WordPress Multisite Masterclass: Managing your Network

WordPress Multisite Masterclass: Managing your Network

If you’re used to managing a standalone WordPress site, you’ll find that there are a few differences when it comes to managing a network. And you’ll also need to manage any sites you personally own on your network, too – the base site, for example.

Welcome to the final tutorial in our six-part WordPress Multisite Masterclass. In this series so far, you’ve learned how to activate Multisite and create networks for user-created sites, how to host sites, and how to develop a community. But once you’ve done all this, you need to know how to manage and maintain your network to keep it humming.

In this tutorial, you’ll learn what you need to do to manage your network on an ongoing basis. You’ll learn:

  • The key differences between the Multisite network and standalone site management screens;
  • How to manage users and avoid spammy content and spammy blogs (or splogs);
  • How to keep your network up-to-date: WordPress itself, plus your themes and plugins. I’ll show you some best practice ways of doing this;
  • Methods for keeping your network backed up and (importantly) for restoring the whole network or an individual site on it if things go wrong;
  • How to enhance security on your network; and
  • Finally, how to make sure your network runs smoothly and efficiently.

Let’s start by looking at how the network management screens are different from the site management screens you’re used to.

Missed a tutorial in our WordPress Multisite Masterclass series? You can catch up on all six posts here:

That’s right, tons of WordPress knowledge, peer review, instructor feedback and certification, for free for WPMU DEV membersStart Learning

Network Management and Site Management: Key Differences

As the superadmin for a network (or network admin), you’ll have access to some additional screens on top of those you have as a site admin. You’ve already used a lot of these as you’ve worked through this series.

There’s a whole set of network admin screens, which you access by clicking on the My Sites link in the admin bar, then Network Admin, which takes you to the network admin dashboard:

WordPress Multisite network admin dashboard

The network admin screens consist of:

  • The Dashboard and updates screens.
  • The Sites section, including the Sites screen from which you can manage the sites on your network, and the Add New Site screen from which you can add a new site.
  • The Users section, including the Users screen where you can view and manage your existing users, and the Add New User screen where you can add a new user to your network.
  • The Themes section, including the Themes screen from which you can enable installed themes, the Add Themes screen where you install new themes, and the Editor screen from which you can edit code in the themes installed on your network. Don’t use the Editor screen, ever! Editing themes like this gives you no way of saving your changes and if you break a theme, your entire network could go down. If you need to edit a theme, always do it using a code editor.
  • The Plugins section, including the Plugins screen where you can update and network activate the plugins you have installed on your network, the Add Plugins screen which you use to install plugins, and the Editor screen where you can edit plugin code. Again, don’t use this screen!
  • The Settings section, including the Network Settings screen where you configure your network, the Network Setup screen where you can access the code that should be in your .htaccess and wp-config.php files, and any other settings screens for the plugins you’ve installed on your network.

If you’re a WPMU DEV member you’ll also have the WPMU DEV Dashboard, which you can use to install and manage our themes and plugins:

The WPMU DEV dashboard screen

If you’ve worked your way through the previous five parts of this series, you’ll have used many of these screens already:

  • In Part 1, Getting Started, you had an overview of the screens and the difference between these and the site admin screens.
  • In Part 2, Activation and Configuration, you used the Network Setup screen to get the code you needed to add to the wp-config.php and .htaccess files. Then you used the Users section and the Sites section to add new sites and users, and the Themes and Plugins sections to install and activate themes and plugins.
  • In Part 3, User and Site Registration, you used the Network Settings screen to configure user and site registration, and the Users section to view and edit new users.
  • In Part 4, Client Sites and Domain Mapping, you used the domain mapping settings screen which the domain mapping plugin added to your Settings section.
  • In Part 5, Creating a Community, you used some new screens which various plugins added to your Settings section, as well as the Plugins screens and the WPMU DEV Dashboard to install and network activate plugins for community management.

In this part of the series, we’ll be revisiting some of those screens and using some new ones added by plugins.

