BloggerSavvy » security

Two Tools that Help Protect Your Blog from Content Theft (Scrapers)

BloggerSavvy — Fri, 06 Feb 2009 18:56:51 +0000

Ever search for something in Google and found your content on another site? I have, often. One of the more damaging issues to your blog is when your copyrighted content is stolen and placed on another blog – and here’s the kicker – the content on the other blog has a higher pagerank than yours and is ahead of you in the search results! Quite frankly that’s terrible as it negatively impacts your blog. Not to mention the annoyance when you note that the blog stealing your content appears to be earning advertising revenue, with excessive ads plastered all around it.

I’ve posted about this subject before in “How to Deter Scrapers and Hotlinkers“, which discusses a bit more of the hands-on and some web based tools you can use to help protect your content.

Many of us have may have read all sorts of articles and other blog posts that delve into the legalities, copyright laws, rights and so forth. That’s not something I’m going to discuss as I think there’s too much discussion (and not enough action). If not, just take a look on Google and you’ll find a plethora of posts on the subject. The fact of the matter remains that we can file as many DMCA notices, cease and desist letters, etc. as we want. Often the content thief (called a “scraper” or “splogger”) does not care. After all they already have your content and you can cry and stamp your feet as much as you want – Many of them will simply not budge, especially if they are out of your geographical area or jurisdiction.

A case in point, on one of my other (self hosted) wordpress blogs, several pages were regularly being lifted by a web site in China. The only recourse was that Google removed the stolen content from search results (the hosting provider, etc. did nothing) – Even though Google was removing their search results, that didn’t stop them from adding more (from my stolen content)! Locally (North/South America and Europe) however, that blog has had a 100% success record in take downs of stolen content found on blog sties such as wordpress.com (Automattic), blogspot.com (Google), etc. Providing I followed their DMCA procedures, all issues were resolved.

In my opinion, this approach is ineffective, costly (with long distance faxing) and quite frankly a waste of time (at one point I was filing about 15 DMCA’s a day for that blog). Why? We need to be proactive not reactive! A client of mine uses the tagline “Predictable is preventable” for his blog and security business. And he’s right! We need to deter, curtail and control such theft attacks against our blog content.

It’s difficult to stop such activity, until you can see it occurring, as such, I hope the following tools will help you:

Grab yourself a copy of Antileech. It’s a plugin that does not stop sploggers, rather (in the developers words) “…produces a fake set of content especially for them that includes links back to your site and sends it only to them. When they steal this content, it appears online just like normal, except now you’ve turned the tables on them and have provided them with useless content…” The benefits here are that sploggers seldom read all the content. They have an automatied system grabbing thousands of pages – And now they will have backlinks to your original content, inviting the reader of the splog (containing fake content) to visit your blog instead. That’s link love!

Another effective tool in your arsenal is ©Feed, which allows you to place a digital fingerprint and copyright notice in your content feed (RSS). For those not familiar, in most cases, your RSS is used to facilitate content theft. What’s RSS? Common Craft’s video below easily explains it:

In the words of the ©feed developers “…You can use html. You can add the IP of a feed reader and digital fingerprint for an explicit key. There can also be a domain name for a whitelist and this domains became not the message [sic]. The plugin search for this key at content theft [sic]. It is furthermore possible to add comments and related posts to the feed. For the related post feature it uses a database-search for the content. You can use the plugin “Simple Tagging” for related posts in a feed. The copyright notice can be added even when using entry excerpts…”

Needless to say, the above two tools are very robust and take a proactive approach. There are some other resources I’ve bumped into over time, that provide good reading and further insight:

Hopefully the above helps you (especially those who emailed me asking)!

Do you have any good solutions? What tools do you use? Feel free to comment your thoughts below.

