To date, my most common way of accomplishing the task would be to use a simple text field and use it to populate the URL of an image uploaded through the Media library. That was always really cumbersome and with everything I’ve been doing with Attachments lately I thought now would be a good time to put in the effort and make this process easier.

The trouble with this goal is the way Widgets work, though. You build Widgets by extending a class, and it would be really cumbersome to try and provide this functionality based on that workflow. Instead, I’ve built a plugin that will act as a utility when you build your own Widgets.

I know already that the biggest assumption for this plugin will be that it’s a Widget itself, but it’s not. This plugin does not attempt to make new Widgets available, it aims to make it easier for your to include an image field in your built-by-hand Widget.

How to use it

The plugin has been added to the plugin repository and you can grab it there. You install and activate it in the traditional way, and it will be available for use within the Widgets area of the WordPress admin.

To explain the usage of the plugin, we’ll go ahead and build our own Widget to power the Image of the Month for a website. It’s going to have the following fields:

• Text field for a headline
• Image field
• Text field for an image caption

To begin, we’ll start with the instantiation of our Widget:

This is a pretty standard invocation of a basic Widget, the biggest difference being it’s inclusion being dependent on the presence of the Widget Image Field plugin. The other addition uncommon to most Widgets is the $image_field definition. This was put in place to make the implementation of our image field more bulletproof by defining a consistency in our field ID.

The next thing we’ll tackle is the form() for the Widget section in the WordPress admin:

We’ve now got the image field implemented and can see it in the WordPress admin.

The $headline and $blurb fields are common to Widgets so I won’t cover those, and our $image_id stores the ID of our image, that’s the only thing that’s saved with this field, the plugin takes care of the rest.

Note: When we define $image_id on line 6 in this snippet we’re making use of the $image_field id we defined on line 10 from the first snippet and makes consistency more easy to manage as we go on.

It’s important to notice line 9 in the snippet, as it’s the first time we’re making use of the Widget Image Field plugin. We define $image as our WidgetImageField and pass the required parameters:

1. $this: the current Widget object
2. $image_id: the ID of the chosen image

The plugin is again used on line 18 in the snippet, where the plugin is utilized to output the ‘Choose image’ button displayed in the screenshot.

The next step will be to implement the update() function for our Widget, which handles data saving.

We’re again referencing the $image_field we defined in the first snippet, but data sanitizing takes place here the the results are returned back to WordPress for saving. Our Widget now stores data.

The final piece to implement Widget Image Field concerns Widget output within your theme, which is defined within widget().

The first step is the standard call to extract() which defines the necessary variables we’ll need for output, both those we have defined as well as those defined by the call to register_sidebar(). In this implementation we’re only using $before_widget and $after_widget.

We’ll define our Widget-specific variables, including our image field which again makes use of the $image_field defined in the first snippet. On line 11 we instantiate our WidgetImageField. Line 20 encompasses retrieval of the image asset itself.

The plugin provides the location and dimension for those chosen image by passing the target image size as the only parameter (defaults to 'thumbnail'). Using this information you can completely customize the output of your Widget.

Our final Image of the Month Widget consists of:

I’m not convinced this is the most elegant solution to accomplish my goal, so reading outside opinions about how to more gracefully ‘extend’ a custom Widget to achieve the desired result, I’d love to hear your thoughts!

Advertise here with BSA

I’ve just finished reading WordPress 3 Ultimate Security by Olly Connelly, which aims to help you make sure your WordPress installs are as protected as you can make them. Security is often one of the most intimidating pieces of running your own site, which is one of the major contributors to the popularity of shared hosting since many people are not comfortable managing their own server. Unfortunately though, shared hosting is often a false sense of security and can expose you further than a more segmented environment.

That doesn’t take away from the importance of being a responsible and reliable source of information for your clients. It’s very likely that your clients have no idea how their website works or how it’s even online, they just know who to call when something isn’t working properly. If you’re in charge of that environment, it would be a disservice to your client to cut corners or take a quick way out when it comes to their server setup. WordPress 3 Ultimate Security aims to help you harden your WordPress installs, resulting in a more stable, longer lasting website powered by WordPress.

