As the pervasive shadow of Covid-19 recedes and slowly becomes a memory, many of the technologies and protocols we developed during that time remain. Global eCommerce retail sales have always experienced an annual incline. However, these figures have been boosted as more consumers have adopted online shopping and abandoned traditional brick-and-mortar stores.

With more shoppers online, cybercriminals are sure to become bolder and more opportunistic too. While consumers must practice proper cyber hygiene and protect themselves on the internet, eCommerce store owners are also responsible for ensuring that shoppers’ private information stays safe.

But how? What steps should you take to protect your customers during the holiday shopping season? This guide will share six cybersecurity tips you can implement starting now.

Why Is Cybersecurity Crucial for the Shopping Season?

A 2021 Verizon report revealed that 46% of all cyber breaches impacted small businesses. Due to the high cost of a breach in the form of fines and damage to their reputation, many of these businesses are now facing bankruptcy.  

However, the most alarming statistic is that over a quarter of small businesses collecting credit card information have subpar cybersecurity or no security at all. With cyberattacks forecasted to spike during this holiday shopping season, eCommerce store owners must pay attention to their cybersecurity measures as much as they do to their marketing campaigns. But what should you look out for?

Most Common Cyberattacks Affecting eCommerce Businesses

The most popular exploits today include:

• Account takeover (ATO): Cybercriminals use stolen usernames and passwords to take over accounts. For eCommerce stores and businesses, this could be employee or administrative credentials to log into servers or client machines. Once the bad actor breaches the company’s network, they can gain access to the databases where confidential customer information is kept. They can then steal this information, sell it to the highest bidder or use it for nefarious purposes.
• Gift card and wallet fraud: There are numerous ways cybercriminals and fraudsters can initiate these types of exploits. They can hack into a company’s gift card database and scrape card and activation numbers. Alternatively, they can tamper with physical gift cards or attempt to use gift card number generators. Your business must be mindful of this potential entry point.
• Inventory exhaustion: Some online stores remove the item from the available inventory when customers add it to their shopping cart. This reserves the item for them, so it’s still available when they finally check out. Cybercriminals can use bots to initiate a hoarding attack. A bot will constantly add items to a shopping cart to create the illusion that it is out of stock. This denies the sale of the item for petty purposes or so that the bad actor can purchase it themselves when they can afford to.
• Bandwidth choking (DDoS attacks): Distributed denial-of-service (DDoS) attacks are one of the oldest tricks in the book. This is where a bad actor floods a website or web service with network traffic to overload and crash it, although it can happen to small online stores too.
• Content scraping: Cyberattackers may use bots to extract or copy all of your website’s content that they can use maliciously. For instance, they can duplicate your website and divert organic traffic from it, then use your website’s clone to steal information from your customers.

Cybersecurity Tips To Protect Your eCommerce Customers

So how can you protect your company and customers from the above attacks this coming holiday season?

1. Enforce Strong, Unique User Passwords

Many eCommerce stores require users to create accounts before they can make purchases. A 2021 GoodFirms survey found that 30% of breaches could be traced back to weak password policies and practices. Generally, the less complex a password is, the more susceptible it is to brute-force attacks. Your business must enforce strong password policies both internally (employees and administrators) and externally (customer profiles).

Here are a few characteristics of a strong password:

• Unique and different from your other login credentials
• Uses a mixture of uppercase and lowercase letters, symbols, and numbers
• At least eight characters long
• Does not contain any personal information, such as dates of birth or names of relatives/pets

Using strong passwords is one of the most important cybersecurity tips, and it’s critical that your business enforces this policy. It is also recommended that users (both your customers and employees) utilize a password manager.

2. Establish Cybersecurity Policies

Good cybersecurity awareness can thwart most exploits initiated by bad actors. Being able to identify fraudulent links and other phishing exploits is more valuable than trying to find a software solution that addresses all your cybersecurity concerns.

You and your employees must be updated on the latest cybersecurity practices and protocols. Consider hiring an expert who can walk you through the best practices. Your cybersecurity policies should be informed by the data privacy rules and regulations of the territories your business operates in. For instance, if you’re operating in the EU, you must be educated on the GDPR. If you’re operating within California, you should understand the rules of the California Consumer Privacy Act.

Any business that deals with payment information and credit cards must ensure that it is PCI-DSS compliant. The official PCI security standards council site has a list of guidelines to help companies keep confidential customer data as safe as possible.  

3. Implement Additional Authentication

Concepts such as two-factor and multi-factor authentication have become extremely popular in recent years. Multi-factor authentication means implementing an additional form of authentication in addition to your user credentials. For example, after entering a username and password, you may choose to verify the login attempt through an email link or one-time code sent to a user’s phone.  

