SEO Audit for site redesign
-
So...this a great discussion. Yay! Many thanks.
And I appreciate everyone's perspectives.
On the supposed security vulnerabilities of WordPress:
**I think it is much exaggerated. **
WordPress (and its plug ins) are certainly vulnerable...in the sense that they are ubiquitous.
But so what? In the real world...lots of people also break into Yale door locks...because there are so many of them. Does this mean Yale locks are inherently insecure? No. You just need to take reasonable precautions..given the ubiquity.
Some of my clients with Wordpress sites have been hacked. In all cases, the problem was rectified within 3-9 hours (including night and weekends) due to robust back up plans.
Like everything in life, all this is a tradeoff: sites that are seldom hacked due to obscuity...,vs. sites that are often hacked due to ubiquity.
I have been at this a long time.
My mega/meta/uber conclusions are:
-
go with a platform that will be here to stay
-
unbiquity is a virtue
-
beware of grandiose claims from obscure start-ups...or failing platforms
-
-
The security issues with Wordpress are real. It was never designed to be an ecommerce platform, it lacks the security. One of the major security points is the login system. Wordpress only uses one login system, while most ecommerce applications use two. This means you are really open to a cracking type attack. One basic security principal is to never store your admin's in the same table that regular users are stored in. That way, if someone does crack a password in that table, all they will see is 1 user account information, not have control of the whole shop.
Plus you run into the lack of features as a security issue too. Sure you can extend the features with plugins, then you have code written by who knows who, code that might not be secure or might have back doors in it. It is just a bad situation.
Not to mention that the way the templates are written is a huge security risk as well. Wordpress has executable code in the template files. That is how their templates are made. I cannot thik of another ecommerce platform that does this. It kills the whole MVC principal which is built on scalabilty and security.
-
Daniel,
I like the WP Yoast combo as well. Another choice for that platform is WooCommerce. We have used that on several smaller ecommerce sites quite well.
Best
-
Some valid points re: Wordpress security. Some of these risks can be mitigated by a good developer taking reasonable precautions.
I have sometimes used a custom e-commerce solution -- together with a WP/Yoast combo framework.
I have also seen small clients drop a bundle on incredibly robust security for a site with little or no sales. So they are left with little money to spend on promotion or marketing. It's a bit like hiring armed guards and a supe-duper alarm system for an empty bank vault. You also need to think about getting some money on vault to start with.
Like everything else in life, it's a risk tolerance trade off.
-
I hate to be that guy, but the responsible dev practice in this situation is to not use Wordpress as an e-commerce platform.
As far as platform everything is relative in cost. I can set a site up using PrestaShop for close to the same in cost as a site using Wordpress (I am shooting off the hip at what a general Wordpress e-commerce site would cost, but I am thinking 3-5k range just as far as time involved) Sure I do shops that cost 10 times that much, because they want custom features that are not part of the stock package.
But lets speak on robust security and the cost of it. Say you create a site on PrestaShop and one on Wordpress. Say the PrestaShop site costs you more, just for sake of argument. Say 50% more.
Then say the sites are pretty basic sites, they figure shipping manually in an easy way and they use Auth.net for processing transactions.
Both platforms have a auth.net module for their ecommerce integration. But with Wordpress, who made the module? How secure is it? The PrestaShop one is developed by Auth.net and PrestaShop and has went through a 3rd party security analysis and testing.
The default Wordpress login system will let you try as many password combinations as possible to get logged in. You can download and install a module like wp_better security to limit that though. But on the front end of an ecommerce site, how do you set that up for UX? If you lock people out of the site, you might miss sales. You would manually have to manage it, or just disable it, because it might be problematic if you have a site that has 1000 purchases a day, you might be spending a couple hours a day dealing with manual password resets and ip white listing. So I would be willing to bet that most merchants will either write a really lax rule or disable the module after a while, it will just cost them too much money. Since Wordpress uses the same login system for the regular customers and the admin, then it will leave the site open to be cracked on an admin level. But there is always the possibility that someone can create a privilege escalation attack too. Then a regular user's access has been escalated to a SU or Admin. But your site does not store credit card info, because you use the AIM method for auth.net, so they are not really going to get anything. OR are they? If it was me, I would just write an override that processed orders as normal, but at the same time printed the CC info to a text file. Then you would be none the wiser.