Content summary

WordPress 3 Ultimate Security is quite a comprehensive guide. I wasn’t sure what to expect when reading the first chapter but it quickly became apparent that the content was going to sprawl the entirety of security as much as it were applicable. The chapter list is as follows:

1. So What’s the Risk?
2. Hack or Be Hacked
3. Securing the Local Box
4. Surf Safe
5. Login Lock-Down
6. 10 Must-Do WordPress Tasks
7. Galvanizing WordPress
8. Containing Content
9. Serving Up Security
10. Solidifying Unmanaged
11. Defense in Depth

Each chapter is further subdivided into a number of dense subsections covering a multitude of topics. The breadth of coverage impressed me from the start. Additionally, the tools and topics covered were modern, up-to-date, tried, and tested. I’ve read a number of security books and it’s rare to find one with comprehensive coverage of tools that will all be useful as you read through the chapters. Chapter 2 is especially interesting in this regard, as you’re guided through the process of analyzing and scanning a possible target as though you yourself were the hacker (or cracker in this case).

Chapter 3 provides extensive coverage on securing your local machine, which is a significant portion of every good security policy. Many times people forget that the biggest security vulnerability could have absolutely nothing to do with your server or the network it’s on, but instead your local computer. The one that insecurely stores you WordPress administrator login information.

WordPress-specific content doesn’t really ramp up until Chapter 5 of the book. SSL and security-oriented Apache modules are the focus of the chapter, leading up to Chapter 6 which outlines a number of smaller tasks that can help with WordPress security through obscurity.

The book moves into the server side of things in Chapter 9. The author gives advice on choosing the right host based on a number of criteria, outlines the pros and cons of popular control panel software solutions, explains how users and permissions work, all the way down to implementing a useful logging system.

The book gets even more detailed from there by discussing lower level server administration steps that can be taken in an effort to minimize the various ways a cracker may be able to obtain unauthorized access to your system. Through Chapter 11 I became increasingly impressed with the level of detail the author went to in discussing the vast number of responsibilities required when it comes to server administration tied into ways they can be exploited and ways you can thwart those attacks.

While I couldn’t consider this title to be the last one you should read on modern server security, I would highly suggest it as a starting point for things to look into as time goes on.

Overall reaction

After making it through the nearly 400 pages of content I was honestly impressed with the amount of content offered in the book. The author does a fantastic job of covering an extremely wide variety of angles which makes complete sense with such a diverse topic as security. If you were to follow the advice offered in the book you’d be left with not only a strong server environment, but a more secure local environment as well.

If you’re the person responsible for your client’s WordPress installs, or responsible for your own, taking a read through WordPress 3 Ultimate Security by Olly Connelly will very likely teach you a few things in a number of areas concerning your install. My take home message is an overall feeling of being impressed with the volume of content covered in under 400 pages. That said, the book may prove to be a bit overwhelming to some people who are less technical, but if that’s the case, unmanaged hosting might not be the place for you.

Advertise here with BSA

WYSIWYG field type

An often requested feature was the ability to have a WYSIWYG field type for Attachments Pro. With the advent of the_editor() we’re finally able to make use of the sometimes unwieldy customized instance of TinyMCE that WordPress uses.

As it went, I didn’t make use of wp_editor() at all and instead did things by hand since Attachments Pro dynamically creates/destroys instances of TinyMCE but beyond that, there is a lot going on behind the scenes to get the editor up and running. To keep a long story short, Attachments Pro will instantiate TinyMCE field types even when the post at hand doesn’t have a default editor. That often causes trouble with plugins that depend on the main content editor being present but Attachments Pro should survive even if that’s not the case. Testing is more than welcome in that regard, as there are a number of edge cases to account for.

Migration from Attachments

I questioned whether or not I should have included this feature for the initial release, but decided against it. One of the nice things was the fact that Attachments and Attachments Pro are interoperable, they can both be active at the same time. That said, if someone had been using Attachments on a project but wanted to upgrade to Attachments Pro, they could do so by leaving Attachments (and their theme customizations) as is, and progressively enhance with Attachments Pro.

