Ecommerce

As you would expect there are a handful of pieces that must all work in concert to form a functional shopping experience. Focus on the experience rather than solely on the mechanics of the cart because the customer’s experience with your service is what will make or break you.

The pieces are:

A shopping cart located at some domain (www.yourstore.com)
A web server to host www.yourstore.com
A Secure Server Certificate – proves you are who you say you are
A Secure Socket Layer(SSL) – provides privacy and reliability between two communicating applications.
A Secure Protocol (HTTPS)
A Merchant Account
A Transaction Processor (aka Payment Gateway)
A Secure Database
A Financial-Tracking Tool
A Privacy & Security Policy
And most important – A Satisfied Customer

The Process In General
I say in general because there are a lot of variables and each shopping cart/ecommerce set up is slightly different from the next. But in general this is how it all works together.

You need to build/buy/download a shopping cart.

You need to secure everything from when the customer enters their personal information right up through and including when you say “Thank you for your order” and provide the customer a printable receipt of their order.

You need someone to handle Credit Card transactions for you (not just anyone is allowed to do this).

You need a way to accept payments from a Credit Card.

You need to ensure the customer has a pleasant and efficient shopping experience.

You need to know what you sold, when you sold it, to whom you sold it, and what you have left in stock.

You need to have a reliable and efficient mechanism for handling returns and customer complaints.

You should always declare what information you gather and what you do with it as well as how you protect it.

And you need to have a way to ensure and measure customer satisfaction with your service and product. Believe it or not – the service is THE MOST IMPORTANT aspect to a successful on-line business. The actual product is secondary.

Ok, let’s look at the pieces in detail.

The Cart
The cart has to have 4 pieces:

just like to add...

Be VERY mindfull of your physical trash. Shred it, burn it, whatever. I had a customer get a visit from the Feds. due to a dumpster diver getting some 400 credit card #s.

Also, be carfull which countries you accept CCs from. Personally, I will not accept charges from Turkey (and a couple others). Turkey will not prosecute for CC fraud and it runs rampant over there. No offence meant to anyone who lives there, just had many orders and all fraudulent, never a good one.

One more...
When you generate your web pages for the secure side (https://), make sure everything on the page is also pulled from a secure url. Otherwise your visitors get a warning that some content may not be secure and this scares away some visitors. Means nothing really, usually just an image tag with an http:// or something like that.

Maybe some people would agree with you on that one, but one company that doesn't is Amazon. They email your email address, name, physical address and telephone number back to you.

Of course, emailing credit card details would be a bit silly (or even very stupid).

Amazon was in the news not too long ago for poor privacy practices: http://www.itworld.com/Man/2688/021008amazonprivacy/ The article doesn't mention email but it does point to the fact that Amazon has been in the news because people have the perception of poor security where Amazon's customer's personal information is concerned.

It´s posts like these that put whole subject areas in to context for newbies that make WW worthwhile!

Im going to be doing very little work this week while I study all this! ;)

JOAT

(not that I do much work anyway...)

Agreed. In fact, they are what makes the WWW worthwhile! Thanks, Lorax.

Buy X, get Y at Z% off (where Y can be more than 1 item and Z can bee 100% for free items)

Buy X, get Z% off the order.

$/% off off shipping. This one is especially tricky as typically you want to offer free standard shipping and then discount that value off upgraded shipping.

Coupons ($X off the whole cart)

Make sure you think the process through and get the input of every department or group you are working with (even if that is just yourself, put on your marketing hat, your merchant hat, you CFO hat, etc...). Trust me, when you are taking 1000's of orders a day (with any luck), you don't want to have to go back and rewrite your code for anything

--Chris

We ask for the customers name and address on a http form before going to a shipping server to
get the shipping amount. We then go to the secure https form to get the credit card info
and phone number.

Considering a persons address as private information is a bit of overkill. I consider name
and address as part of the public domain. Telephone numbers can be unlisted, so we keep this information secure.

I have never received any complaints either.

According to the General Principles of Fair Information Practices a persons name and address are considered "identifiable information" and therefore should be protected.

Other resources that concur with this are:

http://www.privacyalliance.org/resources/ppguidelines.shtml

http://www.research.att.com/projects/privacystudy/

To me this means, secure the customer's personal information as well as their financial information.

I personally won't buy from a vendor that doesn't protect my name and address with an SSL wrapper and I know that many of my clients feel the same way about thier customers.

Why your customers have never complained is unknown. I know that many folks are so baffled by the web they have no clue as to how to protect themselves as they surf, buy, and download stuff. This could be the reason, it could be equally true that your customers trully don't care.

I thoroughly believe in the route of "overkill" and will go out of my way to explain to the customer why. I sleep better at night knowing their info is protected.

... who take it securely, but then email it back to you as an order confirmation at your non-secure email address. Even lorax recommends that:

"Make sure the customer receives an email verification that acknowledges that they purchased X,Y,Z from You on This Date, for This Amount. NO mention of CC numbers, account numbers. Keep the personal information to a minimum – name and address."

Strange how you think it will be secure if taken via SSL, but what you do with afterward must also be secure. If you would not buy from anyone who does not take your details through SSL, how do you know that they won't email it to you?

My only defense is if someone is going to try and capture personal information, they're more likely to try and capture web form post/get calls than they would be to try and capture an email. The forms are located on one webserver and handle many requests - and therefore would provide a higher return for their effort. Though in rethinking this through - they might just as easily hack the mail server.

