CleanTalk's blog

Author: Alexander

A Beginners’ Guide: Crafting Captivating Pages on Your WordPress Website
WordPress pages are the cornerstones of your website’s static content, perfect for showcasing timeless information like “About Us” or “Contact” sections. This comprehensive guide will empower you to not only create pages in WordPress but also structure them strategically and fill them with engaging content.

Creating a New Page
1. Log in to your WordPress dashboard.
2. In the left-hand menu, navigate to Pages.
3. Click on Add New.
Building Your Page’s Content
- Title: Craft a clear and concise title that encapsulates your page’s content. This title will be displayed in navigation menus and search results.
- Content Area: This is where your page’s main content resides. WordPress utilizes a block editor, allowing you to add text, images, videos, and more using pre-designed blocks:
- Click the “+” button to explore the various block options.
- Drag and drop blocks to arrange your content in the preferred order.
- Featured Image (Optional): Select an image that visually represents your page’s content. This image is often displayed alongside your page title.
Content Composition Techniques
- Readability Matters: Break up large text chunks with images, headings (H1, H2, etc.), and bullet points. Use short paragraphs for easy scanning.
- Internal Linking Power: Link to relevant pages within your website to enhance navigation and keep visitors engaged.
Publishing and Visibility Control
- Publish Button: Once your content is ready, click the “Publish” button to make your page live on your website.
- Visibility Options: You can choose to make your page publicly viewable, set it as a draft for further editing, or mark it as private for specific users.
Arranging Your Pages for Optimal Flow (Page Hierarchy)
- Parent-Child Relationships: WordPress allows you to establish a hierarchical structure for your pages. A parent page acts as a category, housing child pages that fall under its umbrella.
- While creating a new page, look for the “Page Attributes” section on the right-hand side of the editor.
- Under “Parent,” use the dropdown menu to select an existing page as the parent. This creates a sub-page nested under the chosen parent page.
- Navigation Menu Creation: Once you have a few pages, it’s time to create a navigation menu to help visitors find their way around.
- In the WordPress dashboard, navigate to Appearance > Menus.
- Give your menu a name and select the pages you want to include. You can use drag-and-drop to arrange the pages in the desired order within the menu.
- Choose a menu location (header, footer, sidebar) and click “Save Menu” to make it live on your website.
Maximizing Your Pages’ Potential
- Categorize and Tag: Organize your pages using categories and tags to help visitors discover related content. Categories are broader groupings, while tags are more specific keywords.
- Preview Function: Before publishing, use the preview function to see how your page will appear on the live website. This allows you to refine the layout and content before making it public.
- SEO Optimization: Enhance your search ranking by incorporating relevant keywords in your title, headings, and content. Consider using SEO plugins for further optimization.
  - Yoast SEO: A household name in the WordPress SEO world, Yoast offers a user-friendly interface with a comprehensive feature set. It excels in on-page optimization, guiding you through keyword optimization, readability analysis, and title tag and meta description creation. While the free version provides a solid foundation, premium plans offer additional features like internal linking suggestions and social media previews.
  - Rank Math: This plugin is a powerful contender, known for its extensive free features and affordable paid plans. It offers on-page optimization tools similar to Yoast, including keyword research suggestions, content analysis, and schema markup implementation. Rank Math integrates well with popular page builders and provides basic local SEO and WooCommerce SEO optimization within the free version.
  - SEOPress: This plugin is another strong option, particularly for those seeking a lightweight and speed-focused solution. SEOPress offers on-page optimization tools, social media optimization, and broken link checker functionalities. Their free version is feature-rich, and their paid plans cater to larger websites with features like content redirection and white labeling.
  - The SEO Framework: If technical SEO is your primary concern, The SEO Framework is a great choice. It prioritizes website speed and automation, with features like automatic image SEO optimization, robots.txt editor, and built-in XML sitemap generation. While the free version offers valuable tools, paid plans unlock features like local SEO optimization and content audits.
Bonus Advice: Choosing the Right SEO Plugin

