What you easily can do yourself

1. Updates, Updates, Updates

At the top of the list is keeping all plugins, themes, and even the WordPress core up to date. Regular updates close known security gaps that attackers specifically exploit. Updates therefore not only bring new features, but above all important security patches.

2. Sensible user capabilities

Not every user needs admin capabilities – usually, one administrator account is sufficient. All other user should only get the capabilities they need in order to do their job. This limits the damage if a user account is compromised. A hacked editor account is significantly less critical than administrator access.

3. Delete inactive plugins

Be sure to only use plugins and themes that are actively maintained. Sometimes the author loses interest or an extension is no longer updated for other reasons. Themes and extensions that are no longer maintained pose a major security risk and should be removed promptly.

The same applies to plugins and themes that are not actively used. You try out a plugin or theme and then deactivate it again. We don’t delete them right away because we might use them after all. You should also keep an eye on this list and delete everything that is not being used.

4. Only use trustworthy sources

Only obtain themes and plugins from official and trustworthy sources. Supposed bargains, where paid extensions are offered for free or at very low prices, usually contain malicious code. This puts your entire website at risk.

5. Secure Access

You should always use strong credentials, which means, above all, good passwords (see box). Never reuse passwords, even if it makes them easier to remember. Avoid the default username “admin”, as this is always the first one tried in brute force attacks. Each user should have their own account with a secure, unique password and only be granted the necessary rights.

6. Don’t skimp on hosting

A good hosting provider protects its servers with a modern, secure infrastructure, creates regular backups, and provides expert support in case of problems. This is an important basis for the security of your website.

Hide login?

Very often, I read the following advice: you should hide the login page. This is not difficult to implement; the WP login is simply assigned a different URL. I don’t consider this measure to be very effective, because attackers can also find hidden login pages. It is better to focus on strong usernames and secure passwords.

And what about security plugins?

There are many offerings in the plugin directory under the keyword “security”. These plugins promise fast, comprehensive protection for all situations. They are available in free versions via WordPress.org or in premium versions for an annual license fee. They usually offer functions from the following areas:

• Firewall, i.e., login attempts are logged and, if necessary, the IP addresses from which the attempts originate are blocked.
• The malware scanner checks the installation for potential malicious code and compares the plugins with lists of known security vulnerabilities.
• Ways to secure user accounts and logins, e.g., by requiring strong passwords.

Many of these functions can also be handled by a good hosting provider. Depending on your hosting provider’s security standards, you may not even be allowed to install any security plugins. This is not a disadvantage, but a sign that the hosting company takes the issue seriously and takes care of it. You can often configure individual aspects in your customer menu.

The appeal of a security plugin is that it guides users through all of the above security aspects. The functions are brought together in a dashboard, where everything is clearly displayed and (ideally) well explained. However, if you want to use more than just the basic functions, you usually need the paid version. For those who have a more affordable hosting plan, a security plugin can increase the security of the website.

Instead of installing a large extension with many functions, you can also manage many aspects individually. For example, you can install a plugin that enforces strong passwords and, ideally, requires two-factor authentication for certain user groups. Or one that only allows a certain number of login attempts.

I also have other options for security scans; there are plugins and services that offer this service, either free of charge or for a fee. This often comes together with the backup function: a plugin that regularly creates backups and sends them to another server, if possible, can usually also initiate a security scan.

Conclusion on security plugins

Security plugins can help make the complex topic of security easier to understand. Some things may not seem absolutely necessary at first glance—I’m thinking, for example, of hiding the WordPress login. But when used correctly, these plugins can be helpful.

It is important to note that security plugins in particular require meticulous attention when it comes to updates. After all, these tools have extensive rights in the system and interfere deeply with a website. If a security vulnerability remains open here, the security plugin itself becomes a security risk.

The usefulness of a security plugin depends not least on the hosting. If your website is hosted by a provider that already offers sophisticated firewalls and malware protection, installing an additional extension does not add much value.
Security plugins can also lead to a false sense of security: if weak passwords are in use or there are many unmonitored admin accounts, the back door is wide open. Even a security plugin cannot prevent this.

