It’s almost an unwritten rule that every tech session has to have at least one lego picture, so here is the required slide.
It’s also a requirement that you include cat pictures, but that’s not really my style, so here is a picture of my Airedale.
This chart is from a survey of people on their trust in online commerce. People trust the e-commerce platforms as a whole, but are becoming more tech-savvy and discerning when it comes to where they place their trust.
People abandon carts based on payment processor, on the price of shipping, of having to pay sales tax, of a myriad of other issues. You can’t stop them all, but you can reduce them.
There are a lot of ways to do this, but we are going to stick to some really generic tips.
If you have a credit card breach, you will be fined. That is guaranteed.
Tell the story of the WooCommerce offline payment gateway.
SSL stands for Secure Sockets Layer. It provides a secure connection between internet browsers and websites, allowing you to transmit private data online. Sites secured with SSL display a padlock in the browsers URL and possibly a green address bar if secured by an EV Certificate
With any kind of on-site processor, you will NEED an SSL certificate. It’s not optional. If you have a WooThemes extension for an on-site processor, then you will actually be required to have that in place before the gateway will function.
These are actually the most secure and easiest to implement in your store, typically. You are offloading all the responsibility for securing the payment process to the actual payment processor. The downside to this is the jump that customers have to make to go through the step of paying on another site, rather than yours.
Sometimes this can be an issue with cart abandonment. Sometimes the exact opposite is true, and your customer actually trusts the payment processor more than you. PayPal is a perfect example of this. Most people know of PayPal, and a good percentage of your customers likely have an account already. This can help lower the barrier of purchase for new customers, and also helps lend credibility to your store, borrowing off of PayPal’s credibility with the customer.
PCI DSS Self Assessment Questionnaire A is much less strenuous to go through than other compliance. There’s 5 pages of questions (not really that hard), compared to 30 for A-EP, and 65 for D. If you use either of the payment gateways that I mentioned earlier, you qualify for A-EP instead of the strenuous audits, etc. that can come with other gateways that don’t post directly to the processor servers.
If all elements of the payment form originate from the payment processor (e.g. a straight redirect or iFrame) then SAQ A can be used
Stripe will handle all your credit card processing, and then PayPal is that alternative payment method that I mentioned earlier.
A lot of people love using PayPal, since it’s accepted in a lot of places, they have their details already saved there, and they trust PayPal to keep their info safe.
Stripe is a great method for credit card processing, as it’s a really extendable processor, and integrates in most online solutions. It save their card to Stripe’s servers, enables them to charge the user card without the user having to input it again. This is great for recurring payments, such as subscriptions or monthly donations. Also, some customers already use Stripe to save their payment methods from other sites, and Stripe can remember them.
Now we are going to move into a bit more technical things. Things to actually do to increase user security and trust.
For the SSL, you can have it running on your entire site, and that is a good thing. Make sure that you don’t have any errors about mixed content when your customer goes to checkout.
Tell them the Cliff Original story about no SSL.
Don’t ask for random unnecessary info, like gender, income levels, etc.
The FTC has a lot of resources on Privacy policies and privacy in general.
Double opt-in means that they sign up on your site, and then are emailed another “permission request” that they have to respond to. It’s a lot more arduous process to go through to get a subscriber, but your customers will appreciate it, and you will have the knowledge that these people really want to hear from you, and will reduce the rate your emails are not opened, or marked as spam, which hurts you in the long run.
Most reputable email services provide what you are going to need to comply with the laws governing mailing, as well as best practices (double opt-in, etc.)
This is by no means a comprehensive guide on SSL certificates or anything like that, but I do want you to understand a bit about them. This will tell you how to force the entire site over HTTPS
I got a lot of this info from the Give guide on this.
having your host do it for you is the best/easiest way.
Let’s Encrypt is a venture that is free and open to use, and is basically a push from a group of companies, including the Linux Foundation, Mozilla, Cisco, and Automattic to get more people encrypting and securing their sites.
Doing it yourself: If you want to do this, have fun. Call me when you are done, and tell me how it went.
Needless to say, a breach of your site that discloses user info is not good for business.
