eCommerce Website

Passing a PCI Compliance Security Audit

2/11/2010 by Michael Losapio

As part of the process to be PCI compliant, one of our eBusiness customers recently underwent a security scan by their processor's PCI audit vendor. The results of the initial scan of their eCommerce website were less than I'd expected - a failure. Failure?!? How? Why?

1. "The remote service accepts connections encrypted using SSL 2.0."
2. "Possible cross site scripting"

#1 was simple enough to resolve... make a quick registry change, reboot the server, and you're done (see here for Micrsoft's instructions). Why did we need to do this - SSL 2.0 is open to "man in the middle" attacks where someone could potentially intercept the data transmission and essentially control the transmission, unbeknownst to those at either end of the data transmission.

For any eBusiness using a SSL Certificate on their eCommerce website, and thinking they are providing safe commerce to their customers - beware, you may be vulnerable.

#2, in my opinion, was crap. Here's the situation - we have a textbox on the webpage that takes user input and appends it to the querystring while redirecting to the search results page. This search results page takes the search criteria from the querystring and passes it to a stored procedure that scrubs it for SQL injection and returns the results. One additional thing the page does is display the search criteria in a label. Sounds pretty straight forward, right? Apparently since we weren't scrubbing the search criteria before displaying it on the page, we were "vulnerable" to cross-site scripting.

I do not agree - the definition (thanks Wikipedia!) of cross-site scripting is "a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into web pages viewed by other users." The key here is "other users." Sure, the page ran whatever script was entered into the Search textbox, but it would've only been for that user session... these results would not appear for others. Congratulations, Mr. Hacker! You just fell victim to your own script! So I sucked up my pride and added code to scrub the search criteria before passing it to the next page - you win this round, PCI Compliance...

So after implementing both "fixes," the eCommerce website passed and is now PCI Compliant. I'm sad, though, that I can no longer search for <script>You're an awesome guy!</script> and have the browser give me a little pat on the back for doing a good job.

eCommerce - Measure Your Conversion Rate

1/25/2010 by Jack Burnett

The conversion rate may be the most important web metric in an eCommerce website. A good conversion rate is important because conversions lead to sales, and sales leads to profits.

The definition of conversion rate is:

Conversion rate (measured in %) = Number of Sales / Number of unique visitors

Customers ask me what is a good conversion rate.  The answer is simple - your conversion rate should be high enough for you to be profitable. It may only be 1% or 3%, or you may need a 15% conversion rate to be profitable.

For an ecommerce site, you can mesaure your monthly conversion rate manually.

1. Find the total number of unique visitors to your website in a month no matter how they find your site (direct and referrals)
2. Calculate the total number of sales in a month.

At TwinEngines, we use MediaChase as our eCommerce technology platform, and we implement Google Analytics  to track website performance. Our customers log into their eCommerce management website and find the total number of sales.  They get their total number of visitors from the Google Analytics dashboard.

I recommend measuring your conversion rate over a calendar year to get a complete understanding.  You'll be able to break the year down into seasonal periods and around other outside events that influence your sales.

Here is a link to an article on an automatic way to measure conversion rates - using Google Analyics.

SEO Tips for eCommerce Website

12/30/2009 by Jack Burnett

I read an informative article about search engine optimization tips for eCommerce websites.  At TwinEngines, one of my duties is to help small and mid-market manufacturing companies in the southeast expand their markets and increase sales with B2C and B2B websites.

I follow my lean web methodology to implement a web presence that works hard for your business 24/7/365. If people cannot find you online, then you have committed one of the 7 deadly wastes of the web - that is, committing time, money and resources into building a website that your customers cannot find.  One of the tools to eliminate this waste is to enhance the basic SEO techniques.

The article at EConsultancy titled, Seven sensational SEO tips for ecommerce sites, addresses some of the common issues found in eCommerce websites.  One of the tips is looking at your products and placing them in multiple categories that have unique landing pages containing their own keyword phrases.  Another good tip is using the singular version of keywords instead of the plural.  This is a good idea since people usually want just one product and not a whole bunch.

