How To Secure WordPress – Common Mistakse

I’ve been seeing tons of posts recently covering the (important) subject of securing your WordPress blog. There are many blogs that are currently sharing their top 5, 10 or 20 security tips.

Why am I writing about this? Because I don’t like the fact that most of these blog posts ignore the elephant in the room, rendering their advice into…rubbish.

Garbage can in Melbourne australia with the label 'Rubbish'

 

Here’s the last one I encountered, on Copyblogger

Last week, in preparation for an interview about my work at Copyblogger’s managed WordPress hosting division, I chicken-scratched a top 10 list of tips for keeping your WordPress website(s) secure.

10 Steps to a Secure WordPress Website

Now, in that link you will find a checklist of ten (mostly valid and important) actions to take to secure your blog (and up-sell some services). So why am I not satisfied?

The Elephant In The Room

Everybody’s talking about security and importance of having “good” passwords. You’ll see tons of debating on how to choose a hard-to-hack password, but zero discussion on who can read your password???

Here’s the elephant: If you have a self-hosted WordPress blog, there’s a VERY good chance that you don’t have a secure way to log in to it . What does this mean?

If you don’t use a secure connection when you log in to your WordPress blog (and in a second I’ll show you exactly how to check if you are using one), then anyone on your local network can see your password when you click that Log In button.

Let me emphasize this again

Anyone can see your password when you log in to your WordPress blog using a non-secure connection.

This means that it doesn’t matter what-so-ever how complicated your password is. If you update your blog, approve comments or even just log in to check stats while you’re at a caffe, shopping mall or airport – congratulations, you’ve just given your password to all the other people that are using the same network like you.

How do you know if you’re using a secure connection?

When you log in to your admin panel, check if the URL (the address at the top) starts with HTTP:// (insecure) or HTTPS:// (secure). If it’s an HTTPS, this is a secure connection, and your password will not be up for grabs by your surrounding. If it says HTTP, you’re in trouble for two reasons:

  1. When you log in, you send your admin password as plain text over to the server, and any other computer on your network can read it
  2. Even if you log in at home, and select “remember me” and then access the blog from a public location, anyone can hack your account. The reason for this is that although you have logged in from your home, the server saves a special mark on your device that will allow it to be remembered. This marked is called cookie, and when you access your blog again in a public network, everyone can steal your cookie, and that will make your blog crumble!!

How To Fix This

Unfortunately, showing how to set up SSL certificates (this is what it takes to have a secure connection to your WordPress) is a subject for an entire blog, not just a post, and is definitely out of the scope for this blog.

Being a complicated setup that it is, it also completely negates the point of easy actions to improve security, like all the blog posts I mentioned advocate for.

What you should do, is contact your hosting provider and ask them to help you set up SSL connection for your blog. Notice that a shared-SSL certificate, like Hostgator (for instance) offers for free, will only allow you partial management of the blog (for instance, will allow to edit posts in HTML mode, but not in the WYSIWYG editor – which is what most people would prefer). Also take into consideration that a private SSL will cost money (few tens of dollars per year on average). If you host more than one blog on your account, take into account that you might end up being able to install SSL only on one of your blogs.

How To Fix This – The Quick & Easy Way

Don’t choose a simple & cheap shared-hosting package. Choose a Managed WordPress Hosting provider. Syntesis [this is NOT an affiliate link] is one that I heared some good stuff about, but haven’t checked them out myself. Make sure to pick a package that DOES includes SSL (their basic one doesn’t).

If you have any recommendations for managed WordPress hosting or at least one that makes it dead easy to enable SSL for WordPress on it, write me a comment!

Image Copyrights Law And Releases – Are Model Release And Minor Releases Required For Photos On Your Blog

Hi everyone,

As you know, few days ago I’ve published a post on the subject of copyright infringement of photos on the web, and how to avoid getting sued by photo agencies such as Getty Images (the original post is here).

Now, a good guy named Will Edwards has stumbled upon my post and wrote his own piece about the subject. Not only it makes a good read, which you can find at “Images Copyright and ‘Getty-ing’ Sued” (I LOVE his title!), but also includes some important points that I neglected in my original post – mainly on the subject of model, minor and property releases.

Adult, minor and property releases

First, this is what Will had to say:

“If you were to take a picture of a person and then use that picture commercially, you could be in legal trouble if you did not gain the permission of the subject of the photograph.”

