photo credit: miss604

A few people have asked me how to make WP Greet Box work with non-WordPress pages.  Luckily there is a way to easily do this and I will show you how in this tutorial:

Requirement

You must have WordPress installed with WP Greet Box plugin enabled.

JavaScript Modification

You will have to make a copy of “http://example.com/wp-content/plugins/wp-greet-box/js/onload.js”, modify it, and place it somewhere accessible by your non-WordPress page. As an example, I will place a copy of the file at “http://example.com/non-wordpress-platform/onload.js”. Now open “non-wordpress-platform/onload.js” and modify the line:

url: "index.php",

to point to your blog WordPress blog index.php.

url: "/index.php",

For example, if your blog is installed under “http://example.com/blog/”, you would change the code to:

url: "/blog/index.php",

JavaScript Placement

There are a few Javascript files that you need to reference to do this. Make sure you drop the following Javascript references into your non-WordPress page:

<script type="text/javascript" src="http://example.com/wp-includes/js/jquery/jquery.js"></script>
<script type="text/javascript" src="http://example.com/wp-content/plugins/wp-greet-box/js/functions.js"></script>
<script type="text/javascript" src="http://example.com/non-wordpress-platform/onload.js"></script>

Notice that we are referencing your modified “onload.js” in here. Be sure to replace example.com with your own site domain.

CSS Placement

There is also a CSS file that you need to reference. Include the following style reference into your non-WordPress page’s header:

<link rel="stylesheet" href="http://example.com/wp-content/plugins/wp-greet-box/css/wp-greet-box.css" type="text/css" />

Be sure to replace example.com with your own site domain.

HTML Placement

This is the easy part.  You will have to place the following HTML code anywhere you want your greeting message to show up:

<div id="greet_block"></div>

That’s all!

That wasn’t so bad was it?

Finding Dofollow Links

Before correcting them, we have to find them! I use the awesome SearchStatus Firefox add-on to hunt down any unintentional dofollow links. After installing the plugin, I just enable the “Highlight Nofollow Links” feature by right clicking on the @ symbol on the bottom right of Firefox.

After enabling the “Highlight Nofollow Links” feature, you will see that all nofollow links will be highlighted red.

Nofollow Using jQuery Magic

The beautiful thing about jQuery is its ability to perform operations on multiple things with a single line of code. I can abuse this feature to help me set all links in any HTML block with a rel=”nofollow”. Just to give you an idea of how easy and powerful this is, this is the line I use to nofollow all links in my Intense Debate comment form:

$(".comment_form a").attr("rel", "nofollow");

To dofollow a certain set of links, you can do something like the following:

$(".blogroll a").attr("rel", "");

Easy isn’t it? No plugin hacking, no search and replace, and no hassle!

(For those of you who are not the jQuery type, you can take a look at the jQuery selector documentation to figure out the meaning of “.comment_form a”.)

Integration

In this section, I will show you how to get jQuery code to run on every page load.

• Download nofollow.js and place it anywhere on your server as a base to start from.
• Modify nofollow.js using jQuery to follow/nofollow any links as you see fit.
• Refer to nofollow.js in the footer of your template. For example:

  <script type="text/javascript" src="/path/to/your/nofollow.js"></script>

Final Thoughts

After realizing the power of jQuery and this Googlebot feature, patching leaking PR link juice isn’t that bad after all.

Do you guys have a better method of doing this? Do you disagree with my Googlebot findings? Do you know any other search engines that follow Javascript links? Please let me know in the comments section.

Being the enthusiast that I am, I decided to implement it on my blog. This post will report my experiences integrating Minify with my WordPress blog.

Installing Minify

1. Download Minify and upload it as a new folder under your web document root. For example:

   /home/user/public_html/min/

2. Create a cache directory and make sure that it is writeable by apache. For example:

   /home/user/public_html/min/cache/

3. Set the “$min_cachePath” variable in min/config.php to the absolute path of your cache directory
4. Point your browser to this location (e.g. http://example.com/min/)

That’s it! The application is ready for use.