The bottom line is that it is best to forego emailing anything other than a thankyou with the information about the purchase. Greet the email recipient with thier first name only and give them the "what they bought, when they bought it etc." but keep everything else out of it. The simpler the better - but just enough to remind them. Ideally, you will provide them a printable receipt wrapped in SSL and use the email to simply acknowledge receipt of the order and tell them when it's shipped.

With the amount of spam out there, I protect my personal email accounts as much as my credit cards.

The web is still new and the consumer hears horror stories about how they can be ripped off. Some of it's true but far more can be avoided by following simple guidelines. The problem for those of us who build and sell through shopping carts is there are far too few authorative web sites that people can turn to get those guidelines - someone they trust. Something akin to "Consumer Reports" here in the US where consumers go to get the skinny on the best camcorder or what to look for when buying a baby seat. Until the web becomes more mature, and more readily accepted, I think that perception will be around.

>> I protect my personal email accounts as much as my credit cards.

I should be more careful with my email address. I have a good working method for incoming spam - it is routinely deleted and occassionally pursued (much to the chagrin of the spammer in most cases). But I don't follow your example as much as I feel I should.

1) Only ask for "personal" information when it's time to checkout
2) Capture ALL identifiable information using SSL
3) Show all charges, including shipping prior to entering your personal information.
4) Entering your zipcode only will show shipping charges.

I have found these practices allow my customers to shop the final price without having to provide any information and come back after comparing other sites. (I guess since we are one of the lowest in price, this is effective)

I find it quite irritating when shopping and someone wants my information before adding an item to my cart or before I see the final price which includes shipping. I usually leave the site when this happens.

20% of people who start an order finish one. You have to probably increase that number a bit for the shoppers that look today and buy tomorrow. That looks like two people, one that finished and one didn't.

Now another interesting bit. People that land on our site searching for a particular product convert at a higher (30%) rate that those searching for the generic widget. In other words, people searching the web for blue widgets are more likely to buy a widget that people searching for just widgets.

I like to think that our conversion rates are pretty high. How's everyone else?

Which is one of the reasons for having them create a user account - so they can pick up where they left off and so you can track their purchases. I'm still on the fence regarding user accounts. In some cases they make perfect sense but in others they're more of a pain in the arse.

Thanks for sharing your numbers duckhunter.

then quit in disgust when they find that it will cost the $15 to get a single memory DIMM

Slindo,
Which is why I always try to make sure they can get the true total cost as quickly as possible. If you calculate shipping then you should add it to the cart. In my opening post I said that you should always provide the client the ability to see thier current sub-total without shipping - which you should. But you should also indicate the shipping cost and the final total based on their current selections.

If you charge a flat-rate for shipping, then a simple chart that can be accessed from anywhere can be made available.

The account I intend on writing will be optional for the site user (no change to the current process), mainly for pre-pop at checkout as we have plenty of repeat business.

The other options for keeping a shopping cart is cookies but they can be disabled, then your site wouldn't work. If I can't make it work for 100% of the people, then I tend to be skeptical.

On the shipping calculations, I couldn't agree more. Be up front and honest. Everyone knows these days to watch for it so if you tell them upfront what the deal is they might just trust you a little more.

To me this means, secure the customer's personal information as well as their financial information.

Not sure about international and local laws here, but in the UK the Data Protection Act means to cover this to protect the consumer.

The bottom line with this law is you need explicit permission from a person to have their details available for public usage, so if anyone does find your "user" table of details then you would be breaking the law here.

Hopefully it is lawful to protect this information "with reasonable effort" as I try to build my own basic cart :)

First you need the zipcode or state to determine the shipping cost.

How much more work is it for the customer to enter their name and street address.

Besides, if the customer has gone to the trouble of entering this information, and get a resonable shipping cost, they are less likely to bail, just because the competion is a buck or two cheaper on shipping, giving that everything else is equal.

The customer will most likely say, while I entered this information, and its not worth the hassle to go somewhere else to save a buck or two.

If the customer only needs to enter a zipcode, they have less effort commited to the order process and is more likely to bail to save a few dollars.

I think in the long run, this will balance out between lazyiness and being cheap.

Playing the Devil's Advocate here: what if your competition makes it easy for them to get that full price without having to enter anything but a zip code? And on the other hand, how can you be sure they even know about your competition?

I suggest it really comes down to knowing your customer and targeting the buying habit that will net you the highest yield. This is where the gold is. Consistently 'speak' to your targeted market segment. Understand them. Learn who they are. Learn what they buy, where, when, and why.

Take for example: Land's End, L.L. Bean and Patagonia. I've never seen advertisements for these companies on TV. Why? Because of several reasons most likely.

One reason is that thier targeted market doesn't like to be pitched to via TV. It's too "low class". Their target market likes to think of themselves as members of a more earthy/natural group. A group that shuns TV in favor of being outside and being active. It's all about image.

They have name recoginition and all three of them ask for your personal information before they give you a total. Patagonia and Land's End both supply you with shipping costs (one in chart form the other using a standard fee based on $) while LL Bean expects you to wait. This is primarily based upon thier business models. LL Bean calculates shipping while the others use flat fees.

And these companies know that their products have mass appeal. This allows them some freedom to expect a bit more from thier customers. There are a lot of other nuances that go into why their websites exist and how they're set up. One can learn an awful lot by analysing the success stories out there.