The attack script appears to connect to a database which stores passwords that have been successfully discovered using the tool.  This, over time, will allow it to isolate patterns, spot trends and generally go about its attack in a more clinical and successful manner.  Going hand in hand with this potential intelligence (and it’s hard to say just how intelligent this script is without seeing it) is the scale at which these attacks could be carried out and the distributed nature of them.

There are, however, some simple tips you can follow to reduce the risk posed by attacks like this.

Don’t Use the “admin” User

I’m going to go out on  limb and assume that this script attacks the site’s “admin” user – the user account automatically created when WordPress is installed that automatically gets granted full rights.  If this is true (it’s been true of many similar attacks in the past) and easy way to reduce the risk of becoming a victim of such an attack would be to remove, disable or lower the privilege of the admin account.

To do this, click on Users, then Authors & Users and then click on Edit next to your admin user.  I recommend changing the role to “Subscriber“, which basically gives them no rights.  Have a look at this codex entry for more information on user roles.

Restrict Access to Admin Functionality

If you always access your WordPress site from the same location (physical location) then a viable tactic is to restrict access to your administration functionality to users from certain IP addresses.  Fortunately, this is fairly trivial to do.  The first step is to find out your IP address.  This can be done a variety of ways, the easiest being a web service such as What is My IP?, which is free and quick.  Once you’ve got your IP address, you’ll need to create a small text file on your server, called a htaccess file, that restricts access to this IP address.

Create a blank text file on your computer and paste the following text into it:

Order Deny,Allow
Deny from all
Allow from x

Replace the “x” with your IP address and save the file as .htaccess.  No, that’s not a typo, it’s .htaccess.  Note that if you’re on a Mac you’ll need to turn on hidden files because every file on a mac who’s filename begins with a period gets hidden from view.  See this post from LifeHacker on how to display hidden files in OSX (it’s really not complicated).  Once you’ve done that, fire up your FTP program of choice (Transmit, before you ask) and upload the .htaccess file you’ve just created to the wp-admin folder on the server.

You can read some additional information on .htaccess files here.  .htaccess files only work with the Apache web server platform.  If you use a different platform, such as Microsoft’s IIS, you’ll need to follow the appropriate instructions for that platform.

A word of warning.  Using this technique is dangerous.  It’s a bit like using a sledgehammer to crack a nut.  If your IP address changes at some point in the future, which happens regularly with most home ADSL connections, or you need to access your site from a different location (when on the move, in a hotel or airport etc), you’re out of luck.  The only way around this is to change or remove the .htaccess file.  An alternative would be to add additional IP addresses to your white list.  To do this, just copy the line beginning “Allow from” and add a new IP address.

Use A Plugin

The third option, which is less involved than manually adding a new .htaccess file is to use a plugin.  One such plugin is called Login Lockdown and is described by the developer as such:

Login LockDown records the IP address and timestamp of every failed login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery. Currently the plugin defaults to a 1 hour lock out of an IP block after 3 failed login attempts within 5 minutes. This can be modified via the Options panel. Admisitrators can release locked out IP ranges manually from the panel.

This particular plugin, and there are many alternatives, uses login attempts from IP addresses to detect potential intrusions.  It takes a more conservative approach than a defaults to blocking .htaccess file and is configurable. This configuration, in theory, allows you to make the blocking more aggressive should you feel the need or less aggressive if it’s causing you issues.  Despite this level of configuration, using a plugin does result in a lack of control which means you can get caught flat footed should the type of attack change (for example, if the IP addresses of the attack machines keep changing).  For most users though, this reflects an acceptable compromise.

What tips do you have for securing your blogs against attacks like these? Let us know in the comments.

I still feel, however, that it’s important to focus on areas for improvement.  This is traditionally, and understandably, difficult when it comes to a tool like WordPress.  The extensive plugin community fills many gaps, and typically provide more choice than a solution that is baked into the core of the application itself.  So let’s look at some of the low risk enhancements that could, and should, be made to WordPress in the coming releases.

Search

By far the most controversial of my suggestions is improving the search functionality. I’ve seen arguments for and against this.  The arguments for simply state that the current search mechanism isn’t good enough.  The arguments against state that there are plugins out there to improve search, and by using a plugin you can choose a solution that better suits your needs.  Nevertheless, there are basic improvements that can be made to the search functionality that wouldn’t put anyone’s nose out of joint.  I can’t see many, if any, people who rely on the search mechanism working the way it currently does.

