• Skip to primary navigation
  • Skip to main content

Microbusiness

Just another Junction30 Sites site

  • Home
  • Articles
  • Contact

Articles

How Do I Score 100 On Google Page Speed Insights

11th April 2017 By Tim Marchant Leave a Comment

For this exercise I have created a demo site using the Genesis Sample Theme and configured it with the basic settings in the the set up guide. However, since this is intended to be for a mobile audience, I dispensed with sidebars and used the full width template, moving all the widgets to the footer.

Test 1 – Google Page Speed Score 62/100

My first Page Speed Test gave a fairly creditable score of 62/100 with the following marked to be fixed:

Should Fix:

Eliminate render-blocking JavaScript and CSS in above-the-fold content

Optimize images

Consider Fixing:

Prioritize visible content

Reduce server response time

Minify CSS

Minify JavaScript

I decided to deal with the offending image first.

The original logo had been generated in Photoshop and saved for the web, mostly that is good enough but if not I use Riot. In this case it reduced the file size to 20.18kb from the original 25.16kb, a saving considerably more than Page Speed demanded.

Test 2 – Google Page Speed Score 69/100

Next step. Install Autoptimize select these options:

Test 3 – Google Page Speed Score 69/100

Now the html, css and javascript are minimised, but the score is still only 69/100. I am left with:

Should Fix:

Eliminate render-blocking JavaScript and CSS in above-the-fold content

Consider Fixing:

Prioritize visible content

Reduce server response time

The next step, go to the Autoptimize Advanced Settings, remove any exclusions of javascript and any excluded css files (e.g. jquery.js will always be listed). Select “Inline all CSS?” Save.

To improve the server response time you will need to enable caching. Install Hyper Cache, or your choice of Caching engine. If you go for Hyper Cache these are my settings:

Once you are done, open a private window and load your page. This will prime the Autoptimise and Hyper Cache caches. From this point on you will need to empty the caches and reload the page  to reprime them again before testing.

Test 4 – Google Page Speed Score 69/100

At this point my score is still stuck 69/100 but I have only one file left to deal with I am instructed I need to Optimise CSS Delivery of the web fonts which are delivered from this url

https://fonts.googleapis.com/css?family=Source+Sans+Pro%3A400%2C600%2C700&ver=2.3.0

I can’t optimise Google’s code. Thanks Google.

However,  I can change the way it is loaded.

The solution is to use the Typekit Web Font Loader to load the fonts asynchronously.

In the functions.php file find and either comment out or remove this line:

wp_enqueue_style( 'genesis-sample-fonts', '//fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700', array(), CHILD_THEME_VERSION );

Then add the following after the end of the genesis_sample_enqueue_scripts_styles function:

https://gist.github.com/e8ec359bc02c6013957060c350153b91

Adjust the code with your own font selections by copying the details from the wp_enqueue_style line you commented out.

At this point, I hit a problem. For some reason, Google Page Speed refused to acknowledge the change and continued to insist I Optimise CSS Delivery of the fonts. It was late, I checked my code and everything looked fine, so I decided to sleep on it and see if I could figure it out.

The next morning, I reran the test…….

Test 4 – Google Page Speed Score 100/100

We Aren’t Done Yet!

Take a look at how your page is performing. Firebug is a great tool to help see how fast your page loads.

So that looks great, I have a page which gets me a 100/100 score and loading in 637 ms.

There are a couple of items we can look at changing to improve performance further. The fourth line is a recent addition to WordPress to imtroduce legacy support for emojis in older browsers. I think that sounds pretty pointless for most sites so I will remove it with the Disable Emojis plugin.

Second, look at the last line. This is the call for the Google fonts css.  I have already mentioned the option of forgoing Google fonts and using web safe fonts. If your site will still look great in Arial or Helvetica you might want to think about removing the web fonts.

On many sites a saving of 321 ms would be of little consequence, but in this case it is over half the page load time.

Personally, I am pretty attached to using web fonts so I would likely end up re-enabling them on a production site and in most cases I think clients would value the improved user experience of web fonts over the increase in speed. Your choice.

If you are using another theme and have additional plugins there may be more for you to do to get to the magic 100 and it can be very frustrating tracking down every last bit.

