Web Hosting Plan - dofollow blog

1Feb/10Off

DDOS Attack – denial of service attack

DDOS Attack – A denial of service attack. DDOS= Distributed Denial of Service. It can also be known as just DOS Attack (without the Distributed)

Without going into great technical detail that you can read on Wikipedia I thought I would publically answer a clients question. This came after the server he was on suffered a DDOS attack but was not his own site.

He asked 3 questions which I have answered below:

a) Why do people do DDOS attacks? What’s the purpose?

Let’s say your website gets to number 1 in Google because you do all the right things. Number 1 in Google gets 42% of all the click through traffic (a leaked AOL research report from around 2005). So it can be big $$ being number one. Especially if you are in the Viagra business or casinos etc. So if you get to number 1 and some company from say China is there then you can kill their business... so they attack!!

They can also occur for political reasons, for fun but it is generally that your website has got to number 1 in Google or said or done something that someone else with power didn’t like. Unfortunately it is common business and happens a lot.

b) What happens to the server and me?

The DDOS attack disables the website and the server for the duration of the attack (so any other web pages on that server are disabled as well). This is done by flooding the server with fake requests so that it cannot reply to the legitimate requests. There are other attacks as well but I am keeping it simple. In a lot of cases you get blackmailed as well. So if you don’t pay $$$ to this account then we won’t stop.

C) Who does this and how?

Unfortunately everyone from the 10 year old next door to criminal gangs in Russia do it.

There are many different methods but the most common is via a “virus” – infect say your computer and 10,000 other computers. This then creates a "botnet" - a network of computers all under the control of one of these groups. They install some software on your computer which does not visibly affect your computer at all. No damage to your files or anything. They don’t steal your bank account numbers but hijack your internet connection instead. They then send a command to your computer getting it to access xyz.com. Now when 10,000 or 100,000 computers around the world want to get xyz.com its server gets overloaded (this happened to Google and Yahoo when Michael Jackson died but it was legitimate requests but they both went into anti attack mode! Incorrectly of course). Now all the big players have their webpage spread out over a lot of servers in a lot of locations -"load balancing". So the big guys can rarely be taken down in attack like this because they have so much server & internet capacity that even 10,000,000 computers would not take a site down.

Unfortunately for the average person and 99.999% of web pages out there, you cannot afford your own data centre. When you are on the cheapest plans (anything under about $150-200 a month) you share a server with other websites. On the very cheapest plans there could be 100 websites all getting 10-100 hits per day. So that is no problem even for a weak server. But if one of these websites gets attacked even with even a 1,000 computers then your site and the other 100 go down as well.

Even our WHP site is attacked because the webhosting business is ruthless - even though we are only servicing our direct customers for SEO services, friends , our own websites, and those people who find our .com or via the affiliate network and Google searches. We don’t do massive publicity campaigns or draw attention to ourselves, but it still happens.

To stop it we start blocking all the computers (more or less) 1 by 1 that are attacking the server but in some cases it is like a snow flake falling on a bushfire! We also take down the site under attack so that error rejects go back to these robot computers. We also contact all the providers (nodes, hubs, service providers) of where most of the traffic comes from but they don’t respond very quickly. Most times after 2-24 hours they give up and move onto the next guy. So it is a matter of waiting it out if it is not you under attack but your server.

So the gangs have found out that instead of stealing your own banking information they get far more use out of stealing your internet connection. So if in some months you used all your bandwidth in 5 days then you know what might have happened! Now your computer might not be part of a botnet, but if you don’t have the correct virus checkers on it - it might well be next time and you will be helping these guys.

WHP

http://www.webhostingplan.com.au/blog Web Hosting Plans

Database Backup – Cron job – emailed automatically

We have a lot of clients playing with templates, upgrades , patches of programs like Joomla, WordPress, Drupal etc and in a lot of cases adequate backups are not taken. The reason for this is that in instances like WordPress and upgrade is 1 button push and it is often done on a “whim” as it is so easy. In these cases no adequate website backups are taken regardless warning messages. Lets also be honest it is only 1 in a 100 where something goes wrong, but often then takes many hours of work on both sides to fix.

