Reasons that lead to WordPress Website Hacking

There are umpteen reasons how and why a WordPress website is hacked. Here the top of the charts list.

1. WordPress Update: WordPress is highly maintained and updated regularly and these updates need to be implemented on the WordPress website instantly. By ignoring WordPress website updates, one allows threats to harm your website. WordPress ensures that every latest updated version involves improvements and security updates, which addresses existing threats, and when a website is not adhering to these updates, the organization is exposing the website to threats, malware, and hacking.
2. Default Admin Login: Even kids these days understand that the default URL for an admin panel login page is probably the most used link, for instance, com/wp-admin. This predictability makes it easy for attackers to hack/phish the website. Hackers and attackers usually try various combinations of username and password for hacking a program; setting an obvious or easy to hack username and password will aid bots crack the credentials and access the admin panel with ease, allowing the attackers to go ahead with their malicious activities.
3. Common WordPress Folders: WordPress has common folders across all websites, such as Plugins folder, Themes Folder, Uploads folder, etc. The website owner can add a different folder, and so can hackers. They can enter malicious code in it.
4. Insecure HTTP Server: A WordPress site can be hosted on an insecure HTTP server, which gives way to hackers to steal credit card information by intercepting the connection.
5. Inactive Users: Users, especially Administrators, have access to modify content, and every User with a weak Username and Password is a threat to the website. When it is necessary to retain users, it is advised to change the role of the User from Administrator to Subscriber to avoid weak links.

Measures to ensure WordPress Website Security

1. Keep it up to date: Keep your WordPress, plugins and themes up to date with their respective latest versions. Every new version of WordPress brings new features along with bug fixes and security fixes. Avoid unnecessary plugins and themes to reduce the vulnerability of the website. Always download plugins and themes only from trusted sources. Reading about the plugins, checking the reviews and number of downloads will help make the decision. Also, ensure that these plugins and themes sources provide regular updates, meaning even if there are bugs, the source should ensure an update or a fix.
2. Security Firewall Plugin: Install a security firewall plugin to scan your website regularly. The firewall plugin allows periodic scanning of the website, malware removal, and track any update on the website such as login details, documents trail, suspicious login attempts, etc.
3. Customize Admin URL: Change admin login default URL /wp-admin to your custom URL using the updated plugin and limit the wrong login attempts, to reduce the exposure to unauthorized users.
4. Rename WordPress Database Prefix: While setting up a website, the default prefix used for the database is ‘wp_’, and most admins ignore changing the default settings, making it easier for hackers. Spammers and hackers run codes that mass attack ‘wp_’ files. Rename the default WordPress database prefix, rename WordPress tables, and User Meta tables. Always remember to backup WordPress files before making any changes.
5. Avoid Common Usernames: Admin, wp-admin, etc., are truly common usernames that do not hold any strength against hackers. Using these usernames for the primary administrator user account makes the website vulnerable and easy to hack. Always have complex usernames and never have a username that appears anywhere on the website; for instance, you should not have an author name as is as a username.
6. Strong Password: Using a strong password is given. However, users do not pay great attention to work-related passwords as much they need to. As a brand guideline, encourage all users to use unique username and passwords. Every password should be at least eight characters and should include all of the following.
   1. One uppercase
   2. One lowercase letter
   3. One number
   4. One special character
   5. No spaces
7. Timely Backup: Be prepared for any adversity that the future holds, and make regular backups of all files and databases of WordPress website. Even in drastic conditions where an administrator is locked out, the backups can come handy.
8. Disable PHP Execution: Block the PHP execution to untrusted folders manually by using the .htaccess file or plugin. Folders such as uploads, themes, plugins by default have read and write access, ensure these rights are allocated based on user roles.
9. SSL Certificates: Secure WordPress website through Secure Sockets Layer (SSL) to avoid any data leaks. Run your website HTTPS server to protect the data from getting stolen.
10. User Rights: There are five different default users in WordPress. Each role has its own significance. Understand the user roles and assign access rights for each user role. Always remove access to any abandoned users. If an employee leaves an organization, the respective User should be either removed or transferred based on the requirement. Any unused or dormant user can be a weak link for hackers to enter.

Ensuring these measures are implemented effectively will close doors to any hackers or spammers or anyone phishing.

