WHAT'S IN THIS CHAPTER?
Is Joomla right for this client?
Planning maintenance before building the web site
Choosing the right extensions
Now that you've had a good conversation with your client about who they are, what they do, and what a web site can do for them, it's time to start thinking about the right technologies to build their web site.
Sometimes, Joomla isn't the right answer to their particular business problem. If Joomla is right for your client, maybe it's time to start thinking about extensions to make the site function the way you envision. You'll also want to consider maintaining the web site. Maintenance is the process of keeping a web site up-to-date with the latest content and the latest upgrades. Is your client going to help with content updates going forward? Are you going to take care of any security upgrades?
This chapter shows you how to move the business strategy to technological specifications. This includes making sure Joomla is right for your client, planning maintenance before you start building, and choosing the right extensions for this web site.
Your #1 consulting answer, which is almost always right in the world of web development is, "It depends."
Joomla is great software for building both small and large web sites. Editing for clients is easy. Plenty of functionalities are built into the core system, and you can download thousands of extensions to expand Joomla's functionality even further. (Refer to the Appendix for some examples.)
On occasion, you'll find a client that is not a good fit for Joomla, though. Here are some examples:
If you need to have multiple people editing the site, but each person needs to have access to only certain parts of the site, this can be tricky to set up in Joomla. Extensions are available to solve this problem, called access control lists (ACLs). However, they can be very complicated to use and configure. Most developers agree that Drupal (
www.drupal.org) has a better implementation of ACL as of this writing. ACL will be incorporated into Joomla 1.6.Having content that needs to be sliced and diced several different ways, such as viewing articles by relevant keyword, is also difficult to implement with Joomla without having the right extension to make it work.
Sometimes a client just wants a simple five-page web site, and isn't planning on ever making changes. You might be better off with a simple HTML web site in this case (although you could also build this site in Joomla or WordPress,
www.wordpress.org).Sometimes a client just wants a blog. Although Joomla can run blogs, WordPress is a better solution if a blog is the only requirement.
Before you take on Drupal, WordPress, and static HTML projects in addition to your Joomla work, you might want to rethink your own business strategy. I find that keeping up with the latest advances and upgrades for Joomla is challenging enough for me. I would not want to also keep up with the latest upgrades and updates for Drupal and WordPress. Therefore, I've decided that for my business, I'll stick to Joomla. This means if I am presented with a job that's not a good fit for Joomla, I will send that lead elsewhere.
Sometimes, in the course of this conversation, the client will ask, "I need a blog, too. Can Joomla do that?"
Two red flags are in that sentence. You should address both of them very carefully.
The first flag is that your client has called for a very specific piece of technology with certain requirements. A blog is essentially a diary, displayed in reverse chronological order, with the most recent item at the top of the page. It's generally accepted that anyone with permission can add content to a blog. Generally speaking, one would expect to be able to add images, video, and links quickly and easily to a blog posting, without knowing technology in depth. Generally speaking, a blog is updated regularly. For some blogs, that's several times a day, whereas others update monthly. Most successful blogs, though, have a regular schedule, whatever that schedule is, so the readership is clear about when to expect new content.
Now, you probably already knew all of that. But does your client know that?
When a client asks me for a specific piece of technology, I ask two questions; first, "what do you mean by that?" Ask the client to define what a blog is. He could mean that he really wants an easy way to update the web site on his own, and his friend does that on her blog, so he's decided that blog means easy updates to all parts of the web site. That's not necessarily true, of course, but that's what a blog means to him.
The second question I ask is, "what problem would the technology solve for you?" You will get all kinds of interesting answers to the question, some of which have absolutely no relation to the technology the client has proposed. I've had many clients insist on a blog, because they've been told that blogs are good for improving search engine optimization. That's true, but they did not know that a blog that improves search engine optimization (SEO) is frequently updated, sometimes more than once a day, so the search engines get plenty of fresh content to read. When they find out they have to post every day (or at least several times a week), they drop the blog like a hot potato.
The real problem in the preceding example is that they want to improve their effectiveness in the search engines. A blog is one possible solution, but it's certainly not the whole strategy for improving SEO.
The second part of that client's question that raised the red flag for me was, "Can Joomla do that?" Well, certainly Joomla can produce a blog. Joomla does a lot of things — calendars, photo galleries, shopping carts, quote rotators, banner advertising, polls, and so much more. Joomla can do almost anything through custom programming if an off-the-shelf extension is not available.