Most CC issuers like Visa, Mastercard, ect charge about 10k a month for non compliance with PCI standards, that 50% dev cost can be mitigated real quick with a couple fines levied your way.
-
Prestashop,
I will come back in a few hours and add more re WP security and ecommerce, but I have to say that the last statement stands out: **Most CC issuers like Visa, Mastercard, ect charge about 10k a month for non compliance with PCI standards, that 50% dev cost can be mitigated real quick with a couple fines levied your way. **
This is a strawman argument. I have been processing with MC, Visa, Amex, Discover, and even Diner's Club for 30 years. I have processed over $100 in that time
In order to get a compliance fine, you are going to have to go well beyond choosing WordPress as your CMS on an ecommerce system. You are going to have to go well beyond someone getting into the system via a login and stealing all the data. Here is the question about it: "What was the compliance fine for Target after losing millions of cards and passwords?"Name a system and someone with enough desire and time can crack it. I just disagree that his is a reasonable argument for not using WP. There may be others, but this is not one I would use. We build ecommerce sites using WP and I have zero fear of exposing a client because of that. I think too often in our world people recommend against WP because it seems to be the vogue thing to do and we then don't think it through enough.
-
After posting re the Processor fines, I finished my other project and am returning. On returning, I realize that you are selling a WP alternative and I did not realize that prior: "The PrestaShop one is..." To me, this is not a good thing to do within Q&A and I am even willing to look at your product myself. I just do not think it helps when we sell our own products/services in that way (juxtaposing your product against another). Frankly, when it comes to ecommerce, there are many safe and quality ecommerce platforms. When you make an argument against Magento: "Just a note on Magento, there are a lot of rumors that the CE is going to be discontinued soon, and that argument is a rumor, but you sell a product like theirs, how reasonable is that? To say that WordPress was never meant to be for ecommerce is a bit disingenuous IMO; was Google ever "meant" be in ecommerce? How many things on the Internet are absolutely what they were originally intended to be?
If that is a valid argument, then any offline business that is now online or also online, should not be used as they were not intended to be online.
You may have a great product, but to knock others on a forum like this when you sell that product is not a great way to sell in my opinion.
I hope you can understand I am not against you or against your product; I just disagree with your methods.
Sincerely,
Robert
-
I see how I could have raised some ambiguity about what I am doing and what I do. The truth is I signed up for a Moz account a few years ago and never converted the trial. Then I decided to try it again and converted over to a paid account. When I signed up the first time I used my company name dh42, so the second time I was not allowed to use that name it was taken. So I chose Prestashop, I did not realize that it would end up being my forum posting name at the time. But I am no more affiliated with Prestashop than you are with Wordpress, I am just a developer that uses the platform, nothing more. I don't have any paid modules or themes for them, I get 0 compensation for them other than what I charge clients to develop sites with their software. But I can totally see how my poor choice of nick leads to believe otherwise.
I think Target ended up having to pay around $100M to get things straightened out after their breach. But at the same time their breach was different than an online store breach, it was a hardware level breach from what I understand. But also their transaction amount is a game changer for fines and penalties as well. When you compare 2 stores and one might do 1 million a year vs the other might do 50 billion the rules are different, contracts are negotiated differently. Target might even run their own clearing house, I honestly have no clue how it is working on their level.
But as for it being the hip thing to do to ward against Wordpress that is totally not where I am coming from. I run Wordpress for my site. Let me give an example, there is a company that does a lot of PrestaShop development that I know, they recently did a redesign of their agency site that does not sell anything. They used PrestaShop as the CMS to run the site. I find that weird that someone would use an ecommerce platform for a static site with no products. I told them that at the time. I still think Wordpress would have been a better solution.
What it comes down to in my mind is using the best tool for the job, not the best tool that you know how to use.
I don't know about your Wordpress installations, but with mine, before I started denying by ip on the wp-login page, I would get hundreds of bot connections and login attempts a day. So much so that some of the smaller sites it would be 80% of their monthly traffic. People run bots like this all the time. Those are the people that I think have enough time on their hands. All they have to do is check a config file on the server, like pull a fileexists on say wp-content/ecommerce-package/img.jpg, if the file exists then start the brute force attack. Just like bots are set up around timthumb flaws, I would be willing to bet that there are people that set them up around other flaws as well.
