My first post of December has been longer than expected in the making. What was supposed to be a quick post at the beginning of the month, quickly dragged to a few days due to unforeseen server issues with my ISP, as well has having connectivity issues with Comcast.

My Internet came screeching to a halt on Friday and so I decided that while I waited for Comcast to fix the modem issues, I’d do a complete overhaul on my home LAN, getting it up to par with 21st Century technology.

Long story short…I’m back up and can finally get back to posting. So here ya are: A complete icon pack for Prosper202, drag and drop import and you’re done!

Download the included zip from the Winzip icon above and watch the video below if you wanna see me walk you through it how to set it all up.

httpv://www.youtube.com/watch?v=4sDGBQ7LdEY

Favicons for the following traffic sources have been added in this icon pack:

1) Aweber
2) Blogger
3) Craigslist
4) Delicious
5) Digg
6) Ebay
7) Ezine Articles
Feed Burner
9) Flickr
10) GetResponse
11) Google Adsense (content network)
12) Myspace
13) RSS (for links in feeds)
14) StumbleUpon
15) Technorati
16) Torrents (for various bit torrent providers)
17) Twitter
18) Wordpress (for links within Wordpress blog, or hosted)
19) Yahoo Answers
20) YouTube

None Found

Without getting into too many of the technical details, last week a security vulnerability in the Zend files (encryption engine) in Prosper202 was exploited. Basically through scouring the search engines for Proser202 footprints, a malicious user was able to find vulnerable installations of Prosper202 and steal sensitive campaign information from a few unlucky targets. Hopefully you weren’t one of them.

Luckily, Wes Mahler and team were fast on the defense and quickly released an update that fixed the vulnerability, as well as ceased using the Zend encryption engine. With release 1.1.2, Prosper202 has officially become open-source, which opens a world of exciting new possibilities (think how Wordpress has exploded).

I am for one excited to see what the affiliate community with come up with. Also, in all likeliness, an open-source version should officially put an end to the paranoia of Wes and his team stealing your keyword data. I know Wes and Steven personally. They’re honest guys. They aren’t stealing your data, and never were. But you can now look through the source code yourself if you’re still an unbeliever.

Moving on to the point of this post, here a just a few of the best practices that I came up with for securing your Prosper202 installation, and hopefully preventing your domain from ever being found by yet another malicious affiliate. (We should be helping each other, not hurting each other)

1) Changing Your Prosper202 Passwords: This may seem obvious, but you’d be surprised at how many people DON’T change their passwords on a regular basis. Treat the information in your Prosper202 installation as you would your bank account, because essentially it’s just as important. (if you’re making money).

• Change the default username/password to something more secure
• Set a reminder in your email program to change this password every 30-60 days
• Also change the MySQL database password on the same schedule. Once you do, remember to also update your “202-config.php” file accordingly.
• To assist with generating secure passwords, you can use: StrongPasswordGenerator.com

2) Don’t Use Obvious Names For Your Install: Since Propser202 requires a dedicated domain or subdomain, but sure to choose something that isn’t obvious to its purpose. For example, don’t use a domain name called “ppctracking.com”, or a subdomain called “prosper202.domain.com or p202.domain.com”. These are huge dead giveaway footprints to your Prosper202 installation, that can easily be found with a few advanced search operators.

3) Always Run The Most Current Version of Prosper202: You should currently be running Prosper202 version 1.1.2, to ensure you’re not vulnerable to the security exploit. If not, do it! Perhaps in the future auto-upgrades (similar to Wordpress) will be made available, but in the meantime, manually stay updated with the lastest build.

Download Prosper202: http://prosper202.com/apps/download/

4) Lock Down Your Prosper202 Domain To Your Own IP: There are a few ways to do this lockdown.

• Either use .htaccess to lock the installation down to your own IP address, which is probably the more secure solution (server-side). This mod is simply blocking access to the login page “202-login.php”. If you locked the entire domain to your IP, then obviously none of your redirects would work for your traffic.

