DoublePlus » Development

Rehabbing a Defunct E-Commerce Site

Susan Petracco — Sun, 04 Jul 2010 00:35:45 +0000

Many of you who know me or regularly read this blog probably know that last December, my husband and I sold our online toy store so that we could focus entirely on our e-commerce practice. The new owners seem to be doing really well with the site, and I'm glad to not have to focus on the day-to-day business anymore - I always liked working on the website much more than running the business. But in addition to the toy store, we also had a drop-ship site for children's furniture that we had started as a second line of income for that business.

However, our focus on NetBlazon left us with too little time to manage the customer and vendor relationships for Coolest Kids Furniture effectively, and as a result we turned off the ability for customers to check out on the site. It gets some traffic, so we didn't want to take it completely offline - but without bringing in revenue, it likely wouldn't have been very enticing for a buyer. As it was, the site was just sitting there doing nothing.

We were left with the question of what exactly to do with it?

Then I ran across a neat set of posts by Eric Nagel on coding a datafeed site using PHP. That sounded like a lot of fun! I don't get to do much PHP work anymore, and the thought of getting my hands dirty on some code was enticing. So weekend-before-last, I sat down with his scripts (there's an entire series of posts Eric wrote), my ShareASale and Commission Junction accounts, and the templates from Coolest Kids Furniture's shopping cart. Although I made a number of tweaks and adjustments to the scripts Eric provided, they saved me hours of work (especially on the CJ web services) and let me get the site up fast.

The site is now pushing traffic through to a number of other furniture retailers through the two affiliate networks. I shut down the old merchant accounts (that should save me $35/month) and moved the shopping cart to a backup directory. Plus I threw some Google AdWords campaigns on there to see how they might perform too.

Last week I added a Wordpress 3.0 blog to target additional keyword phrases for the site's SEO efforts. The new version of Wordpress is so easy to install, and the default template is wonderful. I made a quick header graphic, installed a few SEO-related plug-ins, and it was ready to go. Plus, all the work I did on the site a couple of years ago left me with enough knowledge about the products that the posts are quick and easy to write.

Almost makes me wish I hadn't let some of those other domain names expire!

Do you have any old sites sitting around that you don't know what to do with? Are you up for a rehab? Or looking to sell? Let us know your plans by dropping a comment below.

How Well Do You Protect Your Customers’ Privacy?

Susan Petracco — Sun, 09 May 2010 03:06:49 +0000

Internet users have always been wary of providing personal and financial information online, but as the web has grown, so has the number of transactions, as well as the number of sites seeking orders for products or services. Customers have grown more accustomed to providing their information to many kinds of businesses, but privacy concerns continue to grow. In the wake of the recent concerns about privacy on Facebook, I wanted to focus on the privacy of e-commerce site customers as well.

The last thing your business can afford is public recognition of lapses in privacy and security. But the concerns go far beyond customer perception as well. The emergence and growth of PCI Compliance puts a serious legal and financial burden on companies of all sizes to protect their customers' credit cards and other financial information in an effort to prevent fraud.

If you haven't performed a recent review of your practices relating to both privacy and security, now is a good time. And if you've never really given it much thought, please keep reading and then develop your own plan to maintain your customer's valuable information.

The First Step: An SSL Certificate

An SSL certificate is essential to protect sensitive information as it is transmitted over the internet, such as when a form containing personal or financial information is submitted by a customer. SSL Certificates can be purchased from a number of providers, including Verisign, GeoTrust, Comodo, and many others. The SSL certificate is engaged when the web site is accessed with a URL beginning with "https" instead of "http", encrypting both the request (submission of the form or requesting a web page via a URL) and response (the information that is sent back to the browser).

All sensitive information should be collected and presented on pages served over HTTPS using the SSL certificate. Customers often look to the "lock icon" in the corner of their browser window to ensure that a page asking for this information is secure.