However, the "Can Joomla do that?" question usually indicates that the client is worrying about the technology again, and perhaps they are failing to tell me about a problem they're trying to solve because they can't suggest a technological solution to the problem themselves. Frequently, I tell clients not to worry about what Joomla can or can't do. If I understand the problem they're trying to solve, I'll make Joomla solve the problem. How that technological solution works is of relatively little importance to the client. That is, after all, why they hired me.
Before you evaluate which extensions you need and why, pick out a template, establish hosting, and so forth, you must think about maintaining the web site after launch.
Most web developers enjoy building web sites, but they aren't so thrilled about training clients, and they hate tech support questions after the fact. By thinking through what will happen maintenance-wise before you ever start building, you can make sure the maintenance process is streamlined for your client.
Sometimes your client knows HTML and/or CSS or has a background in web design. Some have been maintaining the site for years already, using a product like Dreamweaver, FrontPage, or Contribute. Other clients have a hard time using e-mail and Word. What is your client's technical ability level? What is the client going to be able to handle to maintain the site?
In general, your clients will be happy if they can make most or all of the routine, regular changes they make to their site. If they have some type of change that happens irregularly (quarterly, semiannually, annually), your handling those changes might be better. They won't remember how to make the changes, and just having you do them is probably more cost effective.
In many small companies, non-profits, and educational institutions, an administrative assistant might make the day-to-day changes for the web site, whereas someone on the IT staff might do more complex tasks as required.
In larger companies and organizations, a dozen people might make updates to the web site.
Make sure you understand who these people are, what their technical backgrounds are, and what kind of changes each person needs to make. Is it okay for everyone to have access to the whole site? Or do you need to lock down the site so one person can only edit a few pages, while another person can edit a section of the site?
If you need to lock certain people out of certain parts of the web site, you will want to look at an ACL extension to accomplish this task. corePHP's Community ACL and Dioscouri's JUGA extension are both available (www.corephp.com and www.dioscouri.com, respectively). Keep in mind that configuring an ACL extension can be challenging, and having good tech support will make your job much easier. Both of these companies will help you configure ACL, which is why they charge a fee for their extensions.
Some clients update their web site daily, whereas others may only update their site every quarter. Sometimes just one page of the site changes, or just one application (like the calendar needs regular updating).
Be sure to understand which parts of the site need to be updated regularly and how often. You want to make sure that completing those regular updates is easy for your client.
You will also want to think about how your client will make changes and updates to the web site. Joomla offers two ways of editing the web site, editing from the "back end" and editing from the "front end."
The back end of the web site is the administrator screens, found at www.yoursite.com/administrator. This interface is very powerful, and this is where Joomla developers do much of their work in setting up a site.
The front-end editing capability of the web site is not always obvious to those new to Joomla. However, if you provide a way to log in from the public-facing side ("front") of the web site, and you provide users with enough permissions (see Chapter 4, "A Brief Tour of the Joomla! Administration Interface"), they can edit the site from the front end.
The front-end editing of the web site, however, is fairly limited in its offerings. As a super administrator, you can edit existing articles, and in some section and category layouts (see Chapter 5, "In the Beginning There Was Content"), you can occasionally add a new article, depending on the site configuration. You can upload new images and documents from the front end of the web site to use in an article.
However, you cannot add new articles to the site and give them their own menu link nor can you assign modules to a page.
Third-party components are spotty in their front-end support. Some provide everything the client needs, whereas others provide little front-end support at all. Be sure to look carefully at the front-end editing capabilities of third-party components, if it's important to your site when considering extensions for it.
Think carefully about what kind of access for updates your client will need. Is it all front-end access, or do they need to access the back end as well? Consider the following guidelines:
If your client has few technical skills, consider offering front-end editing only, even if it means they can't do everything they want to do.
If your client must access the back end of the web site for some reason (for example, they'll be using a shopping cart administrator interface there), you might want to offer only back-end editing access. This can be less confusing than going to the front end to edit articles and the back end to manage the store.
If there is more than one person editing the web site, you might want to know the tasks that each person will need to perform, along with their technical level. It may make sense to give some people only front-end editing, while others have back-end editing.
