Promote My Site

Welcome to the Home of Great Social Media Management Products

PMS Social Suite - Strategize, Automate, and Manage everything about your Digg Marketing. Find and maintain great friends, shout effectively, and perform in depth analysis on your social network. Freemium and Premium.    PMS Social Network Analyzer - Query and analyze a huge list of social networking sites. Find the networks that most closely match your target audience. Freemium.    PMS Ystore Analyzer - Analyze and improve SEO on your Yahoo store. Mazimize your store's presence in the search engines. Free.

PMS Ping - Ping all the backlinks to a URL. Make sure you get credit for your hard earned links! Free.
   Greasemonkey Scripts - FireFox browser enhancements for improving your social media efficiency. Free.   
 
Category >> capability

Apr 10
2008

SEO Puts $31,752 Additional Profit in Man's Pocket

Posted by admin admin in serviceSEOMozSEOSalesproject managementmistakescustomercapability

admin

Additional Profit from SEOAt least. Which is a pretty good piece of pocket money. I suspect even Warren Buffet would slow down to pick that up.

I attribute this to SEO because even thought it was a change in business process coupled with good SEO that made it happen it could not have happened without SEO.

Fair warning to people looking for "advanced" techniques - they ain't here. But what I'm going to talk about is a LOT more valuable than a trick that may or may not work with Google next week or next year.

Best Ever YouMoz Article

Let's look at the real money quote that J Kelly Garrett put in his amazingly excellent SEO article at YouMoz. This piece of advice will serve you while you climb up the value chain from a specialist to a trusted business advisor:

I took the pile [of papers, documentation, etc], pushed it aside, and asked him [the business owner] to tell me about himself. This is a common technique of mine, whether it is a small business owner, or the Chairman of the Board for Burlington Northern Railroad.

He wasn't asking to hear about the guy's soccer team, he wanted to get the gestalt around the company. What is important about the environment, goals, challenges, employees, culture, customers, etc, etc, etc.

SEO Is Never Rocket ScienceIt's Not About the Technology

Really, it's not. Not even in SEO. I wasn't about the technology in OO programming. It wasn't about the technology in robotics. It wasn't about the technology during the dang moon shots either.

It's about how the technology serves the business and makes it more successful. Sometimes 'success' means one or more of:

  • Improved profit
  • Increased revenue
  • Decreased risk
  • Stronger resilience
  • Faster new product introduction
  • and on and on...

But if the technology isn't in service to the goals of the business then it will eventually fail.

The $2M Piece of Advice

I know exactly when I finally understood this. No kidding.

I left one job as a consultant making $55/hour doing NeXTStep programming (hey, that was LOT of money back then) and got another one making $75/hour. The had two slots to fill - lead programmer ($50/hour) and technology business advocate ($75/hour).

For some reason, don't know why, during the interview I was homing in on the business objectives of the billing audit system they were building. I kept asking about change management (people, not source!), about deployment, about disruption, etc, etc.

Next thing I knew I was walking about into the freezing flipping cold in Chicago holding onto a 50% raise. Bubba, you don't get too many of those.

If you work that out - 48 weeks a year, 40 hours a week, 40 work years in a lifetime - you find out that that change in focus gets you a $1,920,000 raise.

Actually, it's even more than that because you keep the advantage while you march up the food chain.

Back to The SEO Example

What really struck me about Garrett's example was that the business took the fairly traditional and predictable approach of getting some SEO guys to graft web and SEO onto a traditional "ring and pitch" business.

The SEO guys put together a campaign that generates 2,500 leads and it kills the guy because:

  • ROI goes from "signup" to 2 years.
    • "He is looking at ROIs that should apply to heavy machinery and commercial aircraft."
  • Growth rate drops from 19% to 3% because of process issues:
    • "growth rate has plummeted from 19% per year to 3% per year because he is in the office answering the phone all the time with close rates of 12% [down from 97%]"

Actually, there were a lot of issues, but those are the two killers. Look at what happened - his profits got pushed out a year from acquisition AND instead of looking at an yearly "takehome" increase of $67,032 he was seeing an increase of $10,584. That is an opportunity cost of over $55K!

You can go broke quickly making money that way.