Credit Card Information

The best thing you can do to protect customer's credit card information is to NEVER store it in the first place. If your website uses a real-time payment gateway such as Authorize.net or Payflow, the customer's credit card is passed through to the gateway, and charged or authorized for the sale, and typically doesn't need to be stored on your server at all. Instead, reference or transaction numbers are stored in your system so that transactions can be reviewed and pre-authorizations can be captured. If your site or database gets compromised, there are no raw credit card numbers and expiration dates that can be stolen.

If you can't use a real-time gateway for any reason, make sure you download the payment data over a secure connection (https over a browser, or sFTP instead or regular FTP). Then delete it from your web server as quickly as possible, as well as removing it from your local systems, once the payment has been processed. If you make efforts to delete the data regularly, then a breach of your web site will expose as few credit card numbers as possible (those that have been provided since you last deleted data).

The one thing you should never store in any capacity is the CVV number, also known by other acronyms including CVC, CVV2, and CID. This is the 3- or 4-digit number on the front or back of credit cards, separate from the actual credit card number, that is not embossed or raised and therefore doesn't show up on a credit card imprint. Credit card companies such as VISA and MasterCard pose significant fines on merchants who violate the mandate to not store the CVV code, even if a breach has not occurred. You may also lose the ability to process credit card transactions in the future.

Customer Names and Addresses

Although not as fraught with concerns as issues with payment data, protecting customers identifying information, especially their home address, is still of ultimate importance. Customers often don't want other people finding out their full names or their home address, or even their employer, due to concerns about identity theft. (The more information a potential identity thief collects, the more likely he can impersonate the victim).

All pages that refer to a customer's account, full name, and address should be served over HTTPs, so that the SSL certificate encrypts the data being transmitted. Other pages such as order history are also recommended for SSL protection, especially if your products are sensitive - think medical supplies, prescriptions, adult items, etc.

You should also test your site's account creation, log-in, and forgotten password functions. Make sure there are no security holes in these processes.

Think Carefully about Open-Source Software

Open-source shopping carts are growing in popularity, due to the low cost (often free) and the typically large developer/user communities surrounding them. However, in the case of software whose source code is available to the public, it's often much easier for hackers to find and exploit holes. Wordpress, arguably the most widely-used blogging platform, has had to issue numerous updates to patch security holes and bugs that were found by hackers. Shopping cart software is no less prone to problems, and the results of losing customers' credit card numbers can be much worse than having your blog replaced by a defaced page (porn or not!)

Additionally, open-source software is often not subjected to the same compliance issues as software that is funded by sales instead of being free. For example, even Magento's Community Version, the current golden child of the open-source shopping cart market, won't be PA-DSS compliant...so unless you purchase the Enterprise Edition (which is not free!) you won't meet this required standard.

Shared Information

Another area of your site to review includes searchable areas like gift registries, wishlists, and other kinds of customer lists (such as those Amazon allows customers to create and share). For example, when a person searches your gift registry, does your site return too much information about matching records? If you display first and last name, city, and state, it could be too much information to maintain customers' privacy. Limit the information to as little as possible, while still allowing gift shoppers to recognize the person they are shopping for.

Limit Employee Access

You should also limit your employee's access to customer and payment information only to those people who need to access it to perform their jobs. Employees come and go, sometimes under contentious circumstances. When an employee leaves the company, delete his or her account or change its password so that the former employee can no longer access the information. Also, encourage (or enforce) employees to use strong passwords and to periodically change them to protect their accounts from unauthorized access.

Many shopping carts and accounting systems allow you to configure user accounts to access only certain parts of the application. Often, you can allow your web developers, customer service representatives, and other employees to access the necessary parts of your system without giving them access to customer records and payment details.

Application Integration and Data Sharing

When sharing data between your cart and other applications (such as accounting systems, CRM systems, even a mailing list application), don't transfer more data than necessary. Your mailing list doesn't need the customer's credit card information - not even the last four digits. So why bother? If it's not needed, don't keep it there. Don't download data you don't need into Excel and keep it on your hard drive either. And be very careful to make sure you don't email credit card information to anyone! It's surprising how many retailers and developers aren't conditioned or informed about the risks of emailing sensitive data.

