What happened on a Tuesday

On the 8th of September, macronimous.com’s admin went from sluggish to unusable. Opening Pages took long enough to make coffee. By the Wednesday, visitors were getting Cloudflare’s 524 timeout page on the front end, which means Cloudflare reached our server, asked for the page, and gave up waiting after a hundred seconds. The site has been on the same WordPress install since 2015, it has 54 active plugins (we know), and it shares an InMotion account with our blog, which is a second, separate install with 33 plugins of its own.

We’d published Auditra three weeks earlier, a free, read-only MCP server for WordPress that lets an AI client read a site’s plugin inventory, autoload, cron schedule, database tables and known vulnerabilities. So the obvious move was to point it at our own site and see how far it got. This post is the honest version of that: what it found, where it stopped, and what it took to get the rest of the way.

We’ll warn you now, it runs long, because the interesting part is the sequence of wrong turns and not the final fix.

Why is the admin slow when the front end is fine? Where to look, in order

If you’re here because your own admin is crawling and you’d rather skip the story, this is the order we’d check now, having done it the long way.

1. cPanel ? Resource Usage. If CPU and memory are low, faults are zero, and Entry Processes reads 0 while the site is timing out, your PHP workers are running outside your account and you can’t see them. That’s a hosting question, not a plugin question.
2. Bypass Cloudflare. Point the domain at the origin IP in your hosts file and hit the login page with curl. If it hangs direct, Cloudflare is cleared.
3. Hit a bare phpinfo.php. If a one-line PHP file hangs, WordPress is cleared too.
4. Ask the host two things: the PHP-FPM max_children for your pool, and a one-day count of requests to wp-cron.php, 404s, and top user agents.
5. Read the autoload, cron list, and plugin inventory with a read-only audit (Auditra, WP-CLI, or by hand). Fix what’s obviously wrong, but don’t assume it’s the cause.
6. Install Query Monitor, open an admin page, and read the HTTP API Calls tab before anything else. Dead remote calls hide there.

Now the long way.

The 12 MB autoload: a real problem, and the wrong one

The first call was analyze_autoload. Autoloaded options are the rows in wp_options that WordPress pulls out of the database on every single request, admin or not, before a plugin has done anything. A healthy site keeps that under a megabyte. Ours was 12.7 MB across 989 options, and 98% of it was unattributed, which is the tool’s way of saying no active plugin claimed ownership of those rows.

The largest entries were all _transient_string-locator-search-files-N, numbered past 200, at 77 to 90 KB each. String Locator is a search-and-replace plugin we’d used and then deactivated, and it never cleaned up after itself. Every one of those transients had no expiry, and every one of them was autoloaded. We ran one DELETE in phpMyAdmin (206 rows, 0.08 seconds), called analyze_autoload again, and watched the number drop to 730 KB.

The first response from the model that read the audit opened with “Found it.” We’ve left that line in because it was wrong, and because it’s the most useful wrong answer in the whole story. A 12 MB autoload is a genuine defect that costs every request on the site, and fixing it changed nothing we could feel. The admin was exactly as slow afterwards. So the finding was correct and the diagnosis was not, and that distinction is the whole point of a tool that reports facts instead of verdicts.

Where the audit stops

Auditra reads state. It can’t time a request, and it can’t see anything below WordPress. So from here the work moved to things it has no access to: cPanel’s resource graphs, a shell, and the hosting company.

The cPanel numbers made no sense at first. CPU sat at 9 to 15% of the limit, memory under 250 MB of 4 GB, zero faults on every hourly row, and Entry Processes (the count of web requests being handled) at zero while the site was timing out. At one point CPU read 215% with Entry Processes still at zero and six processes total, which is not what a busy website looks like. A ps aux from the cPanel terminal during a hang showed nothing running under our user at all.

To rule out Cloudflare we edited the hosts file on a Mac to point the domain straight at the InMotion IP and ran curl against the origin. The home page came back in 1.4 seconds (a cached file served by WP Fastest Cache from disk, no PHP involved). The login page hung indefinitely. So did phpinfo.php, a one-line file with no WordPress in it. That was the moment the site stopped being the suspect. Nothing in WordPress can make a bare phpinfo() hang.

We read all of that, at the time, as “requests aren’t reaching PHP.” That turned out to be the wrong layer too, and we’ll own it: the requests were inside PHP, in a place we couldn’t see.

Six PHP-FPM workers: the max_children limit on shared hosting

The InMotion engineer (a patient man, by the third hour) found it: the PHP-FPM pool for the account was hitting its max_children limit, and that limit was six. Six PHP processes for a 54-plugin admin, a 33-plugin blog, all their cron jobs, and every bot on the internet. And the number is fixed per plan on shared hosting; it can’t be raised, and there’s no slow log to tell you what’s holding the slots.

In hindsight every odd number fit. The pool runs as a server user outside the cPanel account, which is why ps showed nothing and Entry Processes read zero. The six processes and the 215% CPU on Tuesday were the six workers, all busy. And the front page kept loading because a cached HTML file never asks the pool for anything.