As posted elsewhere we encourage a regular backup procedure as we don't have endless hard drive space and have a strict policy of what is backed up and how long it is kept for. So here is a solution for at least part of that. Below is a script which can be loaded onto your server which will automatically take a copy of a specific database, compress it, keep a copy of the compressed file and email it. Now the email is not secure so you can leave that part out if your database contains credit card numbers or sensitive information. We use this all the time for many of our webpages where it is just say a WordPress Blog.

Here is an example of how we use it for some of our WordPress Blogs.

So the code below is created in a file called livedbbackup.php and is saved in the >/home/MYCOMPANY/ directory which is not accessable from the internet so makes a perfect location for running scripts from.

MYCOMPANY - directory is /home/MYCOMPANY/

WPPassword - is the Word Press database password

make a file called livedbbackup.php

<?php
$today    = date("Y-m-d");
exec('mysqldump -u MYCOMPANY_wrdp1 -pWPPassword MYCOMPANY_wrdp1 > /home/MYCOMPANY/tmp/LIVE_DFCdbDump-'.$today.'.sql');
exec('zip /home/MYCOMPANY/tmp/LIVE_DFCdbDump-' . $today . '.zip '.'/home/MYCOMPANY/tmp/LIVE_DFCdbDump-' . $today . '.sql' );
unlink('/home/MYCOMPANY/tmp/LIVE_DFCdbDump-' . $today . '.sql'); //delete the raw sql file you just created to save space

$file = '/home/MYCOMPANY/tmp/LIVE_DFCdbDump-'.$today.'.zip'; // this is the mail attachment

//who will get the email

$to = 'myemailaddress@mydomain.com';
//You decide what the subject should be

$subject = 'Daily WPress Database Backup';
//create a boundary string. It must be unique. so please don't play with these settings

//so we use the MD5 algorithm to generate a random hash. so please don't play with these settings

$random_hash = md5(date('r', time()));
//define the headers we want passed. Note that they are separated with \r\n

$headers = "From: backup@mydomain.com\r\nReply-To: admin@mydomain.com";
//add boundary string and mime type specification

$headers .= "\r\nContent-Type: multipart/mixed; boundary=\"PHP-mixed-".$random_hash."\"";
//read the attachment file contents into a string,

//encode it with MIME base64, and split it into smaller chunks

$attachment = chunk_split(base64_encode(file_get_contents($file)));
//define the body of the message.

ob_start(); //Turn on output buffering

?>
--PHP-mixed-<?php echo $random_hash; ?>
Content-Type: multipart/alternative; boundary="PHP-alt-<?php echo $random_hash; ?>"
--PHP-alt-<?php echo $random_hash; ?>
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Hello !!!
Database backup included.
--PHP-alt-<?php echo $random_hash; ?>
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
<h2>Hello </h2>
<p> Database backup included.</p>
--PHP-alt-<?php echo $random_hash; ?>--
--PHP-mixed-<?php echo $random_hash; ?>
Content-Type: application/zip;
Content-Transfer-Encoding: base64
Content-Disposition: attachment
<?php echo $attachment; ?>
--PHP-mixed-<?php echo $random_hash; ?>--
<?php
//copy current buffer contents into $message variable and delete current output buffer

$message = ob_get_clean();
//send the email

$mail_sent = @mail( $to, $subject, $message, $headers );
//if the message is sent successfully print "Mail sent". Otherwise print "Mail failed"

echo $mail_sent ? "Mail sent" : "Mail failed";
?>

Add this command to your cron job but only run it when you want to get an email.

php -q /home/MYCOMPANY/livedbbackup.php

This has been written for WordPress but can be used for any program that has a MYSQL database.

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

Rereplacer Plugin for Nofollow in Joomla

Google is a funny beast when you want to have your webpage listed at the top of the search results. There are so many things to do to get to the top but you can also help yourself out by doing some of the following listed below. This is regardless of what Matt Cutts might say today or has said in the past.

Is there any reason to have your “Lost Password” button indexed by Google? Are you really expecting someone to search in Google for that? What about Privacy policies? Terms and Conditions? Maybe FAQs and Contact Us are good things to have in Google.

