Using Funnels To Improve Your Website’s Performance

How do I know if my website is a good asset generating business for my company ?
As with any business reporting and analysis work, it is important to establish some objectives or benchmarks to help assess the strengths and weaknesses of your website in generating business. A wealth of material on the use of web analytics has been written in this blogging site and others. In this blog, I would like to focus on one aspect of analytics – the use of goals and funnels.

What is a funnel ?

A funnel is a path that a visitor to your website takes to perform an action. Relative to the size of the website, there can be (a lot) of paths open to the visitor. Some visitors may wish to wander aimlessly throughout your website, but the majority have a specific purpose in mind when they visit your website.
So the first step is to identify a (small) number of goals that you would wish a visitor to complete when on your website, such as;

1. Make a purchase
2. Arrange an online Q&A session with your pre-sales staff
3. Subscribe to your e-newsletter
4. Download a white paper

For each of these goals, map out the path(s), in terms of web links and pages, that a visitor needs to take to complete the goal. Each path is a funnel and typically, the number of visitors remaining at the end of the funnel is less than the number who started out on the path (i.e. the conversion rate).
This is where the funnel provides value-added analysis, showing where visitors dropped off along the path, which can indicate problems such as;

• Difficulty entering credit / laser card and address details for online payment
• Difficulty adding items to the online basket
• Relatively long download times for your whitepaper
• Unclear privacy policy on how the visitor’s data will be used by your company

This can be valuable feedback when reviewing potential improvements to your website. However it’s also important not to forget that some visitors may only be browsing and may not wish to progress to the end of your funnel. As with a sales pipeline, not all prospects turn out to be actual sales.
In defining a funnel, it is important to identify the page or link at each stage on the funnel and ensuring that it has the appropriate call-to-action to progress the visitor onto the next stage.

Ongoing assessment

It can be interesting to assess the visitor conversion rate after making some changes to the various stages of a funnel and hopefully seeing some improvements.
The data that shows the visitor numbers, drop-outs and any number of related measures can be derived from an analytics application such as Google analytics which is probably the most widely used analytics application. Such applications assist you to define goals and related funnels in terms of the various pages that a visitor will view as they progress along the path.
So, pick a goal for your website and identify the related funnel for it and starting tracking and influencing visitor behaviour.

Testing the usability of your website

A well organised usability test not only provides feedback from a user’s perspective on the site’s ease of use, but it also points to where improvements can be made. This blog contains details on how best to organise a usability test.
Using an independent set of testers will provide an independent perspective and assessment of the site’s usability and provide important feedback to the website’s designers and developers.
The timing of the test
A usability test is best organised when a new site is close to completion or a new set of enhancements are near to completion for an existing site.
This ensures that a usability review can provide an accurate evaluation before go-live and allows time for any necessary rework. Thus avoiding any ‘disasters’ after the website has gone live.
Who should do the testing?
Ideally, you should seek to get actual users of the website – whether they be company staff or customers of the company. This is the essence of user centered design.
In terms of numbers, a user test team can range from a minimum of five to as many as can be accommodated. The selected users should fit the persona profile of the target audience to ensure that the website is tested from the target audience’s perspective.  The reasoning behind having a minimum of five testers is to provide a range of user backgrounds. For example, when testing an online share trading facility; a good cross-section of testers will include;

• Experienced trading professionals
• People who trade on an ad-hoc basis
• Those who are new to online trading

Test approach
In order to ensure that any potential problems are uncovered, testers should perform actual task scenarios. These tasks can be listed, allowing each tester to note any positive and negative comments for each of the scenarios.
This task list should provide no instruction as regards how to approach or complete the various tasks. The website and its content should provide sufficient explanation in terms of navigation and task completion.
It can be frustrating for project team members to see testers ‘stumbling’ through completing each of the task scenarios. For this reason, team members should not be physically present at the test sessions.
To complete the test sessions, each of the testers should be debriefed to help capture any remaining observations that they have forgotten to note down. The debrief can help to gather feedback on some generic questions such as;

• How well the tester understands the structure of the website
• Their thoughts on the type of company image projected by the website

Analysis and application of the feedback
In addition to reviewing the individual comments from testers, the analysis should look for any trends;

• Were any problems consistently noted ?
• How many users had the same experience?
• What were the first impressions on viewing the site?

It is important that the project team consider the feedback constructively and use it to address any weaknesses and to leverage all of the positive features. The website project benefits hugely from this type of structured test approach. The feedback – both positive and negative helps to increase the probability of a successful website launch.

Securing your website by handling errors

When a website is being attacked by a hacker, one attack approach is to cause the website to fail in some manner. The thinking behind this approach is to use the error message to gain ‘inside’ information about the website. With this information, the attacker is planning to better organise their attacks on the website.

Error messages can provide detailed information and in the wrong hands…

Error messages, by default, are designed to provide all the necessary information to help resolve the error. However, in the wrong hands, this type of content can provide ‘valuable’ information on how the website operates in addition to access to privacy related information on customers and transactions.
Using this sample database error message from a blog by Securiteam on sql injection as an example; by causing the error, a hacker can see that the first table name in the database  is called ‘admin_login’.

