But first a word about plugin security. Unfortunately, Wordpress plugins have a bit of a reputation for being insecure, due largely though not exclusively to the lack of proper sanitation of user input. Neglecting to check whether a user has entered malicious code into an input field into a form, for example, or tacked it onto the end of a query string can leave your server vulnerable to SQL injection and similar attacks. With that in mind, it’s prudent to check around for any security issues with a plugin before you install. If you have the PHP skills, you perhaps check the plugin yourself for any code that might leave your system open to being compromised.

But that aside, there are many secure and well-tested Wordpress plugins, as well as many (perhaps most?) that do not introduce any user-interaction features beyond the Wordpress core and thus aren’t even really candidates for opening up additional security holes. The following is a list of just a few.

Forms

Whether you need a contact form, a form that allows prospective clients to get a quick sample quote, or even rudimentary e-commerce functionality, chances are your site is going to need a form somewhere along the line. Wordpress has a series of form plugins that all provide basically the same functionality, providing a simple GUI allowing you to create form inputs, buttons, and some amount of validation logic without having to know any HTML or server-side programming language.

The two that I have some experience with (FormBuilder and CFormsII) both do what is mentioned above, but the similarities pretty much end there. In my experience, CFormsII not only provides much more functionality, but also generates nice, clean HTML and has a helpful set of default CSS templates that can help layout your form pretty nicely without too much (or any at all) tweaking.

Sitemap

A sitemap is somewhat of an information architecture best practice. It can be a helpful last resort if primary navigation and search aren’t working for a user, or can even be a first resort for power users if they know how to use the sitemap to bypass several clicks through a deep navigation hierarchy.

I’m using Dagon Design’s sitemap generator for a site I’m currently working on and, while it doesn’t have a lot of functionality nor does it provide particularly fine-grained control over the output, it gets the job done (which is more than I can say for all the Joomla! 1.5 sitemap plugins I’ve tried, though my last effort at that was about 4 months ago).

Page Order

No doubt about it, if you’re running a CMS you’re going to need to have control over the order in which your pages appear in lists and menus. Wordpress has a built in system for doing this, but it’s a very recent addition and is pretty unwieldy (though I’m sure they’ll be improving it in the near future). The My Page Order plugin provides a simple way of getting the control you need.

Incidentally, plugins aren’t the only way you can easily get more control over how pages are listed (or other core functionality). One way (hackish but it works) is to take the Wordpress function you want to tweak, copy+paste the file into your template’s functions.php file, change the function name (e.g. if your theme is called greattheme you could change the wp_list_pages() function to gt_wp_list_pages()) and make whatever little alterations you need.

For example, in a site I’m working on, the standard wp_list_pages() along with some key/value pairs (wp_list_pages(array('title_li' => '', 'meta_key'=>'page-type', 'meta_value'=>'global-nav'))) was working for me, except I wanted to put a link to the homepage at the beginning of the list.

The easiest way for me to do this, without hard-coding the list into the template (and thereby losing Wordpress’s handy way of adding classes to the currently active page and its parent/ancestors) was to copy wp_list_pages() into my functions.php and insert the following line:

$output .= '<li class="page_item"><a href="'.get_option('home').'">Home</a></li>';

Semantic Web

There is a small but growing offering of Wordpress plugins that can add some Semantic Web goodness to your site. One of these is the Dublin Core plugin, which offers a no-nonsense implementation of a subset of the Dublin Core Metadata Terms for your Wordpress site.

While Wordpress is certainly not your best choice if you’re looking to create a complex site powered by a set of linking rules that relate pieces of content to each other via metadata, I think implementing the Dublin Core is a good idea even if you don’t find some clever way to directly take advantage of it: even small steps like this take us further towards the semantic web (or Semantic Web, if you like).

That’s it

That’s it for now. There probably won’t be another post in this mini-series, but I’m thinking of doing another comparing Wordpress, Joomla! and Drupal and discussing the situations in which they would be appropriate CMS choices. That probably won’t happen for a while, though.