Having trained dozens of clients to maintain web sites, I lean toward giving clients front-end editing access only; for non-technical people, it's just easier to understand front-end editing. Only when I have to provide back-end access do I train the client to edit articles from the back end of the site. Understanding how your client will edit content on the web site can impact which extensions you ultimately choose to include in the site, as well as decisions about overall site configuration.
When you take on Joomla clients, unless the clients have their own web hosting and IT staff, you're really taking on the client for the long-term. You'll build a site initially, but then you'll need to upgrade the site to the latest version of Joomla. Clients will frequently also want tweaks and upgrades as they work with their sites. Some clients will also expect search engine optimization work. Others might want you to do everything for them and will never touch the site themselves.
Before you start building the site — in fact, before you have a contract set up — you'll want to ask the client the following questions:
What will the client be responsible for doing when the site is completed? (Typically this is editing text, posting new articles, adding photos to the photo gallery, events to the calendar, and so on.)
If a problem occurs with web hosting, does the client call you or the web host directly?
How does the domain name for the web site get renewed? Does the client handle it or do you bill the client and do the renewing?
Does the client expect you to add new features, functionality, or content on a regular basis? How much direction is provided?
Does the client expect you to implement a search engine optimization campaign?
Does the client expect you to check for broken links on the site periodically?
There are many other questions to ask, but understanding your client's expectations about how you're involved going forward is very important. Some clients expect you to go away until you're called, whereas others expect a lot of ongoing help.
You also want to find out whether you'll need any subcontractors to help you with maintenance.
You also must discuss compensation for maintenance with your client. Generally, maintenance fees are handled in one of two ways. If you're expected to complete ongoing work for the client each month, having the client reserve a fixed number of hours for that work might make sense. Otherwise, you might want to charge your hourly rate. Be sure you disclose whether you bill partial hours or full hours. If you bill partial hours, billing in 15-minute increments is common. You also must spell out how any compensation for ongoing subcontractors will work.
Finally, you must consider what is not maintenance. This definition often depends on the size of a given job. For example, adding a new image or icon to a page on the site is maintenance. However, designing a new custom template from scratch might be a separate contract. A good general rule is if a job takes more than five hours to complete, it might be time to consider a separate contract for the work. You also want to make this clear to your client.
Once you've established that you'll use Joomla to build the client's web site, and once you've identified the types of features and functionalities that need to be included on the web site (blogs, calendars, shopping cart, etc.), it's time to go shopping for extensions.
As its name implies, an extension is an addition to Joomla that extends Joomla's core capabilities. For example, Joomla does not come with a shopping cart pre-installed. However, you can download a shopping cart extension that enables Joomla to behave as a content management system and a shopping cart. Extensions cover all kinds of areas:
The incredibly important. JoomlaPack, a utility that backs up your Joomla site and allows you to restore it easily. (JoomlaPack is covered extensively in Chapter 15.)
Making your maintenance life easier. Joomla Updater, which easily installs the next version of Joomla to your site (that is, Joomla 1.5.14 to 1.5.15).
Important functionality to some sites. Blogs, photo galleries, calendars, forums, community building extensions, commenting software, search, site maps, and so much more.
Language functionality. Install alternative languages for your site, or translations of the back end of your site.
The absolutely sublime. Your horoscope, a Tic-Tac-Toe game, or a random quote from "The Simpsons" are all available to include on your site as well. (Just because you can, doesn't mean you should!)
As of this writing, nearly 4,000 extensions are in the Joomla Extensions Directory (known as the JED; see extensions.joomla.org). More are added every day. How on earth do you pick the "best" extension for your particular site? Is just downloading something and using it okay? Can you get into trouble that way?
Some extensions are widely regarded as "site essentials" in the Joomla community. Many experienced developers, regardless of the type of site they're building, always install these specific extensions.
For example, Joomla comes with TinyMCE as its default editor. The editor is the box where you enter the content and formatting for an article or for other information in Joomla. Other alternatives for editors are available; you do not have to stick with TinyMCE.
JCE, the Joomla Content Editor, has been around for almost as long as Joomla has, and it has a loyal following as being one of the best editors out there. You can view this extension in the JED at http://extensions.joomla.org/extensions/edition/editors/88/details (see Figure 2-1).
Note the following about this extension:
The "Editor's Pick" icon appears after the name of the extension. Editor's Picks are featured extensions that are considered top-notch by the team of editors who review and run the JED. These editors are core team members of Joomla and other noted members of the Joomla community.
