How do you incorporate a Wordpress blog onto an ecommerce website?

[josh-riley]

I think Ben outlines some great, actionable steps - there's one word of caution I'll throw out and that it's not necessarily that easy, depending on how your back end is set up.

I recently looked at something similar, and because of issues hosting WP (with PHP) on our server, we had to worry about hacking and the integrity of our shopping cart checkout system being vulnerable. So that wasn't a viable option to set it up as a sub folder and we had to look at a subdomain and pointing Apache at WP. (I don't want to bore you with all the technical vetting we went through, just suffice to say that theory and reality don't always go hand-in-hand.)

[blacey]

Thank you Andrea. You've also made some good points as well. Obviously storing WordPress on a sub-domain would seem to be the safest option if the website is an e-commerce site, but having WordPress stored in a separate database really would be a necessity. The last thing you'd want to happen is for their WordPress blog to be hacked and data to be deleted from the blog and the e-commerce system simultaneously.

As far as WordPress vulnerabilities go you need to ensure you use trusted and highly used plugins. There is a plugin called WP Security Scan (http://wordpress.org/extend/plugins/wp-security-scan) that might outline ways you could secure the blog.

If WordPress security is a potential concern here are a few things I would recommend doing (or getting your hosting company to do for you):

1: Password protect the wp-admin directory with a .htaccess fileBy password protecting the WordPress admin area, if a malicious user tries to access your WordPress admin area login page to launch a brute-force attack, or any other file which resides in the wp-admin directory to send a harmful crafted HTTP request, he is greeted with a server side login prompt and no direct access to WordPress files is possible. Something like this should do, but feel free to suggest improvements:

_   AuthUserFile /etc/httpd/.htpasswd__   AuthType Basic__   AuthName “restricted”__   Order Deny,Allow__   Deny from all__   Require valid-user__   Satisfy any_2: Change the wordpress table prefix from wp_ to something else.This will make sure that a malicious user cannot insert wp_<table_name<strong>> into their scripts to compromise the database.</table_name<strong>3: Install and use the Login LockDown plugin to restrict failed login attempts (brute force attacks) http://wordpress.org/extend/plugins/login-lockdown/4: Don't use 'admin' account and use strong passwords.http://www.safepasswd.com is good for generating strong passwords if required.

5. Restrict access to /wp-admin to known IP addresses (Public Home IP and a Public Work IP for instance)

Put a .htaccess file in /wp-admin with the following:

Order Deny,Allow 
      Deny from all
Allow from xx.xx.xx.xx
      Allow from xx.xx.xx.xx

You can use whatismyip.com to file the ip addresses you want to use and just update it as necessary

[Dr-Pete]

It's probably true that the subdomain approach is easier, but I lean toward the subfolder these days - it's possible for subdomains to fragment in some cases and not pass all authority to the root domain. The subfolder can help preserve that inbound link value.

Ben and Andrea's comments about the difficulty of subfolders and potential risk of integrating WordPress on to your main servers are certainly valid and worth considering. I'm definitely not an expert on WP migration, and there's more than one way to achieve it. It's possible to actually keep the WP installation on a separate server and then make it act as if it "lives" under the "/blog" subfolder with a reverse proxy, but that's pretty complex:

http://www.apachetutor.org/admin/reverseproxies

No matter which route you go, keep in mind that you'd need to 301-redirect all of the old URLs to either the subdomain or subfolder version. Simply moving the WP installation won't migrate the inbound link-juice or traffic. Both visitors and spiders need to be redirected to the new URLs - that's absolutely critical.

[jonmorse86]

Dear Peter, Andrea and Ben. Thank you all for taking the time to help answer my query. The points re security are valid and also Ben, thank you for your step by step response - much needed by an SEO novice!

However, I spoke to my web agency today and they have told me that they can only run .net blogs on their server and not .php which our current Wordpress blog is written in : ( Does anyone know of any blogs written in .net?

Thank you once again, Jon

[Dr-Pete]

I can't vouch for these tactic, but there are ways to port WordPress to .Net. For example:

http://www.php-compiler.net/blog/2011/wordpress-on-net-4-0

http://sourceforge.net/projects/wordpressnet/

It might be better to go with a .Net-native app, but it's not completely impossible to run WordPress.

Can they set up a reverse proxy? You could theoretically run the current WordPress blog on a separate server, but then make it look like it "lives" on a subdomain or subfolder. It's a bit tricky, but it's possible.

[blacey]

Hi Jon,

Thank you for your feedback, its much appreciated  and I'm glad I could assist. To answer your question, a blog can be written in any server-side language (PHP, .net, Clasic ASP, Ruby etc).

You will often find that .net hosting will be more expensive as opposed to php.

[josh-riley]

As someone who is currently dealing with the making a WP blog look like it lives on a subdomain, I will agree with Dr. Pete that it's very tricky.

[blacey]

The php-compiler.net blog article about running php on a .net platform is interesting, but wherever possible its always better to run applications in their native environment.

[jonmorse86]

Hi Peter,
Many thanks  for sending those two links over - I'm leaning on perhaps setting up a new .net blog so that it'll be easier to integrate with our site.

Regarding your last point, it we run the current Wordpress blog on a separate server and make it look like it "lives" on a subfolder would it still have the same SEO benefit?

Cheers, Jon

[jonmorse86]

Thanks Ben, I feel this is good advice also safer, quicker and easier to run a blog in its native environment. Cheers, Jon

[jonmorse86]

Hi Andrea, thank you for your comments - I'm definitely keen to avoid anything to painstaking and most importantly, costly! Jon

[Dr-Pete]

If it's done correctly and Google sees it as if it lives in the subfolder, then yes - it's perfectly fine for SEO. This is a technically tricky solution, though, and would really depend on the capabilities of your hosting provider.