WP-Cron and bot 404s were eating the pool

What was filling six slots all day? The same engineer pulled a day of access logs, and this is where the audit’s cron finding from the first hour turned out to matter after all.

WordPress has no clock. Its scheduled jobs run when a visitor’s page load notices one is due and spawns an extra request to wp-cron.php. With bots hitting the site a few thousand times a day, that’s a few thousand cron spawns, each one taking a worker for a full WordPress boot. Auditra had listed 65 cron events on the main site, one of them (a management connector we’d installed and never used) firing every minute. We’d noted it as “secondary” on day one. It wasn’t secondary. It was a sixth of the pool, permanently.

The 404s were ordinary background noise, scanners probing for install.php and fake plugin paths, no single source worth blocking. The problem was only that each one cost a worker, because a 404 page is never cached.

The last seven seconds

After the cron and bot traffic was dealt with (details below), the admin was still slow, and this is where a read-only audit has nothing left to offer. You need something that times a live request. We installed Query Monitor, opened the Pages list, and read the panel: 13.2 seconds page generation, 569 database queries, and an HTTP API tab that told the rest of the story in four lines.

Simple Job Board, which ran our careers page, was calling its vendor’s add-on marketplace on every admin page load to check for updates. That server was stuck in a redirect loop, so each call ran 2.8 seconds before giving up, and it made the call twice. Five and a half seconds per admin page, holding a worker the whole time, for a marketplace we’d never bought anything from. CrawlWP, an indexing plugin, was trying to refresh a Yandex Webmaster token twice per page and getting a 400 each time, another 1.2 seconds, for a search engine none of our clients use.

We deactivated both. Page generation went from 13.2 seconds to 1.37.

Neither plugin was flagged by anything. Both were up to date, both were actively maintained, both had clean vulnerability records. An inventory tool can’t see that a plugin’s phone-home endpoint died last month. Only a profiler watching the request can, and only when you happen to look.

What we changed

For anyone in the same situation, this is the list, in the order we did it. Most of it is in the wp-config reference and Cloudflare’s cache rules docs if you want the full detail.

• Deleted 206 orphaned String Locator transients (12.7 MB autoload to 730 KB)
• Removed the every-minute management connector, and confirmed via analyze_cron that it left no orphaned events
• define('DISABLE_WP_CRON', true); on both installs, with two cPanel server crons at 5 and 15 minutes replacing 2,800 daily visitor-triggered hits with about 380
• Cloudflare cache rule: 404 responses under /blog/ cached at the edge for an hour, so repeat scans never reach PHP
• Cloudflare WAF rules blocking the two scrapers by user agent, and the usual scanner paths (install.php, xmlrpc.php, .env)
• A physical robots.txt for the blog, because WordPress only serves its virtual one at the domain root
• WP Fastest Cache preload throttled to 4 pages a minute
• 13 inactive plugins deleted, 8 redundant active ones removed, 2 deactivated (down to about 42 active)
• Simple Job Board and CrawlWP deactivated; the careers page became a paragraph of text

Two things we didn’t fix, for the record. The theme depends on Titan Framework, which has an unfixed medium-severity CVE from 2021 and has been closed on wordpress.org for years; replacing it is a theme rework, not a Tuesday job. And the blog’s 33 plugins haven’t been audited yet. If you’ve read our post on technical debt in old WordPress installs, you already know how this goes: you never finish, you just get to the point where the site stops fighting you.

What a read-only WordPress MCP server is actually for

We built Auditra to be read-only on purpose, and we wrote up why in the plugin security post: no write calls, no scores, facts with thresholds next to them, and the reasoning left to whoever (or whatever) reads the output. This week was the first real test of that split on a site we actually cared about, and here’s our verdict.

It did the first hour and the inventory. Autoload, cron, table sizes, the plugin list with vulnerability flags and content usage, all in a few calls, with none of the clicking through fifty settings screens that a plugin cleanup usually means. And it did the verification: after every change, one call confirmed the cron flag was set, the connector was gone, the server cron had fired. That’s the part people underrate. Knowing a fix took is worth as much as the fix.

It could not diagnose a live hang, and we don’t think a read-only tool should pretend to. That took cPanel graphs, a hosts-file bypass, the host’s view of a pool we couldn’t see, and a profiler timing a real request. Four tools, none of them the audit. If we’d sold Auditra as “finds your performance problem,” it would have failed this week, publicly, on our own site.

So the pitch we’d make to another senior WordPress developer is smaller than the one we started with, and we think it’s the right one. Every site you inherit has a history you can’t see from the admin. A read-only audit reads that history in a minute, in a form an AI client can reason over, and tells you what to rule out first. Ruling out is where the hours go on a bad day. It won’t tell you the pool has six workers. But it’ll get you to the question a lot faster, and it’ll confirm you fixed what you think you fixed.

That’s what we found on our own site. We’d be curious what a ten-year-old install of yours turns up, and if Auditra tells you something you didn’t know, or misses something it should have caught, the comments are open and we’ll add it with credit.

The post Our WordPress Admin Took 13 Seconds a Page. Here’s the Audit. first appeared on Macronimous Blog.