Features

• URI Builder used for adding files CSS and JS files manually.
• Bookmarklet for automatically fetching CSS and JS entries from any page (very cool!). I can just visit any one of my pages, click on the bookmarklet, and then I am brought to a page with the URI Builder all filled-in.
  
• HTTP request API for retrieving CSS & JS files as a group.
  
• Ability to preset groups of CSS & JS files for simpler CSS & JS references
  

Integration with WordPress

return array(
    'js' => array('//wp-content/plugins/fun-with-sidebar-tabs/js/script.js', '//wp-content/plugins/contact-form-7/contact-form-7.js', '//wp-content/themes/omninoggin/onload.js', '//wp-content/plugins/wp-greet-box/js/functions.js', '//wp-content/plugins/wp-greet-box/js/onload.js'),
    'css' => array('//wp-content/themes/omninoggin/style.css', '//wp-content/plugins/contact-form-7/stylesheet.css', '//wp-content/plugins/friendfeed-activity-widget/widget.css', '//wp-content/plugins/wp-note/style.css', '//wp-content/plugins/wp-pagenavi/pagenavi-css.css', '//wp-content/plugins/wp-syntax/wp-syntax.css', '//wp-content/plugins/anti-adblock/css/style.css', '//wp-content/plugins/wp-greet-box/css/wp-greet-box.css')
);

I can then place the following into the <head> tag in header.php:

and the following near the end of footer.php:

<script src="/min/g=js" type="text/javascript"><!--mce:0--></script>

Next you will need to remove all references to the CSS & JS files that you have consolidated and compressed. This is probably the most painful step that you have to do as you will probably have to go through your plugins’ code and comment out lines that print CSS or JS references.

Test Results

• Before Minify, my homepage takes an average of 6.6s to load 348.5 KB with 36 HTTP requests.
  
• After Minify, my homepage takes an average of 5.6s to load 323.3 KB with 28 HTTP requests.
  

Bottom Line (or Will Minify Benefit My Site?)

It depends on the site. In my case, I was only able to save 8 HTTP requests. Minify is a great program, but I don’t think having to maintain a modified set of plugins is worth the 1 second speed boost.

Also the current WordPress framework (version 2.7) supports the functions wp_enqueue_script and wp_enqueue_style which allow plugin/theme authors to queue CSS and JS reference. It is very possible that a future WordPress version will implement a Minify-like feature which will automatically consolidate/compress CSS and JS files that queued via these wp_enqueue methods.

Of course that is just my personal speculation. If your site uses many CSS and JS files then you should definitely try out Minify to see if you are any luckier with your speed boost.

The purpose of this post is to show you how to create such a message for your own website. I had this idea from a comment I found on one of my favorite blogs (Webmaster Source) regarding combating AdBlock.

Before I go on, let me say that I am not interested in discussing/debating the use and ethics of AdBlock software in depth in this post. I’m planning on writing a post with my research and data on the effects of discouraging AdBlock use in a later post, so let’s save that discussion for another time.   For now I would like you to evaluate the pros and cons of this mod and decide for yourself if you would like to install the mod or not.

Pros

• Makes your visitors aware that your website is funded by advertisements.
• Visitors are encouraged to turn off their AdBlock software for your website.

Cons

• The mod is written using jQuery so it will not have any effect on browsers with javascript disabled.
• It does not guarantee that the visitor will disable AdBlock on your site.

Installation

1. Insert the following tag into your theme.  This div block will be populated with the AdBlock message when AdBlock usage is detected. For my WordPress installation, I placed it just above my main content div block in header.php.

   <div id="content_adblock_message" style="display:none"></div>

2. Download the following bait banner and put it into a directory called “ad” on your server. For example,
   

   “http://omninoggin.com/wp-content/themes/omninoggin/images/ad/banner.gif”.

