link juice from blog comments

The greatest thing about blogs is that they’re interactive. You write posts, and people can leave comments and carry on a conversation right there on the same page. Blogs are like part web site, part forum. Sometimes the post comments are more interesting than the post itself! The first goal is to get comments in the first place, and I wrote a post about that long ago “Rock Star Comments in Wordpress in 12 Steps. The more traffic you get the more comments you receive, and a lot of people ask me, “when will I start getting traffic on my blog?”. Well, my rule of thumb is usually most blogs go from obscurity to a steady flow of traffic at about the 6 month / 100 post mark. This is enough time to be through a google update or two, and with 100 posts indexed in the search engines, you’ve got 100 shots at getting found in online search. I believe every post you write is like a little deposit in the search engine bank.

So back to the original topic – “How do you get the most Juice from Blog Comments?”. Well, comments aren’t like a blog post – you don’t just approve them and leave them site there on your blog. Like your own posts, pages, and content – you can re-use comments in many convenient ways you may not have previously thought about.

• Use a Widget: This is probably the simplest thing you can do, add a “recent comments” widget to your sidebar. It shows your blog is active and people are leaving comments. Simple, yet effective.
• Create a page Listing Most Commented Pages: This is one you don’t see very often. Create a page on your web site and list the most commented and active page, like my Active Discussions page. This is pretty simple to do with the Active Discussions Plugin.
• Use Comments in a ‘Testimonials’ page: Everyone gets comments like “Thanks, exactly what I was looking for!”. If you have a product or service on your site turn your comments into Testimonials! Create a testimonials page and copy them there, then link back to the original comments (building internal links in your site at the same time!). How? Download the WP-Testimonials Plugin, that’s how!
• Reply to Comments: This is pretty much a no brainer – reply to your comments! Tell people thanks, answer their questions, and reply to their comments. Comments get indexed in search engines too you know, and the comments you add in reply to your comments the more content the search engines have to index from your site. Also – people like to know that you are reading their comments, and furthering the discussion(s) makes them want to come back. THIS is a GREAT way to build loyal readers!
• Reward Commenters: Use plugins like Comment Luv, Top Commentators, and DoFollow. Commenters will come back more often when they know their link juice “counts”. In addition, you get listed on sites that list blogs that have these plugins (building backlinks for you!). I get a lot of traffic from being listed on this list of commentluv blogs.
• Email Commenters: If you see someone commenting on your site relentlessly for weeks and months – connect with them! Send them a simple email and say “thanks – I see you’ve been commenting a lot, and I really appreciate it”. If you owned a brick and mortar store you’d be smart to treat your regular customers this way – why wouldn’t you do the same on your own blog?
• Challenge Commenters: Run a contest of some kind and challenge your commenters to become part in it!
• Recruit Affiliates: If you come out with a product or service, recruit the people already commenting on your web site to be part of your new affiliate army! They already know you and your content, and probably wouldn’t mind making a little extra cash as an affiliate of your products.
• Hire Guest Posters: This is a no brainer. I’ll never understand why more web sites don’t recruit guest posters. Authors build great back links back to their web site, and you get great traffic and content in return! In addition most authors always link the article they wrote for you (instant backlinks) – and what better way to find quality guest posters than from active commenters you already have on your blog? It’s like the flowers recruiting the honeybees and saying “hey, since you’re here anyway…”!

Like I said in one of those points, your blog is like your “storefront”. If you actually owned a store, and customers can and visited 24 hours a day you would do everything you could to market to those people and increase your sales. Most stores use direct and indirect ways of marketing to customers that are already there. TV screens at the checkout and throughout the store, ads plastered on the floor, ads in carts, coupons on the back of receipts, checkout coupons. All of these methods are trying to “engage” the customer in yet another way to influence his or her buying decisions.

Think of your blog comments as your checkout clerk. It’s the last thing the customer does before he leaves the store – he “checks out”. Why do you think most stores ask the clerk to do certain things while ringing up your goods? They say things like “did you find everything you needed?”, “would you like to apply for our credit card and get 10% off this purchase?”, “would you like to signup for our free catalog?”. In some stores the checkout clerk is the only actualy person a customer interacts with before leaving with their purchase. Comments are the checkout for your blog, are you getting everything you can from them at the one point they are engaged and connected with you?

Are you using squeezing every bit of juice out of your blog comments?