The best SEO plugin for your website depends on your specific needs and preferences. Here’s a quick breakdown to help you decide:
- For beginners: Yoast SEO or Rank Math (free versions) offer a user-friendly interface and essential features.
- For value-seekers: Rank Math provides a comprehensive free feature set with affordable paid upgrades.
- For speed-conscious users: SEOPress is a lightweight option that prioritizes website performance.
- For technical SEO focus: The SEO Framework excels in website speed optimization and automation.
Remember, SEO is an ongoing process. It’s wise to experiment with different plugins to find the one that best suits your workflow and SEO strategy.

By following these detailed steps and incorporating these tips, you can create well-structured, informative, and engaging pages that will elevate your WordPress website and provide a seamless user experience for your visitors.
July 18, 2024
CleanTalk Research Team Discovers Stored XSS Vulnerability in WP SEOPress Plugin (v7.7.1)
The CleanTalk Research Team identified a critical Stored XSS (Cross-Site Scripting) vulnerability in the WP SEOPress plugin, version 7.7.1. This flaw can be exploited by attackers with contributor privileges to create new admin accounts, potentially granting them full control of your WordPress website.

Understanding Stored XSS (CVE-2024-4899)

Stored XSS vulnerabilities allow attackers to inject malicious scripts directly into your website’s database. These scripts are then executed whenever someone views the compromised content. Unlike reflected XSS, user interaction isn’t required to trigger the attack, making it particularly dangerous.

How Attackers Can Exploit This Vulnerability

An attacker with contributor privileges can exploit this vulnerability by injecting malicious JavaScript code into the “SEO Title” field while creating a new post. This code can then be used to create a new admin account, granting them complete control over your website.

Potential Consequences of an Exploit
- Complete Site Takeover: Attackers could create new admin accounts and seize full control of your website.
- Data Theft: Sensitive information like user credentials, financial records, and even your website’s content could be stolen.
- Website Defacement: Attackers could alter the appearance of your site, inject further malicious code, or display unauthorized content.
- Persistent Backdoors: Malicious actors might install backdoors to ensure continued access even after the initial vulnerability is patched.
Taking Action to Secure Your Website
1. Update Immediately: The most critical step is to update the WP SEOPress plugin to the latest version as soon as possible. This update addresses the vulnerability and safeguards your website.
2. Review User Roles: Carefully review user roles and permissions. Contributors should have the minimum access necessary for their tasks.
Through continuous vulnerability discovery and disclosure, we empower website owners and developers to take preventative measures. We believe that by working together, we can create a robust and secure WordPress ecosystem for everyone.

Stay vigilant. Stay secure.
July 4, 2024
Attention CleanTalk Anti-Spam Users! Important Update Regarding Public Widget
We’re writing to inform you that the public widget for CleanTalk Anti-Spam will be removed from the plugin and no longer be supported after August 1, 2024.

What does this mean for you?

The public widget, which is typically displayed on public pages and demonstrates the number of spam attacks, is no longer considered compatible with modern WordPress development practices and has seen low user demand. As a result, we’re removing it from the plugin to ensure optimal performance, streamline the user experience, and focus on core functionalities. This removal also helps us stay aligned with future WordPress versions.

What action should you take?

While the public widget will no longer be available after August 1, 2024, CleanTalk Anti-Spam’s core functionality remains unchanged and will continue to provide robust spam protection for your WordPress site.

Here’s what you can do:
1. No action required: If you don’t utilize the public widget, you don’t need to take any further action. CleanTalk Anti-Spam will continue to operate seamlessly.
2. Review alternative widget usage: If you’ve been using the public widget, we recommend exploring alternative methods for interacting with CleanTalk Anti-Spam’s features. These may include accessing settings pages or utilizing shortcodes.
Affiliate Program Guidance

If you’ve been using the public widget to promote the CleanTalk AntiSpam Affiliate program, we recommend transitioning to using Affiliate links along with our banner. This method provides a more streamlined and effective way to promote the program.