The post Securing WordPress easily and efficiently has first been published on start the loop_.

The best way to manage secure passwords is with a password manager. This kind of software remembers all your passwords and stores them securely and encrypted. It allows you to sort and organize your passwords easily. You can add notes and see when you last changed a password, among other things.

Password managers also offer a solution to a very common security problem: using the same password multiple times. I once had a very well-thought-out password that I used in many different places. Unfortunately, this greatly increases the risk of access data falling into the wrong hands. All it takes is one leaked list containing the password.

Password managers are available for all operating systems (Windows, Mac, Linux) as well as for smartphones and mobile devices (Android, iOS). The software is quite convenient; for instance, it usually provides extensions for web browsers. The password manager also saves the URL of a login page and immediately suggests the correct combination of username and password.

This might also protect you from fake websites, as your password manager will not provide the login data since the URL is unknown. (Unfortunately, you certainly are able to add it manually. But maybe the short moment of surprise is enough to make you realize that something is not right.)

Three of the best known password managers are:

1. 1Password – A widely used password manager with many features for individuals and teams.
   Visit the website of 1Password
2. Bitwarden – Open-source password manager with secure encryption and cross-platform use.
   Visit the website of Bitwarden
3. Keeper – Great if you need to share passwords with others
   Visit the website of LastPass

This article in Wired gives you a short overview over some of the password managers.

The post Password Manager has first been published on start the loop_.

When we log in somewhere, we usually enter a username and password. Very often, the username is an email address or can be replaced by it. This part is therefore relatively easy to guess. If someone then finds out the password, the account is hacked.

Two-factor authentication was invented to solve this problem. The best-known example of this are SMS-based systems, where a code is sent to the user’s cell phone. We are all familiar with this process from online banking. When logging in, you have to enter both your password and the code. This makes access more secure.

With two-factor authentication, access is secured by an additional query that is independent of the username/password system. This can be a numerical code provided by an app or an external device, or a biometric feature such as fingerprint or facial recognition. Without this additional factor, no one can log in, even if they know the username and password.

Two-factor authentication is important if personal and sensitive data is stored in an account. 2FA is already mandatory for online banking, but you should also secure payment services accordingly.

Additional security measures are also advisable for email accounts and social media profiles. The main reason for this is that private details are disclosed here. Identity theft often starts with attackers targeting accounts that are easy to crack. They then work their way from one account to the next.

Last but not least, the admin access to your website deserves special protection. If a criminal takes over an administrator account, it can cause a lot of damage.

Further reading: What exactly do we need to protect our websites from?

The post Two-factor authentication – what is it? has first been published on start the loop_.

Shops store payment data, member sites have user accounts. This data — names, email addresses, passwords, payment information— can be stolen and converted into cash. On websites where user data is stored, the data is usually the target of an attack.

But what if there is no user data on the website at all? Does that automatically protect me against attacks?
Unfortunately not. Because it’s not just data that is of value to attackers.

Taking control of the website

Gaining control of a website is by far the most common motive for cybercriminals to attack a website. The goal is to gain admin access or server access. Anyone with access can insert malicious code.

Compromised websites are used to send spam emails, redirect users to phishing sites, or host malware. There are many ways to use a website for criminal purposes: gambling, pornography, fake shops, SEO spam (backlinks for other sites), affiliate fraud, and so on.

Search engine bots often detect malicious code on a website before the owners themselves do. The website is then classified as dangerous and the search engine removes the site from its index, marking it no longer accessible. Associated email addresses are also affected by such a block, they are blacklisted: All emails are marked as spam.

This can quickly result in quite extensive damage. Cleaning it up involves a lot of work. Without the help of a professional service provider, it is close to impossible for most website owners. Even if you detect and delete the malicious code, the attackers will almost certainly have left an open “backdoor” through which they can inject new malicious code at any time. Finding this backdoor is not easy. And there is no quick solution for rebuilding the site’s good reputation and search engine ranking.