Recently I received an influx of questions asking how to migrate the data from Attachments to Attachments Pro so I sought out to build a migration script, and it’s included and available as a beta in Attachments 2.4. I’d really love to have some testers of the script, but if you’re going to test the migration I can’t stress enough how important it is to back up your database first. This time, the ‘beta’ label means it.

If you’ve been waiting to move from Attachments to Attachments Pro, I hope this migration tool makes it easier for you!

What’s up next?

I’m receiving great feature requests on a fairly consistent basis and I really appreciate that, it really helps me prioritize what needs to be done next as I take care of any bugs along the way. The next new feature I’m going to start working on is another new field type: thumbnail.

A number of people are using Attachments Pro to populate videos, documents, and other non-image files (which were the original inspiration for Attachments) but finding it frustrating to not be able to have a thumbnail image for each resource. I sympathize with that and see it as a valuable addition, so I’m going to start planning the integration of that field type.

If you haven’t checked out Attachments Pro yet, please do so, I’d love to hear how you’re using it!

Advertise here with BSA

Working with any system comes with some inherent responsibility. Systems can be abused just as much as they’re used and it’s the abuse that tends to give a great system a terrible name. I think that happens with WordPress in certain ways.

While a simple caching implementation solves 95% of the major complaints people have with WordPress, I’ve lost count of the sites I’ve run maintenance on that have just way too many bloated, unnecessary plugins installed.

Please don’t take that to mean that my seeing a decent number of plugins activated correlates to a developer not knowing what they’re doing, of course that’s not the case.

That doesn’t change the fact that every plugin installation has an effect on your site. This article takes a deeper look at the effect than most. The testing process is interesting, and it’s neat to see the direct comparison of a few very well known plugins.

Advertise here with BSA

That said, as much as I love WordPress I do have some qualms about it, and everything can be summed up in three words: Custom Post Types. I’ve had a love/hate relationship with Custom Post Types for some time now, even back to before they were Custom Post Types. The problem can be outlined by taking a high level view over how you manage WordPress content.

At the root there are Pages. Pages are the skeleton to your site, they control the URL structure and give your content form. Then there are Posts, most often used to power the Blog of your site. Fact of the matter is, though, unless your Blog is the main page of your site, editing this content in two completely separate places doesn’t really make sense.

I completely understand the situation though, given WordPress’ roots, but I haven’t built a blog-focused site in years. One of the very first options I change is under Settings > Reading and redefine Front page displays, defining my Front page as a Home page I’ve created, and the Posts page as a Blog page I’ve created.

When I’m in this situation, I need to now have a Page view that structures the site in it’s fully organized glory, but then there’s this Blog Page that links to an edit screen that doesn’t power anything because WordPress under the hood us grabbing your Posts, which is in a completely different menu area.

This problem becomes compounded exponentially when Custom Post Types come into play. Now you’ve got a Page tree, Posts in the main sidebar that control the Blog section, and any number of Custom Post Types also in the main sidebar that power various (likely internal) sections of the site.

I hate explaining this to clients and I’ve wanted to do something about it for a long time now. So I have.

Introducing Hierarchy

In an ideal world, CPT editing would be directly integrated within your Pages structure (as Pages are the basis of your URL structure) and not need a dedicated sidebar menu entry. That’s the short version of exactly what Hierarchy does.

Hierarchy allows you to (optionally) remove CPT items from the Admin Menu and integrate them within a Page-like hierarchical view labeled “Content”. Take for example this sample WordPress site. It’s got a mix of Pages, Posts, and Custom Post Types working together to give an overview of a small design business:

The Page view gives us an overview of the site structure, but to manage the Blog or Portfolio is very disjointed with the action links being in the Admin Menu itself. When we activate Hierarchy, we see something like this:

In my opinion, this is much easier to work with in comparison, but it can be even better. All of the CPT entries remain in the Admin Menu, so Hierarchy will let you hide them. In addition, a couple seem a bit out of place, so Hierarchy will let you provide a menu_order for your CPT entry as well:

With these settings in place, we get a complete, hierarchical view of our entire site at once:

This really scratches an itch I’ve had for some time now, and I’m super glad that it’s finally been released.