It’s a complicated topic, and there’s no magic silver bullet to take care of all your needs. I’m going to take the next few slides to talk about some easy ways to implement a higher security standard for your site.
There really isn’t a reason to not running the latest and greatest. #1 source of hacks happen through old software with patches available that people just don’t update.
Passwords typically are the second weakest link in the security chain (out-of-date code being the first), since most people use the same stupid ones. Brute forcing attacks can guess many passwords within a few hours of random guessing. Having a unique username and password greatly increases the time needed to crack your credentials via brute forcing. WordPress 4.3 comes with a tool to help with making better passwords, so it might be time to revisit those. Also, password managers can really help with generating secure passwords.
It sounds cliche and kind of stupid, but the best password is the password that you can’t remember. If you can remember it, it’s typically way too easy for someone to guess.
There are a few different categories for security add-ons for WordPress. A lot of plugins do some or all of these things.
Prevention is what it sounds like; they typically do things like block brute force attempts and lock out the IP addresses that a lot of login attempts come from, help you lock down your settings and things to make sure you are secure, etc.
Scans can look for file changes (from malicious bots/people) or actively scan for known malware, etc.
Backups are pretty straight forward - they backup your site, and store it either off-site or on your server. I greatly prefer an off-site service to an on-site one, as there is a chance that if you are compromised, your backups could be too.
Jetpack - Brute force protection, site monitoring for downtime, managing updates across multiple sites in one dashboard, and security scans and off-site backups (with a VaultPress subscription; you can try free)
Wordfence - Scans your site initially to check for infection, then provides prevention security, login security, firewall, and then scheduled scans, etc. with a premium license.
iThemes Security - Provides much of the same as above, with some nice features like Strong Password enforcement; offers paid version
Sucuri Scanner - Same types of things as the others, but one stand out feature from them is the CloudProxy Firewall (need a subscription) which offers some cool things like DDOS protection, access control, and then some speed features
If your host is terrible, then you can build a rock solid site on top of a pile of quicksand, and end up sunk.
Shared hosting is one of the unsung dangers in eCommerce, as your security is only as good as the worst secured site on that server.
This is fairly broad, and I’m really not going to get a whole lot into this, but use good code.
The most important part of this is making sure that the plugins are supported well, and especially have regular updates. If a plugin is not updated regularly, then you run risks with security, as well as compatibility.
Premium code means that the authors have a very good reason (money) to provide support/updates, and stay on top of security vulnerabilities, etc.
This is not disparaging the many awesome themes and plugins out there that are free, but just make sure that you vet the code.
Your weakest link is the weakest link that has access to the site data. It might be a site management system, or a dropshipper, but they have access to parts of your customer’s info, and as such, need to have their security and privacy policies reviewed.
Tell the T-Mobile story: 15 million T-mobile subscribers had their data breached when Experian was hacked over the last few weeks. They handled credit reviews and checks for T-Mobile
Moral of the story: Be careful who you trust with your user’s data, as ultimately, it comes back on you if anything happens.
Well this is about the end of the presentation. Thanks for joining me.
E-commerce information security (user trust)
WooCommerceWe are the #1 e-commerce plugin for
We currently power approx. 37% of every online
I Like Legos.
And Star Wars.
And Star Wars Legos.
• I love WordPress
• I’ve been working with it since 2008
• I worked for a non-profit for 7 years before
coming to WooThemes, and then Automattic
• I work in Payment Gateways Support for
WooCommerce at Automattic
The #1 tip for people accepting payment online:
Respect your users’ data, and treat it as your own.
It’s all about trust. Getting your users to trust you,
and not betraying that trust by securing their info.
This is huge. If you don’t have the users’ trust, they won’t
give you money.
There are many factors, and not all of them are technical
• Approx. 67% of customer on average never
• There is a huge barrier in getting customers
Process• Tear down the “sign-in” barrier - don’t disconnect your
customer from giving you money. Customers can resent
being forced to create an account.
• Provide a progress indicator - just let people know how
long the process is, and where they are in it.
• Match the checkout with your site’s look and feel
• Never send your customer outside the checkout process
once they are there.
• Visually reinforce all sensitive fields on the payment page
StudyThere is a clear divergence between the customer’s mental model of form-field security and the actual security.
