Red Kite Creative

The “Minding Your Business” Blog

Does Your Website Need a Privacy Policy?

by Leave a Comment

If you have a form on your site, the answer is ‘yes.’

If you collect any type of personally identifiable information (PII) like names, email addresses, phone numbers, or payment information, you need to have a privacy policy on your site. If not, you potentially risk penalties and legal challenges down the road. And if you have an old privacy policy, it most likely has not kept pace with legal changes.

Privacy law is changing fast – more U.S. states are moving to create their own privacy legislation, and if you have European customers, you may already be familiar with the GDPR (General Data Privacy Regulation) that requires protection and disclosure of customer data.

The Colorado Privacy Act

Did you know that Colorado (where we’re based) has a brand new privacy law that was officially enacted on July 8, 2021? It’s the third state (after CA and VA) to enact privacy legislation. If you conduct business in our state or target residents of CO with your products and services, this new law may apply to your business if you have more than 25,000 customers. More information on the Colorado Privacy Act here.

How to Get a Privacy Policy

Check out our sister site WP Minder’s latest post on why websites need privacy policies and get in touch if you have questions or are interested in getting a policy added to your own site.

Three Ways to Share Confidential Info (More) Safely

by Leave a Comment

I often need to get sensitive information from clients: domain registrar login, FTP credentials, hosting account login, etc. Sending this kind of info by email is not a good idea, it’s too insecure (although it’s hard to keep clients from doing it anyway sometimes).

What should you do instead? A phone call to share long passwords is not that helpful. But there are some online tools that are built to ‘self-destruct’ once they’re read or after a specific short timeframe. Here are three.

QuickForget.com

This is my go-to tool for sending secrets online. You can attach files, and set it to delete the message after a set number of views or a certain number of hours. The sender types or pastes their sensitive info, selects options and saves, then sends the recipient the link. Very easy to use.

OneTimeSecret.com

This one allows you to set a time limit as short as 5 minutes (virtually a self-destruct on reading) and a password (or generate a random one).

privnote.com

Similar to the first two, privnote also has some other features. By default it asks for confirmation by the recipient before showing and destroying the note (which you can disable). You can also send yourself, the sender, a note when the private message has been destroyed. And you can set the message to self-destruct immediately after reading.

Any of these tools is a much safer option than using email to send confidential info.

Did you find this information useful? Please share with your friends and colleagues and comment below if you have questions.

Weekly Links Roundup – Product Descriptions, Button Design, Accessibility, Low-cost Marketing Ideas

by

The top website and online marketing links of the week.

Selling online? Check out this detailed post on how to write a good product description. A persuasive product description might be the very last chance you have to convince a potential customer to buy – just like high-quality photos are critical for ecommerce sites, so are well-written product descriptions.

Here’s an interesting post about button design that I found when working on a new theme this week. Have you ever thought about the differences between rounded vs. sharp-angled buttons – especially if you use a plugin for creating lots of different types of buttons? There’s more to it than you might think – the shape of a button can send a subtle message to your user. Learn how to have more control over your messaging.

While there are some plugins and overlays that claim to make websites ADA-accessible, think twice before relying on them. Lawsuits are being filed against some sites using these quick-fix tools. Learn why there is no silver bullet for making a website accessible.

Looking for low-cost marketing ideas for your business? Here are 14 small business marketing ideas you can execute online today.

Did you find this information useful? Please share with your friends and colleagues! And comment below with questions or observations.

Passivity Toward Clients

by

Back around Christmas I got a Samsung Galaxy Active 2 watch to replace my old Garmin Vivofit. The watch is really nice, it has completely replaced my Garmin devices including a 230 running watch – so much better than that.

But it has one really strange problem that I encountered the first time I used my ski machine.

The watch connects to Samsung Health on a phone. I like this better than Garmin’s Connect dashboard.

In the watch when you work out, you can choose from a lot of different workouts from walking to running to lifting to hiking to swimming… many others. There’s an ‘Other Workout’ that I use for gardening and yard work.

However – in Samsung Health (phone app) there are hundreds of activities to choose from. Only a tiny number are actually available in the watch.

There’s no way to add one workout type, the way you add an app or widget to the watch. There’s no way to create a custom workout in the watch.

This seems to me really odd, that such a great watch with so many health features has this severe limitation. Cross country skiing would work great for my ski machine. It’s in the app, but not available on the watch.

When I contacted their support and asked about this, they cheerfully told me to put in a feature request. Here is the thread in the Samsung user community regarding the missing workouts on the watch. It was started just over a year ago and has 8 pages of users wondering why a seemingly basic feature is missing on this high-end, rather expensive health-focused watch. Samsung support marked the issue ‘solved’ on the same day it was posted, but it has never been ‘solved’ or addressed since by Samsung.

That’s passivity toward customers. A lack of concern over a key issue that affects a lot of their watch users who have a genuine need for a basic feature.

This week I got a new password manager that has features I need for handling particular business data. It’s a lot better than my previous one, and offers an important feature that lets me customize templates to hold my data in a really organized way. That’s great!