WordPress is an Open Source CMS which is free, but it does have some paid plugins. To secure the WordPress website, we need to take some actions on a regular basis. Always keep security and firewall plugins active to avoid all vulnerabilities. The best way is to keep a regular tab on your website and have a monthly or a fortnightly maintenance calendar to avoid missing out on any checks and maintain a secured website.
MetaSys has hands-on experience for more than two decades in providing custom software solutions. If you are looking for a WordPress expert to help you with WordPress website development or WordPress Security integration, you are at the right place. Get in touch with us and we will solve all your tech challenges.

Happy Coding!

Barcodes are nothing more than a machine readable form of data represented in the form of lines.  Nowadays, barcodes are an essential part of inventory management for a number of reasons. Firstly, saving time both in terms of data entry, and the automatic processing of the entries. Secondly, entry errors are reduced as the barcode scanning process has a very low error rate. Finally, barcodes help companies track the product across the entire production pipeline. Even after the product is shipped out, the company can track the product throughout its entire lifecycle.

Recently, we worked on a project for a client who wished to include barcode scanning capability in a personal health tracking software application. The required functionality was that the end-user could scan various food items and store the data in the applications web portal. This would allow the user to record their daily food intake conveniently, without wasting much time entering the data.

The first step in the implementation was a data import of standard food item barcodes, which we imported from an available data library. This gave us over 200,000 records of day-to-day food items of popular brands.

Since the users don’t typically own barcode readers, we required a solution that allowed the users to scan the barcodes using their personal electronic devices. Since most people carry mobile phones with a camera, we started looking into the option of using phone cameras as barcode readers.

Since we had a web-based application, it was preferable for us to use a client-side code library or plug-in. After evaluating a few possible options, we decided to use ‘QuaggaJS’ which is a JavaScript-based advanced barcode reader. ‘QuaggaJS’ can read various types of barcodes such as EAN, CODE 128, CODE 39, EAN 8, UPC-A, UPC-C, I2of5, 2of5, CODE 93 and CODABAR.

‘QuaggaJS’ implements the following steps:

1. Read the image and convert it into a binary representation
2. Find the location and rotation of barcode
3. Decode the barcode

We wanted to allow the users to scan barcodes using their laptop as well as mobile phones. We kept specific benchmarks about camera resolutions, and if a user’s laptop or mobile camera met those benchmarks, then they could scan the barcode. We also required an alternative solution for users with older mobile phones which did not have cameras that met the benchmark. We decided to let the user choose any of three options to enter a food on the portal:

1. Live scan: using the mobile camera to scan the barcode
2. File upload: upload an image of the barcode on the portal
3. Manual entry: enter the barcode numerically

After entering the barcode, the user can look up various information about the item if it is in the library. The library includes valuable information such as calories, portion sizes, and nutritional content. Our goal was to make food tracking on the application very user friendly, and using barcode scanning we managed to provide the user a very quick and easy way to track packaged foods.

Feel free to contact us if you are interested in a similar implementation for your application.

How does it help?

The client wanted the ability to read the email inbox, import the order to the system and then send the email with the order details generated to the sales representatives.

With regular mail reading API’s the process would have been as follows. First the email is read, secondly the order is imported, and finally a new function is called that sends a new email with new order details to the sales representative. In this case the details of the requester are saved and reused for sending the confirmation email.

Using the EWS managed API, a more efficient solution was developed. The email was directly forwarded from the email inbox, without the need to create a separate email for the order confirmation. The confirmation email is created directly from the received email object, as is the forwarded email to the sales representative. The following code sample shows how the forwarded email is created and sent:

ResponseMessage responseMessage = message.CreateForward();
responseMessage.ToRecipients.Add(email.FromAddress);
responseMessage.BodyPrefix = messageBodyPrefix;
responseMessage.Send();

In the code snippet above, “message” is the object which contains all the details of the order email and we use it to create the new forward email without saving any details to the local system or variables.

Similarly, we can use reply functionality of the API to maintain the email conversation chain by using the following code:

bool replyToAll = true;
ResponseMessage responseMessage = message.CreateReply(replyToAll);

string emailbody= “Please find the attachment below.”;
responseMessage.BodyPrefix = emailbody;
responseMessage.Send();

Setting the “replyToAll” variable to true specifies that mail will be forwarded to all the recipients who were present in the original conversation. The text contained in the variable “emailbody” will be on the top of the email body of the conversation.

Additional features of EWS managed API

EWS provides useful features for dealing with emails with invalid delivery email addresses. The postmaster bot may send a mail delivery failure email to the same inbox, which can cause issues with the importing of other orders. These issues can be resolved in EWS by checking the subject lines, and automatically deleting delivery failure emails, or moving them to a separate folder. These orders can then be separately corrected and resent without interfering with the remaining orders in the inbox.

