SPF for Your Website: Three Simple Steps to Protect Your Online Presence

As the days get longer and the mercury rises, we’re reminded yet again of the importance of remaining vigilant when it comes to applying sunscreen to protect ourselves from summer’s damaging rays. It’s a simple yet necessary precaution that if neglected has both short-term consequences – the painful agony of sunburn – and long-term ramifications – skin damage and increased risk of skin cancer. The same holds true for our websites. If we are not proactive in taking the necessary precautions to keep our online presence safe, problems will inevitably arise. Here are three simple measures you can take to apply SPF to your website that will safeguard the integrity not only of your brand’s online presence but its reputation as well:

(S)ecure your site against SQL injections.

Websites that feature data-driven applications can be vulnerable to attacks known as SQL injections, whereby malicious code is added to an entry field, then run and executed. These attacks exploit security vulnerabilities in problematic code, attacking your site’s database and performing any number of actions, from adding unapproved content to your public-facing site to allowing the hacker to download your entire database. This is a prime example of why rigorous testing is absolutely critical prior to launch. If your site is already up and running, consult with your web team to make sure that it has undergone thorough testing and is protected against such hacks. If you want to take additional precautionary measures, there are also security companies that specialize in detecting these types of website and database vulnerabilities, and they can provide you with a security audit.

(P)rotect your domain name.

It’s common sense that you must pay to acquire the domain name where your business will reside online. However, it’s important to remember that you have to continue to pay in order to retain the rights to use that domain name. Essentially, when you purchase your domain name, you’re not buying it outright. Rather, you’re renting that name for a specified period of time. Most registrars (Network Solutions, GoDaddy, Register.com, etc.) allow you to secure a name for anywhere from 12 months to 99 years. If you allow your registration to lapse, however, the domain name becomes available for purchase again and is open to the public for anyone to acquire. Bear in mind that there are actually companies that profit handsomely from business owners who neglect their domain registrations. They monitor domains that are nearing expiration, taking ownership of them the moment they become available. If you have the misfortune of having your domain acquired by one of these companies, usually you can negotiate having ownership transferred back to you, but it will cost you dearly. Unfortunately, while this is a shady practice, it is not illegal. If you allow your domain name to expire, it is fair game for anyone to register it – including these types of companies. Before your domain name expires, your registrar will likely send you many notices prompting you to renew. I start getting domain name renewal notices six months or more before the scheduled expiration date, and as that date gets closer, the notices start coming more and more frequently. Still, despite this barrage of email notifications, there are still many companies that are unaware that their expiration date is approaching, and they either lose their domain name altogether or are forced to pay a king’s ransom to get it back. Often when this situation occurs, it is because the person who initially completed the registration process for the domain name is no longer with the company, and therefore the email address they used to register the name is no longer valid, so the multitude of email notices go unreceived. The company innocently thinks they are protected until one day they stop receiving emails (yes, your email is tied into your domain name), or a customer mentions that they tried to go to the site, and it was simply gone. Even though there is a grace period after a domain has lapsed that allows you to reclaim your ownership before it becomes open to the public, the lapse isn’t always discovered in time to take advantage of this safety net. To prevent this, it is critically important to keep the contact information for your domain registration up to date. Either contact your registrar directly or speak with your web team to make sure you know when each of the domain names you own needs to be renewed, and double-check to ensure that the contact information for your account is valid.

(F)ortify your forms.

Web forms are a staple of doing business online. In fact, rare is the site that doesn’t include a form of some sort that allows the user to input information to be transmitted to the site’s owner, whether its purpose is to make a contact inquiry, sign up for a mailing list, complete a purchase, apply for employment, etc. As anyone who has a form on their site can attest, however, not all submissions received via these forms are legitimate. This is called robot spam, which is created by spammers who write programs that send out spambots to indiscriminately fill out any and all different types of forms on the Web, looking for entryways to expose a site’s security vulnerabilities (see SQL injections above). If you find your inbox filling up with indecipherable junk submissions, it’s these bots who are to blame. To combat these spambots, you can install a CAPTCHA system on your form, which generates an image with a random combination of numbers and letters that the user must enter in order to submit the form. The spambots can't interpret these CAPTCHA images, so therefore they can’t complete the process of sending the form. While there is legitimate debate as to whether or not CAPTCHA is the most effective way to prevent bogus submissions, it still remains the most popular solution for web form security. However, the reason it’s important to block these bots goes beyond eliminating the annoyance of a cluttered inbox. A few months ago, my company decided to remove the CAPTCHA requirement from our contact form. We knew we would get a flood of spam submissions, but we decided we could deal with a little extra hassle on our end in exchange for reducing the inconvenience to legitimate users of having to interpret those squiggly letters in order to simply get in touch with us. As expected, the amount of spam we received increased dramatically, but it was still manageable. Then, all of a sudden, we stopped receiving any submissions at all. We also began seeing some of our emails to other people bounce back. What we discovered was that our web domain (which is where our emails originate from) had been blacklisted as spam by Microsoft (which is what powers our email platform). Apparently, all the bogus submissions from our website (which resides on our domain) to our email caused Microsoft to identify us as spammers. This is because our form submissions came from an email address associated with our own domain name (many web forms are configured this way). Obviously, we were not the ones generating the spam, but this strange series of coincidences conspired to get us blacklisted! Fortunately, it was an easy process to get our domain removed from the blacklist, and we quickly re-installed the CAPTCHA system on our contact form, but we certainly learned an important lesson about security and spambots along the way. If you allow those bogus entries to make it through, there is a risk that you, too, could find yourself blacklisted and unable to send email to some of your most important contacts.