Positioning your CPTs

It seems like a number of people are unfamiliar with the fact that you can give your custom post types a nested slug that falls below an existing Page. It’s as easy as defining the rewrite_slug parameter when registering your post type. That (in combination with the Order you set) is how Hierarchy knows where to place the CPT entry. Referencing our example site, we see that Team is a “child” CPT of the About page.

Our About Page has a slug of about and our Team CPT has a rewrite_slug of about/team:

<?php
register_post_type(
    'team',
    array(
        'label'             => 'Team',
        'description'       => '',
        'public'            => true,
        'show_ui'           => true,
        'show_in_menu'      => true,
        'capability_type'   => 'page',
        'hierarchical'      => false,
        'rewrite' => array(
            'slug'          => 'about/team'
            ),
        'query_var'         => true,
        'has_archive'       => true,
        'supports' => array(
            'title',
            'editor'
            )
    )
); ?>

You'll also notice that hierarchical has been set to false, that controls whether or not the CPT entries are included within the Hierarchy as well. If hierarchical is true, a populated Team section would look something like this:

Other things to note:

• The actions row includes a link to add a new CPT entry
• If has_archive is true there will be a View link present in the actions row, it will be omitted otherwise
• The actions row has an Edit link that will bring you to the standard WordPress CPT table edit listing
• Clicking the CPT name will bring you to the standard WordPress CPT table edit listing

Here is the Team row on hover:

Other things have been customized for CPT entries in Hierarchy including respect for a custom menu_icon you have set and hiding the Author, Comments, and Date columns as they're not applicable.

Handling taxonomies

Originally I had made a bigger issue out of taxonomies than it needed to be. When Hierarchy is building the content tree, it checks to see if any taxonomies are associated with the entry at hand. If so, links to manage those taxonomies are included in the action row:

As you can see in the screenshot, we've still got a problem though.

The Blog issue

As I had mentioned, another confusing issue comes up when you set Settings > Reading and redefine the Front page displays setting. In the example above, we've essentially got a duplicated link because this option hasn't been set yet, let's change that.

When you change the Posts page in Front page displays, Hierarchy takes that into account and merges the two, essentially hiding the (not needed) Blog Page, and replaces it with your Posts.

It does it in a smart way though, it'll use the Title you've set for your designated Posts page as the post type name of "Posts" doesn't really make sense anymore.

That's Hierarchy

I sincerely hope you enjoy Hierarchy and that it makes the lives of your clients easier, I know it will mine. I've been wanting to build this plugin for a year or two now, and although it's very new, I'd love to hear your thoughts and feature suggestions! WordPress just took another step toward even better content management.

Advertise here with BSA

The premise

Allowing client uploads has for a long time been a troublesome problem. With the advent of things like SWFUpload back in the day, things got better, but the variance among server configurations and connection speeds proved to be problematic more often than not.

Also: it needed Flash.

Luckily those days are very much in the past. While client-facing large file upload systems have been in place for a while, implementations haven’t quite trickled down to being labeled “easy”, until today.

I wanted to build a WordPress plugin that facilitated adding a client upload form to your site with the least friction possible, something you could literally activate, implement with a shortcode, and leave it at that if you wanted. Enter Front End Upload.

Under the hood

I’ve been keeping my eye on Plupload for a while now. Plupload is built by Moxiecode, the company most famously responsible for TinyMCE. Moxiecode defines Plupload as:

.. a highly usable upload handler for your Content Management Systems or similar. Plupload is currently separated into a Core API and a jQuery upload queue widget this enables you to either use it out of the box or write your own custom implementation.

It’s just that. Plupload system is elegant, takes advantage of the HTML5 goodness we like to see, and does things really well. WordPress core considered it for a long time before integrating it into version 3.3, so going with Plupload was an easy decision. I just had to figure out how it should work.

I wanted to have the plugin be shortcode based, if for nothing more than to lower the barrier to entry. Shortcodes are easy for novice WordPress developers to pick up, and advanced developers know all about do_shortcode() so that’s what I went with for the first version.

Once the shortcode was implemented, Plupload really took over. I was immediately impressed with how seamless everything worked. The thing I was most impressed with though, is the chunking that’s been implemented. During my testing I was able to upload a 1GB file to a shared host. That is an impressive feat to me.

