SEO Audit for site redesign
-
Artfx
You have started off correctly, I suggest that you also run the site through Screaming Frog and download the data so that you have an idea of what you do have and the responses. When you do the redesign also run Screaming Frog and check page to page - especially if you end up with redirects.
You could do an SEO audit, but it sounds as if you are already clear you have issues. If questions come up in the redesign, ask them here in Q&A and get the pro help you need. If, after all of that, you need paid SEO audit help, you will have heard a lot and be better prepared to interview SEO firms for that project.I hope that helps you out. Also, Magento is used by a ton of people; you should be fine with it.
Best
Robert
-
Yep, I get all of that. I've experienced page rank siphoning, blatant misuse of my brand name, not to mention a lot of frustration with the big guys that somehow garner traffic for stuff they don't even have! So I guess you helped me answer that question!
-
Thanks, Robert. That's a great suggestion to manage errant URL's and minimize lost rank due to improper redirects. I am a new user of Screaming Frog as well, and really need to take full advantage of it.
-
Agree with the answers, but not the idea that Magento is especially SEO friendly. Input of image tags on products is a royal pain!
-
Thanks, Daniel. And just when I thought my decision was made about the platform! Is that your only complaint about Magento? It seems as though Magento was the most popular choice with regard to an SEO-freindly platform. Is there one you think is better that is open source?
-
I’m a great fan of the Yoast/WordPress combo.But you would need an e-commerce solution on top of that. It could range from Shopify to one of the WordPress plug-ins. It all depends on how complicated your e-commerce is. The developer I worked with on my Magento site (three years old) says he wouldn’t make that choice today. Updates and day-to-day management are just too exasperating.
-
Just a note on Magento, there are a lot of rumors that the CE is going to be discontinued soon. They already announced they are dropping 2Go and another business product. They closed the community forums a couple months ago, I have heard several rumors at events in the industry that they are going to a paid only model.
-
Prestashop....thanks for the heads up.
As they say on Teletubbies..."Uh-Oh!"
What is the scuttlebutt on what the paid model would look like? What would be included?
Artfx....looks more and more like Magento might not be the right choice for you.
Never a good idea to swim towards a sinking ship! Even rats know better.
-
I considered Wordpress (it's my blog platform), but oh, the vulnerabilities! I have heard that it is the one of the best with regard to SEO. We have about 1000 SKU's, and are constantly adding and discontinuing items. Need a lot of flexibility in design and functionality - that's where I think Wordpress carts were falling short. We need lots of promotional pricing options, loyalty program, giftcard management, etc. Need a template-based system that allows us to add landing pages and content pages when ever we need them.
-
Really! Wow, my developer will be in for a shock. I assume they are focusing on their enterprise edition? Is there no more open source carts out there that are good?
-
Daniel - you are right. I am so glad I posted this! I hadn't a clue!
-
They have had a paid model for a while, it is called enterprise edition. If I remember correctly licenses start out around $14k a year. But at the same time I don't use Magento so I could be totally wrong, I just remember looking into it at one time and thinking it was too high.
PrestaShop is a good open source package. It is what I use.
But again I would just like to say these are rumors I have heard about Magento, they just seem true since they are shutting so much down.
-
So...this a great discussion. Yay! Many thanks.
And I appreciate everyone's perspectives.
On the supposed security vulnerabilities of WordPress:
**I think it is much exaggerated. **
WordPress (and its plug ins) are certainly vulnerable...in the sense that they are ubiquitous.
But so what? In the real world...lots of people also break into Yale door locks...because there are so many of them. Does this mean Yale locks are inherently insecure? No. You just need to take reasonable precautions..given the ubiquity.
Some of my clients with Wordpress sites have been hacked. In all cases, the problem was rectified within 3-9 hours (including night and weekends) due to robust back up plans.
Like everything in life, all this is a tradeoff: sites that are seldom hacked due to obscuity...,vs. sites that are often hacked due to ubiquity.
I have been at this a long time.