Seize the day and stay safe.

Since summer is vacation season for many of us, business tends to slow down slightly as our clients and colleagues enjoy much-deserved time off. That makes this the perfect time to seize the opportunity to apply these S-P-F practices today to ensure that your online presence is well protected all year long.

Mistrustcasting: A Tale of Two Brands

One day recently, a high school math class decided to conduct an experiment to ascertain whether Oreo’s Double Stuf cookies actually contain twice the “stuf” – crème filling – as implied by the treat’s name.

The class’s work yielded the faintly damning discovery that the Double Stuf contain only 1.86 more filling than the original incarnation – a shortage of 7 percent. Hardly headline-making news, right? After all, most folks would agree that it’s close enough and simply applaud the teacher’s creative, hand-on approach to this classroom exercise.

And that’s where Oreo should have left it, but they chose not to. Instead, when contacted about the matter by Business Insider, the company issued a formal statement claiming the math class had reached an inaccurate total and that their Double Stuf recipe does indeed include fully twice the amount of filling. So Business Insider put together its own experiment, which came down in favor of the math class.

Oreo’s response made this story bigger than it needed to be, and as a result, the brand’s overall reputation took a hit. After all, if they felt the need to lie about 7 percent of their filling, what else might they be hiding? The cookie controversy served up good fodder for a few days of news bites and morning drive-time humor, but given the public’s lasting love for Oreo, the Double Stuf kerfuffle blew over in short order.

More than filler

The Double Stuf debacle is an entertaining – if relatively innocuous – example of just how easily the integrity of even the most well-known brands can be called into question. That’s why the task of building and maintaining trust in your brand is such serious business. For more evidence, let’s take a closer look at BP and SC Johnson, two huge corporations with very different approaches to brand integrity – and very different reputations.

Both companies deal in products under close scrutiny in today’s increasingly green-minded business and marketing environments. BP is the world’s sixth largest petroleum fuel interest, and SC Johnson is one of the world’s largest producers of household cleaners.

If you look at their advertising and PR, both companies use strikingly similar language, which is logical, given that each company has a vested interest in portraying itself as environmentally responsible and forward-thinking.

But the court of public opinion tells a very different story, making it clear that their efforts to define themselves are yielding drastically different results.

BP’s big problem

More than three years after the disastrous oil spill in the Gulf of Mexico, BP is still dealing with the aftermath on many fronts. In addition to the illegal practices which led to the spill, the company has been found guilty of felony for lying in its response to the disaster and has paid out more than $42 billion in clean-up costs, settlements and fines.

BP was found to have engaged in multiple deceptions before, during and after the spill. The company repeatedly refused to disclose accurate or timely information for months after the disaster, which resulted in a far greater impact on the environment than would have happened if the company would have been immediately forthcoming.

A visit to BP’s website shows that the spill still dominates much of the company’s PR efforts. That’s as it should be.

But even as BP touts its gulf clean-up efforts in carefully crafted feature articles, it releases defensive statements whenever its efforts and motives are called into question. For example, in a statement dated August 28, BP responds to recent allegations by the state of Louisiana claiming that BP has not adequately addressed the clean up. Here’s the money quote that leads the statement: "Any suggestion that BP has failed to address the clean up of the Louisiana coastline is both false and irresponsible.”

No acknowledgement of BP’s responsibility, no conciliatory tone indicating that BP is committed to repairing the damage it caused, no apology for all of the suffering. Just a hardline defense, with copy that reads like it was drafted by a stereotypical Hollywood lawyer. This antagonistic tone is at odds with the shiny, happy stories that appear throughout the special section of its site dedicated to the Gulf of Mexico restoration.

This stark discrepancy between rosy PR fluff pieces and sharp legal statements defines the very heart of BP’s brand integrity issue. This is a company whose practices are squarely at odds with the public image it attempts to project.