Personally, I tend to switch the blogs I control over to using Google Site Search instead of the default WordPress search feature.  Despite the fact that people temporarily leave the site, the look and feel changes dramatically, and the risk that your latest content is yet to be indexed, it still provides a significantly better experience (and results) than the default search.

Speed and Stability

Despite recent improvements, WordPress sites can and do struggle under moderate to heavy loads. The simple fact is that they use more server resources than they really need to.  Once again, I need to reiterate that this situation has improved vastly over the last few releases (no doubt in part to the close work the WordPress team have done in conjunction with the MySQL guys), but it’s still got some way to go, and lags behind many other blogging and CMS tools.

The API

To say the current XML-RPC based API implementation is crippled would be an understatement. Managing a site is still only really possible through the web backend, with publishing new content (and still not every attribute is available when doing that) the only real option available. Quite why tool developers can’t have easy access to administration functions, most notably comment moderation, I don’t know. I’d love for the WordPress iPhone application to be able to do more than just post new content, that’s typically not what I want to do on the go. What I’m more likely to want to do on the go, the sort of thing that you have to address urgently, is moderate comments. I want to be able to do that.

WordPress also uses APIs to access some of its feature set through themes and plugins.  For example, the creation of custom headers – as seen in the default WordPress theme, is achieved through an API. The documentation for these APIs is, for the most part, extremely poor, if it exists at all. Many theme developers are just teased with this functionality, knowing it’s there but unable to fully exploit it.

Custom Fields and Customisation

I use the custom fields in WordPress quite a bit.  To do certain things in templates, you have no choice.  But my using them is not an endorsement of them, in fact I’m really not a fan. Currently a custom field is simply a key – value pair that gets associated with a post.  If a key has been used previously, it appears in a drop down list for future selection. In some ways, such a simple solution is elegant, but in practice it causes problems and tends to make theme developers think twice before using them.  Especially if the theme is to be used by those who are not tech literate.

As a minimum, I would expect the following options for each custom attribute: -

• Whether it’s mandatory,
• Whether it appears in the RSS feed, and if so, where (beginning, end?),
• The type of data it contains (currently all custom values use the same text box which isn’t usable for large pieces of data),
• Whether users can choose to add new custom fields or whether they are restricted to a pre-defined set.

Going hand in hand with these changes would be a method of customising the write page to better incorporate custom fields. I know which is currently possible, but is only accessible to theme and plugin developers, not the site administrators – which seems non-sensical to me.

Misc.

In addition to the four major changes I’ve listed above, there are some other changes I’d like to see that may be more controversial – and less likely to be implemented.  These are: -

• Management of multiple blogs through one admin interface (WordPress MU is a start, but it’s something that would do well to be built into the main tool to ensure theme and plugin compatibility),
• Better options for site administrators,
• Better organisation of plugin options.

What are your hopes for future WordPress releases?

One of the interesting things about this survey is that the WordPress team rather publically enlisted the help of some usability experts for the 2.5 release, which completely redesigned the back end interface.  Whilst there were undoubtedly many improvements, there are still some aspects of the adminstration interface that need work, and many of us (including myself) have felt that the structure and organisation of administration options is one of them.

So take part in the survey, and have your voice heard.

Background

I’ve recently soft-launched a photoblog, which can be found at http://simontphotos.com.  I took a look around and none of the available WordPress themes grabbed me.  They were either too clunky, or cluttered, or distracting.  Or, at the other end, they were too simple and didn’t have the style I was after.  So I had to create my own.  I thought about it, and realised that to make the blog usable, I’d have to use thumbnails to draw people into the posts, getting them to view more of my photos.  I had another requirement, when viewing the main post, I wanted to display the image front and centre, outside of the main body of text.  This meant that for every post I needed two different sizes of of each image.  This isn’t something I wanted to do manually, so I needed a system of automatically resizing them.

Before tackling these requirements, it’s important to understand that there isn’t specific WordPress functionality for this task.  While it accepts and re-sizes images, it doesn’t make any images available to use in templates specifically.  They just appear in line with the rest of the post, which makes it difficult to style these images on their own.  It’s nigh on impossible to implement a thumbnail using in line images, and if you could to it, it would be a hack that would be difficult to use.  WordPress will also re-size images to sizes it feels are appropriate, which takes away an element of control.

Custom Fields to the Rescue

Fortunately, WordPress provides a feature called “Custom Fields“.  This allows you to assign a value to a post and give that value a name.  So when you’re designing your theme, you specifically return the value of that custom field.  For the purpose of this post, we’ll be creating a custom field called “image”.  This will hold the URL of the image you want to associate with your post as a thumbnail.