3. Refer to the “bait banner” image anywhere in your theme. Make sure your set the IMG ‘id=”banner”‘. For example:

   <img id="banner" src="/path/to/ad/banner.gif" width="1" height="1"/>

4. Download the following onload.js javascript and place it anywhere on your server.
5. Open onload.js to modify the message if necessary.
6. Refer to jQuery library and onload.js, by add the following lines into your footer.

   <script type="text/javascript" src="http://jqueryjs.googlecode.com/files/jquery-1.2.6.min.js"></script>
   <script type="text/javascript" src="/path/to/onload.js"></script>

Testing

1. Try visiting your site with AdBlock on. You should see the AdBlock message.
2. Disable AdBlock and refresh the page. You should not see the AdBlock message.

WordPress Plugin?

I’ve already received a request from one person that I should package this into a plugin. Would anybody else like to request this? The more number of requests makes it higher priority on my to-do list .

IP:82.230.123.141
Host: bne75-7-82-230-123-141.fbx.proxad.net
User agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; InfoPath.1)

From the log snapshot (image), you can see that the bot had recursively crawl through 14464 pages, harvested anywhere between 5 – 20 fake email addresses per page (that’s about 12 * 14464 = 173,568 emails harvested), and wasted nearly 10 minutes on my site before deciding that it’s done. You can see that the last link the bot visited was something that looks like this:

http://omninoggin.com/suspicious/8864/1530/7374/527/3510/9061/8198/9981/3367/1751/5075/1765/7282/4842/1710/3655/614/9951/3183/3609/3731/9430/7682/6298/2287/683/3370/5633/4187/8842/1852/5984/7767/6037/7675/3984/4646/7823/8462/1793/6556/3054/1362/3111/3407/8182/7374/169/7738/158/2802/5438/7230/9552/1384/7538/index.php

This is infinite loop at its finest . Not only that the bot wasted its time spidering my site, the bot has probably added these 170,000 fake email addresses to the master spam list somewhere in the net. Now spam bots referring to that master list in the other end will waste even more time and resources spamming these fake addresses.

If you like the results, please join me in sticking it to these harvesters/spammers by installing my bot trap. Please also let me know when you’ve caught a live one like I did. It’s entertaining to hear these stories.

1. I’ve been getting more readers lately so my bandwidth was almost reaching capacity. Shared-hosting is the cheapest way to get decent burstable bandwidth.
2. I wanted to start focusing more on WordPress and less on FreeBSD. Making this switch will alleviate me from having to maintain/troubleshoot low-level system things, leaving me with more time to focus on WordPress development & discussion.
3. I want to experience the limitations of a shared-host WordPress blog, so I can develop more effective plugins.
4. I want my site to be up in the event of a power outage.
5. I want my files to be securely stored in a remote location.
6. *Bonus* I wanted to turn my dedicated machine into a CounterStrike Source Server.

After the switch, I immediately noticed that I couldn’t do nearly as many things as I used to be able to do before. Here are the things that I can no longer after switching to a shared-host (Cons):

1. Use eAccelerator to cache my PHP op-code. Because of this, my page generation time doubled from ~0.3s to ~0.6s. Even though this is the case, I believe the switch was a good move, since my speed loss of ~0.3 is overshadowed by the speed gain from the new bandwidth connection. The switch should deliver a more pleasant experience for my readers.
2. Use Varnish as a proxy caching server. Because of this, image and other static file requests will always hit the httpd process, which making the httpd process busier than it used to be when Varnish is installed. But again, this drawback is overshadowed by the monster machine that this site is now hosted on and the huge bandwidth connection.
3. Optimize Apache & MySQL myself. I can live without this, but it would been nice to be able to optimize Apache & MySQL myself.
4. Use SSH. I’ve requested SSH access but this was not turned on by default. I will update this list with more drawbacks as soon as I get SSH access. Potentially, these tools might not be available: SVN and symbolic links. Update: It turns out that after poking around on the net, I was able to get SVN to work on a shared host account using solutions found in a forum thread and Joe Maller’s Blog. Here is my SVN install script. Just run it from your home directory to get SVN working on a shared host account.

