Built For Designers & Developers

How do I delete a cron job?

Having set up several cron jobs, how do I delete one of them?

1 Answer In: Cron Jobs By: JRG [11 ]

Where do I put my php.ini file?

This has to be the question asked the most often — Where does the php.ini file go? If multiple domains are hosted using "pointing" (i.e. a pointed domain's web root is a sub-directory of a "primary"...

1 Answer In: PHP By: JRG [11 ]

How do I set up Spam Assassin?

With 80% (or is now over 95%) of all e-mail messages transmitted across the Internet being SPAM, how do I set up spam-filtering on my Site5 e-mail accounts? I have Multi-Site, does that change anything? Can...

1 Answer In: Spam Assassin By: JRG [11 ]

How do you change the password for a mySQL database user?

This should have been trivial to find in the KnowledgeBase. In fact, I'll go further, it should have been obvious how to do this just by browsing the control panel. Well it wasn't (at least for me :( ...

5 Answers In: MySQL By: JRG [11 ]

What is the “host” for my SQL databases?

How do I find the hostname that I need to specify for a PHP script to access my mySQL databases?

6 Answers In: Advanced By: JRG [11 ]

There some basic things to do that apply when using any software on your web site, not just WordPress. Some depend on your having programming knowledge, others are just administrative.

• Subscribe to e-mail notifications of security risks (and notifications of new releases)
• Keep upgraded to the current WordPress release
• If you receive a notification of a security risk and it supplies (or points to) a fix, then apply the fix.
• Most CMS, such as WordPress, have a document on their site that describes how to harden your site, that is, what to do to decrease its susceptibility to attacks. They usually require a degree of programming or Unix-style administrative skill. An example is moving configuration files out of the web root. Here’s the link for the WordPress one:

http://codex.wordpress.org/Hardening_WordPress

• This is the hard one: Check all your plugins. You need to examine the code and ensure that any input is validated and filtered before being used for anything — that includes displaying data and accessing (not just updating) a database. The basic issue here are various ways of sneaking code in without needing to know a password.

• You can turn off SSH access in your Site5 control panel. Do so. Turn it back on if you need to use it, then turn it off again. SSH is great to use if you are doing development or if you are doing an initial installation or upgrade, but should not be needed for day-to-day normal operation.

Go over the WordPress document. It discusses various things and I don’t want to duplicate it (I haven’t read it recently, so I may have already duplicated some things).

Hi Graham. The following is a copy-and-paste from an e-mail I received:

A new comment on the post “What is the “host” for my SQL databases?” is waiting for your approval
http://qa.site5.com/advanced/what-is-the-host-for-my-sql-databases/

Author : Kyle Ross (IP: 206.53.89.99 , d-206-53-89-99.cpe.metrocast.net)
E-mail : [email protected]
URL :
Whois : http://whois.arin.net/rest/ip/206.53.89.99
Comment:
You should use “localhost” without the quotes as the MySQL host name.

Approve it: http://qa.site5.com/wp-admin/comment.php?action=approve&c=36
Trash it: http://qa.site5.com/wp-admin/comment.php?action=trash&c=36
Spam it: http://qa.site5.com/wp-admin/comment.php?action=spam&c=36
Currently 5 comments are waiting for approval. Please visit the moderation panel:
http://qa.site5.com/wp-admin/edit-comments.php?comment_status=moderated

I had tried the obvious answer (“localhost”) before posting to the KB.

Several contributors confirmed that answer is correct (Giovanni, nomore340, Kyle Ross and David). Thank you.

I can, after finding I had a masked error in the live code (since fixed), confirm that this works.

[Aside] I’m not trying to gyp people out of “Star Points” for their answers, it’s just that I cannot approve answers. I have submitted a trouble ticket about this problem.

I had already worked around this problem in the obvious way — delete the user id and recreate it with the new password.

Kyle Ross and David suggest this is the only way this can be done. That may be the case, but it seems wrong not to have a straightforward “password change” mechanism.

[Aside] I haven’t “approved” Kyle and David’s answers, only because I don’t appear able to do so (I have submitted a trouble ticket about this).