The custom field feature can be found towards the bottom of the post creation page in WordPress.  The “key” is the name of the value, where “value” is the value itself.

Putting it to Work – The Post

So now we have a plan, let’s put it into practice.  Adding a thumbnail to a post is a two step process.  Firstly, you have to upload the image, secondly, you have to associate that image with the post.  Of course, if you are using an image that’s hosted elsewhere, you can skip the first step.

We’re going to use the standard WordPress image management functionality to upload our images.  You should be familiar with this (click the “Add an image” button, choose an image to upload).  After uploading an image, you should be presented with a screen similar to the one to the right.  It’s the “Link URL” value we’re interested in.  This is the location on your site where this image lives.  This is a configurable location, but will usually  be in folders organised by date.  You want to copy this URL.  When you’ve done this, make sure to Save the changes, and not “Insert into Post”.

The next step is to associate that URL with the post.  This is done by creating a new custom field with the key “image” (Note:  I’ve used image, you can use anything so long as you remember it for the rest of this article).  The image below shows how to add a custom field.

Note that in the image above a drop down menu is present that contains the option “image”.  This drop down contains a list of all the custom field keys you have previously used.  If you’ve not used any, it won’t appear and you’ll have to manually type image into the Key field.  Then, simply paste the URL you copied earlier into the Value field, and click “Add Custom Field”.  That’s it, the image URL is now associated with your post.  So let’s look at getting that into your theme.

Putting it to Work – The Theme

If you’re reading this post, I’m going to make an assumption about you – you are at least passingly familiar with WordPress Theme Development and PHP.  You may be able to work your way through this post if you’re not, but any problems you come across may be insurmountable.

Retrieving a custom field in a WordPress theme is remarkable easy.  There’s a function called get_post_meta which takes three arguments – the Post ID, the Key (or name) of the value, and whether you want it to only return one value or not.  When invoked it returns (note that it returns the value as opposed to printing it) the value held against that post with that key.  Use it like this:

get_post_meta($post->ID, "image", true);

That returns the URL of the image you have associated with the post.  All you have to do is echo out the URL as the SRC attribute of an IMG tag, like so:

<img src="<?php echo(get_post_meta($post->ID, "image", true)); ?>" />

And that will display the image associated with your post in your theme.  This really is touching the surface of what’s capable and will display the image in the same size as it was uploaded as.  You’ll also want to wrap a link around the image and make sure there’s an alt attribute in there.  I would image you’d also want to add a class or two to help with styling.

Taking it a Step Further

As I mentioned at the start of this post, I want to do something a bit different.  I need the image in two different sizes.  I don’t want to have to re-size the images myself and then upload multiple copies, that’s far too time consuming.  So what we need is a way to automatically re size the image depending on what we want to use it for.  Step Up phpThumb.  phpThumb is an open source PHP script that will automatically re-size images for you.  One of the strengths of phpThumb is that is caches images, which means that it only re-sizes them once, saves the re-sized version on your server, and then serves the saved version.  This speeds up your page loads and reduces the strain on your server.  There are also a load of options, but we’ll look at those later.

To use phpThumb, you need to store the script in your themes folder (it doesn’t have to be, but it really is best if you plan on making the theme portable).  Then, instead of calling the image directly you call the phpThumb script and give it the URL of the image you want to re-size and the size you want to output to be.  So, instead of this:

<img src="http://www.yoursite.com/image.jpg" />

You will have this:

<img src="http://www.yoursite.com/phpthumb.php?src=image.jpg&w=100&h=75" />

The second URL will result in an image that’s been scaled to 100 pixels wide by 75 pixels high whereas the first one will just display the image in its native size.  The first time this URL is called, phpThumb will re-size the image and save it on your server.  Subsequent calls will simply serve the previously saved image.  So, to incorporate that into our theme, we would do something like this:

<img src="<?php echo TEMPLATEPATH; ?>/phpthumb.php?src=
<?php echo (get_post_meta($post->ID, "image", true)); ?>
&w=100&h=75" />

That code will result in the image you added to your post being re-sized to 100 by 75 pixels and displayed.  Easy, huh?  Warning: The script above makes some assumptions about the location of the phpThumb script, please change it as necessary to suit your needs.

Getting Super-Advanced

I bet you’re pretty happy with the results.  But there’s so much more you can do with phpThumb.  Below is the function I use to generate the phpThumb URL.