If you need help upgrading your search engine optimization on your eCommerce website, contact me at TwinEngines and I'll be glad to create an implementation plan with you.  We'll prioritize these 7 tips and more ways to improve your SEO, creating action plans with cost estimates.  Your employees should even be able to perform some of these tips with the content management system of your website.

eCoupons Tips for an eBusiness

9/11/2009 by Jack Burnett

I recently read several articles on eCoupons and online promotions, and thought about my circle of family and friends in Atlanta, GA.  We all love discounts, but no one likes to go through the ciculars arriving in the mail or go through the Sunday newspaper.  It takes too much time or is not timely.  We do use an electronic coupon or promotion when we are at the purchase stage of the buying cycle, though.  And not just the younger generation.  One of my roles at TwinEngines is eCommerce consulting where I help small and mid-market companies increase sales via the Internet sales channel. Online promotions are a great way to increase sales.

For an eBusiness or eCommerce website, there is a trend of more and more people using online promotions and specifically younger people using eCoupons and electronic discounts.  The recession has made coupons cool again, as more consumers use coupons to combat the current economic times.  The social media sites, like Twitter and Facebook, are popular because people can receive the coupons they want to receive.  Just compare receiving a Tweet or a message from your favorite stores or online merchants compared with trying to find last week's mail circular.  Do you even buy the Sunday paper anymore?

When you want to send a promotional discount or eCoupon, whether via the cellphone, an email or through social media sites, consider the fact that your eCoupon can spread very quickly to a greater audience than you first intended.  Consider: You send a eCoupon for a free widget to your Facebook fans, and find out that friends of your fans and friends of friends of your fans are all of sudden placing orders to get the free widget.

Here are some tips on using eCoupons for your eBusiness or eCommerce website:

1. Develop a strategy for using eCoupons and tailor your promotions to motivate customers to make a purchase decision beneficial to your bottom line or future growth. Example are:
   • Daily or weekly Tweet with limited promotion or discount
   • 10% off your order when you join the email program
   • Free shipping for orders over a certain amount
   • A free side dish for the first 1000 customers
2. Be very specific and forthright regarding the terms of the eCoupon or online promotion.
3. Prepare your customer service to be consistent in responding to consumers, and have dedicated resources for all the communication channels your consumers use - including the social media sites. 
4. Make cosnsumers create an account and login to use the eCoupon. 
5. Through the account, associate the promotion to a single shipping address and email address, so you can restrict the usage to one per account, for example.
6. Promote the eCoupons program on your website, explaining terms and offering FAQs to help consumers understand the rules.

TwinEngines' customers with an eBusiness or an eCommerce website use eCoupons and online promotions for the following reasons:

1. Drivie consumer traffic
2. Build loyalty
3. increase sales
4. Attract new customers

It is a continual learning experience on what promotions work best.  The important thing is to (1) measure everything, and (2) listen to your social networks and customers, responding to their desires and needs in a way that makes sense to your business growth plans.

10 eCommerce Website Best Practices

9/01/2009 by Jack Burnett

At TwinEngines, I lead manufacturing automation initiatives and specialize in eBusiness and integrating eCommerce to back-office systems and business processes. I recently guided a client through the process of opening a new sales channel on the Internet, following ten eCommerce website best practices.  A retailer has a store in the Savannah, GA area, and wanted to reach more consumers and businesses along the east coast.  We started by mapping the existing order and fulfillment processes figuring the best way to integrate the web orders into their processes and financial and shipping systems.  Pulling current item counts and pricing from their inventory management system was an important customer service consideration, too.

The web presence was created following a custom web design approach; after the goals and objectives of the website were documented, compositions showing the look and feel and the information architecture were crreated.  Once the design was finalized the product pages were described in wireframe drawings.  The analogy to building a house describes the necessity to pick out the style of the structure and decide on floorplans, before starting to build the house.  Don't make the mistake of having a web developer start building and then determining what the website will look like and how people will interact with it.

We followed these ten eCommerce website best practices:

1. State the security method for transmission of payment information, adhering to the Payment Card Industry (PCI) Data Security Standard for storing cardholder data.
2. State the return policy clearly and accurately during the order process and incorporate an interaction for the shopper to accept the policy.
3. Provide a complete description of the products and services you offer, including photos and availability.
4. When providing age-restriced products, clearly state the age restrictions and have an age-verification process.
5. State the shipping method and policy clearly and accurately, and incorporate an interaction for the shopper to accept the policy.
6. Include unique meta titles, descriptions and keywords for each individual product category and product detail page.
7. Display your store address so it can be seen during the checkout process - the page footer is usually a good location.
8. Display your customer service contact including email and phone number.
9. State clearly your consumer data privacy policy and website terms of use.
10. Allow anonymous orders where the consumer does not have to create an account as a prerequisite to making a purchase.