Managing Users and Avoiding Spam

The way users are stored in a Multisite installation is a bit different from a standalone site. Every user registered to any site in your network has one user record in the database and is a user on your network. But this doesn’t mean they have access to the whole network: WordPress will store metadata on each user to indicate which sites he or she has access to and at what level. So one person may have a site admin role on one site, an author role on another, and subscriber role on a few more. This person will just have one record in the wp-users database table, not a separate one for each site in the network.

This means that users can be added and managed by you as the network admin and also by your site admins. A site admin can add a brand new user to their site and to your network (if you’ve enabled this), and they can also add an existing user in the network to their site. If you don’t enable new user creation by site admins, they can just add existing network members to their site.

As network admin, you manage users via the Users screen in your network admin screens:

Multisite network admin - Users screen

Here you can edit user details and delete them, in the same way as you can for a standalone site.

In part three of this course, you learned how to set up user and site registration, allowing users to register on your network and create their own site. But what if people start creating spammy blogs (splogs) on your network? There are two ways to prevent this:

  • Change your settings to restrict site creation to existing users or to people with email addresses on specific domains.
  • Use an anti-splog plugin.

The first option is the simplest, which is to change your settings. To do this, go to Settings > Network Settings and go to the Registration Settings section:

Multisite registration settings

You have a few options for reducing splogs:

  • Change the Allow new registrations option to Logged in users may register new sites.
  • Use the Banned Names field to ban any names that sploggers are using to create new sites.
  • Use the Limited Email Registrations field to limit new site creation to people with email addresses on a list of domains you specify. This is useful if your network is for an organisation where everyone has similar email addresses but will be very limiting if your network is open to the public.
  • Use the Banned Email Domains field to ban email domains that sploggers have been using to create sites on your network.

But if you do want to give as many non-spammy users as possible the ability to create a site on your network, you won’t want to limit things like this. In which case, you can use the Anti-Splog plugin to get rid of sploggers.

Blocking Splogs with the Anti-Splog Plugin

The Anti-Splog plugin is more than your average plugin. It gives you access to a vast reservoir of data that learns about sploggers and where they’re coming from. Based on the data from other plugin users and from Edublogs, you’ll have access to a database of sploggers that means the plugin can use this to block those people you don’t want creating a site on your network. A bit like Akismet for networks.

Let’s get it set up on our network. First, install and network activate it using the WPMU DEV Dashboard. The plugin will create a new section in your network admin menu called Anti-Splog.

To configure the plugin and make it work, go to Anti-Splog > Settings:

Anti-splog plugin - setting screen

You’ll see an alert telling you that you need to enter your API key before the plugin can work. To get this, go click on the Get your API key and register your server here link in the API Settings screen. This takes you to the Anti-Splog API screen in your WPMU DEV profile:

The WPMU DEV Anti-splog API screen

Scroll down to the Register a Site section. The domain for your network should be auto-populated in the Multisite Domain field. Check that it’s correct and if it isn’t, change it to the correct domain for your network. Then click the Add Site button.

The site will be added to the list of your registered sites. Now copy the API key and go back to your site. Open the Anti-Splog settings screen again if it isn’t already open, and paste the key  into the API Key field. Then click the Check key button to check it. If everything is working ok, the key will be saved and the field will turn green. If it doesn’t work, go back to the Anti-Splog API screen and check that you’ve entered your domain correctly.

Note: If you’ve got Multisite installed in a  subdirectory of your root domain, use the root domain to register your site, not the full domain.

The next thing you need to do before you can start using the plugin is to move the blog-suspended.php file from the plugin to your wp-content directory. To do this, you’ll need FTP access to your server.

Open your FTP client (which could be your code editor or could be a standalone FTP client like FileZilla), and go to wp-content/plugins/anti-splog. Find the blog-suspended.php file. If there isn’t one, go the /includes folder and find the file called blog-suspended-template.php. Make a copy of that and call it blog-suspended.php.

Move the file to your wp-content directory.

Go back to your site and revisit the Anti-Splog settings screen, or refresh it if it’s already open. The warning message telling you to move the file will have disappeared:

Anti-splog settings screen with plugin correctly set up

If the alert message is still there, check that you’ve moved the file to the right place and named it correctly if you made a copy of the template file.