If you have a Wordpress powered web site probably the most important page on your web site is your contact page. I’m a Wordpress consultant – and sometimes even I forget this. Case and point, I have one web site that gets 25,000 pageviews per day. Two days ago I got a post comment that said “I want to advertise on your site and have no way to contact you – please get ahold of me at this email”. doh! It was also a blog I’m not in every day and the comment was 3 WEEKS OLD! I was just lucky he was still interested when I contacted him, and it was a $400 advertising sale! Not having a contact form almost lost me a sale!

On another web site I had a contact form, but it was on my about page. I wanted to get approval to get my product on that web site listed on Clickbank – so I applied. They said I had to have a page called “Contact”, and I had to link to it from both my sales and features page. I did that, but I did one better – I placed the contact form in my sidebar as well. Guess what, within 48 hours I got 3 emails asking questions about the plugin (before they purchased). All 3 people that asked questions bought the product. Who knows how many other sales I lost by not having a contact form that was easy to find and use!

You have no idea how many people might want to contact you – or what for. Sometimes people want to trade or exchange links, some want to hire you, others want reviews, some want to buy advertising, some people just have a question. You never know, maybe some big corporation wants to buy you out (if your site is really popular). You NEED a contact form on your web site, and not having one (or having one that’s hard to find) is like not having a mailbox on the front of your house!

If a future post I’ll go over my favorite contact plugins details in depth, but for now here’s 2 links:

Contact Form 7: This contact form is lightweight, easy to use, and updated frequently. Many people are very happy with it, and it is popular.

Cforms II: Hands down – this is the best contact form plugin I’ve ever used. But it has TONS of features. If all you want is a single form with a name, email, and comment field – go back and use Contact Form 7. With Cforms II you can build anything from small forms to big surveys. It has a dozen+ styled forms (including one for the sidebar). It has a refer a friend feature, it can save form submissions in the database for review on a reports page later either in place of – or in addition to getting form results in email (which can fail). You can even have this plugin handle all the comments on your web site! It’s my favorite, but it’s a heavy duty plugin for heavy duty work!

Do you have a contact form on your web site?

If you’re reading this post right now, chances are you’ve reached my web site because you are investing a lot of time online – your business might even be online. You are working hard, and if someone broke into your Wordpress web site you could lose a lot of work, time, and money. Today we’re going to talk about webhosting and usernames and passwords. These are two areas you can easily tighten up your security.

This is Part 4 of my Wordpress Security Guide, be sure to read the other parts in the series to be fully protected.

Things to Ask a Web Hosting Company

The cost of a web host has nothing to do with the security or competence of their support department. If you have a web host, or are looking for a new one, just try two simple google searches for your host: “webhostname sucks” and “webhostname hacked”. Replace ‘webhostname’ with the name of the host you want information on. Then, read the blog and forum posts of people that had problems with that host. This takes only a few minutes and it’s always good to get some “real world” opinions. It’s also good to see if a host has just a few complaints, or hundreds. Next, ask your current or potential host some very important questions.

• How often are backups performed? If you ever are hacked, you need to know you can get your data restored ASAP!
  • How far back are backups kept for?
  • At what time of day are they performed?
  • Can I specify a specific date and time for a restore?
• Do they offer “SFTP” or “secure” FTP? If not, you don’t want to host with them (explained later)
• What “account” does the apache web server use to serve pages? It should use a “www-data” type user so your files in your hosting account run under your user, and other hosting accounts on the same (shared) server run under their own user – helping to prevent cross-account attacks.
• Does MySQL run on the same server as the web server? Better web hosts typically have MySQL databases running on separate servers.
• Does your web host you allow “777″ file permissions? Not only is this dangerous, but not necessary. Normally “755″ permissions are all that’s necessary for any web site, and hosts that don’t allow “777″ permissions (writeable by all groups) are normally more security concious than those that do.
• Could a virus from another users web site infect mine? If no, why not? Have your current or potential web hosting company explain to you exactly what precautions they’ve taken to ensure that one infected account can’t take down an entire server. Companies that can’t answer this question with an intelligent answer aren’t worth doing business with.

On top of all this, you want to make sure that if something bad happens you find out about it right away and there’s someone to talk to at all times in support. Ask if your current or potential web hosting company has 24/7 monitoring, and if they have toll free support via phone 24/7 as well. In addition, it never hurts to call a company at midnight to see if a live person actually picks up – or it goes to an answering or “call-back” service.