At this point, it pays to have a reliable hosting company who takes security of their servers seriously: If malicious code is detected by your hosting company, they will take your website offline immediately. This way, you hopefully can avoid all the problems that come with being blacklisted.

The post What exactly do we need to protect our websites from? has first been published on start the loop_.

New versions of plugins are released relatively frequently. Depending on the number of plugins used on a website, updates may be required almost daily. The WordPress core, i.e., the WordPress CMS itself, receives minor updates approximately every 1 to 2 months, with a new version released about twice a year. Themes also receive updates, but less frequently than plugins. Updates are often security-related. So if a plugin offers an update, please do not ignore it.

Updates that close a known security vulnerability should always be installed as soon as possible.

Which plugins should be allowed to update automatically?

I roughly divide plugins into three groups:

• Plugins that are indirectly or directly important for the SECURITY of the website. These can be one of the common security plugins, plugins that create backups, and similar plugins. What they have in common is that they have nothing to do with the display of the website. At the same time, they usually have far-reaching permissions and can quickly become a risk.
• Plugins that are essential for the DISPLAY and FUNCTION of the website. Examples include WooCommerce for a shop, LearnDash for an e-learning platform, and, of course, all the additional plugins that you need to go with them.
• Plugins that do not affect the appearance or functionality but are useful tools. These include “KoKo Analytics,” “Yoast SEO,” “Enable Media Replace,” maintenance plugins, or something like “Admin Columns.”

Before enabling automatic updates for a plugin, you should ask yourself the following questions:

• How high is the risk if this plugin runs in an outdated version?
• How big is the danger that something on the website will break because of the automatic update? Like, for example, the display not working anymore, or the shop having a problem?

In addition, conflicts can always arise when two plugins clash after an update. Unfortunately, this cannot be completely ruled out.

Plugins that I usually update automatically

The plugins in the first group, i.e., those that are security-related but run in the background, are usually at the top of my list for automatic updates. Especially if a security vulnerability becomes known, I want it to be closed as quickly as possible.

I also frequently use automatic updates for plugins in the third group. This applies to all useful tools that are not directly responsible for the website’s appearance to visitors. As a rule, they should not cause errors that impair the functionality of the website.

Plugins for which I initiate updates manually

I don’t usually allow automatic updates for plugins that are essential for a web shop, an e-learning platform, or a booking system, for example. I usually read through the changelog before updating. This tells me what changes the update brings. If it’s only a minor update, the list is relatively short.
This helps me to identify potential sources of trouble. In other words, I know where I need to look more closely after the update.

With very complex systems, such as a WooCommerce shop or an e-learning platform, I have to take a close look and test thoroughly. Ideally, these updates should first take place in a staging environment, i.e., an exact copy of the website in the same environment as the live website. This allows you to update without serious consequences. If something does go wrong, you can take your time to search for the error.

How do I enable automatic updates?

Since WordPress version 3.7, it has been possible to select the option to automatically install updates for a plugin on the plugin overview page. For free plugins, updates usually come via WordPress.org. For premium plugins, for which you have purchased a license via the plugin’s website or a platform, these updates are usually delivered by these websites. In rare cases, you may need to download the latest version as a file and reinstall it.

If automatic updates have been enabled, they are usually performed once a day. Sometimes the plugin page will also indicate that an update is scheduled in x hours. Once the update is complete, the system will email the administrator’s address. If there were any problems during the update, you will also receive a message.
It is therefore important to use a current email address as the admin address so that you receive these emails.

Core updates from the WordPress system can also be updated automatically. Here, you can choose whether only minor updates, which usually contain security patches, should be performed, or whether major WordPress updates should also be performed automatically.

Pay attention to silent warning signs

It sometimes happens that a plugin is no longer being maintained. In other words, there will be no more updates at some point. This happens very quietly, and it is very easy to overlook. One indication is when the “auto-update” option disappears, meaning that the plugin can no longer be accessed via the WordPress repository.

In most cases, the old plugin still works, but it is no longer state-of-the-art and potentially unsafe. In this case, you should swiftly look for a replacement.

