WordPress recommendations?

[Heisenberg]

I'm looking to move a basic School website from static HTML site to WordPress, so would like a good security / gallery / slider / WSIWYG plugin etc

 

Does anyone have a list of tried and tested plugins? I find some of the ones pushed by WordPress, and even their most popular can be a bit hit and miss.

 

Also looking for good base themes I can expand upon.

 

Thanks in advance

[Devontechie]

I'll try and post a few tomorrow when I am on my laptop. I know of a few good pluggins that I've used

[Heisenberg]

I'll try and post a few tomorrow when I am on my laptop. I know of a few good pluggins that I've used

 

Many thanks

[CHM-ITServices]

We have used Divi to build our from Elegant Themes. A whole host of plugins but the results are pretty good IMO.

 

cromptonhouse.org

[mats]

Security - wordfence. Closes a bunch of holes and lets you know about plugin updates and login attempts.

BackWPUp - automated backup to a choice of destinations on schedule.

 

Both free.

[Heisenberg]

Also, forgot to mention an events calendar. Ideally something we can display in a sidebar

[IWDave]

Education Hub template is good

https://www.daveiw.co.uk/wp/

I also use siteorigin page builder.

[Jaan]

DIVI here also, just make sure you keep it all upto date. We also use vaultpress for backups Edited April 14, 2021 by ZeroHour

[ThePurpleK]

@Heisenberg - Have you considered other platforms such as Jekyll? This way, you won't need to worry about security as much as Wordpress. For example, looking through a few sites linked here, I can already see potential problems and plugins. For example, Divi Builder had a security vulnerability allowing arbitrary files to be downloaded. Having the /wp-admin/ unchanged makes it perfect for an automated scanner to execute the exploit. However, the sites people have linked to here are up to date with plugins, but imagine if a zero-day that can be automatically executed.

 

Wordpress is a PITA to manage in terms of security and security plugins won't help because it'll always end up being a plugin you've installed having a zero-day vulnerability that you aren't aware of until it's too late.

Edited May 27, 2016 by ThePurpleK

[fiendishlyclever]

My personal site gets hit with hundreds of automated login requests a day - there are plugins that bar an ip address after so many failed login attempts. I use Jetpack to add functionality to my site but I'm not sure if schools can use it for free. I had a free plugin automatically update and bring my site down so take care with plugins and make sure you know how to use ftp to delete them. Backups are extremely useful too.

 

A gallery plugin is an idea if you plan to add a news feed as the one built in doesn't do slide shows. We had our school site designed by a professional company - it's wordpress based but interesting how they've used different plugins to the ones I've used to get a totally different effect.

 

Wordpress is extremely powerful but also can look awful with a bad theme. Having said that very few of our parents interact with the site directly and only follow links there from our Facebook page. I know of schools that do the statutory stuff on a website and everything else on Facebook.

[matt40k]

Just got an email about a zero day security bug in the Jetpack. https://blog.sucuri.net/2016/05/security-advisory-stored-xss-jetpack-2.html?utm_source=Sucuri+WordPress+Plugin&utm_campaign=4ff4cfa43e-Stored_XSS_in_Jetpack_+Plugin_Users&utm_medium=email&utm_term=0_4ac850e5be-4ff4cfa43e-82495933

[Arthur]

It'll always end up being a plugin you've installed having a zero-day vulnerability that you aren't aware of until it's too late.

Either that or no one bothers to maintain the school website and keep the plugins up-to-date...

 

Breaking into a Wordpress site without knowing Wordpress/PHP or infosec at all

 

This is a post about how I tried and broke into my college's wordpress installation without having any prior knowledge of Wordpress/PHP and without any experience with hacking web-servers. The attempts were spread out over a month, but effectively totaled a day maybe. I learned a lot of things while doing the research part which accounted to most of my time, though. Here I'd share some of the relevant details and how I went along doing this.

Edited May 30, 2016 by Arthur

[jonspurs]

Looking to create a Wordpress site. With LGFL, they have free hosting. If I build a site on a test.school.sch.uk domain, and flip it over to the http://www.school.sch.uk domain, everything internally should link fine, right? As it's all 'relative' links when you build pages with Wordpress? So you can move your folder with all wordpress content anywhere and it should just work?

Cheers,

Jon

[3s-gtech]

Yup, you just change the config file so that it knows the new directory/URL and off it goes.

 

https://codex.wordpress.org/Editing_wp-config.php

Edited November 24, 2016 by 3s-gtech

[jonspurs]

Thanks for your help.

Just slightly confused - changing the URL in wp-config seems to be an advanced option and says you can 'define' it. But I've never defined the whole URL, so wouldn't it be working of whatever folder it's within, regardless of the domain?

[3s-gtech]

It's not defined in my installs, so by all means try it. You won't break anything, it just may not load. As you say, it should all be internal - I know that with Moodle you still have to define the path, not so with Joomla and WP may echo that.

[jonspurs]

Cheers.

Ok had a butchers and LGFL PLESK auto populates the 'Settings' area with the full URL. Might have to speak to LGFL when it comes to changing over, to find out exactly what they'll do. Found articles of downloading the database/files/themes and uploading again...but not sure if we have to do that all being hosted by LGFL.