Webmail App

We released an updated Webmail application with improved look and feel. The app enables our clients to provide their users with access to all relevant email tools they need to manage their individual email accounts, such as changing their passwords or configuring autoresponders, folders, and forwarders.

Clients commenting on the Webmail app

HTML in Autoresponders

SiteGround users are now also able to set up autoresponder content to be sent as HTML. They can choose whether their autoresponder email is sent as plain text (default) or HTML. This option is available for all themes and resolutions in both the Autoresponders tool in Site Tools and in Webmail.

We are proud that we introduced the Client Area and Site Tools and all the enhancements backed up by amazing test results, but what makes us really motivated is the feedback we receive from our clients. Thanks for your continued support, and your business – together, we hope we continue to raise the standard of web hosting services! 

[subscribe_cta]