Add additional IP’s if you login from more than one IP address. Here’s the code you’d need to add to your .htaccess file and upload to the root directory of your Prosper installation.

#202 Block
<Files 202-login.php>
order deny,allow
deny from all
allow from 0.0.0.0
ErrorDocument 403 http://somemaliciouswebsite.com/
</Files>

• Or add the following to the top of your “202-login.php” file:

if($_SERVER['REMOTE_ADDR'] != 0.0.0.0 || $_SERVER['REMOTE_ADDR'] != 0.0.0.0) { header( ‘Location: http://somemaliciouswebsite.com’ ); }

In both examples, replace the “0.0.0.0″ with your own IP address(es). And for a bit of well deserved punishment for those daring enough to snoop around trying to access your Prosper202 install…simply replace “http://somemaliciouswebsite.com” with a website of your choice, preferably something containing adult material, viruses, or other malicious content. I’ll let you use your imagination on this one.

Personally, I’ve set mine to a page that logs their IP address, presents the FBI warning, then redirects the perp to the FBI’s website for “further analysis”. (10 years working in computer security for the US Government can’t go to waste, bwahahaha!!!)

5) Preventing / Removing Existing Indexed Pages: You might be one of those unlucky enough to not have protected your Prosper domain from getting indexed from the day you registered it. To find out if you’re site is currently being indexed by Google, check here: Google Webmaster Site Status Tool. If Google reports your site in their index, you can request an entire site removal by:

• Logging into Google Webmaster Tools
• At the dashboard, click the site you want to remove. If you’re site isn’t listed, add it so you can remove it. (You will have to verify that you are the site owner before you can make modifications in Webmaster tools)
• Then click on Tools, Remove URL –> Submit a New URL Removal Request, and be sure to select the option that says “your entire site”.
• Other search engines should have similar tools.

Another method of preventing and removing your site from search engine indexes is to create a robots.txt file.  You can block your entire site from being indexed (no reason to have your Prosper202 domain indexed anyway) by creating a text file called “robots.txt”, and adding the lines below, and uploading to the root directory of your Prosper202 installation:

# Disallow Web Bots
User-agent: *
Disallow: /

# Disallow Archive Bots
User-agent: ia_archiver
Disallow: /

I believe that Prospe202 comes with a robots.txt file by default that prohibits the indexing of your domain, but unfortuntely some search engines will totally ignore robots.txt and index your site anyway. Another line of defense is using meta tags. Do the following:

• Edit the file “template.php”, which can be found in: yourdomain.com/202-config/
• Add the following code snippet in the <head> section of the file (near the existing meta tags):   <meta name=”robots” content=”noindex, nofollow” />

If you’re site is currently indexed, you’ll have to wait for the search engine bots to revisit your site, from which they’ll see your robots.txt and meta tags, and should remove you from their index. If you’re not seeing your site deindexed after a couple of days, you may need to contact the support team directly.

6) Install Prosper202 on an SSL (https) Secured Server: Some search engines won’t index https sites. Google does. MSN says they won’t, but I’ve seen otherwise.

But in addition to the indexing issue, having your key campaign data protected by SSL encryption would be ideal. An SSL install of Prosper202 would not only protect your login and campaign information from plain-text exploits; you would also have the sneaky advantage of totally blanking your referrer.

This is huge for affiliates worried about their CPA network stealing their hard earned money by cloning their campaigns. Prosper202 currently can cloak the referrer via redirects, but it doesn’t blank it so that your network sees “nothing” from the referring domain.

I’ve been experimenting with the HTTPS install, and once I’m 100% sure that it works, I’ll post a tutorial on how to do it (not for the technically challenged).

7) Redirect Your Landing Pages To Clean URLS: In Step 7 of your campaign setup (#7 Get Links), you would normally generate your ad (or keyword) destination URL. The problem with this though is that the variables in the URL (t202id, t202kw), etc…can give a lot away about your campaign structure.

This is especially true if you also use a tool such as Speed PPC in conjunction with Prosper202, which can add even more tokens to the URL (seed, adgroup, keywordtype, etc).