However, as you might imagine, business data might change from time to time. Although you can delete these custom templates, you can never edit them.

So if for example you eventually need to remove a few fields or add a few fields to your custom template, you can’t. Period. You have to first:

  • Create a new custom template.
  • Manually copy all the info for all the custom notes you’ve created into the new custom template – if you have 500 notes, you have to do this 500 times.
  • Then delete the old custom template.

Just like with the Galaxy watch, this edit feature has been requested by users. Not just for 1 year. It’s been a feature request since 2016.

There are a number of threads in their forum asking for this feature. A few of the larger ones have 50+ users involved. So far, I have not seen a single response in any of these forum threads by the password manager support team.

This is, again, an example of a company being passive towards users asking for what should be a basic feature.

In addition, the documentation I’ve read on the company website regarding this and other features is from 2016. Not updating docs is also a sign of passivity.

When I contacted them, they told me:

“We do appreciate your comment and added feedback, and this could be forwarded to our dev team as a feature request. Rest assured I will pass this along to our dev team so they can review, though, I cannot guarantee that this will be added.”

I’m not hopeful that it will ever happen. But at least I know upfront that I’m dealing with a company that really has demonstrated very little concern or interest in its users at least regarding this particular problem. I know that I may be on my own or out of luck if I do have an issue.

I never want my clients to feel this way about Red Kite. I try really hard to always put myself in the client’s position when they contact me about an issue or question, and to do everything I can to give them the best answers possible. Active listening is always better than passive head-nodding.

And I’m thankful that the vast majority of companies that I deal with as a business owner are not passive. They are very interested in solving problems for their customers as quickly as possible – they’re responsive, they actually listen, and they try to come up with the best answers they can. That’s how it should be.

Tips for Extracting a Site from WordPress Multisite

by

A few weeks ago, I had a waking nightmare.

It started early one Tuesday afternoon and went well into the evening, and it was brought on by my casual agreement to help a client migrate one of three sites out of a WordPress Multisite installation to a standalone install. It started off so innocently…

(FYI, if you’re not familiar with Multisite, it’s a tool for setting up a network of WordPress sites all managed from the same admin dashboard. Learn all about Multisite.)

We originally set this  Multisite installation up about 7-8 years ago as it seemed like the perfect solution to manage several sites from one dashboard. My client has disliked it ever since the newness wore off a few months after launch. And as her developer, I haven’t had a happy experience with it either. It seems really clunky and my client always found it difficult to use.

Breaking it up into separate sites seemed like too much bother, but this week she was finally ready, and based on the posts I saw about extracting sites from Multisite when researching the task, it didn’t seem like a big deal to me.

Nope. I was totally wrong about that. It was an enormously big deal.

I am no expert with Multisite by any means and this is not a complete guide to extracting a site from Multisite. But in hopes that I can help another developer get through this process without as much frustration (on the edge of tears a few times), I want to share some tips for this process that would have saved me a lot of time had I known them up front.

Tips for Multisite Extraction

1. When moving a site, normally I’d copy it with All In One WP Migration, which makes it super-easy to migrate a site from one host to another. But when using Multisite you can’t do that (there are some commercial plugins that will handle backups and sometimes migrations for Multisite installs, but they are much more complex than regular sites). So…

Start with a fresh install of WordPress, preferably on a test server you know well.

2. Copy the theme from the live site by downloading it via FTP and then uploading to the test site. Make sure it looks okay when you activate it.

3. Before attempting to move any content, you’re going to want to get all the plugins moved into your test site. You can manually install them one at a time, or you can copy the /wp-content/plugins/ folder from the live site to the test site.

4. For any plugins that need special settings, like WooCommerce, get those set up before migrating in the content from the live site. I didn’t do this the first time and wound up having to import content several times to get everything to come in correctly.

5. Once all plugins are set up and the theme is working fine, it’s time to get the content in. Using the WordPress Importer in Tools, export all the content from the live site. When you import into the test site, let it create the users it needs and be sure to check the tickbox to “Download and import file attachments.” See this guide for transferring content from one WordPress site to another.

6. Once the content is imported, check the entire site very carefully. If you find missing images, don’t panic.

This was one of the most frustrating parts of this entire process for me, as the images kept importing with missing data here or odd sizes there. And once they were finally all imported correctly, many were still showing broken links.

You’ll need to replace the URLs for the missing links in the database. I used phpMyAdmin for this.

Normally it’s super-simple to do a search and replace for these links, but what I didn’t notice at first is that Multisite puts a few extra directories in the URL. So what you’ll be doing is replacing something like this:

mysite.com/wp-content/uploads/sites/2/2019/05/my-image-name.png

with this:

sometestsitedomain.com/wp-content/2019/05/my-image-name.png

Note those extra folders in bold; you have to remove those in every link where they appear.

7. Once you have all the images looking good, check the site again, comparing it side-by-side to the live site. Even after multiple content imports we were still missing 3 widgets, two text widgets and a newsletter signup widget. While they were easy enough to recreate by referring to the live site (or a cached site like the Wayback Machine), we might have missed one or more without a comparison.

