Gaining User Trust in eCommerce

Andrew Wikel - Automattic@slash1andy

About WooCommerce

• We are the #1 e-commerce plugin for WordPress.

• We currently power approx. 30% of every online store.

I Like Legos.And Star

Wars.And Star

Wars Legos.

My Background• I love WordPress

• I’ve been working with it since 2008

• I worked for a non-profit for 7 years before coming to WooThemes, and then Automattic

• I work in Payment Gateways Support for WooCommerce at Automattic

The #1 tip for people accepting payment online:

Respect your users’ data, and treat it as your own.

– Andrew Wikel

“It’s all about trust. Getting your users to trust you, and not betraying that trust by securing

their info.”

User Trust

• This is huge. If you don’t have the users’ trust, they won’t give you money.

• There are many factors, and not all of them are technical

Cart Abandonment

• Approx. 42% of customer on average never get past the 1st part of checkout

• There is a huge barrier in getting customers to checkout

Optimize Checkout Process

• Tear down the “sign-in” barrier - don’t disconnect your customer from giving you money. Customers can resent being forced to create an account.

• Provide a progress indicator - just let people know how long the process is, and where they are in it.

• Match the checkout with your site’s look and feel• Never send your customer outside the checkout

process once they are there.• Visually reinforce all sensitive fields on the payment

page

Smashing Magazine Study

• There is a clear divergence between the customer’s mental model of form-field security and the actual security.

• Many test subjects didn’t think about security until they had to enter their credit card details.

• As one test subject who had just abandoned their purchase said, “It didn’t look safe enough.” Her reaction wasn’t based on the technical security of the website, but rather on the perceived security of the fields.

• Source: http://www.smashingmagazine.com/2011/04/06/fundamental-guidelines-of-e-commerce-checkout-design/

Payment Options• I recommend three

payment gateways:

A. Stripe

B. PayPal

C. Amazon

There are a Lot of Implications

• Your payment gateway is the place that your customers are trusting to be safe with their info

• Not only do you have to be completely trusting that they won’t betray *your* trust, but your user does.

• Different gateways have varying security methods some better than others.

On-Site Processing• One of the methods that I mentioned earlier

was Stripe.

• Stripe is what we call an On-Site gateway. That just means that it stays on your site, rather than sending your customers to another site to checkout.

• Amazon is also an on-site processor, but a bit different than Stripe.

Off-Site Processing

• The other method that I recommended in the beginning was PayPal - an Off-Site Processor

• That just means that your customers are sent to another site to complete payment, and then that site sends your store a notification that payment was complete.

PCI Compliance

• Payment Card Industry Data Security Standard (PCI DSS) is a set of rules that ALL companies that process, store, or transmit credit card info have to follow to maintain security.

• PCI-DSS SAQ A-EP is where you want to be.

That is the theory.

Do

• Have a clear, user-friendly privacy policy

• Make your email lists strictly opt-in

• Use an SSL on EVERY SINGLE PAGE that has a checkout form, log in form, etc. There are no exceptions.

Don’t• Some people obscure their return policy or

privacy policy

• It’s a bad idea to mail people without their permission or sell or give their info to others.

• One of the worst things you can do is have a credit card form on a plain HTTP page. Please just don’t.

Privacy Policy• *Have* a privacy policy. It’s almost a majority

of small business owners that don’t have one.

• Use minimal “legalese” and with the user retaining their rights to privacy.

• Ask for as little permissions and information as possible. Not only does that improve your chances of getting it, but it limits the info you have to care for.

Mailing Lists• Mailing lists should be double opt-in, with few

exceptions.

• There are a lot of guidelines to email marketing that you should look into (laws you have to comply with, etc.

• Use a reputable email service to send out your emails. You can get a service like MailChimp at a low cost, and the tools that they have are worth it.

Why All This Work?• Giving the power to your customer to make

decisions based on what information they do and don’t want you to have is always good for business.

• You want your customers to feel empowered, able to choose, and know what is happening with their data.

• Knowledge and transparency = Trust

SSL: The tl;dr• Purchase and install an SSL certificate

• Update your site URL in WordPress

• Force HTTPS throughout the site

• Resolve any insecure elements on your pages

• Update Google Webmaster Tools and Google Analytics

Installing an SSL Certificate

• Purchase from your host, and have them install it. (hands down the easiest way)

• Use https://letsencrypt.org/ (FREE)

• Do it yourself (slightly masochistic, but ¯\_(ツ )_/¯)

Forcing over HTTPS

• Your blog/site URL in WordPress general settings

• Use WordPress Force HTTPS

• .htaccess rewrite rules

Resolving Mixed Content

• Use Better Search Replace (replace all http with https in the posts and postmeta tables)

• Your theme and/or plugins could also be loading in assets over a hardcoded http call, but you can fix those sometimes with child themes, or you might be better off switching themes/plugins.

Security

Probably the Easiest One

• Keep *all the things* updated.

• Themes

• Plugins

• WordPress

General WordPress Security

• Use strong passwords. Seriously, stop using your cat’s name.

• Change the username from “admin” or easy to guess ones

• Your database username and password are also at risk.

• Disable file editing from the WordPress admin define( ‘DISALLOW_FILE_EDIT’, true );

Security Plugins

• Prevention

• Scans

• Backups

Security Plugins• Jetpack

• Wordfence

• iThemes Security

• Sucuri

https://jetpack.me/

https://wordpress.org/plugins/wordfence/

https://ithemes.com/security/

https://wordpress.org/plugins/sucuri-scanner/

Hosting• Your host plays a critical role in your security.

• Never pick a host that starts you out on a PHP version that is lower than 5.4

• They should have firewalls in place, have correct file permissions set up, not allow for connections via plain FTP, etc.

• Shared hosting is cheap, but it’s probably not really worth the risk.

Use Good Code

• Pick plugins/themes with good support behind them.

• Most times, this means premium code (you have to pay for it)

Limit External Connections

• Sometimes you use 3rd party solutions for parts of your store (shipping, tax, inventory, accounting, etc.)

• Even things that don’t relate to your store can potentially have access.

• Make sure you investigate who has what of your site’s data, what their security is like, and what their privacy policy is like.

The #1 tip for people accepting payment online:

Respect your users’ data, and treat it as your own.

@slash1andy@WooThemes@Automattic