The extension also features the "Popular" icon. This appears when more than 150 views of the extension occur per day. Popularity indicates either something unique in the JED or that many people think highly of the extension because they're looking at it and downloading it frequently.
Note the version of the software, in this case, 1.1.9.2/1.5.4. Beware of extensions that are in alpha or beta development. They may change radically before they are ready for launch, or they may be buggy.
Note the date added. This can give you some idea of the longevity of the extension. JCE was added in March 2006 (about six months after Joomla began). It's a very old extension, but clearly it's going strong.
Note also the last update for the extension's listing, which appears after the version (June 29, 2009 in this case). This date gives you an idea of when the extension author visited the site. It can be a measure of how engaged and interested the author is in this extension. Some extensions are seldom updated, whereas others are updated regularly. More updates mean an engaged, active author for the extension, so you're more likely to get better tech support, more frequent updates, and so on.
As of this writing, only extensions that are 1.5 compatible are being added to the directory. However, if a 1.0 version is still available, it is still listed. A Joomla 1.0 extension has a red icon, while a Joomla 1.5 extension has a green icon.
Note how many votes and what rating the extension has. Getting five stars is easy if there's only a handful of votes but tough if there's a pile of votes. In this case, JCE has a four-star rating with 498 votes, which is a very good rating.
Look at the most recent reviews, particularly with extensions with longevity, such as this one. Are most of the reviews good? If they're not good, has the extension owner responded to the review? Again, the review is a good measure of the current happiness (or unhappiness) of users, and it also gauges the responsiveness of the extension author.
You might see some little icons for M, C, P, or S. They indicate whether the extension is a module, component, plug-in, or has an extension-specific add-on associated with it. You can see that the JCE extension has C, P, and S.
Be sure to watch for extensions that have not been recently updated, those with poor reviews, and those in alpha or beta releases without a stable option.
Also avoid extensions that are for Joomla 1.5 legacy wherever possible. Legacy mode is a backward compatibility mode that enables code that is more compatible with Joomla 1.0 to run within the Joomla 1.5 environment. This means you must enable a plug-in that comes with Joomla, called the Legacy Plugin, for these extensions to run. The Legacy Plugin adds significantly to the overhead for the web site. Furthermore, any Joomla 1.5 legacy component will definitely not run under Joomla 1.6. Be forward-compatible and work with Joomla 1.5 native extensions wherever possible.
Many experienced PHP/MySQL developers will tell you to "evaluate the code" of an extension to make sure no security holes or other coding problems exist. They're frustrated that not everyone does this. Unfortunately, not everyone has the skills that these developers do.
Recently, I had a conversation with Victor Drover, owner of AnythingDigital (dev.anything-digital.com), and creator of extensions such as JCalPro and shSEF404. I told him that I don't have the PHP background to "evaluate the code" and asked what he would recommend someone like me do to determine what the other hallmarks of a well-written extension are.
These points apply to extensions available in the Joomla Extensions Directory (JED), or those not included there:
Is it encrypted? "PHP is a scripting language," Victor said. "The code is there on the page, easy to read and understand. Encryption means you hide that code in such a way that the PHP cannot be read by a human, and you can't make any tweaks or changes to the code. As a policy, encrypted extensions are not allowed on the JED. If the code is encrypted, you don't know whether the extension author has done a good job or not, or whether security problems exist. I recommend you stay away from these extensions. If they require you to install IonCube or Zend Optimizer on your server to run these extensions, that's indicative that the code is encrypted."
Does it require you to change permissions on directories to install or use it? "Joomla is set up in such a way that, if the extension author knows what he's doing, you should be able to get the extension to install without changing file permissions," said Victor. "Particularly dangerous is when you're required to give full read, write, and execute access (chmod 777) for a directory or a file. This is usually a security weakness, and it's an indication that you should uninstall the extension and not use it. In addition, you can search the source code with a good text editor such as TextWrangler (Mac OS X) or Editpad Lite (Windows) for '777'. These applications allow you to search all the files of the extension at once. If you find instances of '777' in the code, proceed with caution and be sure to inquire with the developers as to why this is needed — it might be legitimate."