We successfully launched the website on our hosting platform in Atlanta, GA, and now we are focusing on search engine marketing, social media and email marketing efforts.

Manufacturing eCommerce Website Top Ten Tips

8/06/2009 by Jack Burnett

I help manufacturers extend their sales to the web, and I help companies participating in the manufacturing value chain to establish eCommerce with consumers (B2C) and with other businesses (B2B).  One of the most important keys to success for a manufacturing eCommerce website is the technology platform that has the the functionality, flexibility and scalability to grow with your business. B2B and B2C eCommerce websites require the latest technology features for companies to provide a positive shopping experience that leads visitors from a web search to a purchase.  One that also gives you the tools to fulfill orders and collect payments easily.

TwinEngines uses the MediaChase eCommerce framework to provide the functionality required in an eBusiness.  Our developers can configure and customize MediaChase quickly and cost-effectively for each product catalog and eCommerce store.  This includes the back-office administration website to manage the web pages and SEO content, the product catalog, orders, shipping, credit card payments and customers.  In fact, the entire eCommerce business can be managed with the MediaChase platform.

So MediaChase is a great technical foundation to grow an eBusiness; now here are my top ten tips for manufacturers considering an Internet sales channel for products, parts and accessories:

1. Don't over-commit to maintaining all the content and SEO on your eCommerce site. Realize that if you can spend your time more effectively running and promoting the business, then it makes sense to turn to your web development partner to help you manage content and SEO.
2. Use a professional to create the product photos or obtain them from the OEM, if applicable. The photographer should create photo versions for both traditional marketing materials and the web. 
3. Associate the parts and accessories with the finished goods to make it easy to find replacement parts and encourage additional items to purchase.  Displaying a CAD drawing with an exploded parts view makes it easier for visitors to make a purchase.
4. Describe your products so shoppers can't resist buying them. Talk about the benefits, and consider a copywriter to make your products irresistible.
5. Your website home page should communicate clearly so your customers understand instantly what are your products and the benefits of buying from your company.  Include links directly to the product catalog and featured products that can be added to the shopping cart.
6. Devote resources to search engine marketing from the beginning.  When you are building the website, that's the time to begin planning keywords, content and link building.  If people cannot find you when they search, then you will not sell your products to them.
7. The look and feel of the website and the ease people can navigate to find the information they need to make a purchase is very important.  If people feel that they cannot trust you due to a cheap looking website with broken links, then they will find your competitor to make a purchase.
8. Allow customers, dealers and wholesalers to create an account where they can update personal information, track orders and warranties.  Also allow customers to place orders without requiring them to set up an account; setting up an account to place an order will drive some customers away.
9. Communicate shipping costs and methods for an order early in the check out process.
10. Include manuals and brochure documentation easily accessible for each product or product family.

TwinEngines is an Atlanta manufacturing technology company that has extensive experience in building and designing eCommerce websites for companies participating in the manufacturing value chain.  We are experts in integrating your eCommerce website to your financial and fulfillment sysytems.  We can improve your Search Engine Optimization, and help you implement Google Search technology and search at your site.

PayPal Payflow Pro Upgrade for eCommerce Websites

7/22/2009 by Jack Burnett

PayPal, the owner of the PayFlow Pro Gateway - a popular credit card payment gateway for eCommerce websites - has announced a new update to their standard software for custom shopping cart applications.

TwinEngines creates manufacturing websites, industrial websites and content managed websites for small businesses.  Our expertise includes the Payflow Pro credit card payment gateway as well as the Authorize.Net gateway. The new PayPal PayFlow Pro Gateway interface is live now, and the old gatway software will be shut down on September 1, 2009.

Our eCommerce website platform is a configurable system, where TwinEngines staff easily change configuration settings and developers extend capabilities for unique eBusiness applications.  Our developers created a patch update for existing eCommerce websites that upgrades the gateway plug-in, and included the new plug-in as part of our baseline eCommerce platform for all future updates.