WordPress powers over a third of all websites on the internet, making it an attractive target for malicious actors. As a result, WordPress security issues are a hot topic and a critical concern for many site owners and developers. It’s a jungle out there, and it’s teeming with potential threats that could harm your site or even knock it offline. Whether you’re a WordPress developer or a site owner, knowing these threats is the first step in keeping your site safe. In this blog, we will deep-dive into an array of potential WordPress attacks to arm you with the knowledge you need. I have tried to write it as simple as possible, though they are much technical, and not ever c developer or owner need to know everything. But, Here is the A-Z list of WordPress security issues.

Arbitrary File Overwrite

Arbitrary file overwrite attacks can exploit a weak plugin or a poorly secured theme to replace your original WordPress files with their own malicious ones. This could result in the replacement of your site’s theme, the injection of malicious code, or even a complete site takeover.

Authentication Bypass via Cookie

Cookies on WordPress are used to remember a user’s login information. A nefarious actor could exploit vulnerabilities in plugins or themes to forge a cookie and bypass authentication, effectively gaining unauthorized access to your site.

Backdoor Exploits

Backdoors are typically installed by an attacker after gaining access to a WordPress site, allowing them to maintain access even after the original vulnerability is patched. Backdoors can enable the attacker to modify site content, steal data, distribute malware, and more.

Broken Access Control

A broken access control attack on WordPress might happen when an unauthorized user gains access to admin privileges, effectively allowing them to modify content, alter themes, install plugins, or even delete the entire site.

CSRF (Cross-Site Request Forgery)

In a CSRF attack, a trusted WordPress user could be tricked into executing an unwanted action. An attacker could manipulate an admin into clicking a malicious link that changes site settings, deletes content, or modifies user roles, all without the admin’s knowledge. This is one of the very popular WordPress security issue.

Distributed Denial-of-Service (DDoS) Attacks

WordPress sites are often targets for DDoS attacks, where an attacker overwhelms your site with traffic, causing it to become slow or even unresponsive. This can damage your reputation and result in loss of traffic and revenue.

Insecure Direct Object References (IDOR)

Insecure Direct Object References to occur when an attacker changes a part of the URL which refers to an object ID, like a file or a database entry. If not properly secured, this can give them unauthorized access to sensitive WordPress data.

IP Address Spoofing to Protection Mechanism Bypass

WordPress security plugins often use IP addresses to block or allow certain actions. If an attacker spoofs an IP address, they could bypass these security measures and perform malicious activities on your site.

Local File Inclusion (LFI) and Remote File Inclusion (RFI)

LFI occurs when an attacker can get your WordPress site to run or disclose the contents of a file from its own server. RFI is when the attacker gets your site to run a file from a remote server. Both can lead to loss of sensitive data or enable the attacker to execute arbitrary code.

Malvertising

Malvertising is the use of online advertising to spread malware. An attacker could exploit a weak WordPress plugin to inject malicious ads into your site, which can then be used to distribute malware to your site’s visitors.

Missing Authorization to Authenticated

On WordPress, a malicious actor might exploit a weak plugin to gain authentication. Once they are authenticated, they can carry out actions that they should not have access to, such as editing or deleting content, installing malicious plugins, or changing site settings.

Object Injection

An attacker can manipulate serialized data on WordPress to inject harmful objects into your application, potentially causing harm or gaining unauthorized access.

Open Redirection

Open redirection attacks can harm WordPress sites that rely on user trust. If a user is redirected from your site to a malicious one, their trust in your site may be permanently damaged, and the attacker could steal their sensitive data or trick them into downloading malware.

Phishing

Phishing is an attack where the attacker attempts to trick the user into giving up sensitive information by pretending to be a trustworthy entity. If an attacker gains control over part of your WordPress site and uses it to host a phishing page, users may be directed to this page and be tricked into providing their login credentials or other sensitive data.

Server Side Request Forgery (SSRF)

WordPress plugins often interact with external services, which can leave your site vulnerable to SSRF attacks. In this scenario, an attacker could manipulate your WordPress site into sending requests to other servers, potentially gaining access to sensitive information.

Unauthenticated SQL Injection and SQL Injection

WordPress sites are backed by a SQL database, making them a potential target for SQL Injection attacks. Attackers can exploit weak plugins or themes to run malicious SQL queries, possibly gaining access to, altering, or deleting your site’s database. Unauthenticated SQL injections are especially nefarious, as the attacker doesn’t even need a user account to carry out the attack. This is one of the important WordPress security issues that you should care about.

XML-RPC Attacks

XML-RPC is a feature WordPress uses to allow remote connections to the site. However, attackers can abuse this feature to carry out brute force attacks, or to exploit other vulnerabilities.

Cross Site Scripting (XSS), Stored Cross-Site Scripting, and Reflected Cross Site Scripting

Through XSS attacks, an attacker can insert malicious scripts into your WordPress site via poorly secured plugins or themes, leading to theft of sensitive information, such as user login credentials. Stored XSS attacks can be particularly damaging to WordPress sites, as the attacker uses a weak plugin or comment form to store their malicious script on your site permanently. Every user who views the infected page could potentially have their sensitive data stolen, and your site’s reputation could be seriously damaged. Reflected XSS, on the other hand, involves the malicious script being part of the URL and only affects the users who click on the manipulated link.