<?php
function thumbnail_url_builder($url,$width,$height,$zc,$copyright) {
    /* 
        This custom function uses the PHP Thumb script to build a URL for a scaled image
        There are additional options like copyright, size and whether to Zoom Crop
        To see more information on PHP Thumb - http://phpthumb.sourceforge.net/
    */
    $tn_url = get_bloginfo('template_url').'/phpThumb/phpThumb.php?'; //  Base PHPThumb URL
    $tn_url .= 'src='.$url;  // Add original image URL
    $tn_url .= '&amp;w='.$width; //  Add Width
    $tn_url .= '&amp;h='.$height; //  Add Height
    $tn_url .= '&amp;q=90'; //  Add Quality, default to 90
    //  Zoom Crop or not?
    if ($zc == 'true') {
        $tn_url .= '&amp;zc=1'; //  Zoom Crop is true (On)
    } else {
        $tn_url .= '&amp;zc=0'; //  Zoom Crop is false (off)
    }
    //  Add copyright?
    if ($copyright == 'true') {
        $tn_url .= '&amp;fltr[]=wmt|Copyright 2008|2|BR|FFFFFF||50'; //  Add copyright
    }
    $tn_url .= '&amp;f=jpg'; //  Set Output Format
    return $tn_url;
}
?>

This function provides me with several options.  I can control the size, quality and format of the image as well as optionally adding a copyright watermark and deciding whether I want to use Zoom Crop (Zoom Crop will display part of the image, in the requested size, retaining its aspect ratio.  Turning it off will display the full image in the requested size but will change the aspect ratio) or not.  I’m not going to go through the options in detail, they are all covered in detail on the phpThumb site.  But as you can see, the tool is pretty versatile and works well when trying to create thumbnails.  My function is called like so:

<?php
        if (get_post_meta($post->ID, "image", true)) {
            //  There is an image
            //  Get the url for a scaled version of the image
            $tn_url =
thumbnail_url_builder(get_post_meta($post->ID, "image", true),'289','100','true','false');
            //  File does exist, go ahead and print it
            ?>
            <p><a href="<?php the_permalink(); ?>">
<img src="<?php echo $tn_url ?>"
alt="<?php the_title(); ?>" /></a></p>
        <?php

        } // end if image
?>

If you try this technique, be sure to let us know your results and / or any problems you come across.

So that’s the “why” out of the way, what about the “how”? I’ve previously covered two plugins that assist you with linking in WordPress Blogs by automatically turning certain strings of text into links in my crucial but invisible WordPress plugins post. One will automatically turn typed URLs into hyperlinks, and the other will automatically turn category names into hyperlinks. Both these plugins require very little to no maintenance and just work as advertised. I wasn’t overstating the fact when I called them crucial.

Today, I’ve added a new tool to my arsenal. While reading the excellent Daily Blog Tips blog, I came across a post on 10 Easy Ways to Improve Internal Linking. Within that post is a link to a plugin called aLinks. aLinks allows you to turn any phrase or word into a link, this makes linking to other sites, and other pages on the same site, an absolute breeze. Now, instead of having to type out the URL every time you want to link to another one of your posts, you can just type its name, and aLinks will automatically turn it into a link for you. Another factor which makes this plugin very easy to recommend is the excellent help file that comes with it, a help file which is accessible, and appropriately linked to, from the WordPress admin interface. I wish more plugins did this.  There is also a nice module implementation, so you can expand the functionality quickly and easily, but only if you need to.

I thoroughly recommend it.

Ping Services – With the introduction of XML services, and specifically RSS, a whole bunch of services sprang up that grab all this content to make it available to users. Visitors can then visit these services and see the recently updated sites and all sorts of other information. When you let one of these sites know you’ve updated your site, this is known as “pinging”. Technorati is an example of one of these services, and the functionality that can be built around services like this. Not all are the size of Technorati, and not all provide the amount of functionality, but they all provide benefit, even if it’s just a handfull of visitors every day. The old fashioned way of letting these services know you had updated your site was to go to a page, paste in the URL of your site’s feed, and submit it. This worked, but pinging more than a handfull of services was time consuming. Fortunately, WordPress lets you automatically ping as many of these services as you want whenever you post. The image to the left (click to enlarge) shows you where you can add the list of these services in WordPress. If you’re wondering how you find out about services to use, there’s a handy list to be found in the WordPress Documentation.

By combining these two tips, you are guaranteeing two important traffic sources know about your latest and greatest content, and can start sending visitors your way.

