E-commerce & WordPress: Navigating the Minefield
•
6 likes•4,345 views
How to navigate the e-commerce minefield so you can launch the best site possible. The presentation goes over payment gateways, how credit card processing works, merchant accounts, SSL certificates, PCI compliance, WordPress security tips and (briefly) some of the more popular e-commerce plugin solutions for WordPress.
Recommended
Recommended
More Related Content
Viewers also liked
Viewers also liked (13)
Similar to E-commerce & WordPress: Navigating the Minefield
Similar to E-commerce & WordPress: Navigating the Minefield (20)
Recently uploaded
Recently uploaded (20)
E-commerce & WordPress: Navigating the Minefield
- 1. E-commerce & WordPress: Navigating the Minefield Jonathan Davis, Ingenesis Limited @jonathandavis
- 2. $165.4 billion total e-commerce sales in 2010
- 3. merchant accounts payment gateways fulfillment systems e-commerce is hard! SEO PCI compliance Security SSL certificates shopping carts
- 5. Navigating the Minefield not so much! ‣ Offsite/Onsite payments ‣ Encryption certificate easy buyers guide ‣ Processing payments with gateways ‣ PCI Compliance ‣ Merchant Account ‣ Security Tips for shopping tips Ecommerce on WordPress ‣ Ecommerce Tools for WP
- 6. Onsite or Offsite? Offsite Payments Onsite Payments • Extra checkout steps • Extra setup steps • Can be more confusing • Seamless (easy) checkout experience • No SSL certificate • Website requires • No PCI-compliance SSL certificate certification required • Merchant required to certify • Examples: PayPal Standard or PCI compliance Google Checkout • Requires a Merchant Account
- 7. payment gateway • a service to process payments online • it’s a kind of PoS
- 8. PayPal Standard Express Checkout WebsitePaymentsPro Customer leaves Customer jumps to Seamless checkout the website to PayPal to enter onsite. Customer enter payment payment details, never leaves the details and does returns to complete store. Extra setup not return to the the order. Not work. site. No setup work. much setup work.
- 10. Credit Card Payments Secure authorize & capture Payment Gateway Web Server response co e nfi r ns de rm po or s re re s po ns e Customer Banks d re fer ns tra n ds fu Merchant
- 11. merchant account • a special type of bank account for accepting payments from debit or credit cards (payment cards) • an agreement between the merchant, the bank and payment processor
- 12. Merchant Accounts | Costs Discount Rates • 3-Tiered pricing • 6-Tiered pricing • Qualified Rate • Interchange Plus Pricing • Mid-qualified rate • Bill Backs • Non-qualified rate
- 13. Merchant Accounts | Costs Fees • Authorization fee • Customer Service fee • Statement fee • Annual fee • Monthly minimum fee • Early termination fee • Batch fee • Chargeback fee
- 14. Merchant Accounts | Tips • Some merchant account providers have their own payment gateways • Plan time to get approval • Find out about your monthly limits to prevent shutdowns • Find out about the reserve amount • Beware the chargeback
- 15. encryption • the process of making information unreadable to anyone without “special knowledge” • “special knowledge” is the key
- 16. TLS/SSL Encryption Transport Layer Security/Secure Sockets Layer • Some seriously scary • Browser uses the public key technical voodoo magic found in the certificate to • Garbles browser to server encrypt information before communication over the sending it to the server Internet • Server uses a private key to • No one else can access the decrypt information from the information browser
- 17. Customer 4111 1111 1111 1111 encrypt web browser public f37b13464e451a214b39 507061af9c9a2613fbab public internet 4111 1111 1111 1111 decrypt private Secure Web Server server side
- 18. secure (SSL) certificate • a specialized electronic document certifies a public encryption key to an identity
- 19. Secure Certificate | Buyers Guide • Ongoing costs in the range Vendors $50–$1500/year • Verisign (Costly) • 3-4 certificate types: www.verisign.com • Single-domain • Comodo (Moderate) • Multiple sub-domains instantssl.com • Wildcard sub-domains • GoDaddy (Cheap) • Extended Validation (EV) godaddy.com • Network Solutions (Cheap) networksolutions.com