Do The SEO MathDo the math

I'm just going to quote Garrett's point in toto because it sums up the whole problem so neatly:

SEO Firm Declares “Success.” The PPC campaign is bringing in over 2500 hits per month. Closing the sales is not really their job. They just need to work with the business owner to further tweak everything to bring in more hits. “Obviously” the copywriting needs work to further capture the ones that do get there, or there is something wrong with the business, or whatever...but we are getting people to the site. Just wait till the site starts to rank higher with the search engines!

Remember, the owner is now going broke pretty quickly, has sunk a fair bit of capital into the new venture AND is probably pretty much apoplectic. In fact, if he's like any dial-and-smile salesguy I know, physical and financial threats are probably in the offing.

What's the Solution?

I won't repeat the meat of the article but basically Garrett becomes and advisor and helps the owner re-engineer his business so that he goes back to ROI on close. But most importantly the business growth goes back up to the previous 19% and then all the way up to 28%.

So, back to the math - previous to the first campaign the owner was looking at a yearly "raise" of $67K based on growth. The slap-on-SEO campaign took him down to a $10K raise. The SEO+BPR campaign took him to a $98K yearly raise. Thus the title of this post because the SEO catalyzed a $31,752 additional raise.

I'd like to read a lot more articles like this, and I hope he keeps writing.

Mar 28
2008

More Almost Good Cari.Net Customer Service

Posted by admin admin in serviceOutsourcingmistakescustomercapability

admin

Dilberts PHB Works At Cari.NetSigh.  Once again they almost avoid being the rotten apple of my eye.  My not so snarky comments in red.

This evening Cari.net will conduct an emergency maintenance window to provide additional protection and redundancy for the C2 Data Center. [Planned emergency maintence window. Nice!] Every attempt is made to provide advance notice of these windows; however, in the interest of our customers ,it has been decided that postponing these actions may subject our customers to undue risk. [We forgot to send the email, we got the Special Post Mortem Version of D&D.]

At 12:00am this evening (Friday, March 28th) [Ooops, 12:00am Friday was this morning, around 18 hours ago.  You probably mean midnight tonight, or Saturday morning.][Wait, what time zone?], Cari.net Network Service Teams will install an additional BGP router [Oooooh.] within the C2 data center. This router will provide load sharing and additional redundancy to this segment of our network.

The maintenance will begin promptly at midnight and is expected to take approximately 15 minutes. Service impact should be minimal, though customers with equipment or services located in C2 may notice brief periods of latency and intermittent loss of connectivity during this short window as BGP tables are recalculated. [Is my stuff in C2?  How would I know.  Don't you know?  Why don't you tell me?] Senior Networking Team members will be onsite managing this event. [Blame will be allocated immediately!]

This work is being done to augment changes made during the March 21st window and to provide protection against additional large-scale network problems in the future. [We are not sure we fixed it right last time.   Now we're pretty sure it's the fuel injectors and not the distributor.] Customers located in Cari.net’s C5 facility will be unaffected by this maintenance window. [Probably.]

 Golly.  I am starting to think that Dilbert's PHB works there.

Feb 18
2008

DIgg Friend Finder has high ROI

Posted by admin admin in social networkSEO toolROIDiggcapability

admin

We've talked a lot about SEO Tools and I have been fairly critical of their ROI. You'll notice that most of them are not in the sweet part of the grid (hint: upper right is better!):

SEO Tools Capability Grid

You can see that we liked iMacro (which is why we coded the Ping utility in that on the client side.

What Makes ROI?

I think you have to consider the value of what you get from your labor inputs. In this case you've got both sunk investment and ongoing costs in Digg because you

  • Craft stories (linkbait)
  • Friend other diggers
  • Vote
  • Shout

Now, the question is, can you do something that increases the value of your assets and spend? That leverage comes from Digg Friend Finder. As you increase your use of Digg Friend Finder you get more and more friends for the specific content you create or submit. And it gets more popular, etc, etc.

Simple - high return.

What Makes it Actionable?

This is even simpler: you get a list of targeted potential friends in seconds and you just have to click and analyze. That is actionable. And easy.

