Update: 4.7.08 @ 2115h: Looks like ZDNet was hit, as per John’s comment below, via an xml-rpc hack, and no — they aren’t running an old version of WP either, which makes one wonder how vulnerable the newer versions of WordPress are.

Just to recap: earlier, I documented how Tailrank’s “spam” was accidentally documenting some massive hacking efforts into blogs around the world. What I didn’t realize was that one of the “victims” were one of the more more well known tech blogs in the blogosphere, ZDnet.

Thanks to some intrepid screen capturing it looks like Allen Stern has shown that at one time ZDnet’s own blogs may have been hacked. If you head over to Tailrank, you’ll find that under the “technology” section (as of this writing) there is a ton of credit-card spam. However, as I mentioned yesterday, these are all legitimate blogs that have been hacked.

What’s surprising is that a lot of them are blogs from ZDnet, such as Steve Gillmor’s Inforouter, or ITFacts. As I mentioned yesterday, the probable reason why they are showing up as “spam” is because the security of those blogs were hacked and malicious ‘invisble’ code was inserted, which is what Tailrank is picking up (by accident!)

I was twittering with Matt Craven last night who wondered if WordPress vulnerabilities were the issue. That, in fact, *may* be the case, as certainly ZDnet are running pretty old versions of WordPress which are probably sensitive to security breaches — in fact, if you look up the source code, they are running, as of this writing, WordPress 2.1.3, which, in fact is more than a year old.

addendum: As per John from CNet below, they are not.

As of this writing, it looks like ZDnet has scraped out all of the ‘invisible’ code / links through cleaning up their headers, but they’ll do to upgrade to a more secure version of WordPress (and its a lesson we should all take heed!).

MORE: Wondering where some of the WordPress hackers come from? (not all, of course) Abe Olandres, former editor of the BlogHerald, notes that some of them are Philipino. He’s worked on some security problems in WordPress and has found some of the comments to be in Tagalog. Furthermore, he sheds some light on exactly the kinds of WordPress exploits that some hackers are using. <Disclaimer: Again, I am not suggesting that all hackers are Philipino, I only use the post to illustrate the issue>

What’s this tip?  Oh, a simple fix to get around securing your Plugins folder.

If you’re running WordPress, unless you’ve already locked down your Wp-content folder with some .htaccess fixes, you may not notice that your Wp-content/plugins folder is naked and bare to the world.  That is, navigate to http://www.yourblogname.com/wp-content/plugins and you may find a directory listing of your plugins folder, files and all.  How do you fix it?  Easy.  Just upload an empty index.html into the wp-content/plugins folder and its all fixed.

Just out of curiosity, I decided to check the plugins folders of some other bloggers that I knew — whole some did have this fixed, a surprising number did *not*.

If you haven’t locked down your plugins folder, please do so, because for many people its showing, and its just about as easy to fix as doing up your zipper.

So, if you’re like me and have updated to WordPress 2.3, you may have also noted that on the WordPress dashboard, the “inbound links” list is now being populated by Google’s Blogsearch and not Technorati.

There’s been some talk about how relevant Technorati has been (including a particularly shrill post by yours truly), and perhaps because it *hasn’t* been, getting Google to index inbound links, therefore, is a Good Thing.

But is it?

Is Google’s Blogsearch *good* at finding those inbound Blog links? 

Now, a quick look by myself shows that for Deep Jive Interests, the answer is resounding “HELL NO.”  The last time Google shows any inbound link is October 30th, but in fact I have inbound links all the way until yesterday.  In fact, Technorati is able to find blogs that have linked to me within the minute those posts (that have those links) are published.  Google looks like its about a week behind.
Now the caveat here is that I am still waiting for my blog to get re-indexed by Google after I was hacked.  So, maybe *that*’s the reason why Google doesn’t look so good, right?

Well, I had a few cursory looks at a few of my other favourite blogs, and the same sort of pattern emerges.  Technorati is able to find the “reactions” within minutes of those inbound links actually being published.

Google?  It has trouble.

Now, I don’t know the actual “why’s” for this happening; perhaps its because everyone and their sister who has a blog registers it formally *with* Technorati so they can follow their own Authority ranking and so on.  And furthermore, because by Default, WordPress pings Pingo-matic, which by default usually pings Technorati.