- 20. PCI PCI SSC PCI-DSS PA-DSS Payment Card The PCI Data The Payment Industry Security Security Standard Application Data Standards Council Security Standard The security The body standards Security standards responsible for merchants are for payment managing the required to follow applications such as security standards and certify their payment gateways for the industry compliance & shopping carts
- 21. PCI-DSS 12 requirements for any business that stores, processes or transmits cardholder payment data
- 22. PCI-DSS Build and Maintain a Secure Network Requirement 1: Requirement 2: Install and maintain a firewall Do not use vendor-supplied configuration to protect defaults for system passwords cardholder data and other security parameters
- 23. PCI-DSS Protect Cardholder Data Requirement 3: Requirement 4: Protect stored cardholder data Encrypt transmission of cardholder data across open, public networks
- 24. PCI-DSS Maintain a Vulnerability Management Program Requirement 5: Requirement 6: Use and regularly update Develop and maintain secure anti-virus software systems and applications
- 25. PCI-DSS Implement Strong Access Control Measures Requirement 7: Requirement 8: Requirement 9: Restrict access to Assign a unique ID Restrict physical cardholder data by to each person with access to business need-to- computer access cardholder data know
- 26. PCI-DSS Regularly Monitor and Test Networks Requirement 10: Requirement 11: Track and monitor all access to Regularly test security systems network resources and and processes cardholder data
- 27. PCI-DSS Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security
- 28. PCI Compliance Assess Remediate Report
- 29. PCI Compliance Assess Remediate Report Assess your network and IT resources for vulnerabilities. Constantly monitor access and usage of cardholder data. Log data must be available for analysis
- 30. PCI Compliance Assess Remediate Report Remediate (fix) vulnerabilities that threaten unauthorized access to cardholder data
- 31. PCI Compliance Assess Remediate Report Report compliance and present evidence that data protection controls are in place
- 32. SAQ Self Assessment Questionnaire • A checklist for the requirements with nice little yes/no boxes • You “assess” with it • Get it here: http://j.mp/pcisaqs
- 33. WordPress Security in a Nutshell
- 34. Use a Strong Password The first line of defense against would-be hackers
- 35. Avoid the ‘admin’ account Setup a different admin account with another name
- 36. Salt your keys define('AUTH_KEY', 'el1%+7]b}R._7jj|fZ{XSG]Yh8#>s,qjnD}%x?w~H-y99Hk5+#+wON7=$L8iqgm-'); define('SECURE_AUTH_KEY', '-)pv+c~$2[6O|TBobgd+n#8H8`|QcJD6`nML+vax52a+Rn9H[$e4`v8a ->1P){-'); define('LOGGED_IN_KEY', ']MoH-Sj+pxMk2,-]^RPr^)^i#5E}r~8Bu3AoFVbl9-WS|)l-R9%or/?W!]VVp~du'); define('NONCE_KEY', 'p2?y4<?z3NwtC>=|kwv#Qqx|12q~4hg?/?!`MvR+Z%pXSyj01nUBvJkm02{z0*}z'); define('AUTH_SALT', '4{]-;WEc,fEc]10RG< YhlO(7+HP-I,BS3!7GlE_-GXwsrS*cx}e}/]tne+pX+X '); define('SECURE_AUTH_SALT', 'X6@IARBL/cY-U:34s:Mw|v0{r:h`ti-I,Shm<dFxc}7goavd?zWO!6%7Xgel~^3S'); define('LOGGED_IN_SALT', '&>,SOL-.7cwk*Wf|&JV$hnvF/fI><]VobM2@8^Z:*_X,P=qVf>6X,p>9i!-:C`fA'); define('NONCE_SALT', 'Tk_RGSGz4CBtvzdeFT7KRLP>Vc$y$2VqC3@+l[iQ!h`aq[4G)^9CVwZOI,7lWd0a');
- 37. Hide your database tables Change the table prefix: $table_prefix = ‘wp_’; $table_prefix = ‘g5a21R_’;
- 38. Update Everything Keep WordPress, your theme and plugins up-to-date
- 39. Backup Everything Always, always, always make regular backups: files & db
- 40. E-commerce Tools for WordPress What’s out there?
- 41. WP eCommerce getshopped.org The oldest & most widely used Physical & digital products A variety of payment options Several shipping options Marketing tools Free + paid add-ons ($10-195)
- 42. Cart66 cart66.com Newest solution Uses [shortcodes] 7 payment solutions Subscriptions & Membership Free Lite Version or $89-399/year
- 43. Shopp shopplugin.net A popular solution 18 payment gateways 10 shipping options 200+ template tags $55 or $299 $25 add-ons
- 44. Jonathan Davis Twitter: @jonathandavis Email: jon@shopplugin.net shopplugin.net