This list might seem daunting, but remember, understanding these potential attacks is the first step in securing your WordPress site. Each threat provides an opportunity to strengthen your defenses and protect your digital territory.

In conclusion, it’s clear that WordPress, while a powerful and flexible platform, is not without its potential security pitfalls. Each of the attack vectors we’ve outlined above represents a unique challenge that may require a distinct approach to address effectively. But getting away from these WordPress security issues is not a big deal.

Addressing these vulnerabilities often requires a solid understanding of WordPress’s inner workings, and technical proficiency in areas such as PHP, SQL, and web security principles. It’s not always a simple task, and certainly not a one-size-fits-all endeavor.

However, don’t be disheartened! If this all seems a bit overwhelming, worry not. We understand that not everyone who uses WordPress is a tech wizard, and that’s completely okay. In our upcoming posts, we’ll be providing a comprehensive guide to tackling these issues, broken down into simple, easy-to-follow steps.

Our goal is to empower you to safeguard your site, no matter your technical background. So, stay tuned for our follow-up post, where we’ll dive into the nuts and bolts of securing your WordPress site from the ground up. After all, knowledge is power, and with the right guidance, you’ll be well-equipped to fend off these potential threats.

If you need help on your hacked WordPress website, we at Macronimous can help to get the site cleaned and up. Write us and we will get back.

The post Understanding WordPress Vulnerabilities: An A-Z Guide to Potential Attacks first appeared on Macronimous Blog.

20 Years of WordPress: As we approach May 27, 2023, the 20th anniversary of WordPress, we, as dedicated WordPress developers, want to take a moment to express our heartfelt appreciation to the incredible team behind this revolutionary platform. WordPress has completely transformed the way we build websites, empowering businesses and individuals to have dynamic, feature-rich online spaces without breaking the bank. Join us in celebrating this milestone by exploring some fascinating stats that showcase the greatness of WordPress.

When we first started building websites with WordPress in early 2008 (This is the birth of blog), WordPress was 4 years old, but we were still skeptic. We really didn’t think WordPress can last long, and this Open source CMS platform is not the right way to give something to our clients. Until then, we were using our own in-house built custom CMS, which was written by a team of ASP experts of our team. We only wanted to move our CMS system from ASP to ASP.NET.

But things changed when one of our clients, a web design agency from UK, was willing to use WordPress. Client has already studied WordPress, which was a good thing. So, We built their website with WordPress, and the client was happy. That was a great beginning, thanks to WordPress!

Despite having its own pitfalls, WordPress has significantly reduced the cost of developing a website with a CMS compared to custom CMS options. A simple WordPress website with around 10–15 pages can be built for a few hundred US dollars. Within a week, you can have a fully functional website ready for your business. On its birthday, let’s revisit some of the key takeaways of WordPress that are worth highlighting!

The Power of WordPress:

WordPress has emerged as the go-to Content Management System (CMS) for millions of websites worldwide. Its flexibility, user-friendly interface, and extensive plugin ecosystem have made it the preferred choice for businesses, bloggers, and even major publications. With WordPress, the possibilities are endless, whether you’re starting a blog, launching an e-commerce store, or creating a portfolio. WordPress is more stable now, gone are the days when a developer/site owner suffers with frequent hacks!

A Global Community:

One of the most remarkable aspects of WordPress is its vibrant and supportive community. Thousands of developers, designers, and enthusiasts contribute their time and expertise to continuously improve WordPress. Thanks to their dedication, WordPress has evolved into a robust platform with regular updates, enhanced security, and innovative features. Quick bug fixes and enhancements are frequent.

Some mind-Blowing Stats:

Let’s dive into some jaw-dropping statistics that highlight WordPress’s impact:

• Market Dominance:WordPress powers over 43% of all websites on the internet, demonstrating its unrivaled popularity and trust among users. WordPress is used by 63.3% of all the websites powered by a CMS.
• Plugin Repository: As of May 2023, The official WordPress plugin repository offers an astounding 68,000+ free plugins, providing endless opportunities to extend the functionality of your website.
• Themes Galore: Users can choose from a vast collection of over 10800 free themes (while publishing this blog) available in the WordPress Theme Directory, ensuring a visually stunning online presence.
• Multilingual Support: WordPress is available in several languages, making it accessible to users worldwide and fostering inclusivity. Themes are getting translated into 100+ languages.
• Mobile Optimization: With the rise of mobile usage, WordPress has embraced responsiveness, enabling websites to adapt seamlessly to various devices and screen sizes. You can also build Mobile-first themes, which is highly appreciated by Google.
• E-commerce Prowess: WordPress is not just for simple CMS driven sites. WordPress, coupled with popular plugins like WooCommerce, has become a force to reckon with in the e-commerce space. By using suitable third-party plugins like WP Easycart and BigCommerce WP you can build an online store easily within hours!