Overall switching hosts is not that difficult (just a bit time-consuming if it’s your first time). Luckily I was able to follow a great checklist for host switching written by Matt Harzewski. I believe that everything should be working, but please let me know (via the About page) if you run into any problems with the website.

1. Unpack list-poisoning.zip into a directory on your web server. Make sure to name the directory something unique (i.e. don’t use “spamtrap/” or anything that describes its funcionality).
2. Open .htaccess and modify
   

   “RewriteRule . /suspicious/index.php [L]”

   to

   “RewriteRule . /youruniquedirectory/index.php [L]”

3. Place a link on your site that links to this new directory.
4. You may make this link invisible to visitors by applying the following CSS style on the link:

   .your_unique_class {
     display:block;
     visibility:hidden;
     height:0px;
   }

5. Verify that it works by visiting your trap directory on the web browser and clicking on some recursive links to make sure that you can recurse. For example, my trap is located at http://omninoggin.com/suspicious.

That should be all! As always, if you have a better way of doing this, or have tips/tricks on List Poisoning, then please share in comments.

1. Akismet
2. TypePad AntiSpam
3. Project Honey Pot
4. List Poisoning

I have deployed all of these solutions on this blog, so I believe that I should be in the clear. I will be writing a couple follow up articles on Project Honey Pot and List Poisoning. Please stay tuned!

Also, do you know of any other LoJack anti-spam solutions. Do have any LoJack anti-spam ideas? Please share in comments.

## Called when a client request is received
sub vcl_recv {
  # block list
  # 204.9.177.18 = livejournal.com
  if ( client.ip != "204.9.177.18" && client.ip != "192.168.2.102") {

I then added all the user agent regular expressions that I do not like.