Now you can configure the plugin. The Anti-Splog plugin has plenty of configuration options. although if you’re starting out with it, it’s best to start with the default settings and then tweak them over time if you need to. You can find out more about the settings on the Usage tab of the plugin’s page at WPMU DEV:

Anti-splog plugin - usage information

Keeping Your Network Updated

An important part of managing a Multisite network is keeping the code up to date. This will ensure that you’re running the latest, most secure versions of your code and that any bug fixes or code improvements are in place.

But you need to test any updates on a copy of your network before updating your live site. If an update causes any problems it could affect all of your users’ sites and they won’t be very happy, to you need to check things first.

Tips for Keeping your Network Updated

To keep your network up to date without running into any problems, follow these tips:

  • Create a local copy of your network on your machine, using MAMP. The process for doing this is just the same as for a standalone site, and you can learn how to do it in detail in our guide. Use this to test updates.
  • Alternatively, a better approach is to create a staging version of your network on your server. The advantage of this is that the environment is the same, so any issues that are server-related will be picked up in your testing. Consult your hosting provider for advice on setting up a staging site.
  • Keep your network backed up, so that if you do experience any problems with updates you can quickly roll back to your pre-update network. More on this in the next section.
  • Use the Multisite Enhancements plugin to see which sites on your network are using which themes and plugins. Then you know which sites you need to test when updating a theme or plugin.
The Plugins screen with Multisite enhancements switched on

Updating WordPress itself, a theme or a plugin is something that only the network admin can do. Site admins can’t do this, and won’t see any update notifications in their admin screens. Let’s take a quick look at how you update a plugin, by way of example.

Updating a Plugin

When a plugin you’ve installed on your network needs to be updated, you’ll see a little red circle against the Updates and Plugins items in the admin menu. When you go to Dashboard > Updates, you’ll see all plugins with available updates listed:

Plugin update screen

To update the plugin, select it then click the Update Plugins button. WordPress will update the plugin for you and let you know when it’s done:

The plugin updated notification

Note: You can also update plugins from the Plugins screen, where you can update each plugin one at a time using the link below its name. The same goes for themes.

Once you’ve done this on your staging version of the network and tested it, you can then do the same on your live network.

Keeping Your Network Backed Up

It is very important that you keep your network, and every site on it, backed up on a regular basis. The frequency with which backups are performed will depend on how regularly your users are updating their sites.

Considerations for Backing Up

There are two main aspects to keeping your network backed up:

  • Backing up the individual sites in your network.
  • Backing up the network as a whole.

It’s a good idea to do both of these. That way if one site experiences problems you can restore just that one, but if the whole network has a problem, or most of the sites on it do, you can use the backup of the entire network to restore everything.

For both sites and the entire network, you also need to consider what exactly you’re backing up:

  • Plugin and theme files: you won’t need to back these up as frequently as other items as they’re not changed as frequently.
  • Uploads: you’ll need to back these files up more frequently, as your users could be adding new ones every time they add new content.
  • The database – you’ll also need to keep this backed up regularly, as you don’t want to lose any new content added by your users.

So you might decide to back up your database and uploads every day and your theme and plugin files every week, for example. Or if your users are creating new content frequently during the day, you might need a more regular backup.

Another consideration is where you want to keep your backed up files and database. The popular backup plugins tend to give you a few options:

  • Storing backups on your server: doing this alone isn’t such a good idea as if your server has problems, you may not be able to access your backups. Many plugins will let you store backups both on your server and elsewhere.
  • Using a third party storage service such as Dropbox or Google Drive: this is a good idea if you’ve already got an account with one of these, and can be a good reason to set one up.
  • Emailing backups to you: some free plugins have this as the only option. It can clog up your inbox and isn’t as reliable as using a third party storage solution.

Whatever you choose to do, you’ll need to use a plugin that makes things as easy as possible for you so that once you’ve set it up, you don’t need to worry about it. I would always recommend using a premium plugin such as our Snapshot Pro, as that makes restoring much easier than if you use a free plugin. Being able to restore the sites on your network quickly and easily is crucial, as it reduces downtime.