Copyright © 2009 BloggerSavvy Enterprises Inc. All Rights Reserved.
This feed is for personal reading, non-commercial use only.
The use of this feed on other web sites breaches copyright. Please visit BloggerSavvy to read the original content.
(Digital Fingerprint: 039e595x4620d9aufgvf3rt1skqzybh6 (38.107.179.214) )

6 Simple Tips to Secure Your Blog

BloggerSavvy — Sat, 29 Nov 2008 17:10:34 +0000

I spoke with a new blog owner yesterday, who almost lost a fair bit of content as the result of an intrusion. Additionally, he was locked out of his own site (which prompted the phone call). Fortunately I was able to help him avoid any further damage to his content as we were able to stop the unauthorized access in it’s tracks. But what could he have done to avoid or mitigate any loss? What steps can we as bloggers take to help safeguard our valuable content?

In my opinion, one issue is to maintain your own server. Do not host your blog on a shared server hosting account. Shared hosting accounts mean just that – other people (whom you don’t know) also have accounts on the same server, it can increase the likelihood of an incident. To give you one simple example, I was using a shared server for a quick small web site development project about six years ago. The hosting company had some issues with the server and left it in an unprotected state (they were working on it at the time). I remember logging in (via FTP) that afternoon and had full access to the files of every single account! I terminated my service the same afternoon. Using a dedicated server (or at the very least a VPS server) avoids such issues as you are in control of your own server.

All too often it seems we are so involved in how to grow, promote, enhance, etc. our blogs, yet seldom do we give serious thought to safeguarding our valuable investment.

Having said this, the question remains, for most of us (who are not network administrators), what can we do to help avoid (being proactive is more effective than reactive) security related issues? The following six tips should help you. Some may require a little more knowledge, but they are pretty easy steps to take. So, without further ado, here are the helpful tips:

1) Make sure you ALWAYS have an off-site backup.

I use a plugin called WP-DBManager, which emails me a scheduled backup of my database and also store several versions on my server. I should note that these database backups in turn are backed up by the server based software. The critical point here is that you have a CURRENT copy of your database (and blog files) offline in YOUR possession. Never ever assume that the server software (backup) is working as expected.

2) Keep your blog software updated – Always.

Updates often include bug and security fixes that plug potential exploits. One good feature of WordPress for example is that the administrative area will tell you when an update is available. It’s a simple matter to backup all your data and files, perform the update and continue blogging. If needed, you can find the update (upgrade) steps directly from WordPress’ post “Upgrading WordPress“.

3) Change your password – Do so often.

When you forget your WordPress password (or have just installed WordPress), it sends you a password. That password is short and fairly easy to crack – Change it to something more difficult. Also, there is a plugin you can use to help you lock out visitors who are trying to guess your password (to break into the administrative area), it’s called Login LockDown. Login LockDown will lock out the IP addresses of incorrect password submissions for whatever time period you choose.

4) Disable indexing of your files.

Search engines do not need to index all your WordPress files. Use a robots.txt file to disable such indexing. SImply add the statement:
Disallow: /wp-*
to your robots.txt file. The above statement tells the search engines that any directory beginning with “wp-” should not be indexed.

5) Disable viewing of your folders.

Anyone attempting to access your system may be able to see your files (such as plugins). In your web browser, try to visit your wordpress plugins by going to:

http://www. Your-Domain-Name.com/wp-content/plugins

If you can see a list of files and/or directories, that’s not good. You can create an index page that redirects visitors trying to see those directories, back your blog. Here is the code I use:

Nothing Here

Name the file “index.html” and place a copy of it (with the above code) in your plugins folder. Now if you try to view the contents of the plugin folder, you will be redirected to your blog’s home page. Note: Obviously, you will want to substitute the URL of my blog for your own. This tip is important because it prevents authorized visitors from inspecting your plugins and finding an exploit.

6) Deny access to your administrator login.

I use an .htaccess (among other things) to accomplish this. An .htaccess file allows me to customize how a folder is “treated”. In this case I want to deny access to all IP addresses except my own. If you find one day that you are locked out, simply edit the .htaccess file and re-upload it the the “wp-admin” folder of WordPress.

Here is an example of the code I use:
AuthUserFile /dev/null AuthGroupFile /dev/null AuthName "Access Control" AuthType Basic order deny,allow deny from all allow from 206.138.140.97
Again, change the IP address to your own. Don’t know your IP address? I’ve included a handy tool below. It does not store any data, it just shows you your current IP address (which means everyone else will only see their own IP address below). You can use this post whenever you quickly want to see your current (new) IP address:

This is your connection:
(For the technically adept, these addresses are not logged by the script that displays the IP address above, it simply finds the variable “REMOTE_ADDR” and displays it to you).