If Google and the others index those pages then there is a chance they are not indexing pages you want. Ontop of that if Google and the others can get to that page are you losing your Page Rank power to useless pages via useless links? Matt Cutts says you are not – well he did say it once but they change their minds and everything is secret in Google. So our advice is to stop Google and the others getting to these pointless pages. Humans can still get there by clicking on the links but there is no need for all the search bots to get there. This way you can be nearly 100% sure you are not losing your Page Rank power to useless pages. Thus giving your page rank power to the real links on your page that you want this juice to flow.

For one of our clients who was using Joomla we used the usual robots.txt to stop some pages but others are really hard to stop. Things like password links can be blocked in the robots.txt but then it gets too big and complicated. You might accidently block pages you want indexed as in our clients case.

Another choice is to hack the Joomla code and force the rel=”nofollow” link within the code – but what happens with upgrades?

So we have been using another solution Rereplacer Plugin from here http://www.nonumber.nl/extensions/rereplacer it is free. What it does is allows you to replace whatever you want on your entire site. It is extremely powerful but does not affect the code nor does it change your database. All it does is change the page code as it is rendered. So if you deactivate the plugin all changes are gone.

Here is how we have used it for one of our clients:

In the search field we wrote this:

faqs.html,Lost-user-name.html,Lost-password.html,Create-an-account.html,Policies/terms.html,Policies/security.html,Policies/privacy.html,Policies/contact.html

In the replace field we wrote this:

faqs.html" rel="nofollow,Lost-user-name.html" rel="nofollow,Lost-password.html" rel="nofollow,Create-an-account.html" rel="nofollow,Policies/terms.html" rel="nofollow,Policies/security.html" rel="nofollow,Policies/privacy.html" rel="nofollow,Policies/contact.html" rel="nofollow

And it has added nofollows to the links we wanted to keep Google and the others away from.

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

Adwords & Adsense Payout ratio = 70%

We had had a funny thing happen to one our webpages the other day with regards to adwords and adsense. As you have read in an earlier blog we use adwords extensively for testing the actual search results for certain keywords. As part of that process we added content providers for one particular case. And in that case our advertisement was posted on one of our own websites…and clicked on… So as we owned both the data on the Adsense side and on the Adwords side we were able to see how much we got paid and how much it cost. Want to know the numbers? I thought you might as that's why I am writing it here.

Adsense = $0.62 was the income.

Adwords = $0.43 was the expense.

Which means that the Payout ratio was 43/62 = 69%!

Now the numbers are low so if it was say 42.9cents but Google rounded it up (I doubt it) then the %'s change a small amount.

So we could almost say with rounding it was exactly 70%.

Not bad.

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

Using Adwords to generate Accurate statistics.

We use Googles Adwords for many tasks. One of the most useful task is to actually measure traffic. Sure there are tools around including from Google that provide estimates of traffic but these are just estimates. When you are about to buy an exact match domain, it would be nice to know whether or not “London bird watching” provides the same search results as “bird watching London”. If you are about to pay a few thousand dollars or even a few hundred you need to get this right. The benefit of an exact match domain is well worth the effort of getting it right. So we use Adwords to actually target those keywords.

The exact match function [London bird watching] and [bird watching London] are then added to Adwords.

We then do 2 things

Make sure that we pay enough so that our ad will always be shown. Thus providing real search volumes for those days it is showing rather than the very generic calculation from Google which is often out by a significant factor.
If we have enough cash left over we run the ad at the top of the list for Adwords by paying what is needed to see the traffic sent and see how “clickable” the topic is. It might be that people search for that combination but actually meant to search for something totally different.

If you have to pay a lot to do what I have just written then the chances are that the exact match domain will cost a lot as well. If you think about the cost of developing websites this is not much to pay for real statistics, but you need to think about when to run the ads. No point in testing “skiing ads” at the start of summer etc. If you were thinking of developing a website you would have thought about this already.

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

BACK YOUR FILES UP!

We had a “situation” last week where one of the data centers we use came under attack on 3 fronts. 2 were DDOS attacks on servers on our internet connection but not our servers. Then when they “unplugged” our server to plug it into a “backup” line it was “not working properly”. The words in parentheses are the data centers words in the final technical report.

