SPF for Your Website: Three Simple Steps to Protect Your Online Presence

As the days get longer and the mercury rises, we’re reminded yet again of the importance of remaining vigilant when it comes to applying sunscreen to protect ourselves from summer’s damaging rays. It’s a simple yet necessary precaution that if neglected has both short-term consequences – the painful agony of sunburn – and long-term ramifications – skin damage and increased risk of skin cancer. The same holds true for our websites. If we are not proactive in taking the necessary precautions to keep our online presence safe, problems will inevitably arise. Here are three simple measures you can take to apply SPF to your website that will safeguard the integrity not only of your brand’s online presence but its reputation as well:

(S)ecure your site against SQL injections.

Websites that feature data-driven applications can be vulnerable to attacks known as SQL injections, whereby malicious code is added to an entry field, then run and executed. These attacks exploit security vulnerabilities in problematic code, attacking your site’s database and performing any number of actions, from adding unapproved content to your public-facing site to allowing the hacker to download your entire database. This is a prime example of why rigorous testing is absolutely critical prior to launch. If your site is already up and running, consult with your web team to make sure that it has undergone thorough testing and is protected against such hacks. If you want to take additional precautionary measures, there are also security companies that specialize in detecting these types of website and database vulnerabilities, and they can provide you with a security audit.

(P)rotect your domain name.

It’s common sense that you must pay to acquire the domain name where your business will reside online. However, it’s important to remember that you have to continue to pay in order to retain the rights to use that domain name. Essentially, when you purchase your domain name, you’re not buying it outright. Rather, you’re renting that name for a specified period of time. Most registrars (Network Solutions, GoDaddy, Register.com, etc.) allow you to secure a name for anywhere from 12 months to 99 years. If you allow your registration to lapse, however, the domain name becomes available for purchase again and is open to the public for anyone to acquire. Bear in mind that there are actually companies that profit handsomely from business owners who neglect their domain registrations. They monitor domains that are nearing expiration, taking ownership of them the moment they become available. If you have the misfortune of having your domain acquired by one of these companies, usually you can negotiate having ownership transferred back to you, but it will cost you dearly. Unfortunately, while this is a shady practice, it is not illegal. If you allow your domain name to expire, it is fair game for anyone to register it – including these types of companies. Before your domain name expires, your registrar will likely send you many notices prompting you to renew. I start getting domain name renewal notices six months or more before the scheduled expiration date, and as that date gets closer, the notices start coming more and more frequently. Still, despite this barrage of email notifications, there are still many companies that are unaware that their expiration date is approaching, and they either lose their domain name altogether or are forced to pay a king’s ransom to get it back. Often when this situation occurs, it is because the person who initially completed the registration process for the domain name is no longer with the company, and therefore the email address they used to register the name is no longer valid, so the multitude of email notices go unreceived. The company innocently thinks they are protected until one day they stop receiving emails (yes, your email is tied into your domain name), or a customer mentions that they tried to go to the site, and it was simply gone. Even though there is a grace period after a domain has lapsed that allows you to reclaim your ownership before it becomes open to the public, the lapse isn’t always discovered in time to take advantage of this safety net. To prevent this, it is critically important to keep the contact information for your domain registration up to date. Either contact your registrar directly or speak with your web team to make sure you know when each of the domain names you own needs to be renewed, and double-check to ensure that the contact information for your account is valid.

(F)ortify your forms.

Web forms are a staple of doing business online. In fact, rare is the site that doesn’t include a form of some sort that allows the user to input information to be transmitted to the site’s owner, whether its purpose is to make a contact inquiry, sign up for a mailing list, complete a purchase, apply for employment, etc. As anyone who has a form on their site can attest, however, not all submissions received via these forms are legitimate. This is called robot spam, which is created by spammers who write programs that send out spambots to indiscriminately fill out any and all different types of forms on the Web, looking for entryways to expose a site’s security vulnerabilities (see SQL injections above). If you find your inbox filling up with indecipherable junk submissions, it’s these bots who are to blame. To combat these spambots, you can install a CAPTCHA system on your form, which generates an image with a random combination of numbers and letters that the user must enter in order to submit the form. The spambots can't interpret these CAPTCHA images, so therefore they can’t complete the process of sending the form. While there is legitimate debate as to whether or not CAPTCHA is the most effective way to prevent bogus submissions, it still remains the most popular solution for web form security. However, the reason it’s important to block these bots goes beyond eliminating the annoyance of a cluttered inbox. A few months ago, my company decided to remove the CAPTCHA requirement from our contact form. We knew we would get a flood of spam submissions, but we decided we could deal with a little extra hassle on our end in exchange for reducing the inconvenience to legitimate users of having to interpret those squiggly letters in order to simply get in touch with us. As expected, the amount of spam we received increased dramatically, but it was still manageable. Then, all of a sudden, we stopped receiving any submissions at all. We also began seeing some of our emails to other people bounce back. What we discovered was that our web domain (which is where our emails originate from) had been blacklisted as spam by Microsoft (which is what powers our email platform). Apparently, all the bogus submissions from our website (which resides on our domain) to our email caused Microsoft to identify us as spammers. This is because our form submissions came from an email address associated with our own domain name (many web forms are configured this way). Obviously, we were not the ones generating the spam, but this strange series of coincidences conspired to get us blacklisted! Fortunately, it was an easy process to get our domain removed from the blacklist, and we quickly re-installed the CAPTCHA system on our contact form, but we certainly learned an important lesson about security and spambots along the way. If you allow those bogus entries to make it through, there is a risk that you, too, could find yourself blacklisted and unable to send email to some of your most important contacts.