I get asked a LOT which web hosts I would recommend. Here are shared web hosting companies that I personally use and would recommend:

Hostgator: I’ve been using Hostgator a loooong time, and they are on top of security. You can use secure FTP to transfer files and you can login to your web control panel securely. They have helped me with hacked sites, and can tell you the exact data and time files were changed (and most times by who). This is a North American company with a North American data center.

Servage: Servage has also been a hosting company I’ve been using for years. They have their own internal control panel with lots of features, and you can use secure FTP here as well. The control panel login is secure (https), and they take security very seriously. This is a European company with a European data center.

How to make BOTH usernames and passwords MORE secure

Choose strong usernames and passwords: By default every Wordpress powered site starts with an “admin account”. Every hacker in the world knows that nearly all wordpress sites have this account. So the first thing you should do is create a new account, grant it “administrator” access, and delete the “admin” account.

Strong Usernames: Make your username unique by using both letters and numbers, and make it 8 characters or more. If you make it more than 8 characters you make it much, much stronger. The username you choose should be unique, don’t make it the same as other online logins you have, the same as your email, or the same as your web control panel or MySQL database login. Most people only put letters in their username, adding in some numbers and characters makes it much more secure.

Strong Passwords: Make your password unique by using letters, numbers, AND symbols – 8 characters or more. Don’t use the same password username combination as any other login, and definitely DO NOT make your passwords the same on your Wordpress login, MySQL database login, or hosting web control panel login. Visit Strong Password Generator for examples of what really good random passwords are.

Choose unique usernames and passwords for different logins: This was already mentioned, but it’s worth mentioning again. You want to use different username/password combination for your Wordpress login, MySQL Wordpress database login, and web hosting control panel login. If someone breaks into one account, at least they won’t have access to every account you have.

Change password regularly: Wordpress and (most) web hosting providers don’t require you to change your password on a regular basis, but most online banking does. Isn’t the time you spend on your web site or blog like putting money in the bank? If you lost it all would you be losing money? Changing your password every 30, 60, or 90 days just like online banking is a good idea.

Many people buy expensive alarm systems for their car, and purchase extra strength dead bolt locks for their house. Having piss-poor login names and passwords for your blog is like leaving the door to your house wide open!

Visit the Wordpress Security Guide home to skip to other sections

Need Help Quick? Just Hire Me.

In case you missed the first post, visit the Wordpress Security Guide home.

Examine Your Site for Exploits

There are some really good plugins that can help you to find existing problems and potential exploits with your Wordpress site. Here are are some Wordpress security plugins that perform scanning and alerting functions:

WP Security Scan

WP Security Scan will check you blog for some essential items. Once you download and install the plugin you’re presented with the initial results, which are conveniently displayed in either green or red depending on whether they need attention:

You can see in the image above there were only 2 things that needed attention in my test blog. Here’s a list of the initial checks it performs:

1. That you have the latest version of Wordpress
2. The prefix of your wordpress tables, which by default is “wp_”. You can set the default prefix of wordpress database tables to something different, and leaving it as the default leaves you open to SQL injection attacks.
3. Your Wordpress version is hidden
4. That Wordpress database errors are turned off
5. That the Wordpress ID metatag has been removed
6. The Admin user has been removed
7. There’s an .htaccess file protecting your /wp-admin directory

It also has a scanner function which will check the permissions of key files and folders within your Wordpress installation, letting you know if you are open for attack. Green means the permissions are good, red behind any listing means they should be changed ASAP.

This plugin is a good way to automatically check some of the major items on our checklist, but while it reports the issues, it doesn’t give you the ability to make the necessary changes from your Wordpress admin. It does have a section for attempting to change the prefix of your wordpress tables, but even though my test site had the proper database ALTER permissions, it still wouldn’t allow the plugin to make the changes for me. Just know that your mileage may vary on that part of the plugin. All the other items you’ll need to change on your own manually (which we will cover here shortly).

Wordpress Exploit Scanner

Another way to check your blog for potential exploits is to install the Wordpress plugin Exploit Scanner. The plugin author is Donncha O Caoimh, author of WP Super Cache. It has but one function, which is to search your wordpress files and database to see if you have wordpress plugins with known issues, or to see if you have suspicious posts or comments. This is very important because your plugins are checked against a database list of known “suspicious plugins”, and if you already have spam posts or comments your Wordpress installation might be compromised already. I ran the scan on my test blog:

As you see in the image, I didn’t have any suspicious plugins installed, and I had only one post listed to check out (which turned out to be fine). This plugin is more for making sure you haven’t already somehow been hacked. If the results indicated your Wordpress blog was compromised – you need to take action (which will also be covered shortly).