From PayPal:
"We've added new security features to our Payflow gateway service that will make your payment processing even safer. Because of these new features, you must update the Payflow code that's integrated into your web site. All merchants should update to Payflow Pro Software Development Kit (SDK) version 4.3 or higher, or use our direct HTTPS Interface."

If you are a manufacturer, distributor or an eBusiness and operate a eCommerce website that accepts credit card payments using the Payflow Pro credit card gateway, then you will need to update the gateway connection before September 1, 2009.  After that date, your eCommerce website will no longer be able to process credit card transactions.

eBusiness Insight - When to Charge the Card

7/02/2009 by Jack Burnett

I was working with a customer who operates a store in Georgia plus an eBusiness operation.  We launched their new eCommerce website two months ago, and met to review how the website was working and how smoothly business processes were completed.  Initially, the eCommerce shopping cart was configured to only authorize the credit card when the shopper submitted the order.  After fulfilling the order, the shipping manager charged the card in the eCommerce administration website.  This ensures that a credit card is not charged before the order is fulfilled; a good eBusiness practice to follow.

The merchant wants to streamline fulfillment and be ready for the busy fall season by changing this process.  The requested change to the eCommerce website is to authorize and capture the charge when the shopper submits the order.  Inventory on the eCommerce website is kept up to date, they collect phone numbers with each order in case there is an issue, and their shipping policy gives them enough time to ship all the orders made each day.  The new process would mean a phone call to a customer if there happened to be an order that could not ever be fulfilled.

In the rare case an order could not be shipped that day or the next couple days, after speaking with the customer to discuss another product to order, the merchant then would go into the virtual terminal of his credit card payment gateway software.  Each virtual terminal tool has a function to credit the charge on a credtit card.  If the customer felt like they were not being treated honestly, the merchant risks losing them and maybe any friends.

Knowing their business, internal processes, customer service standards and after evaluating how the eBusiness operates, the merchant feels the odds of orders that cannot ever be fulfilled are very, very low.

Because it is just a database value change to us, this process change was made in less than a minute on the fly without taking the eCommerce website out of operation.  That's what I call a configurable eCommerce solution. We added the policy on his site in the FAQs section, under Terms and Conditions, and with the shipping and returns policies to be up front with customers.  After a couple months we plan to meet again to evaluate the change and make a final decision in time for the busy fall season.

If you are a consumer, the policy is well communicated and you have the customer service phone number and store address available to you on every page, does it matter to you that your card is charged before your order ships that same day?  What would you do if you received that phone call?

eCommerce Website - Where is the Money?

6/26/2009 by Jack Burnett

I was working with a small business today in Georgia that had a simple problem - the new eCommerce manager couldn't find the money from his eCommerce website.  Like people at many small businesses, he filled many roles, which partly explains why he was in this situation. It also gets pretty confusing, what with websites, shopping carts, credit card payment gateways, and internet merchant accounts. So I started by going over these components in his eBusiness.

First, he had a shopping cart module built into his website that he owned.  The customizable shopping cart allows people to add products from the online catalog, and then enter shipping and credit card payment information. 

Second, the credit card payment gateway is a third party service that connects the shopping cart to the financial networks needed for the credit card transaction, including the customer's credit card issuer and his internet merchant account. 

Third, the internet merchant account is at his local bank, which also enables him to collect credit card and cash payments at his brick-and-mortar store.

So our eCommerce manager logs into his eCommerce administration website and sees all the orders.  Customers are getting automatic notifications. The orders are being fulfilled and the credit cards are charged after shipment.  Inventory is being depleted. All the information the company needs to market and sell their products online and fulfill shipments is found in the eCommerce website and the eCommerce administration online tool.

In our case, Authorize.net is the credit card payment gateway.  Our eCommerce manager logs into the Authorize.net administration site that gives him the capability of a virtual credit card terminal plus reporting.  Daily transactions and summary reports shows the credit card transactions.  The detail of each transaction holds the eCommerce website order number, to tie website orders to the credit card transactions.

Most importantly, the money is transferred to his internet merchant account at his local bank.  So after we talked, he called his local banker.  As soon as the banker returned from his bar-b-que lunch social, they reviewed the internet and store merchant accounts, fees, and statements.