To get started with Affiliate links:
1. Access your CleanTalk Affiliate Dashboard: Log in to your CleanTalk account and navigate to the Affiliate program section.
2. Generate your Affiliate link: Your unique Affiliate link is provided within the dashboard. Copy this link for use in your promotional materials.
3. Utilize our Affiliate banner: We offer a visually appealing banner that you can include alongside your Affiliate link. Download the banner from the Affiliate dashboard.
4. Promote your Affiliate link and banner: Share your Affiliate link and banner on your website, social media channels, or other relevant platforms. When a visitor clicks on your link and signs up for CleanTalk AntiSpam, you’ll earn a commission.
By transitioning to Affiliate links and our banner, you can continue to effectively promote the CleanTalk AntiSpam Affiliate program while aligning with the updated public widget removal.

We understand that change can be challenging, and we appreciate your understanding as we work to enhance the CleanTalk Anti-Spam experience.

If you have any questions or concerns, please don’t hesitate to contact our support team.

Thank you for being a valued CleanTalk Anti-Spam user!
June 27, 2024
Critical Vulnerability Discovered in Gutenberg Blocks by Kadence Blocks Plugin
Our team at CleanTalk prioritizes the safety and security of the WordPress ecosystem. Through routine security testing, we’ve identified a critical vulnerability in the Gutenberg Blocks by Kadence Blocks plugin. This flaw poses a serious threat to WordPress websites, as it allows attackers to inject malicious code and potentially gain complete control.

Understanding the Threat (CVE-2024-4057)

This vulnerability, classified as Stored XSS (Cross-Site Scripting), enables attackers to embed malicious scripts directly into your website’s content. Unlike some vulnerabilities, Stored XSS doesn’t require user interaction to be triggered. This means anyone visiting your site, not just administrators, could be exposed.

Potential Consequences of an Exploit
- Complete Site Takeover: Attackers could create new admin accounts and seize full control of your website.
- Data Theft: Sensitive information like user credentials, financial records, and even your website’s content could be stolen.
- Website Defacement: Attackers could alter the appearance of your site, inject further malicious code, or display unauthorized content.
- Persistent Backdoors: Malicious actors might install backdoors to ensure continued access even after the initial vulnerability is patched.
Taking Action to Secure Your Website

The most critical step is to update the Gutenberg Blocks by Kadence Blocks plugin to the latest version immediately. This update addresses the vulnerability and safeguards your website.

CleanTalk’s Commitment to WordPress Security

At CleanTalk, we are relentless in our pursuit of discovering and disclosing vulnerabilities to protect the WordPress community. We strongly encourage all website owners to prioritize regular security updates and implement additional security measures like:
- Regular Vulnerability Scans: Proactive scanning helps identify and address potential threats before they are exploited.
- Least Privilege Principle: Grant users only the permissions necessary for their roles to minimize damage in case of a compromise.
- Security Plugins: Consider using security plugins that offer features like malware scanning, firewalls, and real-time threat monitoring.
By working together, we can create a safer and more secure WordPress ecosystem for everyone.

Stay vigilant. Stay secure.
June 24, 2024
Mitigating WordPress.com API Vulnerability
Attention WordPress website owners! We’re excited to announce that the CleanTalk Security Plugin now effectively addresses a well-known vulnerability involving the WordPress.com API.

This vulnerability, previously discussed here, allowed unauthorized actors to potentially trace administrator usernames through a public API endpoint. While disabling the REST API entirely would be ideal, it wasn’t always a viable option for many websites.

The CleanTalk Team Steps Up

We understand the critical nature of this vulnerability and the potential security risks it poses. Our development team has been working diligently to implement a comprehensive solution within the CleanTalk Security Plugin.