The bottom line was that for 4 days sites that were taking 10 seconds to load normally were taking around 1 minute to load on the even weaker backup line. For some reason we were not able to get our backups off the local backup they had due to the same connection being used. We then requested that they pull out one of the Hard Drives in the NAS and ship it to us overnight but by then (day 4 ) they had fixed all the issues and everything was back to normal.

All of this was completely frustrating especially as they seemed to be hiding the weaknesses they have that are not published in their glossy brochures and whilst this was meant to be a massive attack on some famous but unnamed webpage it is quite surprising that they could completely flood all their lines and not allow us to get our data out of there. Strange really. New data centre here we come!

What this does point out is the value of having your own backups on your own machine. We have some customers who have unlimited bandwidth or have small sites who keep backups on their own machines at home. In 2 of these cases on Day 2 of the problem we restored these sites to a different data centre and they were up and going very quickly after allowing for DNS change over. Then we have a few customers who have little bandwidth and they run backups in Cpanel and have them automatically FTP’d over to our servers saving their own bandwidth so we were able to use those. Then we had a few who had nothing so had to tough it out for the 4 days.

We just want to remind you all to go into Cpanel -> Into the files section -> click “Backups” ->”Full Backup”. Whilst you are more than welcome to keep them on your server area it does not help if there is a server or data centre issue.

If you would like us to create an FTP account on our server so that you can have the backups sent to us then please contact us via support.

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

Email cloaking |Hiding emails in WordPress and elsewhere

What is email cloaking??

There are computers out there scanning the internet looking for email addresses from webpages to put into spam email lists. There are very few webpages these days where you simply have your email address written as address@domain.com . If you did it would not take long depending on how popular your webpage is before this address was picked up and you started receiving emails saying you have won all the money in the world. You know what I mean.

So email cloaking is a way of hiding the email address from these crawlers.

Are any methods 100% perfect?

NO! There is no perfect way because you want legitimate emails to come through. So the most devious people could employ humans to read the webpage and write down the email address.

Solutions:

In the early days of the internet you would write address [at] domain dot com or something similar. Unfortunately as these follow certain formulas they are not safe either – anyone can program those variables in as there are not that many because it still needs to be readable! Just look at how complex and hard it is to read Googles latest CAPTCHAs!
Simple encryption via sources such as http://www.siteup.com/encoder.html (if it is still running). They mix the charactersets up and send you a link which looks like this:

 <A HREF="mailto:&#112;&#114;&#101;&#115;&#97;&#108;es&#64;&#119;e&#98;&#104;&#111;s&#116;&#105;&#110;&#103;plan.&#99;o&#109;.a&#117;">
&#112;&#114;&#101;&#115;&#97;&#108;es&#64;&#119;e&#98;&#104;&#111;s&#116;&#105;&#110;&#103;plan.&#99;o&#109;.a&#117;</A>

Clearly harder to read for a human. But it is only simple encryption by mixing charatersets – and easily converted back.

Java Script – This is currently the most popular way of doing it. You can mix version 2 and 3 to make it not readable by humans. When the “bots” scan the page with this they will see nothing as they don't use JAVA. You can check here - http://www.yellowpipe.com/yis/tools/lynx/lynx_viewer.php

For WordPress:

<script>// <![CDATA[
var prefix = "address";
var suffix = "domain.com";
var address = prefix + "@" + suffix;
document.write('<a href="mai'); document.write('lto:' + address + '" mce_href="mai'); document.write('lto:' + address + '">Email us by clicking here</a>');
// ]]></script>

For others.

<script>
var prefix = "address";
var suffix = "domain.com";
var address = prefix + "@" + suffix;
document.write('<a href="mai'); document.write('lto:' + address + '" mce_href="mai'); document.write('lto:' + address + '">Email us by clicking here</a>');
</script>

Joomla has a module out of the box that does a mixture of 2 and 3. We recommend you use it!
Pictures – You can change the email address into a picture. This means that it is visible to the human eye but they then need to type it in.
Contact Us forms with CAPTCHA – This is a topic of another day.