Latest SEO Capability Grid

SEO Capability Grid with Digg Friend Finder

Hey, we're not neutral, but I think it is undeniable that the Digg Friend Finder gives you capability you can't find anywhere else and it is high value. So we put it into the juicy quadrant.

Feb 17
2008

Free SEO Tool to Ping Lost Backlinks

Posted by admin admin in TechnoratiROIPromote My SiteiMacrocapabilityautomation

admin

We all know that some backlinks never make it to technorati and therefore are less likely to be "discovered" by google.  And all your backlinks are important for SERPS, high quality technorati traffic, etc, etc.  So we built a tool that will automatically generate pings to technorati and pingomatic for all your backlinks.  And it is free.  (Well, it's ad-supported, but that is close enough to the same thing.)

How and Why

If you'd like an architectural explanation of how it work, you can read All Your Links are Pingworthy.  Here is how to download and install iMacro and why we chose iMacro as a SEO automation framework.

Operations - Getting There

It's quite simple, really.  You can go to our website, Promote-My-Site and click on the left hand side toolbar link for Promote-My-Site Ping.

Click PMS Ping

Note: The really cool screen grab above is from FireShot, which saves me five minutes a day, easy.  Get it if you do a lot of screen shots!

 

Using the Promote-My-Site Pinger

Once you get to the right page you'll see some explanatory text and:

Black Promote My Site Backlink Pinger

Which is not so useful, so put in your URL and click PingBacklinks.  Go ahead and click through the dialog box telling you that this might take a while - it's actually very very fast but testing feedback said that we needed something like that.  You'll see:

Promote My Site SEOMoz Scan

This means that Yahoo had 5,087 backlinks and we are 50% of the way turning those Yahoo API'd backlink records into technorati pings for an iMacro script.  (Now is a good time to download iMacro if you haven't already done it!)

When the process is complete you will see this button:Start Promote My Site Ping

One of the tricky things here is that Yahoo's API will only let us get 1,000 records, so you may want to split up your website into a set of strong pages, or take each RSS feed and run it through.

Trouble Shooting

Honestly, we have had a great limited beta (aka QA sucker) round and haven't found any problems we can't fix.  If you start to get 0 results for things that you know have backlinks you may have hit Yahoo's query limit for the day.  But the cool thing is that, because this runs out of an Ajax app on your browser, you can just grab a new IP and you're off.

Drop us an email (help@promote-my-site.com) if you have any issues and we'll help.  You can also find us on Sphinn and SEOMoz, so if PM works better for you then you can reach us there pretty easily.  We'd also be delighted to hear any suggestions for improvements and additions.

 

Feb 12
2008

Architecting SEO Apps for Digg

Posted by admin admin in SEO toolROIDiggcapabilityarchitecture

admin
Digg is a sweet target for automated SEO tools because they have a powerful API, plenty of horsepower, and you can get a lot of ROI from even a little advantage. But you have to build it right or you’ll consume all your own bandwidth/CPU and produce a tool that is down a lot. And no matter how free something is, it’s not very useful if it doesn’t stay up and produce results.

The Obvious Way

Well, it’s usually wrong, or at the very best it’s what everyone else is doing, so there is no advantage gained. So if you were building a tool to mine digg for information you’d:

Digg API Via Server

Easily Banned

We would never do anything black hat (we just look like the jelly beans nobody wants when we dress as Men In Black) but it’s pretty easy to imagine that with a server based architecture Digg would choose to ban our service or choke our bandwidth rather than change their TOS so we’d stop:

How To Build it Unstoppable

Once again, you download a small AJAX application which hits the Digg API from your local machine.

Unstoppable Client Digg API

This conserves our bandwidth, CPU, and (most importantly) makes the overall application run faster and be unbannable.

What if Digg Hits Me Like You Worry They’ll Hit You?

Reasonable enough. But let’s take a look at why they’d hit us….

If five hundred people show up and each of them causes a thousand queries to the Digg API, well, you don’t even have to do the math to figure out that 500K hits on the API from one IP address, well, that is going to attract attention.

But everything we’re going to do is within the TOS of Digg, uses their API in a reasonable way, and can be used in a white-hat manner. So if the service runs from your computer then what Digg sees is five hundred new people using the API in an appropriate fashion. Their response to this sort of use is much more likely to be throwing some more hardware at the gateway.