WordPress has revolutionized dynamic website development, enabling businesses and individuals to harness the power of the web at a fraction of the cost. Its remarkable journey of 20 years is a testament to the dedication, innovation, and passion of the WordPress team and its global community. We’re grateful to be part of this ecosystem and to provide our clients with budget-friendly, yet powerful, WordPress solutions.

Join us in celebrating this milestone, and let’s continue to embrace the greatness of WordPress as we look forward to the next 20 years of innovation, creativity, and growth!

Now, a little bit of History and the Story Behind WordPress, How it went from Humble Beginnings to Global Dominance:

The post Celebrating 20 Years of WordPress: A Journey of Greatness first appeared on Macronimous Blog.

Secure Your PrestaShop ECommerce Website:

A Comprehensive Guide for Business Owners to Protect Their Online Store and Customer Data :

As an ECommerce website owner, securing your website should be a top priority. With the rise of online shopping, the threat of security breaches and cyberattacks has become more prevalent. PrestaShop is a popular ECommerce platform used by many businesses to set up their online stores. In this blog post, we will discuss what you can do to secure your PrestaShop ECommerce website and protect your customer data.

Keep PrestaShop Updated

PrestaShop regularly releases updates to fix security vulnerabilities and improve performance. Your developer should ensure that your PrestaShop version is up-to-date. Running an outdated version of PrestaShop increases the risk of security breaches and can make your website an easy target for hackers.

Use Secure Hosting

Your hosting provider is a critical component of your website’s security. Ensure that your hosting provider offers SSL certificates, backups, and other security measures to protect your website’s data. Some reputable hosting providers that offer secure hosting solutions include SiteGround, Bluehost, and HostGator. We at Macronimous recommend them to many of our clients who are on a budget. You don’t really need a dedicated hosting unless your site visitors exceed in thousands.

Use Strong Passwords

Weak passwords can put your website at risk of being hacked. Your developer should use strong passwords for your website’s admin panel, FTP, and other areas that require authentication. Strong passwords should be at least eight characters long, include a mix of letters, numbers, and symbols, and be unique.

Use Security Modules

PrestaShop offers many security modules that can be used to enhance your website’s security. Some popular security modules include:

“PrestaShop Security Module” by Addons – a security module that protects your website from malicious attacks.
“SecurityPro” by MyPresta – a security module that protects your website from brute-force attacks and other security threats.
“Prestashop Firewall” by Webkul – a firewall module that protects your website from hacking attempts and other security threats.

Use HTTPS

HTTPS is a secure protocol that encrypts data between the website and the user’s browser. Your developer should use HTTPS for your website to ensure the security of your customers’ data. You can use SSL certificate providers like Let’s Encrypt, Comodo, and GeoTrust to secure your website’s data.

Limit Login Attempts

Limiting login attempts is a simple but effective way to protect your website from brute-force attacks. Your developer should configure your PrestaShop to limit the number of login attempts and lock out users who exceed the limit. You can use plugins like “Limit Login Attempts” by Johan Eenfeldt and “Login Limitation” by Addons to implement this feature.

Enable Two-Factor Authentication

Two-factor authentication adds an extra layer of security to your website’s authentication process. Your developer should enable two-factor authentication for your website’s admin panel to ensure that only authorized users can access it. You can use plugins like “Google Authenticator” by Addons and “Two Factor Authentication” by  Back-office security to implement this feature.

Perform Regular Backups

Regular backups are essential in case of a security breach or a system failure. Your developer should perform regular backups of your website’s data, including files, database, and configurations. This will help ensure that you can restore your website in case of a security breach or other unforeseen events.

At Macronimous, we understand the importance of website security for businesses. We strongly advise business owners to implement the security measures mentioned above and work with experienced developers to ensure that their PrestaShop ECommerce website is safe and secure. Remember to perform regular security checks and updates to stay ahead of potential security threats. Protecting your customers’ data and your business’s reputation should be a top priority, and investing in the necessary security measures is a small price to pay for peace of mind.

The post Secure Your PrestaShop ECommerce Website: A Comprehensive Guide for Business Owners to Protect Their Online Store and Customer Data first appeared on Macronimous Blog.

Web development, in general, refers to the tasks associated with developing websites for hosting via intranet or internet.

It encompasses all the operations required to plan design, build, host, and manage a website to ensure its performance, user experience, and speed are optimal. Web development includes the coding or programming that enables website functionality, per the owner’s requirements.

What is a full-stack in web development?

The development of both front end and back end portions of an application is termed as Full-stack development. This involves multiple interrelated yet independent technologies.

This process comprises three layers – the Presentation layer (front end bit which deals with the user interface), the Business Logic layer (back end bit dealing with data validation), and the Database layer. This accounts for all the steps from the concept to the finished product.