Does the extension start with the correct first line? "All Joomla extensions and templates start with the same first line of code," said Victor. "If that line of code isn't present, it indicates that the developer is not taking security seriously, and it leaves the extension and your entire site very vulnerable." Although looking at every PHP file for this entry can be tedious, it is essential. The line of code he refers to is
<?php defined( '_JEXEC' ) or die( 'Restricted access' ); ?>
This line of code is the same as the line of code you use to start a custom template. It's covered in Chapter 13.
Is there an index.html file in each folder? "The index.html file is a blank page that simply prevents the filenames in the directory to be listed, if someone were to try to view the contents of an extension folder from the front end of the web site. It's a simple security measure so that no one knows exactly which files are contained in that folder," said Victor. "Most servers and web hosts prevent directory listing, but this file adds a little security in case your host doesn't offer this feature. (Unfortunately, this is more common than you might think.)"
Does it overwrite core files? "Some extensions clearly state that changes or 'hacks' to the core Joomla files are required for operation," said Victor. "The problem arises when you update Joomla. These hacks get lost if the files are included in the update and are then copied to the server. While extensions that make changes to the core files are published on the JED, in general, beginners should avoid their use."
By following these guidelines, you can minimize your use of insecure extensions. Remember, hackers can also freely examine these extensions for vulnerabilities, so your doing the same is important. Over time, you will build a repertoire of safe extensions and trusted developers.
Most Joomla extensions are completely free to download and use. However, some extensions charge money for their work. Which is better? Right, it depends.
Obviously "free" is a very attractive price point. But consider that a free extension means there's not necessarily any obligation for quality support for that extension. It also means that there's less drive on the part of the author to keep updating the extension.
These points certainly are not true for all authors of free extensions. JCE, for example, is free and is extremely well maintained. However, having worked with hundreds of Joomla extensions, I have noticed that you are more likely to get poor support and/or few upgrades from free extensions than commercial extensions.
Commercial extensions clearly have a responsibility to provide high-quality support to their customers. The authors are also more likely to upgrade their products over time.
If you are the type of developer who needs to ask a lot of questions, who might not be good at figuring things out from documentation (or just by clicking around), or who might just prefer to be told how to do something, you should probably stick with commercial extensions for your site. You will need the support offered for the best experience.
Not long ago, a very popular extension was pulled from the JED because a security hole had been discovered, but the extension's author had no intention of fixing the problem or upgrading it. Just because an extension is popular does not mean it is secure, maintained, or without problems.
Just as upgrading Joomla to the latest version when it's released is important, you must also stay current with new releases of your extensions. Not keeping up with these releases can lead to security issues on your Joomla web site, which might lead to being hacked.
One of Joomla's great strengths is its flexibility. It was built with extensions in mind. Extensive documentation is available on the Joomla web site describing the correct methodology for building Joomla extensions.
If one of the more than 3,000 extensions in the JED can't satisfy your client's requirements, one can certainly be written to do what he wants. My longtime engineer and good friend, Bill Tomczak, has done many wild and crazy things with Joomla extensions. One of the most unusual was making an old AS400 computer talk with Joomla.
Writing custom extensions, however, is not for the faint of heart. If you're going to write such an extension, you should have plenty of experience with PHP and MySQL, and you should understand what Joomla expects from its extensions.
You must completely and clearly understand what your client wants. Sometimes drawing pictures on paper (called wireframe diagrams) that outline exactly what the user sees, what the administrator sees, what kind of data goes into the system, and what kind of data comes out can help.
If you decide not to write the extension yourself, but to hire an engineer, inevitably he or she will have additional questions. The best service you can provide for that engineer is to fully understand the problem the extension is supposed to solve. Understand what the client wants to get out of it in the end. The wireframe diagrams can help communicate those requirements.
Generally speaking, engineers are not happy when you suggest ways for writing the code or making their magic happen. Let's talk car repair for a moment. If your car is making a funny noise, you might take it to a mechanic. My approach has always been to hand the keys to the mechanic and tell him to call me when he figures out what it is and how much it will cost to fix it. That's because I know nothing about car repair! I am delighted to let the mechanic figure out the solution to the funny sound that I want to go away.
Other people might drop their car off with instructions to replace the brakes. When they pick the car up later, the sound is still there. You can't go back to the mechanic and berate him for not fixing the funny sound. That was not what you asked him to do! You asked for him to change the brakes, and he did. Sometimes not suggesting solutions and just letting the engineer (and the mechanic) be creative and find their own best solution to your problem is better.