My mega/meta/uber conclusions are:
-
go with a platform that will be here to stay
-
unbiquity is a virtue
-
beware of grandiose claims from obscure start-ups...or failing platforms
-
-
The security issues with Wordpress are real. It was never designed to be an ecommerce platform, it lacks the security. One of the major security points is the login system. Wordpress only uses one login system, while most ecommerce applications use two. This means you are really open to a cracking type attack. One basic security principal is to never store your admin's in the same table that regular users are stored in. That way, if someone does crack a password in that table, all they will see is 1 user account information, not have control of the whole shop.
Plus you run into the lack of features as a security issue too. Sure you can extend the features with plugins, then you have code written by who knows who, code that might not be secure or might have back doors in it. It is just a bad situation.
Not to mention that the way the templates are written is a huge security risk as well. Wordpress has executable code in the template files. That is how their templates are made. I cannot thik of another ecommerce platform that does this. It kills the whole MVC principal which is built on scalabilty and security.
-
Daniel,
I like the WP Yoast combo as well. Another choice for that platform is WooCommerce. We have used that on several smaller ecommerce sites quite well.
Best
-
Some valid points re: Wordpress security. Some of these risks can be mitigated by a good developer taking reasonable precautions.
I have sometimes used a custom e-commerce solution -- together with a WP/Yoast combo framework.
I have also seen small clients drop a bundle on incredibly robust security for a site with little or no sales. So they are left with little money to spend on promotion or marketing. It's a bit like hiring armed guards and a supe-duper alarm system for an empty bank vault. You also need to think about getting some money on vault to start with.
Like everything else in life, it's a risk tolerance trade off.
-
I hate to be that guy, but the responsible dev practice in this situation is to not use Wordpress as an e-commerce platform.
As far as platform everything is relative in cost. I can set a site up using PrestaShop for close to the same in cost as a site using Wordpress (I am shooting off the hip at what a general Wordpress e-commerce site would cost, but I am thinking 3-5k range just as far as time involved) Sure I do shops that cost 10 times that much, because they want custom features that are not part of the stock package.
But lets speak on robust security and the cost of it. Say you create a site on PrestaShop and one on Wordpress. Say the PrestaShop site costs you more, just for sake of argument. Say 50% more.
Then say the sites are pretty basic sites, they figure shipping manually in an easy way and they use Auth.net for processing transactions.
Both platforms have a auth.net module for their ecommerce integration. But with Wordpress, who made the module? How secure is it? The PrestaShop one is developed by Auth.net and PrestaShop and has went through a 3rd party security analysis and testing.
The default Wordpress login system will let you try as many password combinations as possible to get logged in. You can download and install a module like wp_better security to limit that though. But on the front end of an ecommerce site, how do you set that up for UX? If you lock people out of the site, you might miss sales. You would manually have to manage it, or just disable it, because it might be problematic if you have a site that has 1000 purchases a day, you might be spending a couple hours a day dealing with manual password resets and ip white listing. So I would be willing to bet that most merchants will either write a really lax rule or disable the module after a while, it will just cost them too much money. Since Wordpress uses the same login system for the regular customers and the admin, then it will leave the site open to be cracked on an admin level. But there is always the possibility that someone can create a privilege escalation attack too. Then a regular user's access has been escalated to a SU or Admin. But your site does not store credit card info, because you use the AIM method for auth.net, so they are not really going to get anything. OR are they? If it was me, I would just write an override that processed orders as normal, but at the same time printed the CC info to a text file. Then you would be none the wiser.
Most CC issuers like Visa, Mastercard, ect charge about 10k a month for non compliance with PCI standards, that 50% dev cost can be mitigated real quick with a couple fines levied your way.
-
Prestashop,
I will come back in a few hours and add more re WP security and ecommerce, but I have to say that the last statement stands out: **Most CC issuers like Visa, Mastercard, ect charge about 10k a month for non compliance with PCI standards, that 50% dev cost can be mitigated real quick with a couple fines levied your way. **
This is a strawman argument. I have been processing with MC, Visa, Amex, Discover, and even Diner's Club for 30 years. I have processed over $100 in that time
In order to get a compliance fine, you are going to have to go well beyond choosing WordPress as your CMS on an ecommerce system. You are going to have to go well beyond someone getting into the system via a login and stealing all the data. Here is the question about it: "What was the compliance fine for Target after losing millions of cards and passwords?"Name a system and someone with enough desire and time can crack it. I just disagree that his is a reasonable argument for not using WP. There may be others, but this is not one I would use. We build ecommerce sites using WP and I have zero fear of exposing a client because of that. I think too often in our world people recommend against WP because it seems to be the vogue thing to do and we then don't think it through enough.