Start with the logo

Petroleum is hardly a “clean” business; the best any oil company can offer is diligent safety practices and commitment to mitigating its environmental impact.

When BP debuted its green sun logo in 2001, the flowery “helios” mark, it was a clear effort to position the brand as somehow “cleaner” and more environmentally conscious than its competitors. The green sun implies a very different focus than, say, an oil derrick looming over a seascape. Yet in the decade plus since its logo shift, BP has actually decreased its efforts in the arena of solar power, finally announcing plans to shutter them altogether in 2011.

The fact remains that BP is first and foremost an oil concern, with all the environmental risks that such companies encounter. Until BP’s research spending on alternative fuels exceeds the 50 percent mark, that logo is a blatant lie.

Follow the money

Many brands seeking to build trust with the public establish charitable foundations or make contributions to causes. With its image in desperate need of a reboot, BP has made significant donations to gulf cleanup efforts and regional charities that focus on hunger and housing. These are all high-profile, press-release-ready efforts.

It’s certainly better than nothing, and BP does seem to grasp the idea that it needs to spend big to show its concern.

But you won’t find much in the way of marine environmental research on BP’s books or any slowdown whatsoever in the company’s high-risk deepwater drilling projects. No, right along with its more environmentally friendly efforts like wind and biofuels, BP is still using the lion’s share of its research dollars to pursue the same kind of risky drilling that damaged the Gulf of Mexico so dramatically.

As John Bell writes in Forbes Magazine, “BP’s talk about caring for the environment was for naught, as its actions failed to match its message.” Small wonder that a site like boycottbp.com is still growing strong. Or that the brand ranked at number seven in MarketWatch’s 2013 poll of companies with the worst reputations.

SC Johnson’s evolving transparency

While SC Johnson certainly faces environmental concerns, it does have an inherent advantage over a company like BP. After all, a Gulf-scale tragedy is highly unlikely in the arena of household cleaners.

But this field carries its own set of risks. Many of SC Johnson’s products – insect repellents, cleaners and baby shampoo, to name a few – are used by families on a daily basis. And in the last decade, concerns have increased about how these types of products impact not only the health of customers but the greater environment as a whole.

In large part, SC Johnson has responded to such concerns with a careful trust-building approach that includes admission of mistakes and a proactive willingness to change corporate policy and behavior. While there have been a few bumps in the road, even their response to setbacks has been characterized by a tone that emphasizes responsibility over defensiveness.

Open policies

One major area of concern with consumers about household products is the ingredients. Many cleaners and air fresheners tout a natural, organic identity while their labels contain a long list of unpronounceable components unfamiliar to anyone lacking a degree in chemical engineering. In an effort to counteract this, SC Johnson launched its "What’s Inside SC Johnson" website in early 2009, where it has published complete ingredients lists for almost all of its products.

However, the company’s track record is not perfect. Its “Greenlist” label, featured on Windex and other products SC Johnson claimed passed its highest environmental standards, was the subject of several consumer-advocate lawsuits. Because the label closely resembled other third-party designations for independently vetted products, the suits rightly called into question the legitimacy of SC Johnson practice of promoting its own – potentially misleading – self-proclaimed green standard.

Response to criticism

One of the ways in which SC Johnson has been most successful in upholding the integrity of its brand is in its response to controversy. The company trades heavily on its identity as a family-owned business, something that can be difficult to buy given its global scope and multi-billion-dollar annual sales numbers. But when issues arise, it is not a corporate lawyer that does the talking for SC Johnson; it’s Fisk Johnson, CEO and true blood family representative.

In the case of the Greenlist issue, Johnson reiterated the company’s commitment to the environment, but admitted its misstep. “When you're out in front of an issue like this, it means that you're not always going to get it completely right, as was the case with this particular issue," he said.

SC Johnson has also demonstrated a willingness to change its formulas and policies ahead of any legal mandate – and also ahead of many competitors. The company has reduced its greenhouse gas (GHG) emissions by 42 percent since 2000, and it has installed two wind turbines at its largest global manufacturing facility, enabling that facility to produce most of its electrical energy onsite.

Integrity gets results

All of this earnest effort is certainly paying off for SC Johnson. In 2012, the United Nations Foundation for Social Change honored the company as a global Leader of Change, and in 2013, the company received an EPA Climate Leadership Award for Aggressive Goal Setting.

SC Johnson’s mix of staying true to its family roots, increasing transparency with customers and demonstrating a willingness to change combines to reinforce its reputation as a brand that operates with integrity. While the company isn’t perfect, its actions maintain consistency with its image. By any measure of consumer confidence, that’s a powerful – and to borrow from BP’s ill-used lexicon – sustainable strategy.