Review Your Database

Look at how your shopping cart stores customer records and allows forgotten passwords to be retrieved. Are your customers' passwords encrypted before being stored in your database? Are passwords mailed in plain-text, where anyone with a packet sniffer can intercept them? Or do you email the customer a password reset link sent instead? Can site administrators see the old password or just reset it to a new one?

Communicate the Good

Finally, it's also good to spell out the details of how you maintain customer privacy in a detailed Privacy Policy on your site. Most sites link to their privacy policy from their footer. But also consider hitting the highlights in a few bullet points in a more conspicuous place, perhaps on the view cart page, or the page where customers enter their credit card number. Add a "View our Complete Privacy Policy" link below it for customers who want to read all the nitty-gritty details.

The larger and more visible your company grows, the more important it becomes for you to deal with these issues BEFORE you a breach occurs. When it makes sense financially to do so, consider online services such as McAfee Secure or ControlScan, and later, consider hiring a company that specializes in website and computer security services. The peace of mind, and lack of future problems, will likely make it worth every penny.

10 Questions with Chuck Lasker of MerchantTutorials.com

Susan Petracco — Mon, 18 May 2009 16:58:47 +0000

Many Miva Merchant users are familiar with Chuck Lasker and the various ways he's been involved in the Miva community over the past several years. We caught up with him at the 2009 Miva Merchant conference to ask him ten questions about his new endeavor, MerchantTutorials.com. Find out how he got started with Miva Merchant, what MerchantTutorials.com is all about, and how you can subscribe to the service to learn how to do more things with your online store.

Quick Tip: Easy Domain Switching for Miva Merchant Stores

Susan Petracco — Tue, 26 Aug 2008 00:02:26 +0000

Because we do a lot of redesigns and offline development, our customers usually have at least two stores operational at one time - the live store and a development platform. Sometimes that makes it hard to test, though, if links from the development site link back to the live site half of the time. You don't always notice when you navigate away from the development site. The sessionurl and secure_sessionurl variables in Miva Merchant will automatically pick up the right domain. But any hardcoded URLs, if they are using absolute paths (and in most cases, they should) will not be as easy to manage. And if you use shortened SEO-friendly urls, you may have even more widespread URLs to manage. Here's an easy tip for Miva Merchant users who have more than one environment: set a variable in your store that references your domain name, and then build your URLs around that. This is easy if you use the Toolkit module from Emporium Plus. Go into Miva Merchant, click the name of your store within the left frame, and then on the right side, click HTML Profile. The great thing about this field is that it's usually the first field referenced by the store's page templates. (If your site doesn't use the HTML profile, or if you are running Miva Merchant 5.0 instead of 5.5, use the head tag insert field.) At the bottom of this box, enter the following code:

Then to change the variables for a particular environment, you just have two variables to change. Still too much work? You can use the toolkit to extract the url from your domain settlings instead:

After that, you can build your URLs using this "basedomain" global variable, and when you copy code from one site to the other, the links should still work. Here's an example link to the shopping cart page:

Quick Tip: Including Recent Wordpress Posts in Miva Merchant

Susan Petracco — Mon, 30 Jun 2008 14:44:57 +0000

The great thing about having a blog for your business is that it gives customers and search engines new content to view. It can increase sales by convincing customers of your product's benefits, or teaching them how to use it, or giving them ideas for incorporating the product into the lives. But it's essential to integrate the weblog with your storefront. If customers can't go back-and-forth between your store and your weblog, the impact of your blog is going to be less than optimal. If you are using Miva Merchant 5 and Wordpress, however, one of the simplest ways to integrate the two is to include recent blog posts right on your homepage. To start out, you need a template that can display a very simple HTML page - one that, in this example, is no more than the title of each post, linked to the full post itself. This can be done by modifying the index.php file within your Wordpress template (located in wp-content/themes/your-theme-name). Just add this code at the top of your index.php file:

The rest of your original index.php should follow this code. Then at the very bottom, close your "if" statement like this:

At this point, you should be able to see your recent posts by going to the following URL. Be sure to replace "domain.com" with your website domain name, and replace "weblog" with the correct directory for your Wordpress installation:

http://www.domain.com/weblog/?pull=1

At this point, you're ready to begin working in Miva Merchant. You'll need Emporium Plus's Toolkit module installed. Then, inside Miva Merchant, go to Pages and edit your Storefront (SFNT) page or your Storefront Welcome Message (under Messages). Add the following code (again, replacing the appropriate parts of the URL as specific to your site):

&mvt:global:weblog;

This will print out the list of recent posts from your weblog right on your Miva Merchant storefront.