The following code sample can be used to move all the email items from the inbox to the “DidNotDelivered” folder:

Folder rootfolder = Folder.Bind(service, WellKnownFolderName.MsgFolderRoot);
rootfolder.Load();
foreach (Folder folder in rootfolder.FindFolders(new FolderView(100)))
{
FindItemsResults findResults =
service.FindItems(WellKnownFolderName.Inbox, new ItemView(10));
// The if below checks if the folder “DidNotDelivered” is present in the email box
if (folder.DisplayName == “DidNotDelivered”)
{
var fid = folder.Id;
foreach (Item item in findResults.Items)
{
item.Load();
item.Move(fid);
}
}
}

This is how EWS helped us simplify the processing of emails with minimal lines of code.

We hope that this article gives you some useful ideas for dealing with Microsoft Exchange using EWS. If you are having issues, feel free to get in touch with us at https://www.metasyssoftware.com/dot-net

ANTS Profiler

ANTS Profiler can be used on any .Net application, either web based or in Windows to identify slow processes. We have found that it is useful both at the development stage, and the QA stage. Using the tool involves starting up the ANTS Profiler, and navigating through the app to view the pages with slow performance. Once the profiling is complete, we can dive deeper into the processes that the profiler identifies as slow.

To give you an idea, here are some examples of performance issues we were able to identify and address:

1. The first step we took when analyzing a slow app using the ANTS tool, was to check the database calls. The profiling showed that certain stored procedures were taking a lot of time. The problem was addressed by rearranging joins used in the stored procedures, and selecting only those columns necessary for the output. This significantly improved the rendering time for the page.
2. The profiling also showed that in a single page, there were multiple stored procedure calls which were increasing the database hits and slowing down the app. To overcome this problem, we combined multiple stored procedures into one, which improved the page performance.
3. It was further identified that whilst rendering the page, multiple JavaScript and CSS files were getting loaded, making rendering very slow. The ANTS Profiling helped identify the slowest web requests. This allowed us to use the bundling concept to group files together in order to reduce the number of web requests, thereby improving the speed of rendering.

New Relic

New Relic is another commercial tool which can be used to analyze performance once an app has already been launched. It provides real-time data of user experience with the application in the production environment, which is extremely useful to optimise the process of improving application performance.

To give you an idea of how New Relic can be used, below are some insights we gained from New Relic when trying to improve a customized web application.

1. The data showed us that as the number of users increases, the rendering time for the page increases as well. It was able to give us a lot of insight into how CPU and memory is used by the application.
2. The data also showed us which pages are most viewed, allowing us to focus on improving the performance of these pages. It also showed us on which pages errors were most frequently encountered, as well as the time taken for web requests and database calls on these pages. These were then fine-tuned to significantly minimize the frequency of errors.
3. The tool gives us analytic information about the most frequently used browsers and devices used to access the web application. This information helped us focus the application implementation in order to improve the user friendliness on those browsers and devices.

Improving the app performance in terms of speed and user friendliness will improve the user experience and thereby significantly increase web traffic. Although working on application performance can be a pain, ignoring it is not advisable for any developer. The use of these tools can be very helpful at different stages: ANTS Profiler is most useful at the development environment and for QA, whereas New Relic is most useful in the production environment to analyse the user data.

MetaSys has extensive expertise in improving application performance, including the use of the different tools, some of which have been described in this article. Feel free to contact us for help with improving your application performance. For more info https://www.metasyssoftware.com/dot-net

This article details such an integration project. Our Dot Net application team helped a client integrate InBody technology into their application. 

InBody devices offer detailed measurement of body composition balance, including key health factors such as protein, minerals, BMI and body fat percentage. Our project revolved around integrating the InBody 570 device with a .Net application. The solution we implemented involved the .Net application listening to the serial ports attached to the device for the duration of the test. After receiving a data stream from the InBody device, relevant data is extracted using indices of specific data factors mentioned in the InBody 570 technical documentation. Key settings required by the .Net application include baud rate, parity, data bits, and stop bits. The InBody technical specification includes more details about the values of these settings.  Once the data stream is received, and the data factors are extracted, the data was saved in an SQL server database. The .Net web application reads this data from the SQL server database and displays it to the user. 