4. Only Store Customer Data That You Need

Guidelines and regulations such as the GDPR don’t specify a time limit for how long you can keep a customer’s personal information. However, it’s important that you only store data that you need to provide services to the customer for as long as you need it.

It’s also important that you segment databases and data according to their importance. Credit card and payment information should be kept separate from general customer information and your business information. All data must be placed in secure encrypted databases.    

5. Employ a DDoS Mitigation Solution

DDoS and other bot-related attacks can be mitigated through the right solution. However, you should first ensure that you have a disaster recovery site in place. If your attacker manages to shut your site down, you can roll the traffic over to a recovery site. Of course, this doesn’t always work, especially if the attack is DNS based.

Alternatively, you can purchase a dedicated server to prevent DDoS and bot attacks. Sometimes, your ISP or cloud provider may offer integrated DDoS protection. Do not hesitate to add this feature to the list of services. While bot-mitigating solutions such as CAPTCHA have been shown to decrease conversion rates, they’ve been proven to be somewhat effective against spam and bot attacks.

That said, cybercriminals have begun using more sophisticated tactics, such as machine learning to circumvent CAPTCHA checks. With cloud-based platforms and integrated memory systems being the driving force of machine learning adoption, more cybercriminals will have access to these tools.

As such, it’s important to implement a multi-channel mitigation solution. For instance, your mitigation solution should be able to detect any suspicious traffic coming from a visitor’s IP address. It should also be able to track any questionable customer activity, such as adding items to carts but not checking out.

6. Conduct Regular Software Audits

Your business should be employing all the necessary software tools to facilitate proper cybersecurity, including anti-malware solutions, firewalls, user account management tools, etc. You can hire a zero trust expert to help determine what software will suit your network infrastructure the best.

You also need to monitor your software stack and ensure that your operating systems, productivity/business software and cybersecurity software are all updated to the latest versions. This process can be made easier with cloud panels and workload automation software.

Conclusion

Many of the cybersecurity tips listed in this guide should be implemented regardless of the upcoming holiday shopping season. Nevertheless, your website and servers must be able to handle the usage influxes and traffic spikes that will be brought on by the holiday shopping season. One of the best ways to ensure holiday sales are not interrupted is to have multiple recovery sites to mitigate any downtime.

Next, your company must ensure that it’s up to date on the latest cybersecurity and network protection developments. You can only protect your customers if you protect yourself first.

Through SEO, marketers can improve their websites’ rankings in Google’s search engine results pages (SERPs) and thus reach top results.

While doing SEO, however, there are some common SEO mistakes to keep away from. In case of committing any of these mistakes, marketers might end up harming their search ranking and reputation.

Below are seven of the common mistakes that you must avoid.

SEO Mistake #1: Optimizing your site for the wrong keywords

The first step in any search engine optimization campaign is to choose the right keywords for which you should optimize your site. If you initially choose the wrong keywords, all the time and effort that you devote to trying to get your site a high ranking will go down the drain. What good will the top rankings do if you choose keywords which no one searches for, or if you choose keywords which won’t bring in targeted traffic to your site?

The good news is that there are some warning signs that say you’re maybe optimizing for the wrong keywords. Amongst these, we find the following:

According to Neil Patel, an SEO expert, and co-founder of Crazy Egg and Hello Bar:

If you go about optimizing site content for every keyword you can think of, chances are, you won’t rank highly in search engine results pages.

Worse, you’ll experience a high bounce rate, because search engine users who eventually find your web site will leave without doing anything that you want them to do.

….In fact, not optimizing site content for the right keywords will cripple your search engine rankings.

SEO Mistake #2: Putting too many keywords in the meta keywords tag

We often see sites that have hundreds of keywords listed in the meta keywords tag, in the hope that will get a high ranking for those keywords.

Nothing could be further from the truth. Contrary to popular opinion, the meta keywords tag has almost completely lost its importance as far as search engine positioning is concerned. Google does not use keyword meta tags directly in its rankings.

Hence, just by listing keywords in the meta keywords tag, you will never be able to get a high ranking. Since there is no correlation between the keywords you stuff into a Meta tag and your search engine rank. To get a high ranking for those keywords, you need to naturally add the keywords to the actual body content on page.

SEO Mistake #3: Repeating the same keyword too many times

Another common mistake that people make is to endlessly repeat their target keywords in the body of their pages and in their meta keywords tags.

Because so many people have used this tactic in the past (and continue to use it), the search engines keep a sharp lookout for this and may penalize a site that repeats keywords in this fashion.