-
After posting re the Processor fines, I finished my other project and am returning. On returning, I realize that you are selling a WP alternative and I did not realize that prior: "The PrestaShop one is..." To me, this is not a good thing to do within Q&A and I am even willing to look at your product myself. I just do not think it helps when we sell our own products/services in that way (juxtaposing your product against another). Frankly, when it comes to ecommerce, there are many safe and quality ecommerce platforms. When you make an argument against Magento: "Just a note on Magento, there are a lot of rumors that the CE is going to be discontinued soon, and that argument is a rumor, but you sell a product like theirs, how reasonable is that? To say that WordPress was never meant to be for ecommerce is a bit disingenuous IMO; was Google ever "meant" be in ecommerce? How many things on the Internet are absolutely what they were originally intended to be?
If that is a valid argument, then any offline business that is now online or also online, should not be used as they were not intended to be online.
You may have a great product, but to knock others on a forum like this when you sell that product is not a great way to sell in my opinion.
I hope you can understand I am not against you or against your product; I just disagree with your methods.
Sincerely,
Robert
-
I see how I could have raised some ambiguity about what I am doing and what I do. The truth is I signed up for a Moz account a few years ago and never converted the trial. Then I decided to try it again and converted over to a paid account. When I signed up the first time I used my company name dh42, so the second time I was not allowed to use that name it was taken. So I chose Prestashop, I did not realize that it would end up being my forum posting name at the time. But I am no more affiliated with Prestashop than you are with Wordpress, I am just a developer that uses the platform, nothing more. I don't have any paid modules or themes for them, I get 0 compensation for them other than what I charge clients to develop sites with their software. But I can totally see how my poor choice of nick leads to believe otherwise.
I think Target ended up having to pay around $100M to get things straightened out after their breach. But at the same time their breach was different than an online store breach, it was a hardware level breach from what I understand. But also their transaction amount is a game changer for fines and penalties as well. When you compare 2 stores and one might do 1 million a year vs the other might do 50 billion the rules are different, contracts are negotiated differently. Target might even run their own clearing house, I honestly have no clue how it is working on their level.
But as for it being the hip thing to do to ward against Wordpress that is totally not where I am coming from. I run Wordpress for my site. Let me give an example, there is a company that does a lot of PrestaShop development that I know, they recently did a redesign of their agency site that does not sell anything. They used PrestaShop as the CMS to run the site. I find that weird that someone would use an ecommerce platform for a static site with no products. I told them that at the time. I still think Wordpress would have been a better solution.
What it comes down to in my mind is using the best tool for the job, not the best tool that you know how to use.
I don't know about your Wordpress installations, but with mine, before I started denying by ip on the wp-login page, I would get hundreds of bot connections and login attempts a day. So much so that some of the smaller sites it would be 80% of their monthly traffic. People run bots like this all the time. Those are the people that I think have enough time on their hands. All they have to do is check a config file on the server, like pull a fileexists on say wp-content/ecommerce-package/img.jpg, if the file exists then start the brute force attack. Just like bots are set up around timthumb flaws, I would be willing to bet that there are people that set them up around other flaws as well.
I just have the opinion that Wordpress is inherently insecure on a lot of levels, not just the login system. If you look at any major platform, Magento, Shopify, OS Commerce, PrestaShop, ect, they all have a few things in common. They use a real MVC that separates code from templates, they all have two login systems, they have a module system that extends, not adds functionality. They are built with an ecommerce security minded focus, not an ease of use ease of extension focus.
But I would like to reiterate that I am sorry about the confusion with my name, it was just a poor choice to chose and I am not affiliated with PrestaShop other than being a developer that uses their platform.
-
03170
-
055.4k
-
03189
-
06241
-
161.2k
-
02609
-
04385
-
05906