Key Challenges

The idea is that the application can be used by the fitness facility subscribing to the application and having an InBody machine. The application runs on a laptop or desktop computer connected to the Inbody machine. However, one challenge was that there is no guarantee that the computer is always connected using the same port. If the computer had more than one port on which the device stream can be received, then we had to lock and keep listening to all available ports. Our solution to these issues was to program the app to lock and keep listening to all available and open ports of the laptop and as soon as we receive either data stream or exception, we unlock all ports locked by the .net application. It is important to note that only that process which has locked the serial port can unlock it, no other process can forcibly remove that lock. In the event that the process which locked the port gets terminated, one is left with only the option of system reboot in order to unlock that port.

Another issue is that the same app was required to integrate with another measurement device manufactured by InBody, the BPBIO 320. This device reads systolic blood pressure, diastolic blood pressure and pulse, and we modified the .Net app to work with both InBody devices. We used a condition-based code, which looks at application settings and accordingly saves the data in either the production or the staging environment. The BPBIO 320 requires a different baud rate to that of InBody 570, therefore we adapted the application so that the user enters the test type, and then the baud rate is automatically set up by the software. We also process information contained within the data stream that indicates status such as “Measurement started”, “Measurement interrupted due to use of the stop button”, and “Measurement interrupted due to error”.  These cases are handled in the application and clear information is passed on to the user.  

We used a PuTTY tool to simulate the device stream in the development environment, as the physical device was not always available. Device testing was performed after development was complete, and we made the necessary changes to the application before the launch.

We will be glad to help anyone interested in doing similar kinds of integrations in their software. For more info https://www.metasyssoftware.com/case-study-dotnet

Improving database performance is a challenging task that developers need to pay attention to in order to reduce the response time for the users. In this article, I am sharing a technique for Database Performance Optimization using Data Partitioning.

What is Data Partitioning?

Data Partitioning refers to the database process of dividing large tables into smaller parts by  Rows and Columns. A major benefit of Data Partitioning is that one only needs to specify the partitioning criteria, and then SQL handles the data by itself.

SQL uses multiple .ndf files (Secondary Database Files), in addition to the .mdf file (Primary Database File) to divide and store data based on the partition criteria. The user needs to specify those .ndf files and provide the partition criteria by using Partition Schemes and Functions. SQL Server then takes care of data maintenance by itself.

Data Partitioning can be divided into two categories:

1. Vertical Partitioning: In vertical partitioning, data is divided column-wise. For example, if  a database contains a table with 10 columns of which only 5 columns are used frequently, it can be divided into two tables with 5 columns each. This way a table is made more efficient, by dividing it into multiple filegroups based on columns.
2. Horizontal Partitioning: In horizontal partitioning, data is divided row-wise. For example, suppose there is a table with 1 lakh of records for the period 2011 – 2019, where each record includes a date. Quite often it is only necessary to access the records for last year, i.e. 2019 or recent years -2017,2018. Through horizontal partitioning, the data can be divided into yearly records in multiple filegroups.

By using these Data Partitioning techniques, we can enhance the performance of our database. This is a highly recommended technique for applications where Reporting is frequently used.

Worked example:

We have a table called tbl Data Partitioning with approximately 2.5 crore records. The data includes records from 2011 to 2014, of which the 2014 records are 45 lakhs. The Table looks like:

To execute a select query to find the 2014 records takes almost 23 seconds.

Using Horizontal Data Partitioning on the table using Created Date, the time can be significantly reduced.

For that, we first need to specify the filegroups:

After creating Partition Functions and Schemes, we can map the partitions to filegroups.

Finally, After implementing Data partitioning, the time taken by the Select query is reduced from 23 seconds to 15 seconds:

Advantages of Data Partitioning:

1. Improves performance for larger tables.
2. Fast and expensive storage can be used for active data filegroups, while keeping the less active data filegroups on slower/less expensive storage.
3. Partial backup and restoration is possible.
4. Can be used temporarily as a substitute for data archiving.

Our team has experience of working on PHP MySQL development projects and has handled many assignments from small informational website to robust enterprise applications. For more information https://www.metasyssoftware.com/php-mysql

• Easy to develop websites with interactive dynamic content.
• PHP is fairly easy to learn
• PHP Model View Controller (MVC) framework is now available to develop, manage and maintain complex web applications.
• LAMP, XAMPP are some of the better options to deploy the applications quickly & cost-effectively.
• PHP is compatible with all major web server platforms and web browsers.
• PHP website development software can be easily embedded into an HTML file.