The generally used technologies in full-stack web apps

The generally used technologies in full-stack web apps

1. Front end:

It is the part of the website or application that the user interacts with directly which is responsible for the user experience.

a. For the Front End, some of the languages used are:

• HTML – HyperText Markup Language is used to design the front-end portion of web pages using a markup language.
• CSS – Cascading Style Sheets is a language that is intended to simplify the process of making web pages presentable.
• CSS preprocessor – a program that lets you generate CSS from the pre processor’s own unique syntax.
• JavaScript – is a scripting language used to create the aspect of the sites to make them interactive for the user.
• Graphic designing – It is good to have a full-time graphic designer for web development. UI is the entry for making great impression over the web development deliverables.

b. Front End Frameworks/ Libraries:

• AngularJs – a JavaScript open-source front-end framework that is used to develop single-page web applications
• React.js – an indicative and flexible JavaScript library for building user interfaces
• CSS framework – a library that allows for easier, more standards-compliant web design using the Cascading Style Sheets language.

2. Back End:

It refers to the server-side development of a web application or website with a primary focus on how the website works. It is responsible for managing the database through queries and APIs by client-side commands. Any one of the following backend programming languages is a must-know for full-stack web development.

a. Back End Frameworks and Libraries:

• PHP – a server-side scripting language designed specifically for web development. (+ a high-performance PHP framework for developing Model-View-Controller (MVC) based web applications like Codeigniter of Laravel)
• .NET – a developer platform with tools and libraries for building apps, including web, mobile, desktop, games, IoT, cloud, and microservices.
• Java – Java is widely used for enterprise-grade web applications.
• Opensource platforms for CMS like WordPress, Magento for ECommerce. Using an open-source platform will make things quick and easy.

3. Database:

It is the collection of inter-related data that helps in efficient retrieval, insertion, and deletion of data from the database and organizes the data in the form of tables, views, reports, etc.

• SQL – Structured Query Language is a standard Database language which is used to create, maintain and retrieve the relational database
• MySQL Database – is a fully-managed database service to deploy cloud-native applications

4. API integrations

APIs are a set of functions and procedures allowing the creation of applications that access the features or data of an operating system or application.

An API integration process, simply put, is the ability to connect all applications in a seamless manner

5. Continuous integration (CI)

CI is a software engineering practice in which frequent, isolated changes are immediately tested and reported on when they are added to a larger codebase.

A good example of CI is Jenkins. It is the most popular open-source project. Jenkins can help teams to automate any task. Some of the common uses include building projects, running tests, bug detection, code analysis, and project deployment.

6. Source code version management

Version control is what keeps track of the changes in the code so that if something goes wrong, you can make comparisons in different versions and revert to a previous version. It is a must-have requirement wherever multiple developers are continuously working on or changing the source code.

Git is a highly regarded version control tool presently available among the developers.

It provides strong support for non-linear development and is compatible with existing systems and protocols like HTTP, FTP, etc. GIT provides cryptographic authentication of history and is capable of efficiently handling small to large-sized projects.

7. XML/JSON

Knowledge of XML and JSON is important in full-stack web development.

JSON and XML are human-readable formats, are language independent and both have support for the creation, reading, and decoding in real-world situations

Both JSON and XML are “self-describing” (human-readable), they are hierarchical (values within values) and both can be parsed and used by lots of programming languages.

8. Containers

A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another.

Docker is an open-source container technology that performs operating-system-level virtualization, commonly called ‘containerization’. Each container is essentially a virtual computer, so it is possible to set up different technology stacks as needed.

Choosing a web development full stack setup is mainly about practical experience. You will be able to make good choices once you have had experience of applying technologies and know-how well they work for you.

If you choose a tech stack based on internet research, it will be like trying to fix your car after reading the manual but without having any practical skills. You may do it right, but the chances are that you will have to bear losses for the damage you will cause.

The post What is a full-stack in web development? first appeared on Macronimous Blog.

The development environment plays a pivotal role in web development projects. Programmers will always look for the best dev environment to optimize productivity and reduce time on routine tasks. With the significant development in technology and the emergence of powerful tools, web programmers have the opportunity to create full-fledged software applications. Get to know a list of local development environments that can be ideal for you:

1. XAMPP

As one of the most renowned, widely-used, and popular PHP development environments, XAMPP can render useful support in web development projects. I. XAMPP comes with dynamic Apache distribution which contains Perl, PHP, and MariaDB. The open-source package is a great tool and can render the best support across projects. With Windows, OS X, and Linux versions, XAMPP is the first-choice for powerful web development projects.

2. MAMP

Here’s your chance to do so with MAMP. You can install this free tool within seconds and create a dynamic local environment. Even if you have the existing Apache installations running on your device, MAMP won’t affect its functionalities or reduce the speed. you can easily install and manage Apache, MySQL, and PHP – a feature that proved to be a limitation on native web sharing provided by Mac with separate MySQL installation.

When you are no longer in need of this dev environment, all you need to do is delete the source file. Depending on the needs and importance of a project, you can either use MAMP or MAMP Pro. While the first one sets up personal web servers, the second one configures unlimited web hosts.

3. WampServer

Leverage the benefits of automatic installations, intuitive functionalities, and dynamic web development offered by WAMPServer. You won’t need to use the settings file and can still tune your server. Build powerful web applications with Windows, MySQL, PHP, and Apache2 database. WAMP Server is the preferred choice of IDE in case you need to develop native web apps

4. Laragon

Wish to fulfill your need to embrace speed while developing web applications? Here’s an opportunity to do so with Laragon. The uber-fast, highly functional, innovative, and dynamic development environment will translate the entire process into a flexible, smooth, and swift affair. Move your Laragon folders, shift these files to different destinations, and enable cloud integration; all this and much more with Laragon.