Also, worst case, if you trip some sort of capacity limit and they slow you down, well, you're on a dynamic IP and our server ain't....

What Happens if Digg Changes their TOS

We’d change the service to stay inside the rules. If that were not possible, we’d pull it down. We’re a business and we have to co-exist within a framework of contracts and rules.

You HATE Free Stuff – Why Are You Doing This?

Well, we actually love “free” stuff that works, it’s the undependable and almost not-working free stuff that drives us nuts. But this is not a free service, we get several items of value:

  • Advertising on the ‘free’ pages
  • Name recognition for future, fee based services

How much does it cost to capture a customer? It can cost a lot and we do this sort of utility because we believe that this is the most cost efficient way to get paying customers. By paying we mean that people are either clicking ads or they are migrating to paid services.

What if People Abuse It?

Jeeze, you don’t even know what it does yet and you’re worried about abuse?Well, you’re in good company, we worry too. But we are assuming that people using the site are adults, with good judgment and respect for their internet environment. If that is a bad assumption then we’ll regroup and start putting controls in place.

Coming soon……

We’re pretty excited about this tool and we think you will be too.

Feb 09
2008

iMacro SEO Automation Framework

Posted by admin admin in iMacrocapabilityautomationarchitecture

admin

In order to build an efficient SEO automation framework you must carefully seperate value added manual tasks from reptitious automatable steps. For example, writing content on Social Networking is value added, but posting it to 23 different pligg sites and bookmarking the article at 50+ sites is not.

Manual or Automation

But determining which categories it goes into on the 23 pligg sites is an appropriate manual task. So it's not like you are just going to offshore someone to pickup the phone and say: "Dr. Newharts office, hold please."

Let's posit, for the sake of argument, that you've built a framework of CMS, user administration, content creation, database driven workflow, and iMacro automation of specific tasks. Not a small task, but you can get there stepwise, so bear with me.

What we do here is to flowchart (remember that?) our process and mark boxes as M/A - where:

  • M = Manual
  • A = Automatic

The trick is to NOT mark something as "M" just because you don't know how to automate it. If you can concieve of something as non-manual, odds are that a bit of sweat equity will allow you to build a tool to automate the process.

Real World Automation Example

We recently had to create a BUNCH of customer records for a system migration, fix address fields, verify zip codes, etc, etc. And by BUNCH I mean it was 200K+ items. We had done this type of work before using Mark V1.0 Humans so we had an idea of times and costs. This time we did a bit of flowcharting and what-if'ing and decided that rather than spend 3 months doing the needful with copy/paste/excel and 40 people we would build an iMacro based toolset.

The tool creation took two weeks, we temp'd a dozen folks to manage exceptions, and were done in 2 months. For half the cost and at a measured 95% accuracy rate.

That is SO NOT SEO

Well, yeah, but did you think we'd tell you our internal SEO tricks? Uh, no.

But use your imagination. Say you have 50 keywords/phrases you buy on Google. Who else buys them? How do they rank in the SERPS? How are their websites organized? What else do they own?

You can certainly figure out all that stuff manually. Or you could write an iMacro to query google, capture the ads, present them to people to decode, send iMacro to run reports on their sites, look up their IP's, etc, etc.

If you Do It More Than Once

You might consider automating. Me, personally, it's only worth getting the geeks involved if I have to do it more than twice/week. Otherwise, in my experience, it may take me more time to specify than to do.

Summary: Automate

I think if I were smarter I'd move my 'automate' bar down to the things I do once/week for more than six months. But, then, I have a fair bit of technical support. If you are a roll-your-own person, your barrier to entry might be even lower than mine.

When in doubt, automate with iMacro and capture your data in a relational database.

Feb 04
2008

Choosing a Web Application Manipulation Tool

Posted by admin admin in softwareiMacrocapabilityautomationarchitecture

admin

The bad news is that if you choose the wrong tool you'll have a heck of a time unwinding the mistake. The good news is that these products are different enough and the choice is pretty clear.