An exception would be if the plugin authors deliberately remove the plugin from the WordPress repository. In this case, however, a note would appear indicating where to get updates in the future and, above all, how to proceed in order to obtain them.

When an update goes wrong

Every now and then, an update causes the website to crash. In the worst case, all you see is the dreaded “white screen of death.” Then you have to find out what the culprit is and, if possible, revert to an earlier version of the respective theme or plugin. If that is not possible or practical, you have to consider whether you can replace or even delete the plugin.

WEBSITE MAINTENANCE

We take care of your website.

Daily backups, regular updates. Compromised plugins are updated within 48 hours, if possible.
After the update, we check that everything is working properly and fix any display errors.

from 39€/month plus VAT

Get in touch!

The post Auto-updates on WordPress has first been published on start the loop_.

It is impressive when an AI tool produces a complete blog article from a brief text instruction. Or a photo that looks completely realistic. The system did not invent the image, though. All parts of this image were created by someone at some point. In the form of a photo or an illustration. Midjourney, DALL-E & Co. only reassemble them. In this sense, the systems do not create anything new; they merely combine existing elements in new ways.

This article is about the concept of artificial intelligence. This article goes into more detail: Do I need AI for my website?

The overwhelmed Stone Age brain

I only have a very vague idea of what AI is. I find it difficult to grasp the abstract mathematical and statistical concepts behind neural networks. AI is not a topic that can be assessed intuitively. Our brains are not designed for that. AI works very well technically, but hardly anyone understands why.

At the same time, the fascination is immense. Here is something you can ask questions of, something you can have a conversation with. Something that has an answer for everything and seems to know everything.

Who invented it?

One unresolved and, in my opinion, very controversial issue is copyright. The training data comes from somewhere; someone wrote, said, coded, photographed, or drew it all at some point. At the moment, there are no regulations governing what data a company is allowed to access for its products. The issue of privacy is also unresolved. The big players read every social media post and every message.

Search engines list the sources that match a search term. With AI, there are no longer any sources. There is only training data, but it is not accessible.

Hallucinations and fakes

To enable the models to calculate this, the training data is divided into countless small pieces (tokens). The systems compile their content from this data scrap and a lot of statistics. The model simply calculates until something suitable emerges. The main criterion here is probability.

This can result in texts that sound credible but have no basis in reality. For example, the AI tool may cite sources that do not exist. These errors are known; they are a logical consequence of the probability methodology. The systems could correct these errors, but that would cost valuable time. At the moment, the errors are being tolerated; fast results are more important to providers than correct results.

AI is also great for manipulating and falsifying information. The algorithms used by social media platforms are the perfect breeding ground for this. Highly idealized images and videos have always been produced in the lifestyle and beauty sectors. AI makes producing such content many times easier. Authentic images are disappearing. Entire platforms such as Pinterest are now flooded with AI-generated photos.

The fact that our brains react particularly strongly to negative news plays a problematic role. At best, AI-generated videos are funny, but they are often provocative and frequently malicious (keyword: deep fakes). In the battle for attention, something controversial will always trump a positive message. Posts that generate negative emotions get the most likes.

The distinction between what is real and what is fake is becoming increasingly difficult. Many people consider AI-generated content to be authentic. This is a massive social and political problem.

Conclusion

AI is just a tool, but one with enormous potential. Potential that is difficult to assess. And that has an impact in a social and political context.

There are many useful applications, such as in medical technology. But the influence of technology on our society is so massive that we need to find political rules for it. All areas of life are affected. We cannot leave critical issues such as political opinion-forming, mental health, or weapons technology to large corporations that are solely focused on their profits.

The post Reflections on AI has first been published on start the loop_.

LLMs (large language models) are commonly used on websites. This is a (sub)form of AI that can handle language. This means that someone asks a question and the LLM system searches for something suitable from the information it has been trained with and uses it to generate a response.
Many routine processes can be made more efficient with LLMs.