The eCommerce manager had all the information to reconcile eCommerce website orders with the credit card transactions and with the money in his merchant bank account.  He analyzes the hosting fees and fees from the credit card gateway and merchant account to calculate his net margin on online sales.  On a side note, when the UPS invoices for shipping, he reconciles what UPS charges against what his customers pay in shipping costs - found in his eCommerce administration tool.

There's a lot of moving pieces, each with assoicated costs, all of which requires attention when setting up an eCommerce website or an eBusiness.  We, at TwinEngines in Atlanta, GA, help small and mid-market companies build eCommerce websites and guide them through the process to set up all the components.  Whoever you turn to for eCommerce solution, make sure you go over all three areas to understand the process, operations and costs at the start.

eBusiness Value Chains: eCommerce Website Products

6/09/2009 by Jack Burnett

At TwinEngines, we optimize manufacturing value chains.  Sometimes that is your supply chain or value added activities to fulfill orders from sales, through product configuration, manufacturing and logistics.  Sometimes, for an eBusiness, the value chain includes accepting orders in your eCommerce website, picking and fulfilling the order, and managing shipments and payments.

For an eBusiness, I want to talk about presenting products that are available for purchase online 24/7 in the eCommerce website - the value-added activities including inventory tracking, product marketing and sales order processing. Presumably, inventory is maintained somewhere.  For smaller businesses, inventory tracking may be in a Microsoft Excel spreadsheet; For mid-market companies inventory is found in a back-office system, ERP, financial or inventory systems.  Each individual item is represented in these systems, with a quantity-in stock data attribute.  There are also other attribues, like Reserved Minimum Quantity and Reorder Quantity.

The items (or Skus) in the back-office system are usually grouped together at the product level for display on the website.  This allows an online shopper to search for a product quickly, and then select the particular item based on size, color, brand, etc. For example, you are shopping at the Mercier Orchards online apple store for blackberry jam.  You find the jams product, and then you then select the flavor and the size of the jar.  For the online shopper there is the one jams product presented in the Jams, Jellies, and Preserves category in the product catalog.  In the ERP system however, there is a jam item for every combination of flavor and jar size.  So it is important to manage at the item level back-office systems, and ideal to manage at the product level on the website.

Let's just say the manufacturing business has an ERP system like Microsoft Dynamics, where items, inventory and sales orders are all managed. When there are many products online and even more items in the ERP system, it makes a lot of sense to integrate the eCommerce website with the ERP system's sales order processing and item detail modules.  With integration, each web order is automatically sent to the ERP system.  When the web orders are fulfilled, inventory is automtatically depleted, and inventory counts are transmitted to the website at some frequency (perhaps daily or hourly).  We use eConnect for Microsoft Dynamics, and similar products for other financial and ERP systems.

So now the question is, what do you do when you run out of an item in inventory?  Without getting into backorders, here are the options:
1. Show the product and allow the shopper to select the item.
2. Show the product, but don't allow the shopper to see any items that are out of stock.
3. Show the product and item, but don't allow the shopper to select the item.

I don't recommend option 1, unless you are 100% sure you can fulfill the order meeting your guarantees to your shoppers. When to capture the charge is a topic for another day.  Let's just assume you send an order confirmtation email to the shopper and authorize a hold on the shopper's credit card for the total purchase amount.  When you realize you cannot fulfill the order, you have to tell that shopper and void the authorization.  Chances are you lose that customer forever.

The second option is the other extreme I don't recommend.  If a shopper doesn't see that Mercier Orchards carries his favorite blackberry jam at all, chances are he is lost forever.  The only time this option may be satisfactory, is when you are closing a product line and when it's gone, it's gone for good.

I think the best option is displaying the item, but not allowing a shopper to add it to the eCommerce shopping cart.  Even better, the shopper sees a message indicating the item is currently out of stock with a phone number/email address to get more information.  The eBusiness gets a call from the shopper, and has the opportunity to cross-sell or get the customer's contact information to alert them when the item is back in stock.

Integrating the eCommerce website to the back-office systems is a key piece to optimizing the value chain for a manufacturing eBusiness.  Deciding how to display products and availablity for online purchase 24/7 is also a key business issue.  When presenting products online, there is a lot of prepatory work involved to group individual items (Skus) into product groups.  A product image, description and name has to be created for the eCommerce website, and managed with the website content management system.

Are You PCI Compliant?