    if (
      req.http.user-agent ~ "^$"
      || req.http.user-agent ~ "^Java"
      || req.http.user-agent ~ "^Jakarta"
      || req.http.user-agent ~ "IDBot"
      || req.http.user-agent ~ "id-search"
      || req.http.user-agent ~ "User-Agent"
      || req.http.user-agent ~ "compatible ;"
      || req.http.user-agent ~ "ConveraCrawler"
      || req.http.user-agent ~ "^Mozilla$"
      || req.http.user-agent ~ "libwww"
      || req.http.user-agent ~ "lwp-trivial"
      || req.http.user-agent ~ "curl"
      || req.http.user-agent ~ "PHP/"
      || req.http.user-agent ~ "urllib"
      || req.http.user-agent ~ "GT:WWW"
      || req.http.user-agent ~ "Snoopy"
      || req.http.user-agent ~ "MFC_Tear_Sample"
      || req.http.user-agent ~ "HTTP::Lite"
      || req.http.user-agent ~ "PHPCrawl"
      || req.http.user-agent ~ "URI::Fetch"
      || req.http.user-agent ~ "Zend_Http_Client"
      || req.http.user-agent ~ "http client"
      || req.http.user-agent ~ "PECL::HTTP"
      || req.http.user-agent ~ "panscient.com"
      || req.http.user-agent ~ "IBM EVV"
      || req.http.user-agent ~ "Bork-edition"
      || req.http.user-agent ~ "Fetch API Request"
      || req.http.user-agent ~ "PleaseCrawl"
      || req.http.user-agent ~ "[A-Z][a-z]{3,} [a-z]{4,} [a-z]{4,}"
      || req.http.user-agent ~ "layeredtech.com"
      || req.http.user-agent ~ "WEP Search"
      || req.http.user-agent ~ "Wells Search II"
      || req.http.user-agent ~ "Missigua Locator"
      || req.http.user-agent ~ "ISC Systems iRc Search 2.1"
      || req.http.user-agent ~ "Microsoft URL Control"
      || req.http.user-agent ~ "Indy Library"
      || req.http.user-agent == "8484 Boston Project v 1.0"
      || req.http.user-agent == "Atomic_Email_Hunter/4.0"
      || req.http.user-agent == "atSpider/1.0"
      || req.http.user-agent == "autoemailspider"
      || req.http.user-agent == "China Local Browse 2.6"
      || req.http.user-agent == "ContactBot/0.2"
      || req.http.user-agent == "ContentSmartz"
      || req.http.user-agent == "DataCha0s/2.0"
      || req.http.user-agent == "DataCha0s/2.0"
      || req.http.user-agent == "DBrowse 1.4b"
      || req.http.user-agent == "DBrowse 1.4d"
      || req.http.user-agent == "Demo Bot DOT 16b"
      || req.http.user-agent == "Demo Bot Z 16b"
      || req.http.user-agent == "DSurf15a 01"
      || req.http.user-agent == "DSurf15a 71"
      || req.http.user-agent == "DSurf15a 81"
      || req.http.user-agent == "DSurf15a VA"
      || req.http.user-agent == "EBrowse 1.4b"
      || req.http.user-agent == "Educate Search VxB"
      || req.http.user-agent == "EmailSiphon"
      || req.http.user-agent == "EmailWolf 1.00"
      || req.http.user-agent == "ESurf15a 15"
      || req.http.user-agent == "ExtractorPro"
      || req.http.user-agent == "Franklin Locator 1.8"
      || req.http.user-agent == "FSurf15a 01"
      || req.http.user-agent == "Full Web Bot 0416B"
      || req.http.user-agent == "Full Web Bot 0516B"
      || req.http.user-agent == "Full Web Bot 2816B"
      || req.http.user-agent == "Guestbook Auto Submitter"
      || req.http.user-agent == "Industry Program 1.0.x"
      || req.http.user-agent == "ISC Systems iRc Search 2.1"
      || req.http.user-agent == "IUPUI Research Bot v 1.9a"
      || req.http.user-agent == "LARBIN-EXPERIMENTAL (efp@gmx.net)"
      || req.http.user-agent == "LetsCrawl.com/1.0 +http://letscrawl.com/"
      || req.http.user-agent == "Lincoln State Web Browser"
      || req.http.user-agent == "LMQueueBot/0.2"
      || req.http.user-agent == "LWP::Simple/5.803"
      || req.http.user-agent == "Mac Finder 1.0.xx"
      || req.http.user-agent == "MFC Foundation Class Library 4.0"
      || req.http.user-agent == "Microsoft URL Control - 6.00.8xxx"
      || req.http.user-agent == "Missauga Locate 1.0.0"
      || req.http.user-agent == "Missigua Locator 1.9"
      || req.http.user-agent == "Missouri College Browse"
      || req.http.user-agent == "Mizzu Labs 2.2"
      || req.http.user-agent == "Mo College 1.9"
      || req.http.user-agent == "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)"
      || req.http.user-agent == "Mozilla/3.0 (compatible; Indy Library)"
      || req.http.user-agent == "Mozilla/4.0 (compatible; Advanced Email Extractor v2.xx)"
      || req.http.user-agent == "Mozilla/4.0 (compatible; Iplexx Spider/1.0 http://www.iplexx.at)"
      || req.http.user-agent == "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent"
      || req.http.user-agent == "Mozilla/4.0 efp@gmx.net"
      || req.http.user-agent == "Mozilla/5.0 (Version: xxxx Type:xx)"
      || req.http.user-agent == "MVAClient"
      || req.http.user-agent == "NameOfAgent (CMS Spider)"
      || req.http.user-agent == "NASA Search 1.0"
      || req.http.user-agent == "Nsauditor/1.x"
      || req.http.user-agent == "PBrowse 1.4b"
      || req.http.user-agent == "PEval 1.4b"
      || req.http.user-agent == "Poirot"
      || req.http.user-agent == "Port Huron Labs"
      || req.http.user-agent == "Production Bot 0116B"
      || req.http.user-agent == "Production Bot 2016B"
      || req.http.user-agent == "Production Bot DOT 3016B"
      || req.http.user-agent == "Program Shareware 1.0.2"
      || req.http.user-agent == "PSurf15a 11"
      || req.http.user-agent == "PSurf15a 51"
      || req.http.user-agent == "PSurf15a VA"
      || req.http.user-agent == "psycheclone"
      || req.http.user-agent == "RSurf15a 41"
      || req.http.user-agent == "RSurf15a 51"
      || req.http.user-agent == "RSurf15a 81"
      || req.http.user-agent == "searchbot admin@google.com"
      || req.http.user-agent == "ShablastBot 1.0"
      || req.http.user-agent == "snap.com beta crawler v0"
      || req.http.user-agent == "Snapbot/1.0"
      || req.http.user-agent == "sogou develop spider"
      || req.http.user-agent == "Sogou Orion spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
      || req.http.user-agent == "sogou spider"
      || req.http.user-agent == "Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
      || req.http.user-agent == "sohu agent"
      || req.http.user-agent == "SSurf15a 11"
      || req.http.user-agent == "TSurf15a 11"
      || req.http.user-agent == "Under the Rainbow 2.2"
      || req.http.user-agent == "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
      || req.http.user-agent == "VadixBot"
      || req.http.user-agent == "WebVulnCrawl.blogspot.com/1.0 libwww-perl/5.803"
      || req.http.user-agent == "Wells Search II"
      || req.http.user-agent == "WEP Search 00"
    ) {
      error 403 "You are banned from this site.  Please contact via a different client configuration if you believe that this is a mistake.";
    }
  }