• Automatically generate product descriptions in a shop
• Automatically generate ALT text for images or subtitles for videos
• Optimize content for specific search engine keywords
• Have texts read aloud
• Translate content
• Write content
• Create images

Search engines will change

When you type a search query into Google, there still appears a list of websites. But at the very top, now an AI summary is displayed. For many queries, this snippet of text already answers all questions, which means that people are less likely to click on one of the links in the list below.
This has already led to complaints as traffic to many websites has declined. Since the first page of search results usually mostly consists of paid ads, this is naturally a somewhat delicate problem for Google.

It is unclear what impact AI summaries will have in general. In any case, search results have long since ceased to be selected based on relevance, despite Google’s claims to the contrary. A search query would have to be very niche for this principle to apply. I suspect that AI summaries will only bring about a gradual change in this regard.

It is certainly interesting for search engine optimization (SEO) that people are increasingly phrasing their search queries as questions. Two years ago, if you simply entered the keywords “turf, Munich” into the search box, today’s search query might be “Who can lay turf for me in Munich? Find me the contact details.” With a certain degree of probability, the website will then appear in the AI summary that has already pre-formulated this exact question in its content.

New WordPress-Team

Incidentally, a new team was formed within the WordPress project in June 2025 to deal with the topic of AI. Here is Rae Morey’s assessment in The Repository: The Repository: WordPress Has a New AI Team. Here’s What They’re Planning to Do.

The announcements are still quite vague and there is no roadmap yet, but I think the goal will be to tap into the potential of the open source WordPress system for AI. Open source systems have an open and easily accessible structure; they communicate with all conceivable external data sources via interfaces. For companies, this would mean, for example, that systems that handle customer data, marketing, and sales could actively work together. CRM, analytics, email, marketing, and websites would network with each other and carry out tasks and actions independently.

It doesn’t happen all by itself

A funny image effect can be created quickly, and ChatGPT generates some kind of text from every prompt. But the very quick results are not really useful in a business environment. If you want good results, you have to invest time.

A chatbot designed to answer questions about a product must be well implemented and trained. Otherwise, no one will enjoy using it. We all know how frustrating it is to interact with a disoriented chatbot.
Creating high-quality texts requires well-thought-out prompts and numerous rounds of revision to refine and elaborate on the results. Plus, you should thoroughly check all the facts at the end to make sure the texts don’t contain any nonsense.
When you have a layout built, you should define the requirements precisely beforehand. Otherwise, you’ll end up with a design that looks fancy but leads to a dead end after a few clicks.

AI tools can accomplish a great deal. However, the quality of the results is not always satisfactory. A text may not get to the point, an image may contain irritating errors, and a code snippet may generate a cascade of error messages and paralyze the entire system.
One does not need a great deal of prior knowledge to place an order. However, one needs all the more when it comes to checking and correcting the output of AI tools.

What AI cannot do

The AI model is at a loss when it cannot find anything in its data that matches the task. In the best case scenario, the system has access to a search engine and can query the internet. If this is not the case, though, the model simply continues to calculate and piece together puzzle pieces. This can result in texts that sound credible but have no connection to reality.

For example, the AI tool may recommend books that do not exist or cite sources that are completely made up. This is referred to as hallucination. The term is not actually appropriate: since AI systems have no reality, they cannot hallucinate.

AI models follow clear rules to deal with unimaginably large amounts of data. They calculate probabilities. Thinking creatively outside the box and breaking new ground is therefore not the strength of these systems. Critically evaluating things is not their forte either.

Nor can they provide answers to the “big” questions. What really interests my readers? How can I win new customers for my specific product? What would I have to do differently to increase my visitor numbers? What don’t my customers like about my website? The AI model has no answers to these questions other than general marketing tips.

Who needs AI for their website?

I can think of three scenarios in which I believe work processes will change:

• Websites that publish a lot of content (text and images) on fairly general topics at short intervals.
• Websites where a lot of text and images need to be optimized for SEO.
• Websites that serve as communication hubs and interact with other marketing tools (analytics, email, social media, CRM).

On extensive websites where the same processes are repeated over and over again and which thrive on publishing similar content in ever-new variations, AI tools can certainly save time. However, you shouldn’t have high expectations when it comes to text quality. And the topics shouldn’t be too specific.