WP Antivirus

After that last plugin, you’re probably wondering if there is plugin out there that could monitor your site and alert you if it was compromised. Another wordpress security scan plugin to consider is WP Antivirus. Once installed it will automatically scan your wordpress theme files to make sure they haven’t been hacked or compromised by a virus. It doesn’t do anything else, but it DOES send the admin an email if a “virus” is found in your theme files. You can also run a manual check to check your theme files if you don’t want to enable email notification:

All my files were fine in my test blog theme except for one, and there was no virus – but there was a potential problem with one section of my functions file. As you can see safe files are in green, potential problems are red. It would be nice if this plugin did the same type of database scan as Wordpress Exploit Scanner as well, maybe it will in a future version.

Secure Wordpress

Unlike some of the previous plugins that look for problems, Secure Wordpress actually takes care of some of them by setting options in plugin admin in your dashboard.

As you can see in the images above, it’s as easy as clicking a checkbox to remove the version of Wordpress in all areas, remove update links for non-admins, and it can even create an index file in your plugins directory to keep people from “directory browsing”. The last thing it can do is add a comment to your html code while enable you to use the next tool we’ll talk about “WP Scanner”.

BlogSecurify WP Scanner

Wordpress Exploit Scanner checks your blog via the web. Before they do that, they want to ensure that you’re actually the owner (and not scanning someone else’s blog!), so a simple comment has to be added to your html code. They offer a free plugin that adds it automatically if you don’t want to edit your theme files, or you can add the code by checking an option in the previously mentioned plugin “Secure Wordpress”.

Once you enable the plugin, you Visit the WP Scanner web site to start a scan. The image above shows what the results look like from the WP Scanner web report. It assigns a risk factor to items it finds, but does not give much additional information. It did come up with results for me that the other plugins did not, like some readme files that could clue a hacker in to what version of Wordpress or plugins I’m using.

I hope that you learned some valuable and free ways today to find exploits in your Wordpress blog. Stay tuned, because in Part 3 of our Wordpress Security Guide we’re going to learn how to limit access to your WP sites. In Part 5 we’re going to talk about how to stop spambots and hackers dead in their tracks from trying to break in through through exploits.

Visit the Wordpress Security Guide home to skip to other sections

Need Help Quick? Just Hire Me.

Do you Know What You’re Risking?

Maybe you feel safe because none of your sites has ever been hacked, but honestly – is it worth the risk of losing all or even part of your work? Spammers want to load up your blog with comments linked to online casino and male enhancement web sites. Malware hackers want to inject your blog with redirects to hijack your traffic to their domain. You are risking anything from thousands of spam comments to having every PHP file on your web site “injected” with a javascript redirect to a foreign address. A really nasty virus might even chew through your entire mySQL database and destroy all your content. If you lost your entire web site tomorrow, how old would your latest backup be? How much work would you lose? Do you even take regular backups of your web site? If your web site generates income you could actually lose money during your down time, and your search engine rankings could be compromised – costing your traffic and even more money.

Do You Know What Could Happen?

The world is filled with skeptics who fail to believe this can’t happen to them. Let me explain why it’s more important than ever to secure your Wordpress powered site, because there are literally armies of online villains ready to attack you!

There are specific things you need to protect yourself against:

