Presentation given at WordCamp Phoenix 2012. Exported from notes available here: http://cosper.me/wp201/ Video of this presentation is available here: http://wordpress.tv/2012/06/05/jason-cosper-wp201/

1. WordPress 201

2. Howdy!
My name is Jason Cosper .

3. I work for

4. Today, I'm going to teach you how to do some stuff.

5. Like improve your site's performance.

6. And make it more secure.

7. So let's get started...

8. Performance

9. How do we reduce load time?

10. Methods for Reducing Load Time
Visitor & server side caching
Image tweaks & optimization
JavaScript & CSS minification

11. We'll go ahead & begin with caching...

12. ALWAYS BE CACHING

13. Page Caching Plugins
WP Super Cache
W3 Total Cache

15. WP Super Cache vs. W3 Total Cache

16. Browser Caching
I've adapted a set of .htaccess rules from HTML5 Boilerplate for
this.
There's no need to reinvent the wheel, right?

17. Now, let's tighten up those images...

18. Fun with(out) Photoshop

19. Compress Your Images Locally
ImageOptim
Radical Image Optimization Tool
Smush.it

20. Compress Images on Your Site
WP Smush.it

21. Load Images As They're Needed
Lazy Load

22. Finally, let's cut the fat on your CSS & JavaScript...

23. gzip it!

24. Compressing Your CSS and JavaScript
WP Minify
W3 Total Cache

25. Okay, that covers performance.

26. Now, let's focus on security.

27. But first, we'll cleanse our palate with a video .

28. Security

29. How can we lock WordPress down?

30. Methods for Securing WordPress
Block attacks at the server level
Protect your admin area
Staying on top of updates

31. How about we start with blocking attacks at the server level?

32. The ol' bob & weave

33. Who's already using a plugin?

34. Here's why that's not such a great idea...

35. Blocking Without Plugins
5G Blacklist
CloudFlare

36. Okay. Now let's chat about insulating your admin area...

37. Protect ya neck, kid

38. So, we want to keep unauthorized people from getting into your admin area.

39. But we also want to not be annoying to the site's contributors, right?

40. The Programable Bouncers
Login Lockdown
Auto Expire Passwords
Google Authenticator

41. Note: Enabling all of these at once can make logging in an ordeal.

42. Let's finish this out with a conversation about updates...

43. Updating: Not just for weekends anymore

44. According to WPsecure , there were 186 exploits for WordPress and its plugins in 2011.

45. "But it's such a pain to stay on top of plugin updates!"

46. You know what's an even bigger pain? Cleaning up a hacked site.

47. Getting an email reminder though? That's no pain at all.

48. Update Reminders
WP Updates Notifier

49. And that covers security.

50. Questions?

51. That's it! Thanks for hanging out.