I just have the opinion that Wordpress is inherently insecure on a lot of levels, not just the login system. If you look at any major platform, Magento, Shopify, OS Commerce, PrestaShop, ect, they all have a few things in common. They use a real MVC that separates code from templates, they all have two login systems, they have a module system that extends, not adds functionality. They are built with an ecommerce security minded focus, not an ease of use ease of extension focus.
But I would like to reiterate that I am sorry about the confusion with my name, it was just a poor choice to chose and I am not affiliated with PrestaShop other than being a developer that uses their platform.
-
Lesley, if you edit your profile, you can change your nickname that's displayed here. I think that would be a helpful thing to do here, as the current nickname is leading to a bit of confusion. I'd ask the same of anyone that had a nickname like "Wordpress" or "Magento" that wasn't a direct representative of that company.
You can also uncheck the box that says to use your nickname, and you can use you real name for posting instead.
As Robert mentioned, it could be a good idea to include some context with your answer. "I realize that our company is an alternative to product x, but here's why I think there are some issues with product x" and including an outside referenced link could be helpful all around.
Thanks!
-
The chosen account name was a bit of it, but when you then said, " Sure I do shops that cost 10 times that much, because they want custom features that are not part of the stock package." and similar things it appeared you worked for or were the dev for PrestaShop. My apologies on that.
As to the security criticisms of WP, I simply do not see it the way that you do. I also am not aware of any major issues with Magento, rumor or otherwise. I simply think that if you are going to knock something it needs to be very concrete. I have knocked products on this very forum, but I really do strive to be very clear and make it totally "behavioral" (how a system performs or fails to perform) than any conjecture. I do not have the 100s of bot connections and login attempts and I do not have the time to go into a security dissertation regarding our mechanisms. I just do not see that problem. I am sure there are others here who have more experience than mine on WP, Magento, WooCommerce, PrestaShop, etc. I just have not seen the issue in my experience. Nor have I seen it with sites needing HIPAA compliance, etc.
As to my reference to TARGET around your MC/Visa fine statement there have been implied costs associated with lost business and with lawsuits, but I just checked again to be sure and I can find nothing stating that TARGET was fined by MC/Visa. In fact the head of MC said that cards need chips in them right after it happened! Frankly, I cannot find any fines they have paid due to that data breach. Again, using a straw man like fines of "$10K per day" is not a good way to argue. It lends a certain weight, emotionally, to the argument, but nothing real. Your argument regarding MC/Visa fines is a false argument, it is a total straw man. You are implying that due to WP a person would be opening themselves up to huge fines and it is patently not true. It impunes WP and all of the open source developers who have spent tons of time and money on that work.
Again, this is simply about approach. I hope you understand that. So, maybe it is just a bit of really believing in PrestaShop (and trust me that after this I am going to go check it out), I just did not think it was the best way to go about it.
Best
Robert
-
Totally reasonable, I didn't really know that existed, but it is changed. Sorry for the confusion. Also, like I mentioned I am just a company that uses the product, not someone at the company itself. I do contribute on the blog every now and then too. But as for some links for reference, here are a couple
Magento's forum closed
http://www.magentocommerce.com/boards
Magento Closing products
Like I mentioned above I am just mixing the on the record facts, with what I have heard from some insiders. It could be wrong, it could be right. I know because of the nature of is talked about here we all have to do a little bit of speculation because we are generally discussing systems and companies that we have no direct control of.
But like I mentioned above I can totally see how my name and the posts created a misleading environment and I have changed my name.
-
Sorry about not being clear on the dev. PrestaShop is totally OSS like Magento or Wordpress. So generally what we do is take a spec from a client, see if their are modules commercially available for the functionality they want. If not, we just figure in developing them from scratch. I think how most people do with a site of that magnitude.
As for the really believing in PrestaShop, I do. It might not be the best situation, but I do have all of my eggs in that basket and I hope nothing bad becomes of it.
-
This post is deleted!
-
0565
-
04187
-
03170
-
03302
-
06241
-
07219
-
07384