The permission Will is referring to is known as a release. The American Society of Media Photographers (ASMP) explains why you need the subject of your photo to sign a release:

“A release is a written agreement between you and the person you are photographing, or the person who owns the property you are photographing. The purpose of the release is to protect you from any future lawsuits the person might file for claims such as defamation and invasion of privacy.”

(ASMP Property And Model Releases)

The rights of the subject of a photo are protected not only under rights of privacy, but in some states also under the right of publicity – meaning:

“The right to control how his fame can be exploited for commercial purposes. Unlike rights of privacy, which die with the persons to whom they belong, rights of publicity survive their owners and can be passed along for generations”

(ASMP Property And Model Releases)

Why should releases matter to you?

Why is this important? Well, as Will says on his blog – if you take a photo of someone, although you own the photo, it doesn’t necessarily mean you can legally use it.

So taking your own photos, a strategy mentioned on my original post by several commenters (LOVE YOU GUYS!), is not bullet-proof either. Make sure you have a signed release form for your photos – when needed (again, I’m not a lawyer and don’t plan to become one!)

ASMP kindly offer release templates on their website, including adult, minor, property releases and more. Those are available here, but perhaps you should also read their introductory article first – “What’s In A Release (The Language Of Law)“.

Property Releases

The subject of model releases (either adults or minors) is quite obvious. A more surprising type of release that many people are unaware of is property releases.

Say what?

Will explains:

“if you took a photograph of a building and used it, you could again end up in legal trouble.”

And that applies to dogs, cats and other people’s mice too! This is a very tricky subject, as put by ASMP:

“The whole subject of property releases is filled with urban legend, assumption and myth, along with a bit of actual law.”

(ASMP – Using Property Releases, By Richard Weisgrau and Victor S. Perlman)

“Life is full with shades of grey”, said one of the comments on the previous post. And that is specifically true when tackling property releases.

Generally, properties don’t have privacy or publicity rights. Still, if a property is strongly linked to an individual or a company, they could claim that a photo of their property is much like a photo of themselves (OK, this is over simplified lingo, but you get the deal!).

As an example, if you take a photo of the Trump Tower, and feature it in a blog post about drug addicts, he could very well claim that it’s a defamation of character, and file a lawsuit the next morning.

To make a long story short:

  • If you use your own photos on your blog, make sure they don’t require a release or make sure you get them all signed.
  • If you use photos from public domain websites or Creative Commons collections, remember that many photographers (mainly amateurs and semi-professional) aren’t aware of the need for a release – or don’t bother.
  • This means that although you’re using a licensed photo, you can still get into trouble (DAMN! :()
  • Almost all photo agencies show the photo’s releases on their website – if any were required. This is actually quite an advantage for stock photography.
  • This doesn’t mean you can’t use public domain or Creative Commons collections. But if you specifically need a photo of a model, a child or a famous building (like the Trump Tower…), then you’re probably better off with stock photography for that specific case (unless you take a photo of yourself or your own kids, dogs, or mice) 😉

That’s all for this one

Thanks for reading!

Meron

Getty Images Suing You For Copyright Infringement Over Photos For Blog?

You open your mailbox and find a letter threatening you’ll be sued for a $100,000 due to copyrights infringement.

Man with images circling around his head
Over 85% of photos used online aren’t licensed for their use. (Colin Anderson/Blend Images/Getty Images)

“Impossible! That will never happen to me!” you say?

Well, do yourself a big favor and read this post.

Recent statistics show that over 85% of the photos used online are subject of copyright infringement.

Are you sure you’re not a thief?

Shortly after I decided to start this blog, I had a talk with a friend – Mirelle.

Mirelle is the proud owner of a well-known Israeli blog, focusing fashion, makeup & accessories: The Falafel Fashion blog.

Mirelle shared some horror stories she heard from her colleagues. All stories sounded pretty much the same:

One day, out of the blue, I got a warning letter from Gettty Images, ordering me to compensate some unheard-of photographer with tens of thousands of dollars.” The letter also said that if no action will be taken promptly, that blogger will be sued in court of law for copyright infringement!

Sounds familiar? Rings a bell? The blogosphere has been buzzing with alike stories for a quite a while.

