Skip to content

Latest commit

 

History

History
634 lines (489 loc) · 22 KB

Production-website.md

File metadata and controls

634 lines (489 loc) · 22 KB
Raw

Setting up a production WordPress website

Not only for WordPress sites!

  1. Installation
  2. Migration
  3. Upgrade
  4. Check
  5. Monitor
  6. Backup
  7. Uninstallation

Installation

Overview

  • linux user account for website
  • application source code
  • SQL database
  • deploy script
  • CLI tools (application management, OPcache, DNS)
  • SSL certificate
  • PHP-FPM pool
  • webserver virtual host
  • DNS records
  • CDN
  • email sending
  • set up application
  • cron jobs
  • check log files
  • register in webmaster tools

DNS setup

  • A, CNAME (for CDN)
  • MX
  • TXT records for SPF, DKIM, DMARC
  • PTR records
  • Proper TTL values

SSL certificate

  • For safety (personal data)
  • For security (less attacks)
  • For trust (green lock in browsers)
  • For better SEO ranking since 2014
  • For speed (enables HTTP/2)
  • For receiving referrer information (up to April 2012)
  • Very cheap

Authorities: Let's Encrypt, RapidSSL (by DigiCert), DigiCert and other SSL certificate authorities

OCSP performance

  1. Apache-SSL.md
  2. https://www.ssllabs.com/ssltest/ 🐌
  3. https://crt.sh/

WordPress core and theme as Composer packages

  1. See WordPress website lifecycle
  2. Set up database connection
  3. Define constants, generate salts
  4. Edit wp-cli.yml
  5. Use child theme for purchased themes
  6. Keep custom plugins and themes in git repositories

Plugins

  • Document plugin licenses, access to support 🐌
  • Allow accents in URL-s? mu-latin-accent-urls

Root files

Maintenance mode and placeholder page

  • Static all-inline HTML page
  • ErrorDocument 503 nice-page.html + RewriteRule "^" - [R=503,L] + Retry-After header

CDN

Mail sending

wp plugin install --activate wp-mailfrom-ii smtp-uri
wp eval 'wp_mail("admin@szepe.net","first outgoing",site_url());'
  • Obfuscate email addresses antispambot( 'e@ma.il' )
  • JavaScript href fallback: https://www.google.com/recaptcha/admin#mailhide
  • Authenticated delivery for monitoring emails
  • Shortest route of delivery
  • Add server as RELAYCLIENT on the smarthost
  • Email From: name and address
  • Subject line
  • Easy identification for email notifications (filtering to mail folders)
  • SPF for MAIL FROM:, SPF for HELO, DKIM, DMARC

Use transactional email service through HTTP API or with a queueing MTA. 🐌

Security

  • WAF waf4wordpress 🐌
  • For shared hosting: Sucuri Scanner plugin
  • Ninja Firewall Pro
  • PHP extension: ionCube24 ic24.enable = on (PHP file modification time protection)
  • File change notification
  • Subresource Integrity (SRI) integrity="sha256-$(cat resource.js|openssl dgst -sha256 -binary|openssl enc -base64)" crossorigin="anonymous"
  • Google Search Console ("This site may harm your computer" notification on SERP)
  • Virustotal (HTTP API)
  • Maximum security: convert website into static HTML + Cognito Forms or doorbell or formspree or FormKeep simply-static, static-html-output-plugin

Cron jobs

  • Remove left-over WP-Cron events wp cron event list; wp cron schedule list
  • Use real cron jobs wp-cron-cli.sh 🐌

WordPress Settings

  • General Settings
  • Writing Settings
  • Reading Settings
  • Media Settings (fewer generated image sizes) 🐌
  • Permalink Settings
  • WP Mail From 🐌

User management

  • 1 administrator 🐌
  • Personal accounts for editors and authors 🐌
  • Correct post and page authors
  • Enable/disable author sitemaps

RSS feed

@TODO

  • Number of posts
  • Full content
  • Images
  • Comment feeds

Signature as HTML comment

<!-- Infrastructure, source code management and consulting: Viktor Szépe <viktor@szepe.net> -->

Webmaster tools

  • Google Search Console 🐌
  • Bing Webmaster
  • Yandex Webmaster

Migration

Search & replace URL and installation path

Replace constants in wp-config.php

wp search-replace --precise --recurse-objects --all-tables-with-prefix ${OLD} ${NEW}

  1. http://DOMAIN.TLD/wp-includes -> https://NEW-DOMAIN.TLD/SITE/wp-includes (no trailing slash)
  2. //DOMAIN.TLD/wp-includes -> //NEW-DOMAIN.TLD/SITE/wp-includes (no trailing slash)
  3. http://DOMAIN.TLD/wp-content -> https://NEW-DOMAIN.TLD/static (no trailing slash)
  4. //DOMAIN.TLD/wp-content -> //NEW-DOMAIN.TLD/static (no trailing slash)
  5. http://DOMAIN.TLD (no trailing slash)
  6. //DOMAIN.TLD (no trailing slash)
  7. /home/PATH/TO/SITE (no trailing slash)
  8. EMAIL@ADDRESS.ES (all addresses)
  9. DOMAIN.TLD (now without protocol)

Check home and siteurl

wp option get home
wp option get siteurl

Uploads, media

wp media regenerate --skip-delete --only-missing

Remove missing (base) images.