Real World Web Application Manipulation Tool

We said earlier that a web application manipulation tool is one that drives a web site based on a link back to your backend application containing workflow and data driven information. In a real world setting this tool must have the following characteristics:

  • Supported application - from a commercially viable vendor or an active OSF-type community
  • Mature product - must have developers documentation and have deployment successes
  • Flexible - Must handle a wide variety of web-based applications

There were only four real world candidates that were close enough to analyze:

I was going to lump Chickenfoot in with CoScripter but I will break it out as it has some particularly interesting academic shortcomings.

ChickenFoot / CoScripter


Maturity Test: Failed

I would have dinged both of these tools as not being mature - CoScripter is less than a year old and ChickenFoot is barely 6 months.  I really don't care how smart the guys at IBM or MIT are - that's not a mature product.

Supported Application: Failed

But there is another problem with CoScripter, from IBM.  And the problem is IBM.  Normally (unless you remember OS/2!) it is a good thing to buy software from IBM, but it's not exactly in their software strike zone, is it?  Oh,  well, yeah, it's free and everything,  but how does it fit in with their Linux strategy?

It doesn't.  So CoScripter is only as alive as the interest of the researchers working (part time) on it.

ChickenFoot is even worse: senior project at MIT.  Next year, aside from NOT getting the girls, these guys  will be doing what, exactly?  Again, open source, but is that your business?

Flexible: Too Much So

Here is where the wheels really come off ChickenFoot.  It uses a pattern matching engine to figure out what it wants to click when you say click(“Submit”).  If there are, say, five submit buttons then you have to write a buncha javascript.  Uh, dude, how fragile is that?

CoScripter and ChickenFoot Final Grade: D

AutoIt
Maturity And Support– Yes!

AutoIt is in the third incarnation, has an incredibly active community, and receives regular updates.  Best of all, it’s free, small, and looks a lot like visual basic.  And you can call Windows system level ‘stuff’ as well as COM, DOM, and all those other overloaded Microsoft Acronyms.

Which is the real problem:

Flexible: Yes - Everywhere But the Web

The web side is pretty much, well, krep.  You can smack mouse click into exact locations in a programmatic window that you overlay on an IE region.  And if that sounds like using a laser cannon to heat your Beenie Weenies, well, it is.

AutoIt Final Grade:  D

MacroExpress


Mature and Relatively Flexible

MacroExpress has many of the same powerful windows features of AutoIt but with numerous web features built in.  It is a well supported VB runtime like product, with a relatively active user group and lots of examples. 

It does not handle Java U/I issues, Ajax, Flash, etc.  I'd say that for plain vanilla HTML apps their web automation would work pretty well.  And, yes, I am aware that this is a diminishing crowd.

Well Supported - Not So Much

It costs under $40 and you get about that much support.  The user group/forum seems pretty effective, but there are persistent bug complaints that seem to go unresolved.

MacroExpress Final Grade:  D

iMacro


Very Mature

This product is several years old, is installed in a host of major corporations and startups.   Of all the products, this is most like tools from 'the old days.'   I was reminded more of MultEdit or WinZip or some other product with a cadre of developers and a wide installed base.

Properly Supported

When you buy iMacro (and the developer license starts at $500 and goes up pretty quickly) you get support.  Just like a real product.

Flexible Like A Cirque Contortionist

iMacro can handle Java, Direct Screen, Ajax, etc, etc.  It can even do fuzzy image recognition of bitmapped objects on screen.  Frankly we've been unable to find a situation where we couldn't  bang on an application using iMacro.

iMacro Final Grade:  A

What We Chose

This is probably pretty obvious: iOpus iMacro.  For your amusement, I've placed the candidates on our SEO capability matrix, but I think I can summarize why this really works best: it is the simplest solution.  It has a lot of sophistication under the covers, but a simple glass bottle full of red wine can have a lot of complexity, and history, and artistry too.  So don't be fooled - the buys at iOpus have crafted a specialized tool that eschews the useless and focuses on completing a job just exactly right.

 

Conclusion

We'll start giving some concrete SEO examples using iMacro and some of the architectural framework we've discussed in earlier posts.