While there are several more advanced things network administrators can do to help protect your blog, the above are six simple tips that you may implement as soon as possible. Have any input, ideas, questions? Feel free to include them in your comments below.

25 Most Beneficial WordPress Blog Plugins

BloggerSavvy — Wed, 19 Nov 2008 14:33:18 +0000

I’m often asked what plugins are the best for WordPress, or if I know of a plugin that provides some specific functionality. A reader commented in one of my earlier posts, asking “…if there were some plugins that would work well with marketing and other stuff…” (10 Steps to Effective eNewsletter Marketing).
Some of the benefits of the plugin list below include:

Enhanced blog visitor experience.
Increased traffic and blog promotion.
Improved security and blog performance.
Simplified blog management and productivity.
Better visitor communication.
More effective search engine optimization.
Greater integration with popular Internet communities and services.

Where to get it:v

http://sivel.net/2008/10/better-howdy/

Adds an AJAX rating system for your WordPress blog’s post/page.

Why I like it:

It allows visitors to rate content, which helps you to see what is most in demand. As such, you’re better able to provide the content that visitors want. In a way, it’s another traffic building tool.

Where to get it:

http://lesterchan.net/portfolio/programming/php/#wp-postratings

21) WP-PostRatings Widget

Works in conjunction with WP-PostRatings above. Displays the most rated and/or highest rated posts and/or pages on your sidebar.

Why I like it:

It helps visitors queue into the most highly rated content. It helps them find the hotest content right away.

Where to get it:

Remember to install and activate WP-PostRatings first. http://lesterchan.net/portfolio/programming/php/#wp-postratings

22) WP-Sticky

Adds a sticky post feature to your WordPress’s blog.

Why I like it:

I can display announcement and sticky posts only when viewing categories or not. I can display an announcement banner or display the date instead of the announcement banner (on announcement posts).

Where to get it:

http://lesterchan.net/portfolio/programming/php/#wp-sticky

23) WP Super Cache

It’s a very fast caching module to help improve blog performance. Why have the server create your pages every time there’s a visitor? This plugin will cache previously created pages, to speed up surfing through your blog.

Why I like it:

I can turn it on or off as needed (even partially on). I can specify how long to keep cached content for. I can even prepare the blog for an expected spike in traffic by enabling the lock down feature. When this is enabled, new comments on a post will not refresh the cached static files. The lockdown feature is only useful if you are expecting a major Digg or Slashdot level of traffic to one of your posts or pages.

Where to get it:

http://ocaoimh.ie/wp-super-cache/

24) Wordbook

Allows you to cross post your blog posts to your Facebook Wall. Your Facebook “Boxes” tab will show your most recent blog posts.

Why I like it:

It’s automated and helps build traffic while letting Facebook visitors know when valuable content has been posted.

Where to get it:

http://www.tsaiberspace.net/blog/2007/07/29/wordbook/

25) Yet Another Related Posts Plugin

Returns a list of the related entries under each blog post, (based on a unique algorithm) using titles, post bodies, tags and categories; with RSS feed support.

Why I like it:

It easily helps visitors find other content that may be of interest to them, and it’s also works automatically.

Where to get it:

http://mitcho.com/code/yarpp/

Again, these are the 25 I’ve found to be most beneficial not just to this blog, but others as well. Of course there are tons of other WordPress plugins that benefit us. Have a suggestion? Use a good plugin that I’ve not listed? Please, include the links in your comments below.

Update:

I’ve tested another plugin and it’s working great. It’s called What Would Seth Godin Do.

Why I like it:

It displays a custom welcome message to new visitors and another to return visitors; and I can place it at the top of posts and pages. I also like it because it automatic. (I like automated tools). Needless to say, it’s a good tool to promote features on a site, inform visitors, make announcements and lots of other benefits.