I’ve posted a number of tips to do with blogging over the past couple of weeks, if you enjoyed this tip, why not have a look at One Week to a Better Blog, How to Scientifically Identify Content that’s Great for your Blog and 5 Simple Steps to a Better Blog.

1. CAPTCHA, From ProtectWebForm – Akismet is great, it catches a whole bunch of spam and keeps your comments section clean. However, the fact that the comments are getting as far as Akismet means that each and every failed Spam comment is taking up valuable resource on your server. So why not stop them before it gets that far. The plugin supplied by ProtectWebForm allows JavaScript enabled browsers (almost all of them) to post with no problems, if there is no JavaScript a CAPTCHA test is displayed. The key is, almost all spam bots don’t understand JavaScript, so they can’t submit comments at all! Genius. And even if a genuine user wants to leave a comment, but have JavaScript disabled, they can simply complete the CAPTCHA test and comment away. On one of my blogs which receives a large amount of spam, the installation of this plugin saw Spam comments caught by Akismet drop from over a thousand a day to 1 or 2, it’s THAT good. The upshot is you can allow largely un-moderated comments on your blog, confident in the fact that the vast majority of spam comments will get caught by this plugin, and the rest will be caught by Akismet. That’s the policy I use on this blog, and there aren’t any spam comments, nor have there ever been. Combine this with the excellent Simple Trackback Validation plugin to stop trackback spam as well.
2. WP-Cache – Anyone who’s had a site go down under a heavy load, a digg perhaps, will appreciate this plugin. Essentially, it converts all the dynamic pages on your blog into static pages. This greatly reduces the load on the server, especially under heavy stress, as the database does not need to be queried multiple times for every page load. All that sounds great, but this plugin goes a few steps beyond that. Each static page is updated regularly, so they are never stale. They are also automatically updated if the content changes at all, for example if someone leaves a comment or you update the post. This plugin requires no maintenance and you will only realise it’s even there when your site remains up under a particularly heavy load.
3. Autolink Plugins – I use two plugins on this blog that counteract my inherent laziness. The first is Categories Autolink, which turns any word that matches the name of a category on your blog, into a link pointing to that category. Great for pointing visitors to other related content on your blog with absolutely zero effort. The second simply turns URLs into hyperlinks, and is called Auto-hyperlink URLs. So if I type www.google.com, it automatically becomes a link without me having to go through the hugely time consuming process of adding the link manually (if it appears as a link for you, that’s the plugin in action).
4. WordPress Duplicate Content Cure – For some reason, Google has a bit of a problem understanding the way blogs constantly link to their own content. Whether this is linking to an older post, or the fact that links to posts occur across many pages, the homepage, the categories page, the archives by date and others. This plugin adds some confusing stuff to your pages, possibly magic, that prevents Search Engines from indexing your content in multiple locations. You’ll know that you need this plugin if you Google your blog and all the results have the “Supplemental Result” marker next to them. A word to the wise though, even after installing this plugin it can still take a while for you to lose the Supplemental status. I still haven’t completely lost it on all my pages, but other users have reported complete successes.
5. Google (XML) Sitemaps – If you build it, they won’t come. You need to go out there and grab an audience. Yet, even in this social, Web 2.0 world, a large proportion of your traffic will come from search engines. In fact, Google alone sends over 40% of this site’s traffic every day. So how do you make sure Google knows how to get around your site? Well you send it a description of your site that it can understand, a map of your site if you will. If you were to do this manually, it would be incredibly tedious. Fortunately, Google supports an industry standard XML schema for sitemaps, a schema that this plugin follows. Essentially, every time you add content this plugin updates the sitemap and tells Google that it needs to come and have a look at the changes. I can pretty much guarantee that if you use this plugin, your Google search rankings will improve (warning: Not a real guarantee!).

I hope this list has given you some food for thought. It’s sometimes worth remembering that your blog needs some under-the-bonnet work, just to keep it running smoothly. If these plugins work correctly, they will be completely invisible to your users, which is kind of the point.

I’d like to give some honorable mentions to the following:

• Add Meta Tags – Yes, they are still important, and this plugin in does it all.
• Adsense Manager – If you use Adsense, you are going to be interested in this plugin which allows you to easily place adverts in your posts and in certain other areas of your blog. You can create multiple ads in different zones and ensure consistent colourisation. Very nifty.
• Akismet – This is a given. It comes with new WordPress installations and does an absolutely stellar job of stopping spam.
• Feedburner Feed Replacement – If you use Feedburner, you’ll want this plugin which automatically replaces the feed URLs WordPress generates with ones that point to your Feedburner feed. No mess. No fuss.