Testing The Page

While Autoptimise and Hyper Cache worked very well for me in this speed optimisation exercise, sometimes things don’t turn out well and scripts or css stop working. Check your site carefully and make sure everything is as it should be. If not, you might need to switch tools, I have also used Async Javascript successfully instead of Autoptimise, for example.

Firebug only shows you how the site is performing on your machine, in your room. Test performance with other tools:

  • GTMetrix (my favourite) offers a great range of options, good reports and tips on optimisation.
  • Pingdom Tools
  • Web Page Test
  • DotCom-Monitor’s Web Page Speed Test (rather fabulous, 24 simultaneous tests from all over the world).

If you are optimising for a site which is going to get traffic from all over the world the Dotcom Monitor test makes a pretty good case for using a CDN.

Filed Under: Genesis, Wordpress, Wordpress Performance

Securing WordPress

4th March 2017 By Tim Marchant Leave a Comment

As I set out in my previous article The Security Illusion, security can never be absolute.

Make sure your site is kept updated

Most attacks on WordPress are drive-bys, they are carried out by automated bots looking for WordPress installations which are out of date, or unpatched, outdated plugins or themes.

WordPress is very widely used, and the core application is actively, even intensively managed by a large team. So long as you ensure it is up to date, WordPress itself will prove very secure. Plugins and themes are also attack vectors and security issues get reported widely both on and offline. For example:

WordPress photo plugin opens ‘a million sites’ to SQLi database feasting

Here is the thing though. The article was published on the 1st March, the effected plugin had been patched 8 days earlier. Sucuri, who discovered the plugin, published their own report on the 27th February saying This is quite a critical issue. If you’re using a vulnerable version of this plugin, update as soon as possible!. Again, four days after the patch had been released.

So, by the time hackers had armed their bots with the necessary kit to exploit vulnerable versions of this plugin, site owners had had more than enough time to update their sites. Anyone whose site got hacked as a result of this vulnerability had only themselves to blame.

If you have your site hosted on WordPress.com, then they will handle updates for you, otherwise, if your site is self-hosted, then it is up to you.

I recommend that you check and update your site every 24 hours.

Choose Plugins And Themes Carefully

As I said above, WordPress itself is actively managed by its large team and quickly updated if a problem is discovered.

This is not necessarily the case with plugins and themes. Of the thousands available only a very few are provided by the WordPress team. The rest are provided by a wide range of third parties.

One of my favourites is Contact Form 7. The interface is simplistic but functional. The dashboards of other form plugins may be more attractive, but in practice CF7 is very easy to use. It has been around since 2007, has been carefully maintained and updated by its author during that whole period. It is reliable.I always use it.

When you are choosing plugins check the Last Updated date, have a look at the star rating – look for 4+ stars (with large numbers of reviews) and check out the support forum.

There are significant number of plugins which have not been updated for a very long time. Unmaintained plugins may not be a) not compatible with the latest WordPress release and b) secure.

As a rule of thumb, I look for plugins which have been recently updated – in the last couple of months. Something which hasn’t seen any activity for years is probably best avoided. However there are quite a number of plugins which have not been updated for a long time for the simple reason that they have not needed to be updated, for example, one I use frequently is Genesis Simple Edits, at the time of writing, this has not been updated for a year.

Check out the support forums for plugins and themes, if you find a lot of unanswered cries for help there, or just tumbleweed, don’t add yourself to the list of sufferers, chose something else.

Get  A Firewall And More

This is a report from a relatively low traffic site which I manage:

As you can see the scale of the threat is massive, the “Attacks” include a wide range of miscreance, for example, from the same site, these are attempts to login to the site’s dashboard.

There are several very good firewall applications for WordPress. Popular ones include:

  • All In One WP Security & Firewall
  • BulletProof Security
  • iThemes Security (formerly Better WP Security)
  • Wordfence Security

Use one. My preference is Wordfence but the others are good too.

I also like:

  • Activity Log The #1 Activity Log plugin helps you monitor & log all changes and activities on your site, so you can run a safer, more organized WordPress site. This is not just useful if your site is hacked, it can give you useful pointers when you have other problems as well.
  • Sucuri Security The Sucuri WordPress Security plugin is a toolset for security integrity monitoring, malware detection, audit logging and security hardening.