For example, take a URL such as:

“http://www.yourdomain.com/landingpage.php?t202id=1234&t202kw={keyword}&seed=seedkeyword&adgroup=adgroupname&match=broad”

If I saw this URL in the address bar of a landing page, I immediately know:

• You’re using Prosper202 to track your conversions = potential profitable affiliate
• You’re passing the bidded keyword in the URL {keyword}, which obviously reveals the actual terms you are bidding on.
• Tokens like “seed or adgroup” reveal that you are probably using Speed PPC, shows the campaign structure, and the matchtype (broad) being triggered for the search.

This is simply much more campaign information than I want to reveal to my competitors. So using a few tricks, we can still capture the key tracking information, and then redirect the user to a clean URL like: “http://yourdomain.com/cleanpage.php”

(I gotta give props to Wes Mahler for helping me get this working)
Do the following to maintain your tracking, but redirect your destination URLS to clean (token free) URLs that spy affiliates can’t openly see:

• Create a new file that will act as the redirect landing page. I suggest you name this file something like “lp1.php or landing.php” as to not alert its purposed (ie: don’t call it redirect.php)

• In your new redirect landing page (we’ll use lp1.php), add the following:<html>
  <head></head>
  <body>
  <script>code from step#6 Get LP Code goes here</script><!– js script is called, the visitor is recorded, then redirected to the clean URL –!>
  <script type=”text/javascript”> window.location=’http://yourdomain.com/cleanpage.php’;</script>
  </body>
  </html>

• In place of “cleanpage.php”, this will be the true destination where you want your visitors to ultimately end up. If it’s a directory, simply specify the directory path in the script above and add “index.php”.

Be sure to modify the Landing Page URL in Step#4 (Landing Page Setup) to reflect the path to your “lp1.php” file. For example, instead of setting the landing page URL to your former destination: http://yourdomain.com/destination.php, you’ll instead set it to: http://yourdomain.com/lp1.php

8)  Monitor Your Log Files For Login Failures / Suspicious Access: With your webhosts control panel, you should be able to get access to your raw log files. Unless you’re using third-world web hosting, you should be able to see your log file data in some fancy statistical interface. Ask your web host if you are unsure about how to locate your log files. You might also be able to schedule a job to email you the logs files on a regular basis.

Also, Prosper202 will show you the last 20 login attempts by simply clicking the “Administration” link in the top header.

9) More .htaccess Fun: A few more .htaccess mods to tighten things up, and to have a little fun with your intruders.

Disable showing the contents of directories that don’t contain an index.php file:

# Disable directory browsing
Options All -Indexes

Set error 403/404 pages to some site of your choosing. By resolving a page not found to a website you specify…you can have a bit of fun with where you choose to send your snooping intruder.

ErrorDocument 403 http://somemaliciouswebsite.com/
ErrorDocument 404 http://somemaliciouswebsite.com/

10) Implement a “Honeypot” Install of Prosper202: A honeypot in computer terms is somewhat of a trap or counteractive measure of defense. Logging a dummy admin account on an XP machine with the password of “password” could be considered a honeypot.

This step of course is only for those who have the time, knowledge, and resources to implement such extreme measures of protecting the Prosper202 community. But if we teamed up, we could certainly catch more than a few of the guys in the act, and call them out.

Basically, you would install Prosper202 on a “dummy” domain, with none of the best practices that I just mentioned in place. Set up a few fake campaigns that get indexed to throw the perp on a nice goose chase to make him think he’s hit pay dirt. Of course you’ll need to be logging all the activity secretly as to catch him in the act.

So after about 2 days of writing this post (and testing), there are about 10 best practices for securing Prospe202 that I was able to come up with. Again, this list certainly isn’t exhaustive, so be sure to comment in and let me know of any other findings and/or corrections you may have.

More Prosp202 tutorials to come!

None Found

1) The adgroup structure for a successful content campaign is very different from search.
2) Keyword matching options in the content network are not used (phrase, exact match have no relevance)
3) Content ads are driven by themes vs search ads that are driven by keyword queries.
4) Keyword insertion (dynamic or static) has no relevance in content ads.
5) Your target audience on the content network is much different (and
much wider) than on search, so therefore a new psychology of ad
writing must be used.