What you want to make sure is that you don't make it too difficult for people to contact you. Using forms and CAPTCHA means that only the most keen will contact you as it requires a lot of work to get a message through. The easiest of course is to have a system like the JAVA script where they can just press on the link and it will open Outlook already for you. But there are risks.

It is really upto you to decide. You could use disposable email addresses but this will not work for people who have saved an email address but for contact via the internet you could use contact@domain.com and once it gets full of spam change to contact1@domain.com and set an auto reply telling humans to go back to your webpage as your address has changed. There are other options which we will discuss next time.

Have fun out there.

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

a bit about SEO and the plan for the blog

Our blog title is “all about the web”. We plan to talk about whatever is on our minds and at the same time to do some projects of interest. This will all be about the web and whats happening on the web and how you can make the most of it in which ever way you want.. knowledge… money etc.

We will be talking about SEO and what that means and how to make your web page stand out above the rest but only at a basic level. We will only be giving you the information which will help you to get to a Page 3 Ranking in 6 months or so. Everyone here has done it and everyone who will be writing about it has done it. A Page Rank of 3 is achievable within 6 months if you are happy to do the work! We have 2 sites that are actually 5’s but that's not easy. It is almost like the Richter scale in terms of going from a 3-4-5 and beyond. We will help you get to a Page Rank 3 for free – give you the information to get yourself to a 4 but not tell you any of the tricks. They cost and we are not here to sell those and at last count this site was not there yet. Not surprising since it is only 1 month old. We are here to just help your webpage go in the right direction. Don't forget that Page Rank really does not mean anything. It is just funny how obsessed we were with it at the start of our career with Page Rank. It is like a score but after you get to a 3 you will stop following it. Your logs and statistics will be more important. Your conversions rates as well.

We are not just going to be talking about SEO because at last count there were 2,000,000,000,000,000 blogs (almost) on the topic with everyone claiming they know the secrets. Let’s be honest go to Google.com or you local Google and type in SEO or Search Engine Optimization and you will get the people who REALLY KNOW. If you can get into the top 10 for that search in Google then you know what it is about the 1,999,999,xxx,xxx other people might know what it is about but are not the best at it!

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

a Dofollow blog

This blog is a “dofollow” blog using link love of the Hobo variety. That means when you comment to posts you will see just your name and the comment until you have posted enough times. Once you have posted enough times you will then see your link for your name and there will be a “dofollow” – or rather there won’t be a “nofollow”. So the page rank or link juice will flow to your site. We want you to comment and we are happy to reward you. Why else would you bother? That's easy isn’t it? There is a catch or two however

To get this reward you have to add “value” to the post.

o This can be in the form of finding mistakes ( you do this and you will get instant link love!).

o Adding words to your post that Google will love to pick up on! So in that way it does not have to be a long post.

o You can link to it from your website if you think it adds value (link love will instantly flow)

o Spending more than 1 minute thinking about what you are writing where OTHER people would like to read it.

o This blog is here to help you and the comments need to help other people. If we feel they don't then they won’t get approved it is as simple as that. We would prefer to have no comments than 2000 full of spam.

Posts that say things like “great post” or thanking me for this post will not even appear. You can thank me in the ways listed above rather than saying so.
If you hate the post and add value like above it will get posted.
If your webpage is in “bad neighborhoods” as defined by Google or Web Hosting Plan on the day then we won’t approve the comment. Generally we are not interested in gambling, Viagra, free money, scams etc. We am more interested in the honest, hardworking businessman and you will get rewarded.

Enjoy

The team at Web Hosting Plans
http://www.webhostingplan.com.au/blog

Web Hosting Plans – blog Its all about the web

DDOS Attack – denial of service attack

Related Reading:

Database Backup – Cron job – emailed automatically

Related Reading:

Rereplacer Plugin for Nofollow in Joomla

Related Reading:

Using Adwords to generate Accurate statistics.

Related Reading:

BACK YOUR FILES UP!

Related Reading:

Email cloaking |Hiding emails in WordPress and elsewhere

Related Reading:

a bit about SEO and the plan for the blog

Related Reading:

a Dofollow blog

Related Reading:

Sponsor

Pages

Categories

Blogroll

Archives