Quick Tip: Setting a Fallback Image

Susan Petracco — Wed, 11 Jun 2008 13:43:15 +0000

Nothing looks less professional than an ecommerce site full of broken images! However, if you're running a site with a lot of products, it's bound to happen every now and then. Here's how to stop it from happening. Most ecommerce sites use images to provide a visual representation of their product line. Product images are usually set in one of two ways - either specified in a database field provided by the shopping cart package, or specified in a template by using a file naming convention (for example, /images/PRODUCTCODE.jpg where PRODUCTCODE is replaced with the actual code for each product). Either is a convenient way for specifying product images. However, because the HTML code produced is always dependent on the existance of an image on the filesystem. there is a possibility that your site will display the dreaded "red X" or broken image icons - or in some browsers, such as Firefox, the image's alternate text. Although it's always best to have images for every single product, it's also a good practice to configure fallback images. These are images that display whenever the specified image in the HTML output cannot be found on the server. We do this by using mod_rewrite rules in our .htaccess file. A .htaccess file (note the dot in the front) is a method offered by Apache for setting up configuration parameters for the web site. We start by adding the following line to enable mod_rewrite if it does not already exist:

RewriteEngine On

The next set of code looks for any requested files that do not exist, and if the URL has the extension .jpg and resides in the images directory, it is replaced with the image "comingsoon.jpg" located in the images directory. The browser still sees the URL specified in the HTML, but the server delivers the comingsoon.jpg image instead:

RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^images/.*\.jpg$ /images/comingsoon.jpg [L]

Of course, make sure you actually have an image named "comingsoon.jpg" in your /images/ directory! This method will deliver a fallback image, one that might say "Photo Coming Soon", in place of any missing images. No more broken image links. If your site uses multiple-sized images, such as thumbnails and full-sized images, you can have multiple copies of this code in your .htaccess file, with the appropriate changes to manipulate files in different directories or with different naming structures. Below is an example from one of our clients, whose site displays 4 sizes of images, with each size residing in a different directory:

RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^graphics/40px/.*\.jpg$ /graphics/comingsoon/40.jpg [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^graphics/65px/.*\.jpg$ /graphics/comingsoon/65.jpg [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^graphics/100px/.*\.jpg$ /graphics/comingsoon/100.jpg [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^graphics/125px/.*\.jpg$ /graphics/comingsoon/125.jpg [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^graphics/275px/.*\.jpg$ /graphics/comingsoon/275.jpg [L]

Improve Your Bottom Line with Better Search Tools

Peter Petracco — Sun, 18 May 2008 00:08:17 +0000

Many e-commerce packages available today provide some search capability out of the box. These out-of-the-box search utilities typically are good for searching through product names and description. Some even provide advanced capabilities to search other fields or order the data in some unified fashion - like showing you categories of interest, related products, and more. While these were acceptable solutions 3-4 years ago, nowadays shoppers are a lot more sophisticated about searching for products they want to buy. If they can't find the product they want quickly and easily, you're not likely to close that sale, let alone keep that visitor.

Is there a solution?

Thankfully, the answer is yes, there are options to enhance your search capability on your website. As you can expect, there are price points all over the map. When investigating the options available today, a storeowner can quickly become overwhelmed with all the options available. So, the very first and most important task to accomplish is to assess what your shoppers' search needs are. Doing this before you look at the search solutions will help you quickly narrow your list of potential solutions. If you start looking at products first, you might find yourself becoming a search tool expert and unless that's part of your business model, it's probably not the best use of your time as a business owner. Below we have provided some details about three of the leading industry solutions. There are many other options that may be more pertinent to your business, but we've outlined these three because of our direct experience with them (e.g. our confirmation that they actually do what they say they can do) and our own customers feedback about the usefulness of their new search solutions.