Feb 02
2008

I'm Just Saying - Complexity is Complex

Posted by admin admin in softwaremistakescapabilityarchitecture

admin

We're trying to debug something that seems relatively simple, but we've got the following bits and pieces in the mix:

  • Joomla
  • Components galore for Joomla
  • PHP
  • Ajax
  • MySQL
  • Oracle
  • Two servers (same hosting center)
  • Development on Windows
  • Deployment on Linux
  • IE and Mozilla
  • Display widgets from DXHTML (awesome stuff!)

And some other stuff, I'm sure. Swear to gosh, simple problems can take forever to find.

On the upside, we find that complex problems are easily tackled and that the system's flexibility in meeting the needs of new solutions is outstanding.

True Story

Back in the days when nobody owned a domain and a 24K modem was trick, I was working on an embedded system. We'd compile in a development environment, test, then when it all looked plausible, we'd cross-compile from the x86 environment to the M68K hardware world. (Little Indian to Big Indian for the other geriatrics out there.)

One Friday morning everything stopped working from a software perspective. Everything. Lights didn't go on, lines wouldn't go from low (-5V) to high (+12V) to make the widgets widgetier. Nothing.

We got out the fricking oscilloscope. Nothing made sense.

We dumped the memory (128K of it!) onto some green bar paper and started reverse assembling it back to C. Still nothing made sense.

48 hours later, around 9am Monday, a colleague walked by, asked what was going on, listened to us explaining how we were totally baffulated, and glanced at the much scribbled green-bar.

"Shouldn't there be a memory offset for the pointer to the hardware PROM load right there" he said, pointing at the first four bytes of the printout.

The bug was that we'd somehow forgotten to #include the hardware.h file.

And somehow we'd not noticed that the very first thing on the printout told us the problem.   For two days! 

We fixed the code (10 seconds), cross compiled (5 minues) and were magically right back where we'd been three days ago.

Then we went and got drunk, which was not so easy to do at 10am on a Monday morning in a small Southern town.

Plus Ca Change

The more things change, the more they stay the same.  I betcha we're looking for something really tricky and what we're really seeing is something really simple.

Jan 30
2008

Architecting SEO Tools For Success

Posted by admin admin in softwareSEO toolcapabilityarchitecture

admin

I'd like to get a bit geeky on everyone - not the chicken biting geeky, but the other kind - and talk about architecting SEO tools for successful deployment. I'm going to skip by discussions of PC/Mac UI, Ajax/Ruby, vi/EMACS, etc, etc. I want to talk about basic system architecture.

Service with a Smile

The most commonly deployed form of system architecture for SEO tools is server-centric.

Server based SEO

In this model you use a browser to make requests of some mysterious backoffice system that queries around the internet (in this example, Yahoo) and brings you back some results pretty on your screen.

Yawn.

As the service gets more popular it does what? Slows down.

But, here's the problem: as the service gets more popular, or does more stuff that gives you a competitive advantage, guess what happens? Exactly.

Server There is a Fly in my Soup

IP Banned Server SEO

Happens all the time. So people do crazy stuff like anonymizing their server, hopping IP's, etc, etc.

But all that stuff is a bandaid. Once you're server centric, popular, and whacking the smack out of some other guys site, well, banning is going to occur. Or they'll help you experience "serial temporary outages" - anything to get you to go away.

 

There is an Easier Way

You just have to do a little work and have the actual grunt work happen on the user's side.

Client XML Based SEO

In this instance what we're showing is a lightweight AJAX app running in the browser. The actual mysterious query happens on the client side, XML is sent back to the server, which grinds the data up, and then it sends it back for display.

What a Load of Trouble!

Not really. Let's say Yahoo dislikes Cartoon Man's use of this service and blocks him.

DHCP SEO Architecture

Our intrepid cartoon man just gets a new IP. And goes on his merry way.

But that is even less likely to happen because instead of one server hitting Yahoo a zillion times a day (think the last guy working there will notice?) you have a few thousand users hitting Yahoo a few times a day each.

The other thing uses will notice is that it is much faster for almost any service - after all the client PC is really sitting around not doing much, most of the time, ain't it?

Conclusion

There is fair amount of work required up-front to get an advanced SEO friendly architecture like this working but it pays benefits because it is simply more robust in the wild.

Jan 29
2008

10 Very Evil Things That Could Happen When You Use a Free Theme in your CMS

Posted by Don in softwareopen sourcecapabilityarchitecture

Don

Have you ever installed a theme or a component without reading and thoroughly understanding the source code of what you've just installed?