Using Snapshot Pro to Back Up Individual Sites on Your Network

You can use Snapshot Pro to create snapshots of each of the sites in your network. You’ll have to do this each time you add a new site to the network, so it’s best suited to networks of your own sites or your clients’, or smaller networks of user-created sites. If you’ve got lots of users creating their own sites, you’ll need to use an alternative plugin to keep the whole network backed up, which is a good thing to do anyway. More on that shortly.

First, install the Snapshot Pro plugin via the WPMU DEV dashboard and network activate it. Before you can create any snapshots for your sites, you need to add the destinations where your snapshots will be sent. Go to Snapshots > Destinations to see the options:

The Snapshot Destinations screen

For the destination you want to use, click the Add New button and follow the instructions. You’ll need to give the plugin access to your account if you’re using a third party service like Dropbox.

Once you’ve done that you can set up your snapshots. Go to Snapshots > Add New in your network admin screens to create a snapshot of a site.

Start by defining which site you’re creating a snapshot of and adding any notes:

Adding a Snapshot - getting started

Next, select which files you’ll back up. You might want to create two snapshots for each site, one with all of the files and one just with uploads. Or you might just create one snapshot:

Creating a snapshot - picking files to back up

If you select Include common files it will just include uploads in the backup. If you select Include selected files you’ll then be expected to select which ones you want to include in this backup. In the screenshot above I’ve chosen to create a full backup of everything.

Next, select which database tables you’ll backup and how often:

Creating a snapshot - selecting database tables

You can specify individual database tables or select all of the tables for this site, which is what I’ve done.

You can specify any frequency for the automated backups: above I’ve set up a daily backup. You then need to set how many copies of the backup (i.e. how many snapshots) will be kept on the server. If you leave this as O, it will keep them all, which will take up a lot of space. I’ve changed it to 7, to keep backups for a week. If you’re running client sites you’ll probably want to keep a month’s worth.

Finally, specify which destination you want to save the backup to:

Creating a snapshot - selecting a destination

If you select a remote destination, the plugin will also save your snapshots locally. If you’re using a third-party service you can specify a directory in which you’ll store this particular snapshot. I find this useful as on each of my networks I have multiple snapshots set up for multiple sites, and I don’t want them all in one folder. So I create a folder with the name of that site in the Directory (optional) field. You can use the same directory for multiple snapshots, so if you’re creating more than one snapshot for each site in your network (e.g. one for the database and uploads and a less frequent one for everything else) you can save them in the same place.

Finally, click Create Snapshot to finish. The details of the snapshot will now be listed in your main Snapshots screen:

Snapshot plugin - list of snapshots

From this screen, you can edit your snapshots, change their frequency, and use them to perform a restore with just one click.

Keeping Your Entire Network Backed Up

Using Snapshot Pro is great as it gives you easy one-click restores and also means that if just one site in your network has problems, you can restore a backup without affecting any of the other sites in your network. But what if your whole network has a problem and you need to restore the whole thing?

There are lots of plugins that will back up your entire WordPress installation for you, and with Multisite they back up the whole network. Some of the premium plugins will do this for you, but if you’re already using Snapshot Pro for your individual sites, you’ll probably want to use a free one for this task.

I’d recommend installing and activating a plugin from our list of great free backup plugins and using that to set up an automated backup of your entire network on a regular basis. I use the BackWPup plugin which sends a backup of my database and files to dropbox for me on a regular basis. The only downside is that the free version doesn’t have a one-click restore feature, meaning that if I want to restore my network, I have to do it manually from the database and files. If you’re not comfortable doing this, you might prefer to use a premium plugin that isn’t Multisite compatible (which means it will back the whole WordPress installation up, not individual sites on your network).

Enhancing Your Network’s Security

Your users and clients are relying on your network for their precious website, so you need to ensure the sites can’t be compromised. To do this, you’ll need to use a security plugin, like our Defender. Let’s take a look at how you set that up.

Firstly, install Defender using the WPMU DEV dashboard and network activate it. Then go to Defender > Dashboard to start setting it up:

the Defender plugin dashboard screen

Hardening Your Network

Hardening your network is about making it tougher for people to gain unauthorized access. You can do this via the dashboard screen or via Defender > Hardener.