Seize the day and stay safe.

Since summer is vacation season for many of us, business tends to slow down slightly as our clients and colleagues enjoy much-deserved time off. That makes this the perfect time to seize the opportunity to apply these S-P-F practices today to ensure that your online presence is well protected all year long.

---

Four Fears That Sink a Website

Your website is one of the most important tools in your business growth arsenal. However, website development is a complex science, and there are any number of opportunities for the process to go awry. Following are four common decision points where uncertainty or indecision can compromise the execution of good design, content and functionality, resulting in a site that doesn’t perform.

Not catering to every possible customer and every imaginable need

You never want to waste the opportunity to gain a new customer. When you think about all the people sitting in front of a keyboard who could potentially land on your site, it’s difficult not to want to swing for the fences. However, the penalty for trying to appeal to everyone is that you’ll appeal to no one. You’ll end up with bland, unfocused content that speaks in broad generalities rather than razor-sharp sales copy that addresses key points. It’s critical to think about the type of person who falls within your core target audience, how they most likely arrived at your site, what their level of familiarity with your product or service is, and what is required to convince them to take the next step – whether that’s submitting a contact form, picking up the phone or making a purchase. When you’re honest and realistic about who you’re really speaking to, you can build your site around powerful sales messages that hit home and compel action rather than settling for an insipid and ineffectual approach that fails to motivate anyone to do anything.

Not addressing every question on the home page

This is the corollary to the fear of not serving every possible visitor. You’re afraid that if every potential question that someone could have is not addressed as soon as they land on your home page, you’ll lose them. The result is a cluttered mess, and the reality is that you’ll turn away more customers than you’ll win because no one will be able to find what they’re looking for. It’s important to divide your website visitors into audience segments based on their needs and motivations and provide funnels for each user type that point them to the tools and information contained below the surface of your site that are most relevant to them. For example, if you’re a non-profit, chances are that you have three primary audience segments: prospective clients, prospective donors and prospective volunteers. The only two jobs your home page must accomplish are conveying your mission, so that all of these groups understand who you are and what you do, and providing clear signposts that guide each segment to content within your site that is tailored to their specific needs. Website users are in no way averse to clicking and navigating; they just need your help in knowing where to go.

Not providing enough information to close the sale

Unlike when you’re face-to-face with a prospective customer, when someone is browsing your website, you don’t have the ability to adjust and tailor your sales pitch on the fly based on the flow of conversation. As a result, the tendency is to include any and every detail possible within the copy on your website in order to make sure you address all possible questions and sales objections. After all, if someone can’t find what they’re looking for on your site, they’ll give up and you’ll never hear from them again, right? Wrong. When you provide too much information, it makes it difficult for users to find anything of real use or value to them. In the culture of the Web where time and attention spans are severely limited, “less is more” is a universal truth – as long as that “less” is well-chosen and well-crafted. You simply can’t afford to put every detail about your product, service, company or brand on your site. Instead, you must make smart choices and be strategic in the way you present information on your website so that you capture visitors’ interest provide the best possible user experience. By stripping down your content to only that which is most relevant and most useful to your target audience, you’ll make the good stuff more prominent and make it easier for users to find exactly what they’re looking for. Brief, powerful, well-organized copy will win out every time over page after page of verbose, indirect, indecipherable content. Read more: Ten Secrets of Must-Read Copy

Not doing everything the competition is doing

It is the curse of anyone charged with the task of growing a business to obsess over the competition. The Web only intensifies this fixation because everything is highly visible. It’s tempting to make sure that your website does everything in exactly the same way as your competitor’s because it’s right there in front of you. Or is it? You don’t know the motivations – business growth driven or otherwise – that determined why they chose to go one route over another. You also aren’t likely to know if they have a great web architect directing them or if they’re just grasping at straws and trying to capitalize on every web design trend du jour. If their site features bells and whistles that yours doesn’t, that doesn’t necessarily put you at a disadvantage. For example, you might envy the colorful, eye-catching animation on your competitor’s website. But what you may not realize is that those effects were created in Flash and are therefore invisible to anyone who might be trying to access their site on an iPhone or iPad. Moreover, you may be competing for some of the same customers, but that doesn’t mean that your business models are the same. Their strengths are not your strengths, and your long-term growth plans may be leading your company in a different direction. You need to ensure that your site serves your business growth objectives – present and future – not theirs. Let them do what they want. If you stay true to your own goals and your own well-founded knowledge of your customers, you’ll win in the end.

Need a second opinion?

If your website isn’t bringing you new customers every day, something’s amiss. Find a business-growth-oriented web development firm that specializes in web design and user interface to partner with you and steer your site back on course to work for you.

---