Clean up database

Check database collation and table storage engines.

See alter-table.sql

Delete transients and object cache contents.

wp plugin install --activate wp-sweep
wp transient delete-all
wp db query "DELETE FROM $(wp db prefix)options WHERE option_name LIKE '%_transient_%'"
wp cache flush

Flush full page caches.

wp w3-total-cache flush
ls -l /home/USER/website/code/static/cache/
ls -l /home/USER/website/pagespeed/; touch /home/USER/website/pagespeed/cache.flush

Check spam and trash comments.

wp comment list --status=spam --format=count
wp comment list --status=trash --format=count

Optimize database tables.

wp db optimize

Remove development and testing stuff

  • Sample / Demo content 🐌
  • Code editor configuration file .editorconfig
  • Files: find -iname "*example*" -or -iname "*sample*" -or -iname "*demo*"
  • PHP-FPM pool configuration: env[WP_ENV] = production

VCS

Put custom theme and plugins under git version control. 🐌

Keep git directory above document root.

Redirect old URL-s (SEO)

wp plugin install --activate safe-redirect-manager

https://www.google.com/search?q=site:DOMAIN

Also redirect popular images.

Flush Google public DNS cache

http://google-public-dns.appspot.com/cache 🐌

Upgrade

Things to stop before upgrade

  • External monitoring - wait for Pingdom - maintenance5.sh
  • Requests from the Internet - Apache - service apache stop
  • Cron jobs (maintenance mode) - service cron stop
  • Monitoring - Monit - monit quit
  • Incoming emails piped into programs - Courier - disable alias

Check

What people remember on your website 🐌

Marketing

Code styling

  • UTF-8 encoding (no BOM)
  • Line ends
  • Indentation
  • Trailing spaces sed -i -e 's|\s\+$||' file.ext

Theme and plugin check

  1. Theme meta and version in style.css
  2. query-monitor errors and warnings
  3. theme-check and https://themecheck.info/
  4. vip-scanner
  5. Frontend Debugger with ?remove-scripts
  6. p3-profiler
  7. https://validator.w3.org/ 🐌
  8. https://validator.nu/

Typical theme and plugin errors

  • Mobile views (responsive design), Mobile-friendliness, Accelerated Mobile Pages (AMP)
  • Zooming in desktop browsers
  • Dynamic page parts (e.g. rotating quotes by PHP)
  • Dynamically generated resources style.css.php (fix: grep -E "(register|enqueue).*\.php")
  • New WordPress entry point (fix: grep -E "\b(require|include).*wp-")
  • Missing theme meta tags in style.css
  • Missing resource version in grep -E "wp_(register|enqueue)_.*\(" calls
  • Script/style printing (instead of using wp_localize_script(); wp_add_inline_script(); wp_add_inline_style();
  • Always requiring admin code (fix: whats-running)
  • Lack of grep -E "\\\$_(GET|POST)" sanitization
  • Missing nonce on input
  • PHP short opentags (fix: grep -F "<?=")
  • PHP errors, deprecated WP code (fix: define( 'WP_DEBUG', true );)
  • Lack of permissions for WP editors
  • Non-200 HTTP responses
  • Extra server-side requests: HTTP, DNS, file access
  • Independent e-mail sending (fix: grep -E "\b(wp_)?mail\(")
  • Proprietary install/update (fix: disable TGM-Plugin-Activation)
  • Home call, external URL-s (fix: search for URL-s, use Snitch plugin and tcpdump)
  • Form field for file upload <input type="file" />
  • Insufficient or excessive font character sets (fix: &subset=latin,latin-ext)
  • @font-face formats: eof, woff2, woff, ttf, svg; position: top of first CSS
  • BOM (fix: sed -ne '1s/\xEF\xBB\xBF/BOM!!!/p')
  • Characters before <!DOCTYPE html>
  • JavaScript code parsable - by dummy crawlers - as HTML (<a> <iframe> <script>)
  • Page loading overlay, display content by JavaScript causing FOUC
  • Unnecessary Firefox caret
  • Confusion in colors: normal text color, link and call2action color, accent color
  • Email header and content check https://www.mail-tester.com/

Duplicate content

  • www -> non-www redirection
  • Custom subdomain with same content
  • Development domains
  • Early access domain by the hosting company: cpanel.server.com/~user, somename.hosting.com/
  • Access by IP address: http://1.2.3.4/