Work through the items it tells you to, following the instructions to make your site more secure. This will include things like:

  • Changing the database prefix: makes your database structure a bit more obscure.
  • Disabling the file editor: this shuts down those Editor screens for plugins and themes, a good thing to get rid of!
  • Disabling trackbacks and pingbacks: whether you want to do this will depend on how social you and your users want to be. It prevents people from pinging your network repeatedly, which could cause it to fail.
  • Preventing information disclosure: this puts .htaccess files in relevant directories to prevent attackers from accessing their contents.
  • Preventing PHP execution: this prevents attackers from using any vulnerabilities in themes or plugins to upload PHP files to your site and run malicious code – a good one to fix.
  • Updating security keys: it’s a good idea to update these every so often to prevent them from being accessed and used. If you do this, it will log you out of your site (and all your users), so I’d recommend doing it late at night.
  • Blacklist monitoring: checks you’re not being blacklisted by Google.

Now when I go to Defender > Hardener, it tells me that everything’s in place:

Defender plugin - Hardener screen

Scanning Your Site for Problems

With Defender, you can do a manual scan and also set up regular, automated scans to check everything’s ok on your site. Let’s start by doing a manual scan.

Go to Defender > Scan and click the Scan my Website button. Defender will start a scan of your network. Be patient, this could take a while, especially if there are lots of sites on your network.

You can also set up a regular automated scan by going to Defender > Dashboard and scrolling down to the Setup Automated Scans metabox. Click the Enable button to set it up:

Defender - setting up automated scans

Enhancing Network Performance

Your users will want their sites to run as efficiently as possible and you’ll want the network to tick along smoothly. To enhance performance, you can use the Hummingbird plugin.

Start by installing the plugin via the WPMU DEV dashboard and network activating it. Then go to Hummingbird > Dashboard to see the results of Hummingbird’s test of your network:

The Hummingbird dashboard screen

If you scroll down, Hummingbird will show its recommendations for enhancing performance. What it tells you will depend on how your site is set up, but here’s mine:

Hummingbird performance recommendations

Now work through the dashboard setting up enhancements. Options include:

  • Caching: this can speed up page load times.
  • Uptime monitoring: Hummingbird can check for downtime and notify you when the site isn’t up and running.
  • Compression: this makes your files smaller which can speed things up.
  • Removing render-blocking resources: this moves resources such as JavaScript and CSS to the right place in your site’s pages.
  • Image optimization: install the WP Smush Pro plugin which will optimize images as you upload them. Install it, network activate it, and leave it to do the work for you.

Once you’ve followed all the tips, do another test by clicking the button on the dashboard. My score has improved from 70% to 86%:

Hummingbird dashboard showing an improved score

If you want to tweak things further and get as close to 100% as possible, Hummingbird provides you with more advice you can follow. Go to Hummingbird > Performance Report and click the Improve Score buttons for more information:

Hummingbird - improving individual performance scores

Managing Your Network Effectively Will Help It Run Smoothly

Running a successful Multisite network isn’t just about activating Multisite and waiting for the sites to start appearing. You’ll also need to keep an eye on your network to avoid any problems, keep things up to date, and enhance performance.

If you follow the steps in this part of the course that will help your network to run as smoothly as possible.

Now you’ve completed this course you’re ready to get the most from WordPress Multisite. You’ve learned the following:

  • What Multisite is and how it differs from a standalone site.
  • How to activate and configure Multisite.
  • How to add sites and users to your network as the network admin.
  • How to enable site creation by users and enhance the user experience for this process.
  • How to use Multisite to host client sites (or your own sites) and use domain mapping to enable multiple domains.
  • How to create a community of users on your network.
  • How to manage your network, including keeping it backed up and up to date, avoiding sploggers, and maximizing security and performance.

If you need additional advice and resources, don’t forget to check out our blog. We’re experts in Multisite and regularly add new posts packed with advice and tips to help you get the most out of Multisite.

Missed a tutorial in our Multisite masterclass series? You can catch up on all six posts here:

Did you find this tutorial helpful? Why do you want to learn about WordPress Multisite? What do you want to know more about? Let us know in the comments below.