As a bonus, I added the following to prevent hotlinking from people I don’t know. (code adapted from Turbocharged Blog)

  # if images, prevent hotlinking for some, permit for some
  if ( req.url ~ "wp-content/uploads/(images|200.)" || req.url ~ "wp-content/themes/[a-z-]/images") {
    if ( req.http.referer ~ "^http(s)?://" ) {
      if ( !(req.http.referer ~ "^http(s)?://([a-z-]+\.)?(omninoggin|postnerd|twidded|ciciscafe)\.com" )) {
        error 403 "Hotlinking is forbidden";
      }
    }
  }
  lookup;
}

Simple isn’t it? Now your Apache process will not have to deal with these spammers at all and save memory / CPU cycles for more important tasks like executing PHP.

Do you have a better bots list? Do you have a better method of doing this? Please share below!

SSH keys are one of the common authentication techniques people use to log into a Unix session (the most common authentication technique is login & password).

If you are like me, you get sick and tired of typing in your login and password every single time you open a new terminal to connect to a Unix session. This is where SSH keys help me everyday by letting me authenticate against the key once, and every new shell session I start will authenticate using the same SSH key.

All you have to do is create a pair of public and private keys. In this analogy, the public key is the house lock and the private key is equivalent to the house key.

Private Key = House key

Public Key = House locks

Using an SSH key to authenticate is like using one key for all the doors in your house instead of having a bunch of combination padlocks (with the same unlock combination) on all your doors.

How to Setup SSH Key Authentication (using OpenSSH)

1. Run ssh-keygen and follow prompt (# ssh-keygen -t rsa -b 2048)
2. Save the key as id_rsa under your ~/.ssh/ directory
3. Create a password for the key pair
4. You will get two files:
   1. id_rsa (this is your private key)
   2. id_rsa.pub (this is your public key)
5. Log into your desired machine (using login & password this time)
6. Append the contents of your local id_rsa.pub into the machine’s ~/.ssh/authorized_keys
7. Log out
8. Log back in and you should notice that you will not need to type the username and password anymore
9. Repeat this with any other number of machines you log into often