This update delivers:
- Enhanced User Data Protection: CleanTalk can now effectively block attempts to exploit the exposed API endpoint, safeguarding your administrator username and other sensitive user data.
- Improved Overall Security: This fix is just one piece of the puzzle. CleanTalk Security offers a robust suite of security measures to keep your website safe from a wide range of threats.
What You Can Do
1. Update Your Plugin: Ensure you’re running the latest version of the CleanTalk Security Plugin to benefit from this critical fix and ongoing protection.
2. Review Your Security Practices: Consider implementing additional security measures like strong password policies and user access restrictions for an extra layer of defense.
CleanTalk: Committed to Your Security

We at CleanTalk are dedicated to providing the best possible security for your WordPress website. We continuously refine our plugin to address both emerging and long-standing vulnerabilities.

For further information on CleanTalk Security and its capabilities, please refer to the plugin’s documentation.

This revised announcement emphasizes the team’s effort in resolving a known issue and highlights the broader security benefits of the CleanTalk Security Plugin.
June 13, 2024
Strengthen Your WordPress Security with Built-in Vulnerability Checks by CleanTalk
The CleanTalk Security plugin now offers built-in plugin vulnerability checks, empowering you to safeguard your WordPress website proactively. Just a friendly reminder if you haven’t try it till now: feel free to pick up the plugin and install it according to these instructions.

While plugins add valuable functionality, they can also introduce security risks if vulnerabilities exist. To address this, CleanTalk regularly scans popular plugins and integrates the findings directly into the Security plugin.

Here’s how it benefits you:
- Real-time Vulnerability Insights: Get notified within the plugin itself whenever potential vulnerabilities are detected in your active plugins.
- Proactive Security Measures: Take immediate action to address vulnerabilities and minimize the risk of attacks.
- Simplified Security Management: No need to visit external platforms for vulnerability information; it’s all accessible within the plugin.
This integration strengthens your WordPress security by informing you about potential threats and allowing you to take immediate action.

Stay Updated, Stay Secure!

The CleanTalk Security plugin continues to evolve, offering comprehensive security solutions for your WordPress site. Remember to update the plugin to benefit from the latest features and vulnerability checks.
May 27, 2024
A Beginner’s Guide: How to Install WordPress Step by Step
Welcome aboard the WordPress express! Today, we’re rolling up our sleeves to install WordPress from scratch. Don’t worry if tech stuff seems like a foreign language; I’ll guide you through each step with crystal clarity.

1. Pick Your Host

Selecting the right hosting provider sets the foundation for your website’s success. It’s akin to choosing the perfect spot for your dream home. Take into account crucial aspects like pricing plans, available storage, customer support responsiveness, and server uptime reliability.

With a plethora of hosting options out there, ranging from big names to smaller, niche providers, you’re spoiled for choice. Some offer user-friendly interfaces, while others prioritize lightning-fast servers or round-the-clock support. It’s like browsing through a buffet—each option has its unique flavors, catering to different preferences.

So, take your time to explore the offerings, read reviews, and consider your priorities. Once you’ve found the host that ticks all your boxes, it’s time to make it official. Sign up, secure your digital plot, and get ready to build your online empire with WordPress!

2. Launch One-Click Install

Once you’ve got hosting sorted, log into your hosting account. Look for the “WordPress Installer” or a similar tool. Click it, follow the instructions, and boom! WordPress is now installed on your hosting server.

3. Installing WordPress Without One-Click

If your hosting provider doesn’t offer a one-click WordPress installation option, fear not! You can still install WordPress manually, and it’s simpler than you might think. Here’s a step-by-step guide to get you started:
- Download WordPress: Visit the official WordPress website and download the latest version of WordPress. It will be a zip file, so make sure to extract its contents to a folder on your computer.
- Create a Database: Log in to your hosting account’s control panel (usually accessed through a link provided by your hosting provider). Look for the “Database” section and create a new MySQL database. Note down the database name, username, and password—you’ll need these later.
- Upload WordPress Files: Using an FTP client like FileZilla, connect to your hosting account. Navigate to the directory where you want to install WordPress (usually the “public_html” folder) and upload all the extracted WordPress files.
- Configure wp-config.php: In the WordPress folder on your hosting account, you’ll find a file named “wp-config-sample.php.” Rename this file to “wp-config.php” and open it in a text editor. Enter your database details (database name, username, and password) where indicated, and save the file.
- Run the Installation Script: Now, open your web browser and navigate to your domain name (e.g., www.yourdomain.com). You should see the WordPress installation wizard. Select your language and click “Continue.” Enter your site details (title, username, password, email) and click “Install WordPress.”
- Complete Installation: Once the installation is complete, you’ll receive a success message. You can then log in to your WordPress dashboard using the username and password you set during installation.
4. Choose a Theme