Joe McCall from St. Louis, Missouri told his personal story on a forum message, titled “Getty Images Suing Me for $4,000!!!“:

“I received a letter from Getty Images today telling me to cease & desist using 4 images immediately… I have to send them $4,000 after I delete the images for copyright infringement. If I don’t pay them within 14 days, they are threatening to pursue damages.”

(Joe McCall, Flipping Homes forum)

Yikes! Another post, titled “Getty Images is after me” tells a similar story:

“Several months ago somebody made me a website and used several images he claimed he got from a public domain site. Last month I got a letter from Getty Images demanding $1000 for the use of the picture”

SydneyJen (user at Site Point)

I have tens of similar stories in my “research” folder, and the internet is literally packed with tens of thousands (if not more) of these abysmal experiences. Try googling “Getty images letter”. You will find over 34,000 exact match results, and over 9.5 million (read aloud: nine-point five million) relevant results.

So, who are these poor, poor people who Getty is apparently after, and are you one of them?

Jesus at church across from the Alfred P Murrah Memorial
Illustration: Even The Church got sued by Getty. (“Jesus” by tonystl. Shared under CC BY-ND license).
  • Blog owners
  • Site owners
  • Forum users
  • Forum owners
  • Web designers
  • Web developers
  • Graphic designers
  • Newspaper companies
  • Plumbers
  • Realtors
  • Carpenters
  • Charity organizations
  • Environmental organizations
  • Church reverend
  • and the list goes on…

Yes, you read it right. Getty Images actually filed a lawsuit against a church from Lichfield, United Kingdom for £6,000, according to The Guardian. They seem to stop nowhere.

If you are reading this post, you probably fit one or more of these categories. You must be somewhat troubled by now: Are you the next one in line?

In order to understand why are the bad guys at ‘Getty Images’ suing and bullying what seems to be everyone, everywhere; and to learn how to avoid being sued yourself, we should first answer two important questions:

  • Who the hell are Getty Images anyway?
  • What to they want from me or your?

WHO ARE GETTY IMAGES?

Here is (some of) what Wikipedia tells us about Getty Images Inc.:

“Getty Images, Inc. is a stock photo agency, … It is a supplier of stock images for business and consumers with an archive of 80 million still images… In February 2008 it was…acquired by  Hellman & Friedman in a transaction valued at an estimated US$2.4 billion”

(From Wikipedia: Getty Images)

So, there you go. Getty Images license usage rights for over 80 million still images.

If that doesn’t make them sound really, really big, then being previously purchased for an estimated $2,400,000,000 should do the job.

Getty Images are one of the biggest stock photo agencies on planet earth, if not the biggest one. Yes, they are aggressive sometimes, but so are all huge corporations.

Hell, I LOVE Apple, but I wouldn’t want to be in the shoes of those sued by them.

Still, there seem to be far more innocent bloggers being sued for (allegedly) no apparent reason by Getty Images, than by Apple, Google, Microsoft, IBM and any other business empire combined.

Nasdaq Marketsite at the Time Suqare
House of all huge corporations (Nasdaq). (“Nasdaq Take 3” by bfishadow. Shared under CC BY license)

Being raised on ‘Robin Hood’ fairy-tails, I decided to give Getty’s representatives a call, and ask them what are they up to. I was forwarded to their master delegate for my region: ‘Image Bank Israel‘.

 A Coin Has Two Faces

I wrote an email to ‘Image Bank Israel’ that evening, pretty much in the lines of:

“I’m a newbie blogger writing a blog post on how to legally find and use photos on my blog without getting sued by you”.

The next morning (!), I got a phone call from Ms. Aviva Weinman, CEO and owner of ‘Image Bank Israel’ herself.

We met a few days later at her office in Tel Aviv. As I entered, I saw smiling faces everywhere. I didn’t even have to sit down and wait, I was buzzed right in. “They don’t seem half as bad as people bad mouth them”– I thought.

Image Bank Israel Offices
Image Bank Israel offices in Tel Aviv

The interview turned out to be a very friendly and open conversation. We discussed photography copyright infringement at start, but later we got talking about the moral state of the Israeli society in general, and more.

But do not worry: I’m only sharing the “photo rights stuff” with you! 🙂

First, Aviva points out that ‘Image Bank Israel’ are merely Getty’s delegates in the region. This means she has no responsibility for Getty’s actions overseas, hence she can’t explain Getty’s actions, but only Image Bank’s. Nevertheless, the information she provides from an insider perspective is invaluable.