Of course, you can also use AI assistants if you only write a text once every six months or need an image quickly. For me, however, that would fall more under the category of personal preference. AI does not necessarily make a text better, nor does it necessarily make it easier to write if you are not used to do it.

The situation is different for smaller websites with a personal profile that focus on a very specific topic. Websites that do not use large amounts of text and images and do not target a mass market can continue to thrive without AI. Of course, you can make your life easier and get AI support, but FOMO is not the order of the day.

So, Kirsten, how do you use AI tools?

AI tools are very good at summarizing texts. This can actually save time when preparing a text. However, I would not have my text written by AI. I feel constrained by a half-finished text; I find it difficult to break free from the path that has already been trodden. Personally, I find revising tedious and time-consuming.

I would never use ChatGPT & Co. as a search engine. AI tools are not suitable for researching facts. Due to the nature of the system, at least 35% of the results are incorrect (so-called “hallucinations”), and sources cannot be identified. I hope that this will change in the future, but I am rather skeptical. LLMs do not look at sources; they more or less blindly assemble texts according to probability rules. This makes it impossible to trace where the information comes from. It remains unclear who is serving me information and with what ulterior motives. This is a massive problem; chatbots consume clicks and sources.

The huge amounts of garbage and disinformation currently flooding the internet worry me. That, combined with the market power of a few corporations, makes me wonder how information diversity can survive in the future.

I find the current changes in coding exciting. Many processes that used to be very cumbersome are becoming more accessible thanks to AI tools. On the one hand, this is great because it removes many obstacles. On the other hand, it naturally leads to a flood of dubious results. As in other areas, it is becoming increasingly difficult to distinguish the useful from the useless. Only someone who is familiar with the subject can verify how good and useful a piece of code is.

How can you stand out from all the AI noise?

Texts and images generated by AI are currently flooding the internet. This content often comes across as shallow and lacking in substance. There is a term for this: “AI slop,” which refers, among other things, to the uniformity of articles whose titles begin with phrases such as “The ten best [search term].”
How can you set yourself apart from this?

• Communicate your expertise from your personal perspective.
• Critically evaluate information and provide your customers with guidance.
• Seek personal interaction, whether through forums, groups, comments, or face-to-face encounters.

If you want to grow a relationship between website owner and visitors, content with personality and genuine expertise is essential.

Be unpredictable, be creative.

The post Do I need AI for my website? has first been published on start the loop_.

The two names stand for different concepts; both are equally well suited for SMEs, but they approach the topic in very different ways.

What is Shopify?

Shopify is a ready-made shop system. You don’t need your own website, you don’t have to install anything, everything is already there. Shopify is a so-called SaaS platform (Software as a Service). You pay fees to use this service, and the provider also takes a share of each sale. In return, Shopify takes care of the technology.

What is WooCommerce?

WooCommerce is an extension, that is a plugin for WordPress. WooCommerce can be downloaded free of charge, just like WordPress. To use WooCommerce, you require your own website, which includes buying a hosting plan. You are responsible for maintaining this website yourself.

Which solution is the right one for you?

Capability

Both WooCommerce and Shopify can be customized and personalized very well. You can sell all kinds of products, both physical and digital.

Expenses

With WooCommerce, you can basically set up a shop for free, or rather for the moderate cost of a hosting plan. In Germany, however, you need an extension to make the shop legally compliant for sales in Germany. There are two options that do this: German Market and Germanized. Germanized is available in a free basic version.
Shopify offers a range of subscription models. There is no free plan for Shopify.

There are many third-party extensions available for both systems. In terms of sheer numbers, WooCommerce is ahead. There are also free plugins available for WooCommerce. This is not the case with Shopify.

In the long run, however, you won’t get very far with WooCommerce’s free options. Sooner or later, you’ll need to purchase a plugin license. For example, we required several such plugins for the Viereck Verlag shop.

Take multilingualism, for example: a shop is very complex. If you want to display your shop in different languages, you will find that only paid plugins offer the necessary functionality to reliably implement multilingualism throughout the system.