The answer: Separate Content Network Campaigns. Even Google suggests this as the best way to run a successful content campaign: Content Network Optimization Tips.

Ok, so now that we have that out of the way? How else can we optimize our content only campaigns? Well, like search, we must track our performance. This can be done using Google’s performance reports, as well as with a third party tool like Tracking202. (Video Tutorial Coming Soon)

Keep in mind that when tracking performance on the content network, you’ll be tracking adgroups, not keywords. This is a fundamental difference that must not be overlooked. Also, as Google says…you want to focus on conversions, not CTR. A click-thru rate of 0.05% on the content network may seem embarrassingly low compared to search, but performance should be judged based on your conversions and ROI.

Also, once you’ve run a campaign and gathered some data, consider running separate placement targeted campaigns for the sites that are converting for you. You can then custom tailor your bidding and ad writing strategies for these specific sites. A tool I like to use for finding and targeting specific sites in the content network is “Site Sniper Pro” (Free Demo)

You’re tracking reports will also show the sites that have either received lots of clicks or lots of impressions, but without conversions. A word of advice from the start: Turn off social networks, unless that is your target audience. You can now do this from a global setting within your adwords account, or you can manually add the sites as negatives sites in Adwords or with the Adwords Editor.

To turn off social networks, within your Adwords account, click: Campaign Summary > Campaign Name > Site and Category Exclusion. Click Page Types, Select Social Networks.

At a minimum, I hightly suggest you turn off: Myspace.com, Friendster.com, YouTube.com. These are some of the highest traffic sites on the internet with a very click happy demographic. Not excluding these sites can deplete your daily budget in almost no time, especially if you’re bidding on a CPM basis. You can find more sites that you should exclude from your performance reports and add them as you find them.

In another post, I’ll go into how to structure your content campaigns, and even how to gather an initial list of themes to target. Once I have a my campaign created, I like to cast a wide net, then reel em’ in. Meaning, I run the campaign for the entire content network (with a few exclusions). Then once I’ve found what domains, pages, ad copy is working, I can create a placement targeted campaign and go in for the kill.

Way of the Warrior: Tip of the Day: Run your content & search campaigns separately, then gather performance data from Google by creating a weekly scheduled Placement Performance Report for your content only campaigns. Remember, data gathered for the content network may take longer to show than a search campaign.

• Content Network Domination With ImageAds

Tracking202 - A hosted, but free keyword conversion tracking software.

Prosper202 – The same as Tracking202, yet self-hosted (if you hosted tools aren’t your thing)

Export202 – A cool online utility to quickly convert PPC campaigns from one search engine to another.

WorldProxy202 – A proxy tool designed for marketers who want to promote international campaigns. WorldProxy202 makes it possible to see campaigns that your affiliate network might normally block from your country.

I’ve mentioned some of these tools a few times in other posts. Being that this entire suite of tools is free, as well as the support, I thought I’d help alleviate some of the questions the Tracking202 team gets and starts some posts with 202 tutorials.

For example, people new to 202 tools seem to ask the same questions again and again (without reading the forum), so I may do some in depth walkthroughs documenting some common questions, or perhaps some of the more technical challenges people may face.

The 202 tools can be used in many different ways, and made to work with a number of different third party software tools. So in time I hope to cover as many tutorials as I can. I’ll probably do written posts for the simpler explanations, but anything that might be heavily in depth, may call for a Camtasia video.

Without going into each tool too much at this point, use the links above to start checking out these tools yourself. If you’re already a 202 user and looking for some new trick or method, have a look at a recent Wordpress tutorial by Nickycakes: “Tracking Wordpress Landing Pages With Prosper202”

Stay tuned for the tutorials, I promise they’ll be good. In the mean time, if you have any questions about anything 202 related that you can’t find it their forum, you’re welcome to ask me and I’ll find out for you.

None Found