I told Aviva that I’ve decided to write this post because there are so many people obviously doing it wrong, so many people confused, and mainly so many people are scared, perhaps terrified by the name of you-know-who (Getty of course!)

“There really is no reason for confusion”, says Aviva. “The law is simple and the rules are very straight forward. Either you took a picture – and then it belongs to you, or you didn’t take the picture – and then you must obtain rights in order to use it.”

“If you use a photo that wasn’t taken by you, and you don’t bother with licensing it”, clarifies Aviva – “you are performing copyright infringement”. And that is all there is to it.

Copyright infringement is an offense

“Copyright infringement is an offense”, states Aviva. “Just like stealing a car or robbing a supermarket”.

“People don’t see it this way”, she explains, “because it’s so easy and ‘innocent’ to right-click a photo you found on Google and hit the ‘save as…’ button. But that photo was taken by someone, perhaps making his living from licensing his photos”.

PicScout’s CEO claimed that 85% of photo usage online in 2010 was done without appropriate licensing, I tell her. She doesn’t seem surprised.

“That’s why Getty Images, and their delegates overseas, are taking action. Some people don’t even understand that they are stealing something that belongs to someone else. Others just don’t care.”

Porsches aren’t that cheap!

OK, but let’s face it, I say. Buying licenses from Getty, iStockPhotos, or others can cost quite a lot of money. For an amateur blogger or a newbie writer, the price can be overwhelming.

Aviva has a great comeback (and marvelous analogy): “That’s true. But buying a Porsche isn’t cheap also. Still people know they cannot just take one that is parked at the parking lot. Even if the door is open and the key is in the ignition switch, most people will know better than taking the car for a spin!”

Porsche 911SC
Ain’t so cheap either. “Porsche 911SC” by FotoSleuth. Shared under CC BY license.

To this interesting analogy, she adds: “Remember that even if you steal a car, and then return it a week later to the exact same spot, it still doesn’t correct your wrongful act. Gasoline was wasted, wear and tear occurred…That’s why sometimes we can not settle for a cease and decease act (when one removes and stops any usage of non licensed copyrighted material [MB])”.

Judgement: When to settle

Unlike the (justified or not) image of Getty (pun intended), at least at their Israeli delegate I hear some sound judgement as to deciding when to file a lawsuit vs. when to settle:

“We understand that not all are born equal. We don’t want to make anyone lose his home or leave his family with nothing. But people still need to take responsibility for their actions”.

“People need to understand that we only manage the rights of the photos for our photographers. We don’t own the photos themselves. So, if a photographer is reluctant to settle or no compromise can be reached, we sue for the whole worth.”

Sure, I say. But to be honest, some of the prices I’m hearing sound crazy! How does one  reach such high figures??

“First, at least the Israeli law defines a ‘default’ penalty per picture that was used against terms. This is the same in most countries, and usually serves as the starting point. If we go to court, the photographer can sue for the entire value of the photo, determined by much money he could make of licensing it over a period of ten years.”

“And yes,”, she adds, “It can be a very high figure when dealing with professional photographers”.

Auctioneer banging gavel, (Close-up)
Must apply some sound judgement. By Photodisc/Getty Images

“In case of severe infringement for commercial benefit, and after having our letters ignored again and again, we could sue. If someone makes as spend on lawyers, private investigators, requires the work of the Getty legal department and an entire team of people in Israel and around the world – they will pay the price.”

“But we try to settle as much as possible with smaller business owners/bloggers. Many times we end up with a simple act of cease and decease and an apology. Other times we settled for the blogger buying the license at market price. Hundreds of them become longtime returning customers afterwards.”

It’s worth pointing out that this is only the policy of ‘Image Bank Israel’, and doesn’t necessarily say anything about Getty Images behavior (which does seem to be more radical!). Nonetheless, play by the rules and they’ll have no claims either.

If you’re willing to settle, I ask Aviva, why are you demanding so much money in the initial warning letter, instead of offering alternative options?

“As sad as it may seem”, Aviva answers, “No one reads nice letters anymore. Only when we threaten, we get people to take action and talk to us”.