Example: shipping costs. Goods are potentially shipped all over the world. Therefore, a powerful plugin is needed to correctly calculate shipping costs for all regions.

There are also plugins that make your work much easier. One of the most important plugins for shop operators with lots of products is definitely Admin Columns PRO. With its help, you can display specific product features in the product list, sort by these features, and edit many products at once (bulk edit).

However, even with Shopify, you usually need third-party extensions, which must be paid for in addition to the monthly fee.

Usability

WooCommerce takes some getting used to. The system is complex and it takes a while to set everything up and find your way around.
Shopify’s interface is more intuitive. There are lots of templates, which makes it easier to get started. On the other hand, this means you have less control, as you are tied to predefined options.

That’s possible with Shopify.

If you want to get results quickly and don’t have the nerve to deal with issues such as updates and web hosting, Shopify is an interesting option.

With Shopify, however, you are tied to one provider. In addition to the monthly “rent”, money flows to Shopify with every transaction. Third-party extensions incur additional costs.

That’s possible with WooCommerce

WooCommerce is a good choice for anyone who wants to run their shop as independently and flexibly as possible.

WooCommerce is open source, meaning that the website and shop belong solely to the operator. All profits go into your own pocket. Depending on the payment options used, most or all of your profit stays with you. Costs are easy to control because WooCommerce allows you to proceed in small steps. There are also many free extensions available for WooCommerce.

However, getting to grips with WooCommerce takes time. Independence also entails responsibility: you have to take care of website maintenance yourself. This means you have to perform regular updates and ensure the security of the website yourself.
Some hosting providers offer special hosting packages for WooCommerce that help with this, or you can hire someone to take care of things.

Conclusion

In terms of performance, both systems are comparable. The differences lie mainly in the cost structure and the type of business model. Among other things, Shopify takes a share of every transaction, whereas WooCommerce does not. But Shopify takes care of many things that you have to keep an eye on yourself with WooCommerce.

Shopify is geared toward the American market. This means that it may not be possible to meet all requirements. For example, if you want to connect local payment service providers or parcel services. Or if you want to implement very specific shipping options. In this case, there is a relatively high chance that Shopify will not be able to help, but that some developer has written a plugin for special cases X and Y for WooCommerce.

WEBSITE MAINTENANCE

We take care of your website.

Daily backups, regular updates. Compromised plugins are updated within 48 hours, if possible.
After the update, we check that everything is working properly and fix any display errors.

from 39€/month plus VAT

Get in touch!

The post Comparison WooCommerce vs. Shopify has first been published on start the loop_.

For the e-learning platform violinlab.com, I built the overview pages for the courses using the editor.

Layout overview pages for the courses

Violinlab is an online course where you can learn to play the violin. The violinlab.com curriculum is divided into three levels of difficulty: beginner, intermediate and advanced. A student usually assigns herself to one of these three levels, which means that only one area is relevant to her.

That’s why it was important to me to design the layout in such a way that the three levels of play are easily discernible. The visitor should reach the place where she can continue as quickly as possible.

Click on the picture to see the full image.

Settings via the block

I created the layout with the LearnDash Course Grid block. In the editor, you can already see in the editing view how the whole element will look from the front.

IIn the sidebar of the LearnDash Course Grid block, I can filter the courses according to the categories Beginner, Intermediate and Advancing. There you will find many other setting options for colors, fonts, spacing, etc. This allows me to adapt the course elements very precisely to the look of the website.

Click on the picture to see the full image.

Alternative approach: Shortcodes

Before there were blocks, people worked with shortcodes. You can do the same things with them as with blocks. However, shortcodes are not very intuitive to use. The options such as colors, number of columns or sorting are hidden in a kind of code. You have to know the abbreviations to understand what is going on here. And you don’t see such a nice WYSIWYG preview in the editor as with the blocks.

[ld_course_list col="4" progress_bar="true" num="12" orderby="title" order="ASC"]

Example of a Shortcode

Shortcodes for additional views

But shortcodes also have an advantage: you can build your own relatively easily. For example, I was missing an alternative to the “tile display” of courses in LearnDash. This layout takes up a relatively large amount of space, which is not always practical on a platform with many courses.