It’s time to spruce up your site with a theme. Head to “Appearance” > “Themes” in the dashboard. Browse the free themes or consider purchasing a premium one for extra features. Click “Install” and “Activate” to apply your chosen theme.

5. Customize Your Site

Personalize your site’s appearance by tweaking settings in the WordPress Customizer. Change colors, fonts, and layouts to match your style. No coding is required—just click, preview, and save your changes.

6. Add Essential Plugins

Plugins are like apps for your website, adding extra functionality with a few clicks. From your dashboard, go to “Plugins” > “Add New.” Search for plugins like Yoast SEO for better search engine visibility or Contact Form 7 for creating forms. It’s a good idea to shield your website from spambots—they’ll know about it in the blink of an eye, and you’ll be attacked by virtual armies in no time. Also, you might want to exclude the possibility of your work being ruined by malware programs. For both of these problems, a good solution is Anti-Spam and Security plugins by CleanTalk.

Click “Install” and then “Activate” to start using them.

7. Start Creating Content

Time to unleash your creativity! Click on “Posts” or “Pages” in the dashboard to write articles or create new pages. Use the intuitive editor to format text, add images, and publish your content. Don’t worry about making it perfect — editing is your friend!

There you have seven straightforward steps to install WordPress and kickstart your online journey. No tech wizardry required, just a little patience and a willingness to explore. So go ahead, dive in, and start building your dream website!
May 24, 2024
CleanTalk SpamFireWall Sets New Record: Blocking 777 Million Bot Requests in April

In April, CleanTalk SpamFireWall achieved a significant milestone by blocking an impressive 777 million bot requests. This accomplishment underscores our commitment to enhancing digital security through cutting-edge technology and vigilant monitoring.

This feat serves as a reminder of the persistent threat posed by automated bots in today’s interconnected world. SpamFireWall plays a crucial role in safeguarding online platforms from exploitation by swiftly identifying and neutralizing suspicious activities.

We owe this success to our team’s dedication and our customers’ support. Their invaluable feedback and collaboration have been instrumental in achieving this remarkable milestone.

You can find our latest spam stats here for those interested in more detailed statistics on bot activity and SpamFireWall’s performance.

SpamFireWall, an optional feature of the CleanTalk Anti-Spam Plugin, enhances website security by blocking access for spam-active IP addresses, effectively denying them entry (via blocking GET requests). By intercepting spambots before they reach the website, SpamFireWall prevents the loading of pages for these malicious bots. This action alleviates the burden on your web server, reducing the load on both the database and server resources.

Moving forward, SpamFireWall remains committed to staying at the forefront of cybersecurity. We will continue to innovate and adapt to emerging threats to ensure a safer digital landscape for all users.

This achievement in April reflects our unwavering resolve to combat cyber threats and uphold the highest standards of digital security. Together, we will continue to protect online ecosystems and instill confidence in users worldwide.

May 13, 2024
Strengthen Your WordPress Defense: The Ultimate Brute Force Protection
In the vast world of the internet, your WordPress site faces constant threats from brute force attacks. But worry not! Security & Malware Scan by CleanTalk is here to fortify your digital fortress and ensure it remains impervious to intrusion.