5/21/2009 by Jack Burnett

I am helping a marine supplies company expand their customer base and increase consumer sales with a new eCommerce website. Consumer sales means credit card payment processing. Credit cards mean PCI compliance.

Some people think that PCI compliance is the big credit card companies attempt to push the responsibility down to the merchants, so they don't have to spend money now to upgrade their infrastructure from the 1980's. While there may be some truth in that, a merchant is responsible for protecting its customers' credit card information when they purchase their products. If they want to offer VISA, MasterCard and American Express credit card payments, then they have to follow the rules.

Wikipedia says the Payment Card Industry Data Security Standard is a worldwide information security standard created to help organizations that process card payments prevent credit card fraud. The standard applies to all organizations which hold, process, or pass cardholder information.

PCI compliance means that merchants and eCommerce solutions must follow the standards or be liable for credit card fraud. There are 6 core principles and 12 requirements to follow. The major business areas to consider for a merchant are:

• Merchant's facility, order processing and internal financial/ERP systems
• eCommerce website
• Credit card processing gateway
• Processor
• Merchant Bank

I recommend Authorize.net and PayPay Payflow Pro credit card processing gateways in our eCommerce websites, because they are rock-solid PCI compliant. A merchant chooses their Merchant bank and processor company, and best practices dictate due dilligence to ensure PCI compliance. This happened to be a concern for the marine supplies company, because they chose to use Heartland as the processor. Heartland was removed from the PCI-compliant list in March because of data breaches (see eCommerce Times article here), so it was important to ensure they were back on the PCI-compliant list; they were reinstated earlier this month.

TwinEngines eCommerce solutions do not store full credit card information in the website database. Very limited, partial information is stored only for customer service. The shopping cart transaction is secure with SSL, and does not display full credit card numbers anywhere after the card information is taken. The administrative engine used in eCommerce websites, connects directly to the credit card processing gateway to authorize payments at check out and to capture the charge at shipment.

Some merchants use the eCommerce website administration tool to process phone orders, ensuring PCI compliance. The eCommerce website holds the credit card gateway transaction numbers to allow the merchant to work with the transactions securely in the credit card gateway's virtual terminal. This is necessary for activities such as voiding an authorization or crediting a card when needed.

If you are selling online, the first place to start is the PCI DSS questionaire found at the PCI Security Standards Council. You'll also find the 6 core principles and 12 requirements established by PCI SSC.  After you do your homework, make sure your eCommerce website will be in compliance when selecting a partner to help you implement commerce on the web.

eBusiness - TV Shows and Your Product Catalog

5/20/2009 by Jack Burnett

We were discussing TV shows and viewing habits over coffee recently. Topics like, how there is never enough time to sit down and watch the regularly scheduled show. How some people record the show and watch it later. How popular shows are on the network companies' Internet websites now.

I had missed the season finale of a favorite show this week, but I watched the show the next night on the network's web site. I get asked often by small and mid-market companies, 'What is eBusiness?, and over our morning coffee I explained how this was eBusiness for the network TV company. They offered me an easy way to view the show online with very, very little commercials - so much so that the hour show lasted around 42 minutes.

The network's web site is up 24/7 so I could watch the show anytime I wanted. I was on their website where they controlled the viewing experience and the content - advertising in this case. I didn't skip commercials by using a competing product like recording technology to watch the show. When I view shows I sometimes even meander around the site to see what else the network offers.

Sounds like eBusiness to me. When I work with small and mid-market companies  to increase sales leads and revenues with an eCommerce website, those are all the types of benefits we discuss. As an eBusiness service, your product catalog or service offerings are available to the general public 24/7. You decide what actions consumers can take and what information, in what format, is viewed. Customers can shop or purchase products when it is convenient to them from practically whereever they want.

At TwinEngines, we have found that small and mid-market companies can attain a larger customer base and increase sales with an online product catalog and an eCommerce website. The internet is another sales channel that does not require staff to answer shopping questions or conduct the sales transaction.  By adding email marketing and continually improving the website with search engine and social media optimization, small and mid-market companies can increase the velocity of growth on the web.

Technology has come a long way allowing companies to expand their reach and serve customers all day, every day. The trick to success is planning and the strategy of taking the technology and integrating the web eCommerce solution so that information flows through your organization supporting the value-adding activities in your business value chain.