Where to get it:

http://richardkmiller.com/wordpress-plugin-what-would-seth-godin-do

How to Deter Scrapers and Hotlinkers

BloggerSavvy — Wed, 05 Nov 2008 22:56:41 +0000

When I launched my first blog (a Linux based niche blog) at Ubuntu Linux Help, initially I did not have much content. As content built and traffic grew, I ended up writing some posts that went viral. Three of them were:

I enjoyed the traffic those posts provided (and still provide to this day) as they helped my blog grow. I think they were popular because they provided a valuable resource as well as elicited fair bit of discussion, as some of the posts and resulting comments were very outspoken and opinionated. One of the above posts (Why I Quit Windows and Switched to Linux) was a very personal story describing some of my career experiences and how they effected my professional life and thoughts.

Imagine my surprise when I found another blog with the identical content on it. So much so, that the author who scraped my content claimed it as his own! At that time I had more than enough technical knowledge to initiate actions that would catch-out scrapers, but I’d not yet fully experienced some of the nitty-gritty administrative aspects such as contacting the hosting providers, filing DMCA notices et al.

For that matter, why would this be an important issue? Why should bloggers (or any web site owner for that matter) take actions to mitigate such issues? Well a few good reasons immediately come to mind:

It’s annoying. A blogger puts a fair bit of work into his or her post, only to find it copied elsewhere and used to earn revenue (usually via advertising) for the content thief.

It can impact your web hosting cost if you have a busy site. Remember, most hosting accounts have a monthly bandwidth allowance. Exceed the monthly bandwidth and the blog owner incurs extra cost. But wait!… How did scrapers cause my cost to increase? Simply put, they copied the text content onto their blogs and linked the images (in that content) from my blog. This resulted in the text being duplicated on their site and the images being stored on my hosting account. When a web browser viewed the content on their page, it was pulling the images (for that content) from my hosting account, for which I had to pay the bandwidth.

It can reduce your Google (SEO) ranking. How does that happen? When Google finds content, it tries to determine if the content is original (not copied from another site) and proceeds to provide it with page ranking data. It is conceivable that content can be copied and receive a page rank (and inclusion in Google search results), without the original blog article being yet found by Google. If it get’s found by Google later, how can you ensure that your original becomes noted as the original post? Don’t misunderstand me, search engines like Google do try to remove duplicate content, but it becomes difficult when your original content becomes listed as the duplicate.

One important issue I realized is that you cannot be overly emotional about such actions. When trying to fix such issues, you need to work with various parties such as Google DMCA, Hosting Providers, etc. Sending them flippant or angry letters is not going to get you the help you need. Remember, large organizations and businesses deal with such issues daily and they are not impressed with theatrics. You need to have these people on your side. Remaining calm, assertive and professional goes a long way to getting support (as does courtesy).

Let’s define a couple things before we move on…

A scraper is someone who copies your content and places it on another site, without your permission. In essence this is theft of your intellectual property.
A hotlinker is someone who displays your images on another site, and uses the coding on their page is such a way so as to pull the image that is stored on your server (hosting account), for display on another page. As I mentioned earlier, this is tantamount to bandwidth theft.

I’m often asked how I discover that my content has been scraped or hotlinked. There are several tools that when used on a regular basis, can help you reduce the amount of content thieves.

Review your web statistics.

All good hosting accounts have built in web statistics. In my opinion AWStats ranks highly. AWStats has a feature that displays “Links from an external page (other web sites except search engines)”

The display will show you the URL of the page linking to you as well as the number of hits to your page. It will also tell you how many page loads (of your pages) that URL initiates. For example if another site URL causes 10 hits on my site, then there should also be 10 page loads. If not something’s up. Take a look at the image below (clicking on the image will show you the large version).

AWStats hotlinker example

What you’re seeing in the edited image above, is that another site has displayed something (from my site) 1645 times but never actually sent a visitor to my site. In other words my content (an image in this case) was shown on another site, but no page visits (referals) were ever recorded coming from that site. I visited the URL in question, and sure enough, the site was hotlinking to one of my images.

Use online services.