Many test subjects didn’t think about security until they had to enter their credit card details.
As one test subject who had just abandoned their purchase said, “It didn’t look safe enough.” Her reaction
wasn’t based on the technical security of the website, but rather on the perceived security of the fields.
• Payment Card Industry Data Security
Standard (PCI DSS) is a set of rules that ALL
companies that process, store, or transmit
credit card info have to follow to maintain
• PCI-DSS SAQ A is where you want to be.
There are a Lot of
• Your payment gateway is the place that your
customers are trusting to be safe with their
• Not only do you have to be completely
trusting that they won’t betray *your* trust, but
your user does.
• Different gateways have varying security
methods some better than others.
• That just means that it stays on your site,
rather than sending your customers to
another site to checkout.
• There are multiple ways to make this happen,
varying in the security of the methods.
• That just means that your customers are sent
to another site to complete payment, and
then that site sends your store a notification
that payment was complete.
PCI-DSS SAQ A-EP
• This includes a lot of the payment gateways
in use, including most authorize.net
• Methods like PayPal and other redirect
methods are definitely under SAQ-A.
• Other methods that are include Stripe, Pay
With Amazon, and Braintree (at least the
ones that we make), since they are all
iFrames coming directly from the payment
I recommend 4 payment
• Make your email lists strictly opt-in
• Use an SSL on EVERY SINGLE PAGE that
has a checkout form, log in form, etc. There
are no exceptions.
• Some people obscure their return policy or
• It’s a bad idea to mail people without their
permission or sell or give their info to others.
• One of the worst things you can do is have a
credit card form on a plain HTTP page.
Please just don’t.
of small business owners that don’t have one.
• Use minimal “legalese” and with the user
retaining their rights to privacy.
• Ask for as little permissions and information
as possible. Not only does that improve your
chances of getting it, but it limits the info you
have to care for.
• Mailing lists should be double opt-in, with few
• There are a lot of guidelines to email
marketing that you should look into (laws you
have to comply with, etc.
• Use a reputable email service to send out
your emails. You can get a service like
MailChimp at a low cost, and the tools that
they have are worth it.
Why All This Work?
• Giving the power to your customer to make
decisions based on what information they do
and don’t want you to have is always good for
• You want your customers to feel empowered,
able to choose, and know what is happening
with their data.
• Knowledge and transparency = Trust
• Purchase and install an SSL certificate
• Update your site URL in WordPress
• Force HTTPS throughout the site
• Resolve any insecure elements on your
• Update Google Webmaster Tools and
Installing an SSL
• Purchase from your host, and have them
install it. (hands down the easiest way)
• Use https://letsencrypt.org/ (FREE)
• Do it yourself (slightly masochistic, but ¯_(ツ
Forcing over HTTPS
• Your blog/site URL in WordPress general
• Use WordPress Force HTTPS
• .htaccess rewrite rules
• Use Better Search Replace (replace all http
with https in the posts and postmeta tables)
• Your theme and/or plugins could also be
loading in assets over a hardcoded http call,
but you can fix those sometimes with child
themes, or you might be better off switching
Probably the Easiest One
• Keep *all the things* updated.
Security• Use strong passwords. Seriously, stop using
your cat’s name.
• Change the username from “admin” or easy
to guess ones
• Your database username and password are
also at risk.
• Disable file editing from the WordPress admin
define( ‘DISALLOW_FILE_EDIT’, true );
• Your host plays a critical role in your security.
• Never pick a host that starts you out on a
PHP version that is lower than 5.4
• They should have firewalls in place, have
correct file permissions set up, not allow for
connections via plain FTP, etc.
• Shared hosting is cheap, but it’s probably not
really worth the risk.
Use Good Code
• Pick plugins/themes with good support
• A lot of times, this means premium code (you
might have to pay for it)
Connections• Sometimes you use 3rd party solutions for
parts of your store (shipping, tax, inventory,
• Even things that don’t relate to your store can
potentially have access.
• Make sure you investigate who has what of
your site’s data, what their security is like,
The #1 tip for people accepting payment online:
Respect your users’ data, and treat it as your own.