Customization

The default implementation is far from glamorous, but that’s by design. My intention when writing plugins is to provide the baseline, the most basic implementation I can come up with as to prevent and customization hurdles.

The default skin for Plupload is used, and no styling is provided for the form. CSS classes are provided for easy customization and hopefully you can get up and running really quickly. The settings are also quite straightforward, with the goal of facilitating a customization of the implementation, not having to deal with any technical details:

You’re able to set a passcode, which when enabled will require the visitor to correctly enter it prior to gaining access to the upload form itself. You can put a limit on filesize, enable additional custom file extensions, customize the email that’s sent upon upload completion, and also provide your own markup for the success message.

Check it out, let me know what you think

Front End Upload is now available in the WordPress plugin repository, and I’ve love to hear your initial thoughts. I’d also like to hear what you think it’s missing. The plugin is brand new and I’m still coming up with a roadmap, but feature requests are more than welcome, I’d love to make the plugin more adaptable and useful for people.

A few things I’d love to take care of sooner than later:

• Customize the fields used in the form
• Add more available tags for the email template (e.g. submitter IP)
• Provide a way to customize the skin of Plupload

I can’t express enough how much of the heavy lifting Plupload is doing, this plugin is only a wrapper. I hope it accomplishes it’s goal though, and I’m really looking forward to some feedback now that it’s in the wild.

Advertise here with BSA

I’ve just finished reading Internet Marketing with WordPress by David Mercer. The book, like a number of Packt books I’ve read lately, takes a more abstract approach to its title. The majority of the information is useful aside from the niche (in this case, WordPress) and only becomes restricted to it periodically.

I’ve read a few books that follow this line, and I can see the reasoning for it. We say all the time that the tools don’t really matter, it all comes down to what works for you. The core principals are what matter, the philosophy behind what you’re doing, the premise of good and bad when it comes to something specific. That said, I really like when authors choose to write books in this fashion, but on the flip-side it could be a detriment when a potential reader doesn’t fit the mold of the niche.

That criticism aside, this book might not seem appropriate for my library, but I try to read as much about our industry as I can. My company provides a client service, and our client service directly applies to this industry, so to help my company become a better asset, a better partner to our clients, I do my best to keep up to date not only with the technical aspects of Web development and design, but also the areas in which my clients will focus once our project has been completed.

Building a website is going to become easier for our potential clients as time goes on. Eventually the tools are going to become so powerfully easy the lower hanging fruit in our industry is going to fall to the ground. It’s important to be well rounded in your approach to client work to remain relevant, and researching beyond your comfort zone comes with that.

Internet Marketing with WordPress

This book is for the people who want to get their website out there. In particular, it’s for those website owners that have a site powered by WordPress and would like some advice on how to market it to the world. It’s meant to help people expose their site without requiring a large ad budget.

The book opens by talking about the importance of finding a niche. The Web is supersaturated with a lot of noise, and the hardest part of your job is getting a signal through. The author gives a brief introduction to the world of Internet marketing and covers the circular, reiterative process necessary to become successful.

Preparation and business objective research are important topics early in the book. From there, target audience dissection is discussed and then David moves into a large discussion on content creation. He explains that essentially content creation is marketing, and it’s very important to have a plan in place that produces effective, valuable content.

SEO in WordPress

It wouldn’t be much of an Internet marketing book if Search Engine Optimization wasn’t covered, and all of Chapter 3 discusses the implications of SEO in your marketing plan. Here’s where some more WordPress-specific context comes into play. David explains the purpose of SEO in relation to searching on the Internet, and illustrates how much of the work WordPress takes off your plate.

David speaks about site and page (URL) structure in WordPress, and explains what effect it may have on SEO for your site. He goes so far as to explain how you should be constructing your content by using appropriate headings and taking advantage of the SEO-rich content insertion of an image can provide.

Socializing WordPress

David appropriately picks right up with the fact that simply having lots of optimized content won’t necessarily get you a successful marketing campaign, it takes more work than that. After beginning with a light overview of the current status of social networking on the Web, we’re guided into a number of ways you can directly integrate your WordPress site with any number of existing social networks you’re likely to take advantage of.