8. If everything now looks good, it’s very strongly advised to take a backup of the hosting account where the live Multisite is if like me you are replacing the Multisite with the new single install (you may or may not be doing this).

If you’re just moving the newly-created single install to another host, that’s easy (and as a developer you don’t need instructions for that). But if you’re replacing the Multisite, you need a backup. Just in case.

If the client’s host tells you that their built-in backup system ‘works fine with Multisite’ or ‘backs up the entire account including Multisite,’ I’d make sure I had an external backup too. Don’t count on what your host says.

Unfortunately there aren’t many backup solutions that work with Multisite (another reason to stay away from it), and the ones that do are almost all commercial plugins. But it’s important so it has to be done. Buy a plugin and make a backup – and if your host claims to support it, make one there, too. You can’t have too many backups.

9. The last step is migrating the test site to the client’s host server. That’s the easiest part. Breathe a sigh of relief.

Alternatives to Multisite

If I were to advise a client with multiple sites now how best to manage them, I’d recommend getting something like MainWP and avoiding Multisite completely. But if you already have a Multisite situation on your hands, hopefully these tips will make extraction less of a banging-head-on-desk ordeal.

Did Your Site Get Blacklisted by Norton Safe Web?

by

One of my sites was blacklisted by Norton Safe Web last week. A client’s site was blacklisted two days after launch. Both have no malware and are not blacklisted anywhere else – a sure sign that Norton is doing something very different than all the other blacklisting services.

Here’s how Norton describes their ‘service.’ While I’m sure there are legitimate flaggings going on, the only ones I’ve encountered so far are not. Sucuri confirms that Norton is sending out ‘false positives’ in a chat I had with them today:

‘Regarding the Norton blacklist alert, Norton systems have been flagging a lot of false positives lately.’

One of my clients first reported this problem about about a month ago. Despite not being on any other blacklist, and having her site cleaned by Sucuri repeatedly and verified to have no malware whatsoever, she remains on Norton’s blacklist. Here’s what her site profile on Norton Safe Web says:

‘This is a known dangerous web page. It is highly recommended that you do NOT visit this page. The threat categorization is not complete & details will be added soon.’

So if your site is blacklisted by Norton and a potential customer is running some form of Norton’s security software, when they visit your site they will see a warning like the one above. They will most likely choose to avoid your business as a result.

Improperly flagging a site without due process can harm the business and doesn’t help anyone except Norton. No one should blacklist without due process, and unless they offer a reasonably fast and easy removal process for improperly flagged sites.

Here are the steps required to request (but not necessarily receive) a review from Norton to get your site off their list.

1. When you go to their report for your site you’ll see the link for ‘Site Owner? Click Here.’

2. You’ll see a menu of choices. If you click on ‘Do you think your web site’s rating is inaccurate,’ you’ll see this: ‘Please note that your site needs to be registered and site ownership verified to get the site re-evaluated.’ It goes on to say:

If you feel that your Web site has been given a rating by Norton Safe Web that is inaccurate, you can easily request a re-evaluation following these steps:

  1. Sign in to your Norton Safe Web account.
  2. On the “site dispute” tab, click the “Re-evaluate my site” link next to your Web site name. You can raise your concerns and issues regarding content on your Web site here.

The “site dispute” tab lists any threats detected on your site. You must remove these threats from your site.

3. You are required to sign up for NortonLifeLock and join their Safe Web community and create a display name.

LifeLock is an identity protection company that many of us were signed up for in the wake of the credit reporting agencies’ personal information theft debacle. If you were one of those signed up and later tried to leave LifeLock, you know that they make it extremely difficult, time-consuming, and onerous to remove yourself from their services.

4. When you go back to your site’s report page, you can click on Add Site under Site Dispute and then will have to verify that you actually own it. To do this you’ll have to either upload the supplied HTML file to your site or add a meta tag to your site header. I chose to get the HTML file, but I don’t think it matters which one you do.

5. Once you do one of the above (HTML file or meta tag) click ‘Verify Now.’ During this step, I got this message: ‘The Norton Safe Web site is unavailable. Please try again later.’

…..

6. When I could see the profile page again my site was verified. Click on ‘re-evaluate my site.’

7. You’ll see that the language is broken, looks like a scam email rather than a legitimate company: ‘Please provide re-evaluation reason for each reported threats and proceed to click on Submit button.’  There was no space to provide any reasons or comments, at least not for my submission.

8. After you click the Submit button you should see your site and a ‘re-evaluation in progress’ message under Status.

That’s it for now – I’ll report back when I get a response.

EDIT: An email from Norton says it takes 2 weeks for a re-evaluation. Don’t hold your breath – one of my colleagues has had a clean site blacklisted for 9 months – 3 attempts to contact Norton have been met with complete silence.

If you work with Sucuri (recommended if you know you have a legitimate malware issue, they are great) they submit a request to all blacklisting databases once their cleanup work is complete. But my client has been on Norton’s list for almost a month now. Even Sucuri is having problems getting false positives removed from Norton Safe Web, it seems.

Also – Norton began sending me ads the day after I registered on their site to request removal.