SearchSpring - SearchSpring (www.searchspring.net) is a relatively new entry to the enhanced search marketplace with solid entry level price points.But that shouldn't make you think it's a simple or incomplete offering. SearchSpring provides fast and accurate search results with added capability to boost certain fields or make others more or less fuzzy, such as product name or description. Customers can drill down into search results by selecting from any additional fields (such as price ranges, brands, or features) in a process known as "faceting". SearchSpring provides synonym-searching, a feature to provide keywords that can map to your products that may not necessarily be part of the product's description/name itself. SearchSpring also provides a web-based administrative interface for managing your feed data, search facets and overall results of your search service. While SearchSpring is a relatively new entrant - being released just in 2008 - we have implemented this solution on several stores. The SearchSpring staff has been very helpful and responsive in addressing our needs, as well as taking our suggestions to make the product even more useful. A few of our client sites where you can see SearchSpring in action: CPAPXchange (www.cpapxchange.com) is using the search to enhance their product display results, allow users to better sort the results data and ultimately is interested in driving customers to products without making them have to refine results per se. PennState Industries (www.pennstateind.com) would be on the opposite end of that spectrum. PSI has created a very advanced faceted search that allows shoppers to zero in on the exact product details they are interested in. The value of SearchSpring is in its tightly coupled nature with Miva Merchant and its flexibility in enhancing the displays of results.
Nextopia - The Nextopia product suite provides a plethora of offerings outside the hosted search capability; however, to keep this an apples to apples comparison, we're only going to focus on the search service. Nextopia's offering - eComm|Search - is, like SearchSpring, a faceted-search - they refer to them as refinables instead of facets. (If there's one constant in the software marketplace, it's that no two software solution providers will refer to their features in the same manner). Nextopia provides similar breakdowns for sorting products as the SearchSpring solution, including a fuzzy search capability to enhance or widen the search terms, so that if you put in the word "soffa", you'd still get sofas back. The Nextopia search solution's base price is $1k/year for listing up to 10,000 SKUs. If you have a higher number of store items, they can provide you with a custom quote. We have implemented this search solution on a number of sites as well. WonderBrains Toy Store (www.wonderbrains.com) has seen definitive sales increases as a result of implementing this solution as most of their products used very similar feature sets - such as grouping products by activity, or age of a child. On Katom's (www.katom.com) site, the refineables are making all the difference in the right products getting to the top of the search results page. Both clients are very happy with their implementations, especially the conversions rate increase for customers using the search tool.
SLI Systems - If there's a purported Cadillac in this group, it would have to be the SLI Systems solution - Site Search. Site Search provides the faceted search features we have described above, but adds a new wrinkle - Learning Navigation. A site search that learns (yes, it sounds very HAL9000 to me as well, or maybe WOPR in War Games, but I digress) the Learning Navigation feature "learns" from previous site visitors' search activity. It will track search queries and click-throughs and uses those results to deliver better search results based on popularity. In other words, it creates an affinity between the search term, "sofa" and the sofa products that were clicked, so the next user to enter sofa is going to see those same results. SLI says, "Learning Search delivers the results people are looking for on the first page 95% of the time, which means more satisfied, and potentially more loyal customers". You're going to have to be the judge of course if this is true or not, but conceptually it's a nice feature. SLI Systems provides an ecommerce merchandising offering that includes a "related search" feature, targeted promotional banners, custom landing pages and an up/cross-sell capability to push your customers through the buying process. Some or all of these features may be of interest to you, but again unless you're REALLY looking for a Cadillac, either of the other offerings is probably sufficient for most e-commerce sites. We are currently implementing our first SLI solution at time of this writing and so far, it's going well. Once we're finished, I'll add a comment to this entry in order to complete our assessment of all three solutions.