While this isn’t my favorite practice in the world, knowing how to appropriately take advantage of the ease of integration can be beneficial when used properly.

Being social yourself

The remainder of the book talks about ways of organically promoting your website as part of your marketing plan. What I like about David’s explanation is that he speaks about natural, grassroots, white hat approaches to socializing yourself. Making the most of your RSS feeds, asking other authors to collaborate on content generation in the form of an article or review, and forum participation to name a few.

Reader conversion

The book then moves into actual traffic conversion. This is where marketing does what it can to prove itself: metrics. When it comes to marketing, many people want to see results, but that’s not the most straightforward thing to slap a number on and call it a success.

The book covers conversions both in the concept of ‘followers’ (your readership) as well as converting customers (e.g. you’re making money through readers). Advertising, landing pages, calls to action, visual appeal, and copywriting are all discussed as methods of increasing these conversions.

The job is never done

One of the most important sections of this book is the final chapter titled “Analyze, Refine, and Repeat”. David explains that a marketing plan is never complete, it needs constant attention and revision and your job as a marketer is never finished. Assessment of performance is an essential part of the process, so that you can make changes to hopefully help the next round go that much smoother and be that much more effective.

Here’s where analytics come in. Metrics are a great way to compare and contrast moves in marketing over time, and having an established plan for analysis and review is essential to a plan’s longevity. Both Google Analytics and Webmaster Tools are discussed in the book, and David touches on how they can be directly integrated with your WordPress install.

In summary

Overall, I think Internet Marketing with WordPress by David Mercer is a great book to potentially recommend to clients should they be interested in becoming more serious about their marketing plan for a project. It’s well read, up to date, and quite comprehensive. As with everything, it’s not the single resource that should be used on a particular subject, but I see it as great overview material that goes into just enough detail without being overbearing. It incorporates WordPress to an appropriate extent as well which makes it not only useful on that level, but valuable to someone looking to refine their Internet marketing skill as a whole.

Advertise here with BSA

One of the crowd favorite features brought in WordPress 3.3 was the ability to further customize your permalink structure to use only the postname as the slug. Prior to 3.3 this was extremely costly and didn’t scale very well, especially once your page count grew.

A stroke of genius from Otto illuminates just how this problem was solved.

Studying the URL routing of WordPress has helped me to build better websites. I think that goes for any system you use, you should really know how it works as much as you possibly can. Your quality of work will rise exponentially and everyone (including yourself) benefits from that.

Advertise here with BSA

Things will get more interesting as time goes on as well. For example, today we’ll be releasing a single copy of Attachments Pro. Tomorrow there will be two copies given away. On the third day we’ll give away three copies. You can see the trend here, so keep your eyes open as time goes on!

The rules are quite simple: either myself, Kevin, or Iron to Iron will be tweeting coupon codes for a single copy of Attachments Pro. If you’re interested in a free copy, just follow us and wait. The coupon code can be entered at checkout.

Remember: you can use any domain when registering your copy, it can be changed at any time down the line!

While you’re waiting for the codes, have a look at all the new greatness in WordPress 3.3!

Best of luck everybody, and have a very Merry Christmas!

Advertise here with BSA

Pods 2.0 has been a work in progress for some time now. The core team has been doing everything we can to make it happen, but the fact of the matter is we’ve got families to support and bills to pay.

Working on such a huge project in our free time hasn’t facilitated what we wanted to get done in the time we wanted, so Scott has added Pods 2.0 on Kickstarter. The goal of the Kickstarter project is to facilitate a solid chunk of time for Scott to get a working alpha of Pods 2.0 out the door, something we’ve been working towards for months.

We’re trying to strike while the iron is hot and if the Kickstarter project goes through, Scott is hoping to have something tangible within 2-3 weeks. I’ll be continuing on UI work during that time, and hopefully our two paths can coincide and get a working alpha done in early fall.

If you use Pods, especially on client work, the Pods Foundation can really use your help in contributing to the Kickstarter project for Pods 2.0. Please spread the word. Here’s to Pods 2.0!

Advertise here with BSA