One service I’ve experimented with is Copyscape. They are a site that provides a service which scans other web sites, providing you with the URL of copied content. In my case I found scraped content (stolen from my other blog) during the writing of this very post. That is… one of my original blog posts, was found via Copyscape to be duplicated verbatum on another web site in another country. They were using it to sell their advertising space and also had hot linked to all my images. While they did include a link to my original post and did list my URL as the “Original link”, they did so without permission and were using my complete work for their own profit.

A Google search will provide you with a plethora of other sites that provide such services, I’m only mentioning Copyscape as one good example. To further take advantage of such tools, its most advantageous to include a very unique sentence in any given post and search for it in Google (that’s often a very quick method to catch sites that copy your valuable content).

Once you’ve been able to isolate a specific URL that has hotlinked and/or scraped content, what can you do about it?

Here’s how the process should work:

Find and isolate a specific URL that is using your content.
Evaluate the need to take action. Are they still sending you traffic or referrals in some fashion? The bottom line question you could ask yourself is “Does their copied content really do my blog enough harm that I have no option but to follow through?” If you’ve answered yes, action is the next step.
Take action.

But wait! What actions are there? Can I really protect myself from a scraper or hotlinker in another country?

Before moving into they types of actions (tools) you can use to protect your content, it’s important to keep one salient point in mind:

If you have some content that is so important, private or valuable, etc. and you do not want other people to copy it, then DO NOT POST IT ON THE INTERNET. If you post something of excessive value on the Internet, no measure of copyright protection is going to prevent an individual from accessing it and copying it. But (there’s always a “but”), there are ways you can impede the profitability and earning power of copied content and in some cases injecting your own revenue generating systems into content copied from your site.

So what kinds of actions can we take?

Make sure you provide appropriate copyright notifications within every page of your blog. If you intend to permit your content to be shared, Creative Commons provides a great copyright tool wherein you can specify how your content is shared. You’ll find that tool at Creative Commons. You can select your jurisdiction in a drop down menu on the upper right side of the home page.

Is the copied content being served by Google Adsense? If so, you can issue an infringement notice at Digital Millennium Copyright Act – Google AdSense. I’ve found the best method is to fax the notice to the number they provide. In practice, I’ve found that it takes a few days for this to work through their system. However, they have always acted professionally, responsible and have indeed taken action.

As a side note: If you are looking for notification templates you can use, take a look at Copyright Law and SEO Part 3 (Sample DMCA Notifications, in HTML and MS Word Format), found on the McAnerin International web site.

Personally, I’ve experienced an excessive number of blogs copying content to Blogger.com based blogs. If you review their Blogger Content Policy, you’ll also find that notifications are to be sent to Google at Digital Millennium Copyright Act – Blogger. Again, I’ve found the response to be incredibly fast and Blogger.com is very quick (in my experience) to remove the violating content.

Many scrapers capture and repost your content by tapping into the RSS feed of your blog.

Side note: If you’re not very familiar with RSS feeds, Commoncraft has a great video, RSS in Plain English.

The fact that they are simply capturing and re-posting your RSS feeds may be indicative of an automated system (with little human intervention), where the scraper may not necessarily read your copied content. If that’s the case, you could try embedding a link back to your blog. There’s a great WordPress plugin that will automatically do just that: RSS Footer. (One helpful thing is the RSS Link Tagger for Google Analytics, which helps with the tracking of non-adwords advertising campaigns. If you log into Google Analytics and go to your created campaign and view the traffic sources information you’ll garner more information).

Try earning a bit of revenue from your stolen feed content. If you’re a Google Adsense publisher, try the “AdSense for Feeds” option within your “Adsense Setup”. Additionally, the RSS Footer plugin above, I think can also be used to embed advertising content from any other affiliates or advertisers you subscribe to.

For those who are a little stronger at coding issues, you may want to try out a great little WordPress plugin called “From RSS?“, where, as their site says: “…do something extra for your RSS subscribers, you might want to give them a little bit of extra content, or simply leave out some annoying footer about subscribing to the RSS feed. This plugin facilitates that…”

You can of course Report a Spam Result to Google which they use to help “…maintain the quality of Google search results.”