Let us know which of these will be your favorite local dev environment.

The post Local development environments for web programmers discussed first appeared on Macronimous Blog.

4 CSS Preprocessors for Your Web Development

A big advantage of a CSS pre-processor is the value you can add to your client during the web development project. :

1. Sass

As a mature, highly stable, dynamic, and powerful CSS extension, Sass plays a significant role in web development projects. You can work with all the CSS libraries as Sass is compatible with every CSS version.

2. Less

Apart from its powerful interface, Less comes with a stunning feature. The preprocessor is compatible as well as backward-compatible with CSS. Quite naturally, web developers won’t find it difficult to learn ‘Less’ and can always fall back on Vanilla CSS for reference. The fact that differentiates ‘Less’ from the rest of the preprocessors is the presence of unique features. Since it makes CSS more extendable, themeable, and maintainable by integrating features that allow functions, mixins, and variables, ‘Less’ is one of the most popular CSS extensions used by numerous web developers. Installing ‘Less’ is a cakewalk and you can do it quite easily.

3. Stylus

The preprocessor supports both – regular CSS development style along with indented syntax, and that is what makes it special! You just need Node.Js to install Stylus. Yes, it’s that easy! It is clean, minimal syntax makes coding a breeze. Its own coding framework, Nib provides developers access for crossing browser support mixins for Stylus.

4. Crush

Inspired by standards and equipped with a range of powerful features, Crush is a unique aid for web development. The preprocessor comes with auto-prefixing features which help you make the most of the CSS platform. From properties, functions, rules, and vendor prefixes, every component undergoes an auto-generation process. That ensures three crucial benefits for web developers. Firstly, they can achieve clean coding. Secondly, they can achieve cross-browser support, and thirdly, code maintenance becomes easier than ever! So, it’s high time to have a crush on ‘Crush’!

These preprocessors will prepare the ground for a successful web development project for you.

The post 4 CSS Preprocessors for Your Web Development first appeared on Macronimous Blog.

GitHub

A well known  hosted Git repository is GitHub. Ruby on Rails and Erlang was used to write this and was developed by Wanstrath, Hyett, and Preston-Werner in early 2008. It has a command line tool as well as a web-based GitHub. Ruby on Rails and Erlang was used to write this and was developed by Wanstrath, Hyett, and Preston-Werner in early 2008. It has a command line tool as well as a web-based GUI, It also supports mobile integration. Be it bug tracking, feature requests, task management, or wikis, all  are included.

Beginners may find it difficult to start with, GitHub compared to other version control systems. However, its power to facilitate collaboration on coding and code review, coupled with the multiple client tools, are more than sufficient compensation.

Even if you are a registered user or say, non-registered user, GitHub provides access to both. Again, some need private reports and others are ok with open-source repositories. For either case, there are plans available. GitHub currently has 14 million users and yes, it does host a mind-boggling 35 million repositories.

GitLab

Released in 2011, GitLab has been rapidly gaining popularity among coders. Written on an open source website in Ruby by Ukrainian Dmytro Zaporozhets, it is designed to support the entire programming pipeline, from coding to testing to deployment. In July 2013, GitLab was split into a free edition (Community) and the paid (Enterprise) edition, besides the GitLab-hosted website. GitLab stands out with its multitude of detailed access controls, code reviews, issue tracking, activity feeds, wikis, and continuous integration.

GitLab scores over GitHub with its powerful issue tracker, attachment capabilities, permissions, flexible authentication levels, and branch protection. It promotes inner sourcing and searchable commits. However, it does not allow assignment of an issue to multiple developers, unlike GitHub.

This cloud-based Git repository manager is now used by over 10,000 organizations, including NASA and CERN.

BitBucket

BitBucket has become an extremely popular web repository hosting service during the last few years. It was launched by Jesper Nøhr, who wrote it in Python on the Django framework. In 2010, Bitbucket was acquired by Atlassian, integrating it with JIRA. Along with extensive wikis, REST APIs, and both GUI and command line tools for Windows, Mac, Linux, as well as a mobile app. It stands out with its branch comparison and commits history, Stash, compatibility with Crucible, Bamboo, and Jenkins, and snippets from all kinds of files.

BitBucket hosts a team of five or less, and unlimited private repositories, for free – unlike GitHub which focuses on public and open-source projects.

Despite its lack of detailed editing tools, its entrepreneur-geared system supports both Git and Mercurial, making it just as useful as GitHub.

Kiln

The kiln is a source control and code review tool developed by Fog Creek Software. Both Kiln and BitBucket support the Mercurial and Git control systems.

The kiln is aimed at small and mid-size businesses. Its cross-compatibility with web-based project management and collaboration tools FogBugz and Trello lets it merge the management and client communication sides of a project.