MetaSys Software has experienced PHP, MySQL developers who can help you with your requirements. Customers expect speed and often bounce rate goes up when websites load slowly. This can be effectively handled by experienced PHP developers at MetaSys. Our developers also use the  CakePHP Framework which speeds up the development process.

At MetaSys we offer PHP based web application development using MySQL and/or FileMaker as the backend for multi-tier architectural solution. With FileMaker PHP API it is quick to extend existing FileMaker solution to the web. A PHP MySQL being completely open source is a cost-effective combination and allows you to develop a solution customized to your business needs.

If you are looking to outsource PHP development projects then please feel free to contact us.

New Features

• Brand New Bootstrap Cards
  Cards have been introduced to unify some of the previous elements such as panels, wells, and thumbnails. It is an extensible and flexible content container. It includes options for a wide variety of content, headers and footers, powerful display options, and contextual background colors. Cards are more flexible and allow a bigger space for creative implements.
• Opt-in Flexbox Support
  In the newer version of Bootstrap, you can take advantage of CSS3’s Flexbox Layout. Flexbox layouts are adaptable and can be well utilized in the responsive design. It presents an elastic container which fills the available space either by expanding or shrinking itself to the most proficient way.
  IE 9 users, please note that Flexbox does not support version 9. Hence the default version of Bootstrap 4 uses float and display CSS properties for the implementation of a fluid layout.
•  Relative CSS Units
  As a significant move to streamline the CSS -Bootstrap 4 dropped support for the IE8 browser. The new release uses REMs and EMs which enables implementation of responsive typography on Bootstrap sites. It also improves readability and improvement in accessibility for physically challenged users.
• Handy Utilities
  Various useful helper classes have been added such as margin and padding, and text helpers. Also, there are responsive and contextual colors helper classes to hide content on particular breakpoints.

Significant Changes

• Improved Grid System
  Bootstrap’s fluid grid system allows programmers to focus various devices having different viewports. At present Bootstrap 3.x grid system offers 4 classes to define different size columns. Bootstrap 4 improves the fluid grid mechanism with a 5th one which facilitates programmers to aim for small devices having a viewport of 480 px or lesser than that.
• Completely Redesigned Navbar
  The new Navbar is simpler. You can toggle it using the Collapse component, the `.navbar-toggleable-xs`, `.navbar-toggleable-sm`, etc.. let you control the breakpoint. Here’s an example.
• Fonts are Bigger
  In Bootstrap 4, the default font size which was earlier 14px is now changed to 16px. Also, a new large display for headings which makes text stand out.
• Tether powers tooltips and Popovers
  Tether, a JavaScript library, offers the position of an absolute positioned element stay next to each other on a web page. The power of Tether will enable automatic placement of tooltips and popovers. Note that it is a 3rd party library which supports IE9+, needs to be included separately in your HTML before adding the bootstrap.js.
• A New Approach to Global Theming
  It will be the most interesting change. At present, with the version 3.x, it is very hard to do changes in RAW CSS, LESS file and overriding the settings. Easy customization of the global theme is expected in the new version.

RIP

• Rearranged Support for IE
  The newer version has dropped support for IE8 as it was not supporting CSS media queries. IE 9 does not support Flexbox. To support IE9 Bootstrap has made Flexbox as optional to integrate with the framework.
• Glyphicons Dropped
  Glyphicons, which was used by many, has been removed. The alternative provided is to use Font Awesome and Octicons as third party components. Instructions will be included eventually in the documentation.

Changes Behind the Scene

• Bye Bye LESS, Hello SAAS
  As compare to LESS, SASS is more popular among frontend developers. SASS is easier to use, offers more possibilities and has an immense community base.
• Refactored JavaScript Plugins
  All JavaScript plugins now are rewritten in ECMAScript 6 to take the benefit of the latest specification to improve the frontend experience.
• Optimized Variable Customization
  Now all the Sass variables are incorporated into one single file named _variables.scss. This makes customization very easy. To change the default values, one needs to copy the settings into another file named _custom.scss.
• New Reset Component Called Reboot
  The Reboot module now replaces the normalize.css file. The new module is the enhanced version of the normalize.css with the goal to include generic style and selectors within a single and easy to use.SCSS file. This change enabled the user to override the default setting in a better way without using ‘!important’.

This article is based on Bootstrap 4 alpha 3 version. For latest updates, visit the official blog.