On the other hand, I’ve read that Google also monitors Pingo-matic, and should therefore also update whenever Pingo-matic updates.  If that’s the case, then, I don’t know — perhaps actually registering your site (and pinging) with Technorati makes it easier to work these kinds of relationships out and in a much quicker fashion.

In any case, I suggest you try and figure this out for yourself.

1. Go to Google’s BlogSearch at http://blogsearch.google.com/

2. For the search term, enter “link:URL_OF_YOUR_BLOG” –> and of course replace the URL of your blog as necessary.

3. Note the results which are sorted by default according to date.  Marvel at how dated some of these results are.

4. Then, go to Technorati at http://www.technorati.com (naturally)

5. Enter your own blog URL again, and note the number of reactions.  Marvel at how fresh these results are.

If you find that I’m totally off my rocker, let me know.  However, in the few blogs that I’ve checked I’ve come up with similar results.  Maybe I *will* install this plugin now. ;)

Why?

For no other reason than his blogging success.
The guy starts out with a half-dead mac-mini one year ago, and starts blogging on WordPress with a K2 Theme on Technology and other things. One year later after a helluva lot of sweat and tears:

1. Alexa Rank: 24 305
2. Feedburner Subscribers: 2284
3. PageRank: 5

Nice. :)

What’s interesting is that in his one year anniversary post, he makes an interesting comment:

I realize that many of you enjoy reading my content through RSS. That’s good and I wanted to say that I’ll always be providing full, ad-free feeds. However, I encourage you to minimize your RSS aggregator every once in a while and chime in on the conversation, or even start one up. That’s how I know if people are actually listening. Site metrics are one thing; actual, tangible involvement and engagement is another. How will I ever know if I got through to the 3,676 people that stopped by yesterday?

One of my other passing fancies is web metrics. And I think Mr. Stamatiou hit it right on the head with this one. At the end of the day, it doesn’t matter what your Alexa Rank, the number of posted subscribers, pagerank, or other magical forms of metrics you use.

(Well, perhaps if you try and sell advertising on your website it is — but I digress.)

I think the real measure of a site’s effectiveness is just that – how effective it is in garnering an action … a response.

Although most blogs are not geared towards asking for an action, so you can measure a reaction, I wonder if its something that all blogs should do every once and a while.

Sort of like rotating the wheels.

Because all the traffic in the world means nothing if you they’re not responsive to your own writings, thoughts and words. On e-commerce sites this a more mercenary metric is the conversion rate. At the end of the day, the inbound traffic is an interesting number compared to the percentage who actually DO something.

Do I care if your site gets 100 000 uniques a day if

• after repeated solicitations you get no participation in your comments
• you have no signups
• you have no sales
• you have no click throughs on your ads?

Well, again, if you’re selling “reach”, then perhaps not. But conceptually, a better metric than pageviews or “subscribers” is understanding how response they really are. A blog, retailing site, or what have you can survive on minimal traffic if they’re active enough to support the site.

Yes, of course, the irony is that I’m writing about responsiveness, and you can’t help but notice that … well there aren’t too many active conversations on this site.

But then again, I’ve just celebrated my one month anniversary. ;)

But back to Mr. Stamatiou – Congratulations on your efforts. More important than your traffic stats, you clearly have an active and engaged following of fans.

Well done.

It’s automating your del.icio.us bookmarks!
Yes, I’ll admit that its part of the “oldie-but-goodie” file, but for all newer bloggers, this trick is a must.

But why bother? There are at least TWO good reasons.

(1) Its great content.
Really? Ok, this is debatable – but not for me.

The answer to this lies in my RSS feed, which is handled through Feedburner.

Currently, I’ve set it up so that Feedburner automatically inserts my del.icio.us links through a script which they call a “feedflare”. Nevertheless these little insertions are great because they’re handled automatically

Although I used to have a “FeedFlare” to insert the del.icio.us links automatically, I can now do it through this automatic posting process. (Full details on how to manipulate your feed in a post to come)

I have also subscribed to their “Total Stats” Program which is pretty nifty.
It allows you to see how many people are actually clicking on the links in your feed — gives you almost like a click through rate … and more importantly, an idea of which items IN your feed are successful. Or interesting. Or worth clicking on.

For me, it was *VERY* telling.