SEOmoz had a great article on Choosing the Right CMS Platform for Your Website and Dawud Miracle ran The Ultimate Resource For Free WordPress Themes . Both are great articles worth reading.

Everybody Loves Free Themes

What do these two seemingly unrelated articles have in common? They both implicitly guide readers towards using systems that are heavily dependent upon external themes. There's absolutely nothing wrong with that and I heartily support leveraging open source software where it makes sense. This blog runs on Joomla with several components and a commercial template from an outside vendor.

Themes and CMS

What is a theme within the framework of a content management system? A theme is just a mechanism for a content management system to separate the graphical user interface from the underlying code. Rather than trying to be all things to all people, the CMS developers have put hooks into the system that allows third parties to control what the user interface looks like without having to dive into the innards of the underlying system. It all works very well, and there are literally thousands of themes to choose from for just Word Press.

The Birds and Bees for Themes

So what's the catch? It's quite minor, but it could be disasterous if you don't know what you're doing. A theme is really just a collection of php files and the associate graphics and css files that allows the rendering of the page for the user. For instance, if you look at the directory structure of the default Wordpress theme you see something like:

404.php comments.php header.php page.php search.php archive.php comments-popup.php images rtl.css sidebar.php archives.php footer.php index.php screenshot.png single.php attachment.php functions.php links.php searchform.php style.css

All harmless enough. The different files implement "methods" for dealing with the different rendering events, so when it's time for the system to draw the footer of the page it just calls footer.php. Here's what the code looks like:

What?

That is the default theme from Wordpress - you get to give them a free link back to their site. Yes, it's linkware which is really a paid link and Google still counts it, but that's a different rant.

Leaving the Door Unlocked

But what else could a malicious person do? See the PHP statements? That tells the web server that it's no longer running HTML code and should now invoke the PHP processor to interpret this code. That php code can do all sorts of wonderful things. For a theme, it generally transfers something to the output stream that will end up on your web page. But there are literally thousands of functions available in PHP, and any code could be contained within a template. If someone had evil and very black hat intentions, they could:

Do These 10 Bad Things

1> Cloak your pages so that it looks normal to everyone except the search engine bots. They get shown a page of spammy links.

2> Implement an Ajax based function that sends any form data entered (for example, login and passwords from the comments) to an external web site.

3> Cloak your pages so that they look fine to you, but it someone enters the page on a search engine they get a different page with the evil template developer's adsense

4> Watch the IP addresses that view the pages (phone home) and make a good guess as to which addresses are probably the owner. Cloak the pages so that the site owner sees their own content, but everyone else see's the template developer's content.

5> Collect the email addresses of anyone who enters a comment and phone them home. In fact, in certain systems they could access the MySQL database and just query for all users and emails.

6> Change the ID's for ads and affiliate programs so that revenue flows to the theme producer and not the site owner.

7> Open a command window for pages served to certain IP addresses that allows the template developer to enter any PHP command (and thus any operating system command since PHP can shell out to the OS).

8> Send home the configuration data for the CMS, such as the administrator's user id and the "salt" for the password. If you don't know what the "salt" is, your takeaway should be that it's a lot easier to use brute force methods to decrypt someone's password if you know it.

9> Modify the robots.txt file so that search engines don't see any pages. Or do see the wrong pages. Or block the google-bot IP's and let ask.com through. Can you imagine the head-scratching to figure that out?

10> Ping the, er, ping services 1,000 times on each publish and comment so that you get banned.


Evil You

I was trying to come up with 10 because that's what you're supposed to do, and I thought it would be hard - it wasn't.

Don't think that I'm letting some super secret ideas out to the blackhat community. If they're good enough to do those things and evil enough to think of it, they've already figured it out.

Don't Panic!

Don't go screaming off into the night with fear that any Wordpress Theme you download is going to bite you. I personally have never seen a theme that did any of those things (with the exception of changing the Amazon Id -- I saw a plug-in that did that, but they were upfront about it in their documentation).

But I do read through the source code of any third party open source tool I'm going to install.

Do You?

<< Start < Prev 1 2 Next > End >>