In WordPress security, the login form is both essential and vulnerable. Hackers target it with relentless brute force attacks, exploiting weaknesses in passwords and outdated software. Once inside, they wreak havoc, defacing sites or stealing sensitive data. However, with measures like two-factor authentication and regular updates, we can strengthen our defenses and keep our digital kingdoms safe from harm.

Enhance Your Security: Key Features
- Security Firewall: Guard Your Gates
“Build a sturdy wall around your website! CleanTalk’s Security Firewall filters out malicious IPs and halts DDoS attacks, safeguarding your WordPress site from harm.”
- Malware Scanner: Detect and Remove Threats
Hunt down hidden dangers! CleanTalk’s vigilant scanner identifies and eliminates malware, ensuring your WordPress files stay clean and your site stays secure.
- Brute Force Protection: Keep Intruders Out
“Block unwanted guests from your site! CleanTalk’s Brute Force Protection plugin limits login attempts and adds delays on failed logins, effectively thwarting brute force attacks.
- Two-Factor Authentication: Double Up on Security
Add an extra layer of protection! CleanTalk’s Two-Factor Authentication ensures that only authorized users gain access to your WordPress domain, boosting security for your peace of mind.
- Custom wp-login URL: Hide Your Entry Point
Keep your login page under wraps! CleanTalk lets you customize your login URL, confusing automated login attempts and safeguarding against unauthorized access.

Secure Your WordPress Stronghold

With over 20,000 active installations and nearly a perfect 5-star rating on WordPress.org, Security & Malware Scan by CleanTalk stands as a trusted guardian in the realm of WordPress security. Its widespread adoption and high user satisfaction attest to its effectiveness in fortifying websites against cyber threats. From thwarting brute force attacks to detecting and eliminating malware, Security & Malware Scan by CleanTalk offers a comprehensive suite of features to keep your WordPress site safe and secure.

Don’t overlook the critical need to fortify your digital defenses. Stay informed with CleanTalk Research, your indispensable source for real-time alerts on plugin vulnerabilities and PSC plugin security certificates. Subscribe to our Telegram channel and stay one step ahead of cyber threats. Learn more: Subscribe to CleanTalk Research

Choose Security & Malware scan by CleanTalk and protect your WordPress kingdom with ease and efficiency. Your digital fortress awaits its impenetrable shield!
May 13, 2024
Revealing Vulnerabilities: The All-in-One SEO Plugin Dilemma

In the expansive domain of WordPress, a critical security flaw has been unveiled within the widely-utilized All-in-One SEO plugin. Known by its identifier, CVE-2024-3368, this vulnerability exposes a concerning loophole that malicious actors can exploit through Stored Cross-Site Scripting (XSS) attacks, jeopardizing the security of numerous websites. The trouble concerns all versions of All-in-One SEO older than 4.6.1.1.

This flaw was unearthed during routine security evaluations, shedding light on a troubling scenario where unauthorized individuals can inject harmful JavaScript code directly into WordPress posts. This unauthorized access allows for the manipulation of administrative privileges, potentially leading to serious repercussions such as website tampering and unauthorized data access.

In response to this alarming revelation, immediate action is crucial. WordPress website owners are strongly advised to promptly update their All-in-One SEO plugin to the latest version, fortified with patches to address this vulnerability. Furthermore, implementing stringent security measures, including regular audits and access controls, is essential to mitigate the risk of exploitation.

Behind the scenes, CleanTalk remains dedicated to safeguarding the WordPress ecosystem. Through vigilant monitoring of plugins and the provision of timely alerts, CleanTalk aims to empower website owners with the necessary tools and knowledge to defend against cyber threats effectively and preserve the integrity of their digital platforms.

May 13, 2024

CleanTalk

Sign up / Sign in

Solutions

Anti-Spam for websitee

Filter fake emails

Hide contact data

Stop spam emails in Contact form 7 (CF7)

Stop spam in Elementor form builder

Stop spam in WPForms

Website malware scanner

WordPress Security & Firewall Plugin

Documentation

License agreement

Signs of Malware

Contact us

Create a support ticket