I know they’re great content because as it turns out I do subscribe to the “PRO” content area of Feedburner … and it provides some real interesting information. In particular, it can tell me how many of my items in the feed have actually been seen … and how many have actually clicked through!

You can see here how on this particularly good day for me — most of the links that were read AND clicked on were my “Del.icio.us” links!

(2) Its also a Great Linking Strategy (and Tipping of your Hat Strategy)
By doing the automagic posting-thing, you’re creating links on your page, permanent posts that google and the other search engines love to index. Without posting your links, you’re not really maximizing the effort you’re putting into collecting and annoting your favourite links.

The permanent links attract attention because if you’re bookmarked a blog, that blog will most likely register a pingback automatically … thereby getting yourself a reciprocal link on another website!

It also attracts the attention of the blog author, and if you’re interested in the traffic and reputation business (and who isn’t), this is potentially very, very useful.

*Especially* if you have a the an appropriate Sitemap, Google will love you for this.
Everyday, I would estimate 10-30% of all new visitors come through either Google or a trackback link because of the automated posting strategy.

If you’ve boomarked smaller, less-known blogs, actually having them in a permanent post (rather than a pulled in RSS feed) you’re also acknowledging … tipping your hat as it were … to these smaller guys, and also sending *them* traffic purposefully.

So now what? What do you do?
For those who have already figured this out, you can take a pass, but for everyone else, listen up!

1. Bookmark as Usual. If you don’t already have an account, go to del.icio.us and sign up/ log on. The bookmarklet is very helpful to post automatically.

2. Set up the settings in del.icio.us, so that it will post to your blog automatically.
If you’ve got MovableType, try these instructions.
If you’ve got WordPress, try these instead.

3. (Optional) Download the plugin to format your Automatic Post. For example for WordPress, Drunkey-Love has a great formatting tool, so all of your posts don’t see “Links for xx-xx-xxxx”.

3. Make sure you have a Google-appropriate Sitemap. If you’re running WordPress, there is an awesome plugin that will not only a) create your sitemap auto-magically, but b) ping Google to let it know EVERY time you have a new post, so that it can re-crawl your website.

4. Rinse, repeat, lather.

Last Important Point: With Great Power Comes Great Responsibility
As Brian Clark mentioned in a recent post — it is critical that your posts aren’t completely made of link farms … unless you have a “Fark” in the making, most people won’t be interested in this at all. Your automatic link posts should complement your existing posts … not be a replacement for them.

A second important Caveat:
I think the reason why I’ve had some success with this process is because I dutifully fill out a Description and an appropriate Title. No one likes the generic titles of the articles without any description. Its dull and no one will care. If Title isn’t zippy enough, I just change it. The Description also needs to be punchy as well; long enough that it contains enough stuff (keywords?) to be meaningful and effective …. but short enough to be entertaining.

The problem: Wp-Slimstat’s time would be offset by a few hours, as it would only grab the server’s time. The problem is my server is in Los Angeles, and I am in Toronto. Result? The time for all the stats would be off by 3 hours. Bleh. :(

Well, there is a hack, if your Server has PHP5 (if you want to check out what version your server has, go here)

The Solution: Use the date_default_timezone_set function!
Basically, this will set a default timezone for a given script if you give it the proper location from where you are, rather than displaying the server’s default timezone. Luckily Wp-SlimStat is a single script — wp-slimstat.php — and so adding a single line of code with this function should affect the whole statistics package (and it did for me!)

This particular function requires a single argument, and that is the location.
It just so happens that there is an index for where you can find your own location, and how format that Argument.

For example, I am in Toronto, Canada. Therefore, I added “America/Toronto” to the arguments, so it ended up being:

date_default_timezone_set (“America/Toronto”);

Here’s how you can do it too:

Step 1. Open up wp-slimstat.php in your favourite text editor (I use PSPad).
Step 2. Find somewhere early in the plugin to pop in the script. I think line 30 should be fine.

Step 3. Insert your line of code (I also included a Comment).

Step 4. Save, upload, and there should be an automatic change!

Well, I hope that was pretty self-explanatory.

This was sort of crucial for me, as I often post after-midnight local time — and the stats would show that people would be arriving BEFORE my post. It would drive me crazy! Anyway, enjoy! And as always, support the author (particularly if you read Italian), who is doin’ some great work. Lavoro grande!