Sure, you do need to repeat the keywords a number of times. But, the way you place the keywords in your pages needs to make grammatical sense. Simply repeating the keywords endlessly no longer works. Furthermore, a particular keyword should not ideally be present more than thrice in your Meta Keywords tag.

SEO Mistake #4: Creating lots of similar doorway pages

Another myth prevalent among people is that since the algorithm of each search engine is different, they need to create different pages for different search engines. While this is great in theory, it is counter-productive in practice.

If you use this tactic, you will soon end up with hundreds of pages, which can quickly become an administrative nightmare. Also, just imagine the amount of time you will need to spend constantly updating the pages in response to the changes that the search engines make to their algorithms.

Furthermore, although the pages are meant for different engines, they will actually end up being pretty similar to each other. Search engines are often able to detect when a site has created similar pages and may penalize or even ban this site from their index.

According to Google,

“…they (Doorway Pages) can lead to multiple similar pages in user search results, where each result ends up taking the user to essentially the same destination. They can also lead users to intermediate pages that are not as useful as the final destination.”

Hence, instead of creating different pages for different search engines, create one page which is optimized for one keyword for all the search engines.

SEO Mistake #5: Using hidden text

Hidden text is text with the same color as the background color of your page. For example, if the background color of your page is white and you have added some white text to that page. That is considered a black-hat SEO practice.

Many webmasters, in order to get high rankings in the search engines, try to make their pages as keyword rich as possible. However, there is a limit to the number of keywords you can repeat on a page without making it sound odd to your human visitors.

Thus, in order to ensure that the human visitors to a page don’t perceive the text to be odd, but that the page is still keyword-rich, many webmasters add text (containing the keywords) with the same color as the background color. This ensures that while the search engines can see the keywords, human visitors cannot.

Search engines have long since caught up with this technique, and ignore or penalize pages that contain such text. They may also penalize the entire site if even one of the pages on that site contains such hidden text.

However, the problem with this is that search engines may often end up penalizing sites that did not intend to use hidden text.

For instance, suppose you have a page with a white background and a table on that page with a black background. Further, suppose that you have added some white text in that table. This text will, in fact, be visible to your human visitors, that is, this shouldn’t be called hidden text. However, search engines can interpret this to be hidden text because they may often ignore the fact that the background of the table is black.

In official guidance from Google, they state:

“Hiding text or links in your content to manipulate Google’s search rankings can be seen as deceptive and is a violation of Google’s Webmaster Guidelines.”

Hence, in order to ensure that your site is not penalized because of this, you should go through all the pages in your site and see whether you have inadvertently made any such mistake.

SEO Mistake #6: Using page cloaking

Cloaking, which is against Google’s webmaster guidelines, is defined by Google as follows:

“Cloaking refers to the practice of presenting different content or URLs to users and search engines. Serving up different results based on user agents may cause your site to be perceived as deceptive and removed from the Google index”

People generally use page cloaking for two reasons:

1. To hide the source code of their search engine-optimized pages from their competitors
2. To prevent human visitors from having to see a page that looks good to the search engines but does not necessarily look good to humans

The problem with this is that when a site uses cloaking, it prevents the search engines from being able to spider the same page that their users are going to see. And if the search engines can’t do this, they can no longer be confident of providing relevant results to their users. Thus, if a search engine discovers that a site has used cloaking, it will probably ban the site forever from their index.

Hence, our advice is that you should not even think about using cloaking in your site and if you are already doing any cloaking and getting away with it, I guess you may have to be on the lookout.

SEO Mistake #7: Devoting too much time to search engine positioning

Yes – we lied. There’s another common mistake that people make when it comes to search engine optimization – they spend too much time on it.

Sure, search engine placement is the most cost-effective way of driving traffic to your site and you do need to spend some time every day learning how the search engines work and optimizing your site for the search engines.

However, you must remember that search engine optimization is a means to an end for you – it’s not the end in itself. The end is to increase the sales of your products and services. Hence, apart from trying to improve your site’s position in the search engines, you also need to spend time on all the other factors which determine the success or the failure of your website – the quality of the products and services that you are offering, the quality of your content, and so on.

You may have excellent rankings in the search engines, but if the quality of your products and services is poor, or you’re not producing high-quality SEO content, those high rankings aren’t going to do much good.

Jacob McMillen is a copywriter, marketing blogger, and inbound marketing consultant.

Subscribe to the Search Engine Watch newsletter for insights on SEO, the search landscape, search marketing, digital marketing, leadership, podcasts, and more.

Join the conversation with us on LinkedIn and Twitter.