So, I say and pause. Hypothetically speaking, lets pretend I’m a blogger with a bunch of unlicensed photos on my blog. What should I do to avoid being sued due to my already committed offenses?

“At the very least,” she smiles, “you should license all of the photos appropriately, and pay the photographer his dues.”

View of the Mediterranean Sea outside Image Bank Israel offices
The Mediterranean Sea outside of the Image Bank offices

Time Traveling for evidence

This raises a question, debated outside Image Bank Israel offices, by many bloggers and so-called experts:

Should you pay, or should you remove the unlicensed photos and call it a day?

Well, here come some bad news for you, folks: Maybe Albert Einstein proved time traveling to be impossible in the real world, but on the internet, time traveling has been around for years.

Time traveling can be done via time machines (well, duh…). Time machine websites let anyone go back in time and see past versions of your website, sometimes dating years and years back. That’s long before you removed the subject of infringement off your site!

And yes, you guessed it right. Getty Images and their automatic robots use such archives to find & prove infringements. (Wanna check out the most popular internet archive? Visit the Wayback Machine)

Now, you could contact the support teams of these websites, and kindly ask them to remove your website from their archives. Some of them even  went public about their objection to Getty using their services (‘Wayback Machine’ for instance), and they will be happy to help you out.

But who knows what private archives are in use today, or will exist tomorrow? Could you ever be sure you have destroyed all evidence?

Banner saying "We are naughty naughty copyright violators"
evil murphy says NO to Copyright Violation” by stacey~. Shared under CC BY-ND license.

Back to Aviva’s office, she tells me: “We give heavy weight in handling the case to the behavior pattern we see. If someone acts like he has something to hide – if he starts hiding evidence, deleting pages and generally behaves like a thief that’s aware to the severity of his actions, then it is not an innocent mistake.”

“We understand that people can make innocent mistakes. Sometimes it’s the web designer’s fault, and he’s already out of the business by the time we reach the website owner. But sometimes it’s as clear as the sun that someone has been doing it knowingly for ages, and those people need to pay for their actions”.

So yes, you could try to destroy the evidences. It’s hard to estimate your chances of succeeding, and it might make the matter worse if you are caught. Take that into account, and perhaps consider avoiding copyrights infringement to begin with!

The risk

But there are so many photos and graphics in the free domain! I tell Aviva.

Sure, it’s Image Bank & Getty Images job to make as much ca$h possible for the photographers, but why shouldn’t I use photos from the public domain?

Aviva tells me a story. “One day, I open the weekend newspaper. One of the full-page ads caught my eye. It was by a professional photographer, offering his services for weddings, birthdays, etc. He had 4 samples of his photos at the bottom of the ad. I immediately recognized those photos – they came from my image bank! That photographer stole four photos of other photographers, and claimed on national newspaper that they are a sample of his own work”.

The lesson? If someone can publish an ad on national newspaper with stolen photos, someone can sure-as-hell upload stolen photos to his Flickr, Instagram or Facebook accounts, and even upload them to open “public domain” (AKA ‘free’) web galleries.

If you, or your designer, happen to download and use a photo from a public domain website, that was uploaded without the photographer’s knowledge – you are performing an infringement as if you stole the photo yourself.

A Blackjack hand dealt in casino
Risk when using photos from public domain. (“Solar Casino Night (11)” by Ian Murphy. Shared under CC BY license).

So, that makes a compelling reason why you should use Getty, Image Bank, Dreamstime or any similar licensing agency (or even contact the photographer directly, if he doesn’t manage his rights through such agency). This way, you know for sure that you are doing everything right to a tee.

There are alternatives of course, but as stated above, they do come with some risk.

The main alternative is using photos licensed under ‘open licenses’, such as the Creative Commons (abbreviated as CC). Flickr has a library of over 210 million photos that can be used for free under the CC licenses.

My next post is going to be dedicated to show you how to find and legally use photos from Flickr on your blog. If you want to get an email notification when it’s out, why not  subscribe to the mailing list?

tips and lessons

The most important lessons to learn from this blog post, in addition to the understanding of why you can’t just copy-paste any image you see online, are:

1. Make sure you attain rights before using the material

How can you obtain rights for photos you did not shoot yourself?