Another aspect that can get annoying: If you want to know which lessons a course contains, you have to click on the course. Only then can you see the content. There is no way to display a course and the content/lessons it contains at the same time.

Display an overview in list view with individual shortcode

Suppose you want to have an additional overview in list form. This may look a little plain, but it can be helpful for orientation. It would be good if you could also display the course names, including the lessons they contain. This would allow learners to get a better idea more quickly.

I have built my own shortcodes for this via the add_shortcode method. The shortcodes can be used to create a page that first lists all courses and then displays the courses and lessons within the different areas.

Conclusion

The LearnDash blocks are very comfortable to work with. The blocks have many setting options that allow you to configure exactly what you want. Another big advantage is that you can already see what the design will look like on the front of the website in the editor view.

Shortcodes are no longer used today, the developers of LearnDash have converted everything into blocks. Unless you want to do something that is not offered by LearnDash as a block. Then the good old shortcode method becomes interesting again. Individual shortcodes can be built relatively easily, so that you can also create displays that are not provided by LearnDash.

The post Creating a Layout with LearnDash has first been published on start the loop_.

A cookie is a small file that enables a website to recognize visitors and save visitor settings. These can be language settings or the location, for example. Cookies are very useful if, for example, the browser remembers the products you have placed in a shopping cart.

In principle, all cookies that are necessary for the operation of the website are permitted. You cannot deactivate them. This applies, for instance, to the cookie mentioned above, which kindly ensures that your shopping cart remains up to date. This is a so-called “session cookie” and it is allowed to be there. What these cookies usually have in common is that the information is only used by your website. No information is passed on to third parties.

Cookies you need a cookie banner for

Particularly relevant for a cookie banner are cookies that transfer your data to third parties, e.g., Google or Facebook. As soon as you use an interactive element on your website, such as Google Maps, Google Analytics or YouTube, data is passed on. The same holds true for Facebook Like buttons and other social sharing buttons.

These days, many contact forms or booking tools unfortunately can no longer do without cookies. The flood of spam messages is often very high, forcing you to use a captcha. Plugin developers typically offer the simple integration of Google Captcha. This brings us back to the cookie banner.

In all these cases, visitors to your website must have the option of preventing these cookies from being set. In this case, the YouTube video or Google map will be marked accordingly and will not be displayed. As a visitor, you need to be able to change these settings or allow individual services.
Depending on the cookie banner plugin you use, configuring it can therefore be as complex as you like. However, that would then be an additional article.

Nevertheless, there are websites that get by without cookie banners: If you do not sell anything, do not use a contact form with captcha but only an email link, have not integrated Google Analytics, Google Maps, videos or social sharing buttons, you probably do not need a cookie banner.

Finding cookies on your website

If you are not sure whether there are cookies on your website, you can find out relatively easily. www.cookieserve.com

However, you can also use the browser tools to find out what is happening on your website. To do this, click on any element with the mouse and hold down the right mouse button. A context menu will appear. If you are on a laptop, or have a mouse with only one button, the context menu appears if you hold down the CTRL key while clicking with the mouse.

Depending on the browser, the option we need is called “Inspect” (Firefox), “Inspect” (Chrome) or “Inspect Element” (Safari).

After clicking, the browser console opens at the bottom of the page. In all three browsers, the information on cookies can be found in the “Storage” tab.

All cookies that appear on this website are listed here. Please note that with your own website, there can be two different scenarios, logged in and logged out.

start-the-loop.com only uses the technical cookies that WordPress needs to manage the website. These cookies are not relevant under data protection law. When you are not logged in, you find only the cookie that determines, which language you want to use, that is German (de) or English (en).

In other words: No cookie banner is required for our site here.

NOTE: You need to make sure to check for cookies on the different pages of your website. If there are pages where you display, e.g., videos from YouTube, you need to check these pages separately in order to make sure that you see all the cookies that are there. Read an in-depth article on checking your website for cookies here.

The post Do you need a Cookie Banner? has first been published on start the loop_.