404 page

  • Post and image removal policy (for bots, for humans, redirect to another post)
  • Informative
    • Reassuring the user we know about the problem 🐌
    • How to go on? 🐌
  • Attractive 404 pages on AWWWARDS
  • Cooperative
    • Search form
    • Error reporting email address
    • Out of stock message get_page_by_path( untrailingslashit( $_SERVER['REQUEST_URI'] ) . '__trashed', OBJECT, $post_type )
    • Automatic suggestions (specific category archive)
    • Promotions
    • Google's fixurl.js
    • Support: Intercom Bot on repeated attempts or a simple (3rd-party) feedback form 🐌
  • Adaptive Content Type for 404-s
  • Redirect with delay <meta http-equiv="refresh" content="8; URL=/">
  • Other error pages (500, 503)

Resource optimization

HTTP

PHP errors

wp-config.php: define('WP_DEBUG', !false);

tail -f /var/log/apache2/SITE_USER-error.log | sed -e 's|\\n|\n●|g'

SEO

Google's Search Quality Evaluator Guidelines

Legal (EN)

Jogi dolgok (HU)

  • Adatkezelési tájékoztató (cégen belül Adatvédelmi szabályzat) EU általános adatvédelmi rendelet (GDPR, 2018. május 25-től érvényes) 🐌
    • HTML és PDF formátumban (PDF title)
    • A tájékoztató címében a honlap domain-ja
    • Fogalom értelmezés
    • Adatkezelő adatai, elérhetősége
    • Adatvédelmi felelős adatai
    • Adatfeldolgozók listája és tevékenységük és az adatok: látogató mérés, közösségi doboz, tárhely szolgáltató
    • Cookie-k kezelése
    • Offline adatok: ügyfélkapcsolat (email, telefon), könyvelés, kamera rendszer, papíron tárolt adatok
    • Az érintettek jogai, adatvédelmi incidens
    • Jogorvoslat, bíróság
    • Bírósági jogérvényesítés
    • Kártérítés és sérelemdíj
    • Törvényekre § való hivatkozás
    • Kelt és érvényesség kezdete
  • Impresszum (csak űrlaphoz kell)
  • ÁSZF (vásárláshoz)
  • Ingyenes NAIH Tájékoztatás az adatvédelmi nyilvántartás megszűnéséről

Compatiblitity

  • JavaScript disabled
  • OpenGraph for Facebook (Sharing Debugger) and Twitter (Card validator) 🐌
  • Google Translate (notranslate meta), Facebook app (running in an IFRAME), Google Search "Cached" 🐌
  • GoogleImageProxy (Gmail, Google Images)
  • Ad blockers and filter lists: uBlock Origin, Adblock Plus, Disconnect (Firefox ETP), Ghostery
  • Microsoft Office, Libre Office (copy-and-paste content or open URL in office application)
  • Text selection: color+background-color, disable selection, display share options on select (see Feedly)
  • Keyboard-only navigation (tabbing, skip navigation) 🐌
  • Emojis and UNICODE (entering, storing, displaying)
  • Toolbar color of Chrome for Android (theme-color meta) 🐌
  • Windows 8 and 10 tiles
  • <head> cheatsheet
  • Phone numbers (clickable, tracked)
  • Skype IE Add-on <meta name="SKYPE_TOOLBAR" content="SKYPE_TOOLBAR_PARSER_COMPATIBLE">
  • Printer, Gutenberg framework
  • Accessibility, attributes for screen readers, guidelines
  • Reader mode (from Firefox chrome://global/skin/aboutReaderContent.css)

Integration (3rd party services)

Document in hosting.yml and check functionality.

Tracking

Gain access, set up and test.

  • Heap Analytics
  • Google Analytics (revenue tracking), Google Tag Manager 🐌
  • Facebook Pixel
  • Segment
  • Clicktale
  • Smartlook
  • Hotjar
  • URL shortening: Link tracking, Download tracking

Verifying and debugging trackers.

Last checks

  • Basic site functionality 🐌
  • Registration 🐌
  • Purchase 🐌
  • Contact forms 🐌

Monitor

See /monitoring/README.md

Uptime (pingdom.com, hetrixtools.com, selectel.com) 🐌

List of all errors in Apache httpd

Track application and JavaScript errors with Sentry

Set up status page with Cachet

Backup

  1. Database
  2. Files
  3. Settings (connected 3rd party services)
  4. Authentication data
  5. External resources (S3 bucket)
  6. Issues (Trello, GitLab)
  7. Code repositories (GitLab, GitHub)

Uninstallation

  • Archive for long term
  • Monitoring
  • Backups
  • DNS records
  • PHP-FPM pool
  • DB, DB user
  • Webserver vhost, add placeholder page
  • Revoke SSL certificates
  • Fail2ban logpath
  • Webserver logs
  • Files
  • Linux user
  • Email accounts
  • External resources (3rd party services)
  • Google Search Console
  • Delete accounts at service providers

Maintenance 🔧

Have me on board: viktor@szepe.net