  • If the photographer is employed by you, you get some rights – depending on your signed agreement. If you expect all rights and ownership of the photos to belong to you once you pay the photographer, you must put that in your written agreement. If you don’t sign a contract, it is generally considered that you have a one-time license to use the photos for the exact purpose described in the job order, and nothing more (this is not legal advice!).
  • The same goes for website designs – they belong to the designer unless stated otherwise!
  • If the photo is licensed under some “open” license, such as the Creative Commons (also referred to as CC), you may use it for free as long as you are keeping the usage to the exact license terms.
  • If the license is managed be some agency, the process generally follows this path: A. You buy “credits”, averaging at $1.5 per credit point. B. You choose the required photo and choose appropriate license, image size, and allowed usage. This is usually handled by the purchase wizard at the agency website. The wizard will tell you how many credits are required to license your needs.
  • Are you a student or part of an educational institution? Do you need the photo for private or educational use only? ‘Image Bank Israel’ and many other agencies will not only allow you to use photos for free, but will happily give you high-resolution versions of the photos upon request.

2. Protect yourself

Are you buying a design for your website or blog from some gallery or web designer? Is someone designing some brochures for you?  Your order should include a contract forcing them to only use licensed works, and have them to take legal responsibility if they fail to do so.

Ambush-protected vehicle
Protect Yourself! (“Ambush-protected vehicle” by The U.S. Army. Shared under CC BY license).

This advice is common sense, but you should have a lawyer help you with a template agreement of such kind. When doing so, do make sure he specializes in copyright infringements and not transportation and car accidents!

One more point to remember: There is no such thing as a free lunch! Not all photos licensed under Creative Commons on Flickr actually belong to the user that uploaded them. Use common sense. If it looks too good to be true, it probably is.

3. License types

As already mentioned, ‘open licenses’ exist (like CC), allowing you to use a photo for no money down. Besides those, if you decide to pay for licensing you will generally find terms similar to the following:

  • Royalty Free (RF) License
    • Usually refers to a non-transferable, non-exclusive right to use a photo for specified needs.
    • It is usually less restrictive in terms of allowed usage and limitations than more ‘complicated’ licenses, but it varies by the websites and agencies, so read their terms before purchasing.
    • Many websites offer Basic RF and Extended RF licenses, so make sure you compare them before you buy.
    • Don’t forget – RF license is non-exclusive, so there is a good chance someone else will be using the same photos.
    • Normal limitations include: size, market, format (web, printed, etc), maximum allowed exposure, and more.
    • At Getty Images, RF license price is based solely on the size of the purchased photo.
  • Rights Managed (RM) License
    • An exclusive right to use a photo.
    • Usually is limited by time, region of the world (e.g. ‘China only’, ‘Latin America’ or even ‘Worldwide’), and usage (e.g. Editorial, software design, website design, printed materials, etc.).
    • As it is an exclusive right to use the photo, it generally costs much more in comparison to RF or CC licensed photos.
  • Editorial Rights
    • This is a sub case of RM License, where the photo may only be used for editorial purposes (newspapers, news sites, blogs following current events, etc.) referencing information, news or noteworthy event.
    • At almost all cases, the license is non-exclusive and for one-time use only.
  • Preview License
    • Intended for personal, educational and noncommercial use only. Some limitations may apply.

4. Finding Photos

As I mentioned, I’m in process of writing a blog post showing where to find photos for your blog and how to use them legally, including the process of purchase and download (both open licenses and RF websites).

Here is a small taste from the coming post, showing how to find photos under CC licenses on Flickr:

http://youtu.be/xXTfuyOrSgE

You can find photos under RF or RM licenses at:

  1. Getty Images (Obviously..). Curated by Getty editors.
  2. Corbis Images – Owned by Bill Gates. Over 100 million images. Never used them, but prices seem good, and they also accept local currency.
  3. Dreams Time  – A cheap choice for stock photos.
  4. iStock Photo (Owned by Getty Images) – Same like Getty, but the photos are uploaded by the photographers themselves, and not by Getty. Cheapest RF photo I found there went for ~15 credits, which averages at $22.
  5. Shutter Stock (I Didn’t try it yet, but will during my next blog post writing).

I’m going to review all these websites and show you the exact purchase process on my next post. If you want to receive an email notification when it’s published, subscribe to my mailing list right now. You will receive blog posts only, and nothing else. You can un-subscribe at any time of course.

Until the next time,

Meron