Finally another tactic that’s available is to report the site to the hosting company. There must be a ton of resources to help isolate who is the ultimate network provider (for the server that hosts the offending web site), of which I primarily use two:

Whois lookup and Domain name search and
Netcraft’s Search Web by Domain.

Using the domaintools.com site, I can see which DNS servers are managing the domain (ostensibly indicating who’s hosting it). And with Netcraft’s tools, I can determine who owns the IP address block that the website and server is one, thereby opening another venue of recourse.

In conclusion, I’d like to remind everyone of on salient issue. There may always be hotlinkers and scrapers of our content. I don’t think anyone can stop all of them, as doing so would in all likelihood prevent legitimate visitors from viewing your content, instead the primary objective of this post was simply to impart the concept of DETERENCE, so as to reduce such activities.

Protecting Your Domain Name

BloggerSavvy — Fri, 31 Oct 2008 22:43:22 +0000

Your domain name is an important (and critical) feature to your blogging success. Without a registered domain name, nobody would be able to access your web site. Additionally, to ensure your maximum exposure (search engines and the like), your domain should be:

easy to remember
be related to the content
reinforce your branding
not easy to confuse
easy to spell

All too often someone has spent the time to thoroughly research their domain name and had someone register the name on their behalf. Another scenario is that the developers have researched and registered the domain. But what happens if the relationship breaks down or the developer’s business closes?

I’ve often encountered domain name issues , as well as mediated such disputes between clients and their former site or blog developers. Invariably the scenario involves a breakdown in communication in which the rightful owner realizes that they don’t have control over their domains. In other cases the domain name is held for ransom and in others the original developer is no longer in business, among many other scenarios.

Recently I was contacted by a client who needed more cost effective and responsive hosting. The primary issue at hand was that the original developer had passed away and there was nobody to update their site or tend to hosting related issues. Upon examination, I found that the domain was not registered directly to them and as such (from a technical perspective) they did not appear to be the rightful owners. This resulted in the inability to move to a different hosting provider. They had no usernames or passwords to access and edit the domain name records, they had no current payment receipts proving their ownership, nor did they even know who the real hosting provider or domain registrar was. The hosting service was a resold account from a third party provider. The domain name was also resold from a third party. I was able to return control of the domain back to them, but it took three weeks of phone calling and faxing to the registrar to accomplish this, additionally it did help to garner the support of the hosting company.

How did this happen? What are some of the caveats?

When you have a domain name registered on your behalf by a third party, make sure that the email address used for the “Administrative Contact” is YOUR email address. This ensures that any transfer of the domain (to someone else) needs to be approved by you (because you get the email request). Additionally, this also enables you to change other information pertaining to your domain name registration record.

In the above case, the client did not have their email registered as the Administrative Contact (or as the Registrant). In fact the developer used his name, email address and other personal credentials within the registration record. In my opinion this is a big no-no! What happens if the developer is unable to provide services? Can a blog or site owner really wait for an extended time period to gain access to their domain name so they can move to a new hosting provider?

I’m not suggesting that the world of web developers or designers is frought with unscrupulous characters intent on seizing control of your valuable domain names. Rather I’m suggesting that you ensure you’re involved in the registration process, that you ensure you protect your interests. For those not familiar with hosting systems, there will always be a learning curve. Avoiding that learning curve could in some cases be very costly!

When registering a domain name, or having someone register it on your behalf, make sure you are aware of the following:

The Registrant is the legal owner of the domain. The Registrant should always be you, your business, etc. NOT your web developer, web designer, hosting company or anyone else. Period!

The Administrative Contact has the credentials and access to change the domain record information. This should be you, your business, etc. NOT your web developer, web designer, hosting company or anyone else.

As I alluded above, the web developer had listed himself as the owner and administrator of the domain, which resulted in the client having to wait an excessive time to garner access to the domain. And I may add it was only through shear “consideration” on the part of the registrar that they obtained access to their domain prior to it’s expiry and (hopeful) re-registration.

The Technical Contact should be the individual with the technical knowledge to resolve issues with the domain (commonly the hosting provider).

Are you currently listed as the Registrant and Administrative Contact of your domain name? If not, your name could be at risk. Here is one of the tools I use to help clients view their registration records: whois.domaintools.com