Hopefully you enjoyed this post. If you did, why not subscribe to ensure you don’t miss out on any future content. If you have any WordPress plugins you simply cannot do without, let us know in the comments.

1. Feedburner – So you’ve got a feed on your blog? Great! Thats a step in the right direction. Why not spruce up your feed using Feed Burner. Not only does it give you detailed stats about your subscribers but it also lets you easily promote your feed and add some cool toys such as del.icio.us links and tools to email stories. Also, once you sign up to Feed Burner it lets you email your new stories to your readers, this is a great tool if the subject, or readers, of your blog are less tech savvy and/or scared of that little orange RSS symbol.
2. Google Adsense – So you’ve got your blog, and you’ve got some readers. Now, how about paying those bills? Even fairly small blogs can run up some substantial bills. This blog, for instance, uses around 10Gb of bandwidth every month. Getting that much allowance in a host that isn’t pig slow isn’t exactly cheap. The best way to pay the bills for bloggers is still Google Adsense. There are others out there, such as Text Link Ads, but their different approach can lead to the smaller sites not making a proportionate amount. The reason Google Adsense works for bloggers is that your advertisements change when your content changes, and we all know bloggers aren’t too hot at staying on topic. The key is to make your ads clickable but not obtrusive and annoying.
   
   
3. PinGoat – Awful name, good service. What Ping Goat does is simple, it lets a whole bunch of sites know about your content. You pick the sites you want to inform, enter the address of your site’s RSS feed and hit go. From there it will let all the sites you selected know about your content. Bookmark the results page and then just call it up each time you add new content. It saves you having to do the work manually and submits the info to allot of sites.
4. Stikkit – Oh, how I love Stikkit. As someone who really needs to be pushed to add new posts (its a memory thing, really) Stikkit always keeps me on my toes. The way it works is, you create a stikkit which is just a box that allows free typing, and stikkit figures out that you meant and then acts upon it. So, I have a stikkit with a list of post ideas, stikkit translates this into a to-do list so I can check them off to avoid repetition. I’ve also added a simple line to the end, “remind me every tuesday 5pm”, which means stikkit will send me an email every tuesday reminding me to blog! The reason I like stikkit is simple, it works for me as a blogger but it would also work for me as a project manager or whatever else I want to use it for. Its so adaptable and so easy to use, it really makes your life easier as a blogger.
5. News Sites – Its quite hard for most bloggers to be proactive in creating content, most are reactionary creatures, posting articles about whatever the hot news is at the time. So finding this hot news is increasingly important. One of the best ways of finding this content is to have a list of sites that either aggregate this content or provide you with whats popular. For this purpose, sites like digg, del.icio.us, Technorati, Google News, and for those interested in tech news, Techmeme, are absolutely invaluable.

Is there anything I’ve missed? If so, let me know in the comments. I’m sure something like a statistics package should be in there, something like Google Analytics, but you need a fair amount of traffic before something like that is really necessary.

Usually, I settle for the standard, prettyish permalink setting that includes the index.php prefix. So the result is a link that looks like “…/index.php/2006/12/10/post-name/” and thats been fine. I’ve been limited to this because for the most part I use IIS servers. For this blog, however, I thought I would go with a Linux hosting package and take advantage of mod_rewrite to have proper pretty permalinks. So I set up the main part of the site, which can be found at http://www.oakinnovations.co.uk/ and wrote a nice little .htaccess file to enable pretty permalinks for those pages. And it works a treat.

Now, I’d heard that WordPress automagically sets up .htaccess for you once you choose the permalink options, unfortunately, this just wasn’t the case for me. Yes, it created a .htaccess file and seemed to add the correct rules but it just wouldn’t work. After much searching It was starting to look as if this may be a problem with my host, godaddy.com. Reading these forum posts would lead you to think the same I’m sure.

I’ve used Godaddy before for other sites and not had any problems, in fact, I’ve found them to be very good, so I wasn’t going to believe that they could have a problem as fundamental as detailed in the forum posts above. Thats when it struck me. This WordPress installation is sitting in a sub directory called “blog” but for some reason, the mod_rewrite rules seemed to assume that WordPress was in the root directory of the domain. So, I copied the WordPress generated rules and popped them in my main htaccess file and … bingo! Success. So for all those out there experiencing similar problems, and theres seems to be a few, try that approach and see where it gets you.