Kiln impresses with its ability to allow developers to continue coding without interruption. It lets you report, track and fix bugs, updates your code, and track the changes. It simplifies branching, cloning, pushing, or pulling, as well as offering HTTPS and SSH support, and flexible user permissions. The notification tool lets you remain abreast of updates to subscribed repositories.

While Kiln lags a bit compared to BitBucket and GitHub, it offers good value for new entrepreneurs.

The post 4 version control services for programmers first appeared on Macronimous Blog.

Accelerated Mobile pages

It hasn’t been unknown that Google is leaning heavily towards providing a better mobile experience for quite some time now. Case in point – In April 2015′ algorithm update that considers mobile friendliness as one of the ranking signals. Another update rolled out in October 2015 saw Google come up with Accelerated Mobile Pages or AMP. This open source project has the support of Google, WordPress, Twitter, and LinkedIn, among 30 other publishers and developers.

What is it mean for you?

At the heart of the initiative is to help the mobile user get a better reading and browsing experience, with pages that are fast to load and thus achieve optimized mobile web performance. The AMP HTML is a more mobile efficient version of HTML. This development framework is geared to let developers create web pages that are light and fast. There are 3 main parts worth considering

1. AMP HTML – The technical standards have been altered to exclude certain tags and limits some functionality. For instance, programming interstitials (ads that come up during page download) will be a thing of the past.
2. AMP JavaScript – AMP doesn’t allow third party JavaScript
3. AMT CDN – This optional element will implement caching and bring in further performance improvement

Tips for AMPing your website

1. Keep two versions of the web page – a standard page and an AMP version of the same page
2. Be ready to rewrite certain portions of the code to conform to AMP norms – for instance, only < 50kb CSS is permitted in AMP
3. Image handling is the one substantial change you need to look out for. Check out the new amp-img element that needs to be used.
4. Video handling too needs special treatment with help of amp-video and amp-youtube
5. If your website or blog is built on WordPress, things could be pretty easy, as you can install WordPress AMP Plugin. This will create an AMP version of your website, that could be accessible by another URL with a /amp/ in the rear. (Eg. https://www.macronimous.com/blog/be-mean-and-lean-in-web-app-development-build-apps-with-mean-stack/)

What is the latest on AMP?

As of Feb 2016, Google has already added AMP listings to its mobile search results. Google has put up a demo here of how fast the mobile search and reading experience will be. For developers and SEO experts, this news means that they need to start incorporating AMP into the website development, so that mobile rankings do not drop for their clients.

Though Google’s John Mueller says that at the moment AMP is not considered as an SEO signal. However, we can expect Google to announce this, if not now, but later.

Related articles across the web

• What Are Accelerated Mobile Pages and Should Your Website Implement AMP?
• Google Adds AMP Data To Search Analytics
• AMP Remove unused CSS (New)

The post ‘AMP’lify your mobile website with Accelerated Mobile Pages – AMP first appeared on Macronimous Blog.

MEAN

As developers, we know the importance of full stack of development technology putting our lives at ease. While LAMP stack started this trend many years back, we now see another trend fast catching up in the development universe- the MEAN stack

Simply put, this technology bundle consists of 4 components

1. MongoDB – The database

MongoDB is a widely popular schema-less open source NoSQL database system. Its design makes it easy to pass data to and fro from the server to the client.

2. ExpressJS – The development framework

This agile framework lets developers build single and multipage web application easily and quickly.

3. AngularJS – The front end solution

AngularJS is an open source JavaScript framework ensures quick time front end development. Angular has become popular after Google started backing it. It is used to create RICH Internet Applications (RIA), especially single-page web applications. Which means, With lesser lines of codes, developers can build applications that are running functionally rich applications.

4. Nodejs – The server side environment

The JavaScript-based execution environment helps to build concurrent network applications that are robust and scalable. It’s  built on Google’s Chrome V8 JavaScript engine. Node.js has an event-driven framework and has non-blocking Input/Output model, hence making the applications run efficiently.

The benefits of learning this stack are obvious: a developer with skills in these 4 technologies under his belt can bring about enormous value added than 2-3 different programmers with various expertise adding substantial HR cost overheads to the company. The immense ROI presented by this talent makes MEAN developers highly in demand in the market.

MEAN stack provides amazing facilities with these 4 technologies. Utilizing the combined prowess of these technologies, developers can easily build enterprise grade web apps. What’s more, the stack also has multiple utilities like Passport and Mongoose pre-built into the stack. The brains behind MEAN have strived to tackle the key problem of bringing together multiple popular environments and frameworks and solving integration issues.

Downloading the components

1. MongoDB can be downloaded here and there is a very good Installation tutorial which you can find here.
2. Express can be installed post Node.js download. This has Express as one of the Node.js Package Manager with the command – $ npm install express
3. Steps for installing AngularJS can be found here
4. Nodejs can be downloaded here and there is another good tutorial on npm (nodejs package manager) installation.

Tried your hand at MEAN stack? Let us know your thoughts on your experience on this versatile technology stack.

Like to have solutions developed with MEAN? Contact us!

The post Be MEAN and Lean in Web App Development – Build Apps with MEAN Stack first appeared on Macronimous Blog.