Recommendations

  1. Update your site (WordPress, themes and plugins) every 24 hours.
  2. Choose plugins and themes with care.
  3. Get A Firewall

Backups

Finally, remember that whatever you do, you cannot guarantee that something won’t go wrong – your site or your server could be hacked, or you could suffer a catastrophic hardware failure, a plane could crash on your datacentre, there could be a fire. Whatever, make sure that you have backups, lots of them and in locations remote enough that they will not fail at the same time as your site. I back up the sites I manage onto a server leased from a different supplier to my web hosting servers, in a different datacentre, I download copies of those backups periodically to my local machine. There is no point taking backups if you do not know how to restore them.

Filed Under: Uncategorised

Free Starter Themes For Genesis Framework

27th February 2017 By Tim Marchant 1 Comment

A collection of great child starter themes for the Genesis Framework. These child themes are free but to use them you will need to have purchased a copy of the Genesis Framework for WordPress.

These themes are great starting points for development and design, the exception is BG Mobile First, which can be used straight out of the box for a clean and simple look, but is ideal for customisation as well.

BG Mobile First

By Brian Gardner


https://briangardner.com/themes/mobile-first/

Sassified for developers

https://github.com/pmgllc/bg-mobile-first-jp-sass


Genesis Starter Child Theme

By Sridhar Katakam

https://sridharkatakam.com/genesis-starter-child-theme/


Bolt Pro Theme

By Chris McIntosh
https://mcintosh.io/bolt-pro-theme/


Prometheus

By Ryan Rudolph

http://www.ryanrudolph.com/prometheus-a-genesis-starter-child-theme/


Bones for Genesis 2.0

https://github.com/cdukes/bones-for-genesis-2-0

Filed Under: Genesis, Websites, Wordpress

The Security Illusion

22nd February 2017 By Tim Marchant Leave a Comment

Hatton Garden Bank Raid (Cred: Metropolitan Police)

I have had a lot of conversations with people about data and website security. It is alarming how many people either don’t keep backups, or if they do, have no idea how to restore a backup should they need to.

Several times I have talked to people who grew up in a world where security meant a five lever lock, or a big steel box with a lock on it. If that is the case, then the idea of moving your stuff to “the cloud” is a concept they find troubling. Among other things, I don’t think the term “cloud” sounds very secure. Maybe if it were called “the fortress” or something like that it would be more inclined to set people at ease.

My real point is that there is no such thing as secure. That applies to all forms of security.

For example, when you buy a five lever lock for the front door of your house it should be pretty obvious that the lock is not going to guarantee that someone doesn’t break into your house. It is hard to open a door with a good lock on it, you aren’t going to pick it, it will take several minutes to drill it open or smash it with a chisel and that will make a lot of noise and attract attention. Much easier to (quietly) smash a window. But what if there are shutters on the windows, well then just take a few tiles off the roof and get in that way. Even if you have a house built like a fortress, if someone really wants to get in they can always pick your pockets, hold you up at gunpoint, or whatever. At that point, you might have been safer not making your house so secure in the first place! The same goes for banks. By and large, they put little effort into keeping people out of their branch buildings, enough to deter rough sleepers but not much more. The vaults are a different matter, the plan is simply to make it take so long to get in that people won’t bother. Even then, sometimes people will find a way.

All we can ever achieve is relative security and that means not only thinking about how we keep people out as far as is practically possible, but also having a plan for how we are going to deal with what happens when our security is breached.

Filed Under: Hacking, Security, Wordpress

Essential WordPress Plugins

31st October 2016 By Tim Marchant 1 Comment

Whenever I build a new WordPress website, one of the first things I do is to install a collection of plugins. These do the basic things I need for pretty much every site and are ones I have confidence in. While WordPress itself is regularly updated and secured, plugins are not. They are maintained by individuals or small teams and in some cases get abandoned, so you can find that they fail to keep up with WordPress developments and stop working, or worse, they provide a way for hackers to get into your site. My advice, only use recently updated plugins, look at the star ratings and check out whether support posts are being dealt with.

General Plugins

Antispam Bee

Contact Form 7

Imsanity

MailPoet

MainWp Child

UK Cookie Consent

Wordfence

Genesis Plugins

Enews Extended

Simple Share

Simple Edits

Title Toggle

Simple Hooks

Simple Social Icons

Filed Under: Wordpress Tagged With: plugins

  • Page 1
  • Page 2
  • Go to Next Page »

Copyright © 2025 · Metro Pro On Genesis Framework · WordPress · Log in