Microsoft OLE DB Provider for ODBC Drivers error ’80040e07′
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ‘admin_login’ to a column of data type int.
/index.asp, line 5

With a subsequent query, it can be possible to start to extract the column names of this table, as the example shows the column name ‘login_id’.

Microsoft OLE DB Provider for ODBC Drivers error ’80040e07′
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ‘login_id’ to a column of data type int.
/index.asp, line 5

In this example, with the names of the table and columns, it would be possible for a hacker to easily get access to login ids and passwords for the website.

The best defence is…

The best place to start to ensure that any error messages are handled securely is when the website is being designed and developed. As the website requirements are being discussed, any related exceptions that may cause an error should also be documented.
For example,  I discussed the importance of data validation to ensure that no inappropriate data inputs could be used to attack a website. In such a scenario, rather than having the website failing and producing an internal error message such as in the above example, a user friendly message should be displayed, indicating the expected format and length of input.

Test and test again…

During the testing of the website, security testing using different attack scenarios should be completed to test the strength of your website by simulating a series of different attack methods and reviewing the results to detect and correct any weaknesses. These penetration testing scenarios should cover both typical attack methods, along with any unexpected attacks or errors. To ensure that the ‘unexpected’ errors are tested, brainstorming sessions involving developers and business owners who know their user community will be necessary, where the focus is on uncovering any unusual and unexpected user actions.

Fail safe is key

When designing the website, an important principle to include is to ensure that if an error occurs, sufficient information is provided to guide the user with no information on any server or software related topics (i.e. the website has ‘failed’ into a safe mode). In addition, all errors should be handled in a structured manner, so that irrespective where an error occurs on a website, the response is the same and managed in a consistent manner.

Business logic not the code can be the problem

When reviewing your website for potential weaknesses, it’s more important to assess the logic of your workflows, as the logic is the foundation for your code. The logic is driven by the business rules of the functions being provided by the website. Two examples of possible mis-use of logic include;

• The provision of a password reminder function to assist legitimate users who may have forgotten their passwords. To ensure that such a function is not abused by a hacker, a captcha function can be included to prevent any brute force attacks.
• The assumption that a withdrawal amount entered into an online banking service will be positive, thus leaving the possibility that a negative amount will trigger a credit to a person’s account. A data validation check on the entered value should resolve this potential weakness

As with all security principles, if time and effort is put in at the early stages of a website or application, it provides the foundation for a secure website. So in the enthusiasm to get your website live, taking some time at the start to ensure that any potential weaknesses are removed and that any unexpected errors are managed in a fail-safe manner is well worth the investment.

Importing Images From External URL into Magento 1.7.02

There are occasions where you might not have access to downloading the images from your current setup into the Magento or it is simply easier to reference the current file path on an external URL. The following snipet will add the ability for you to grab images from an external URL when importing products through a data feed. Rather then setting up the image column within the data feed with /image-name.jpg you can now use the full URL path http://www.domain.com/image-name.jpg as an example.
Download the following file – /app/code/core/Mage/Catalog/Model/Convert/Adapter/Product.php and and code for it is instead of this one:
foreach ($product->getMediaAttributes() as $mediaAttributeCode => $mediaAttribute) {
if (isset($importData[$mediaAttributeCode])) {
$file = trim($importData[$mediaAttributeCode]);
if (!empty($file) && !$mediaGalleryBackendModel->getImage($product, $file)) {
$arrayToMassAdd[] = array(‘file’ => trim($file), ‘mediaAttribute’ => $mediaAttributeCode);
}
}
}
put this one:
foreach ($product->getMediaAttributes() as $mediaAttributeCode => $mediaAttribute) {
if (isset($importData[$mediaAttributeCode])) {
$file = trim($importData[$mediaAttributeCode]);
if (!empty($file) && !$mediaGalleryBackendModel->getImage($product, $file)) {
// Start Of Code To Import Images From Urls
if (preg_match(‘%https?://[a-z0-9\-./]+\.(?:jpe?g|png|gif)%i’, $file)) {
$path_parts = pathinfo($file);
$html_filename = DS . $path_parts['basename'];
$fullpath = Mage::getBaseDir(‘media’) . DS . ‘import’ . $html_filename;
if(!file_exists($fullpath)) {
$ch = curl_init ($file);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_BINARYTRANSFER,1);
$rawdata=curl_exec($ch);
curl_close ($ch);
if(file_exists($fullpath)) {
unlink($fullpath);
}
$fp = fopen($fullpath,’x’);
fwrite($fp, $rawdata);
fclose($fp);
}
$arrayToMassAdd[] = array(‘file’ => trim($html_filename), ‘mediaAttribute’ => $mediaAttributeCode);
}
else
{
$arrayToMassAdd[] = array(‘file’ => trim($file), ‘mediaAttribute’ => $mediaAttributeCode);
}
}
}
}