Keep in mind, I've discussed three solutions in this space to present a range of currently-offered tools. If I were trying to do an exhaustive article on this topic, it would be a book and by the time I was done, most of the players would likely have changed by then, so take it for what it's worth - a snapshot of an upcoming software market where we're sure to see many more challengers before we settle into a true landscape of solution providers. Keep that in mind, when deciding on a solution.

So, where do I go from here?

Ultimately, as a storeowner, you will need to assess the cost/benefit of implementing an enhanced site search tool. We have found that the enhanced search tool capability brings shoppers to products that interest them much faster than casual clicking can, and if you have shoppers that don't like to "browse" online, then the fewer clicks you give them, the more likely you'll close a sale and see your conversion rates improve.

Building a Miva Merchant 4 Website with XHTML and CSS

Susan Petracco — Sat, 12 Apr 2008 20:29:00 +0000

For web development purists, the holy grail of coding an ecommerce site using an off-the-shelf package is the ability to write a fully standards-compliant site. The upcoming Miva Merchant 5.5 release brings this desire into full reality for Miva Merchant developers. Version 5.5 offers a completely-open page templating system, where all aspects of the site are fully customizable at the HTML and CSS code level. Historically it was much more difficult to code a Miva Merchant site with XHTML and CSS. We pioneered the effort, using a variety of add-on modules such as OpenUI and OpenUI Supermod templates to provide access to the code around the page elements. But the method also involved a couple of hacks of the core Miva Merchant files, to add a doctype declaration and to change the tags from upper-case to lower-case. OpenUI Supermod templates were slow, so we often added Merchant Optimizer to speed up the site. It worked well, but building a site in this manner was akin to applying band-aid upon band-aid to force a system, never intended to allow standards-compliant code, to produce the desired effect. The release of Miva Merchant 5.0 provided a huge step forward. With the addition of pages that can be templatized nearly from start to finish using Miva Merchant's Store Morph Technology, developers now had the ability to code almost the entire site according to modern standards for markup and layout. A few third-party modules were still needed, to gain access to "black box" code areas such as the category tree. But Miva Merchant 5.0 was already much faster, thanks to the ability to run the shopping cart on a MySQL database (instead of the older DBF files). And with native templating support, which renders quickly due to its compiled nature, several layers of complexity (and those "band-aids") were removed. Miva Merchant 5.5 brings this all into fruition, as developers can now access all of the code that builds the site. To get started, the first thing to do is to make sure every page in the site conforms to the proper doctype. I prefer XHTML 1.0 Strict, though we've sometimes used Transitional for various reasons. A doctype paves the way for CSS positioning by bringing Internet Explorer out of quirks mode, allowing the site to look very similar in all modern browsers, when designed properly. Next, all the tables should be removed from the pages, except when used to display actual tabular data. XHTML and CSS websites rely on CSS positioning to define their layouts, instead of putting images and content within the cells of HTML tables. Typically the only table we use on a CSS-based Miva Merchant site is the layout of the basket contents, since that is tabular data by nature. Instead of using tables, content is placed within other elements according to the nature of the content -

tags for block-level elements; tags for inline content,

tags for paragraphs, etc. Elements can be assigned a class or an id so that they can be styled via the CSS stylesheet. Larger Miva Merchant sites often need to consider the fact that the site may also include other packages or custom-coded sections that reside outside of the Miva Merchant framework. To reduce the load on the filesystem and to keep the assets organized - as well as to make it easy to switch between one client and another - we try to standardize the location of the site's assets. For example, all site-wide graphic files are stored in a /images/ path, just off the document root, and not within the /mm5/ directory tree created by Miva Merchant. (This /images/ folder may be further subdivided into subfolders such as /images/buttons/ as needed.) JavaScript code is placed in external .js files located in a /js/ directory. And the stylesheet(s) are stored in /style/, with the main site stylesheet being named style.css. Additional CSS files may be added for popup windows, printing a page, or page-specific elements, but are almost always stored in the same directory. Once the CSS file has been created, it can be linked into Miva Merchant by adding a