• Malware, Trojans, and Viruses – oh my! Believe it or not, your web site or blog can be hacked by a virus. Usually you think of a virus as something that attacks your personal computer. There are viruses and trojans that are designed to steal your FTP or login info and gain entry to web sites. Once inside they can chew through your PHP files like a mouse eating cheese. These types of attacks normally originate from a Windows based computer.
• Hackers, Spam-bots, and automated software – When you’re sleeping your web site is being bombarded night and day by online attackers. Some of these are from real live people, but most of them are completely automated by hackers using bots and automated software. Software doesn’t sleep, and it’s designed to find web sites that have potential exploits. The most common targets are sites with older versions of Wordpress or plugins that have known security holes. These types of attacks happen as often on your web site as real visitors, and you don’t even know they’re happening because more than likely you have no way of tracking them.
• Bad Web Hosts – Would you purposely buy a home in a bad neighborhood you didn’t feel safe in? When you build a web site online it’s like building a real brick and mortar home, the safety of your new “web home” depends on your web neighbohood. What if the the great $9.95 per month deal you got on web hosting means that your shiny new blog is now parked in an online ghetto? Your site is only as safe as the server you’re hosted on, and you might be more succeptible to attacks if their server security isn’t very good, and depending on their setup you could even be at risk from the other customer’s sites hosted next door to you! Maybe you never thought about your web site being attacked by neighboring accounts or lax web host security until now.
• Your own computer – Believe it or not, you are your own worst enemy. You are 80% more likely to infect your own web site or give you FTP login info away unwittingly through a trojan than you are being attacked by other means. This is mainly because the majority of people have Windows based computers, and a great percentage of them are infected with some type of malware, virus, or trojan. Even if you are the most careful person on earth, other people using your computer (or children) may not be. Your virus program could be out of date, or you could have an older version of Windows without current updates.
• Internet Security – Even if you’ve thought of everything to secure your own computer, what good does it make if you’re still connecting to your web site in regular FTP? Are you using a wireless router at home that’s not encrypted? Do you use public wifi connections and check your email and use the admin functions of your blog? Are you still logging into your Wordpress blog unsecured? All or any of these could compromise you site.

Where Do You Begin?

If you want to secure and harden you Wordpress powered site there are some very simple steps you can take to protect yourself:

1. Upgrade Wordpress and all plugins to the latest versions available
2. Examine your site for potential exploits and security holes
3. Limit access to your site through permissions, robots.txt, and .htaccess file
4. Examine the security of your web host
5. Make all usernames, passwords, and logins more secure
6. Don’t encourage bad behaviour by allowing spammy accounts or comments
7. Consider tracking attack attempts against your site to keep aware of potential problems
8. Use secure connections at all times
9. Keep your personal computer up to date and protected

This guide will explain in easy to understand steps how to do all those things and more. By the end of this tutorial you will be able educate other bloggers about Wordpress security and potential online attacks.

Backup Now!

Before you make any changes at all the first thing you need to do is backup your web site and database. If you’re not doing that already, now is the time to start! There are all kinds of plugins that will do this for you, but to be honest I’m not a very big fan of that technique. Mainly because at some point in time the database file will probably be too large to manipulate via Wordpress plugin – especially if you have an active blog. The Wordpress Backup plugin can help you with that if that’s the route you choose.

Manually downloading all your wordpress files to a directory on your computer is as easy as it was to upload a theme or plugin. Download everything, so you have a current working version of all wordpress files, themes, and plugins. Nearly all web hosts provide you with a web control panel to manage your web site. Login and find the section for managing your databases. You should have access to a web tool called “phpMyAdmin” which allows you to administer your database via web page. Find this tool, select your database from the drop down menu, and then export!

The Wordpress Codex has a page about phpMyAdmin, as well as a page about Restoring Your Database from Backup if you have to need to.

Upgrade Wordpress and Plugins

Now that you have backups of everything in your current version of Wordpress, it’s safe to upgrade everything! Since version 2.8 of Wordpress, it’s been possible to upgrade your Wordpress installation from your admin dashboard, as well as updated versions of your plugins (as they become available). If you’re not up to version 2.7 of Wordpress, you’ll need to update by downloading the lastest version from wordpress.org first, and the uploading the files via FTP. Then you’ll be able to update your plugins via the admin dashboard plugin page. This may be the first step, but it’s one of the most important, because exploits in outdated versions of Wordpress and plugins are exactly what hackers are looking for. Staying up to date is your best defense against issues like this.

The following images show how easy it is to updating both Wordpress and plugins in version 2.7x and above by simply clicking a link to do it live in your Wordpress dashboard admin.

Releases of Wordpress are pretty solid, but when new versions become available sometimes themes and plugins get broken until they are updated. It always pays to view the latest plugin compatibility list BEFORE UPGRADING, in case something you rely on might be immediately broken. It doesn’t mean to never upgrade in fear of breaking things, but rather be more aware of conflicts that might need fixing once you do. Just google wordpress x.x compatibility for the lastest official list (replace x.x with the version number you’re searching for in google).

Stay tuned to the next part in this series to learn how to examine your Wordpress powered site for exploits!

Visit the Wordpress Security Guide home to skip to other sections

Need Help Quick? Just Hire Me.