“Build a new Magento site,” they said. “It will be easy,” they said.

Over the years we’ve run into many frustrated Magento merchants. So frustrated, in fact, the word Magento is unfortunately followed by some expletives. The stories usually go like this:

“I had my Magento site built by people who swore they had Magento experts on staff and could easily meet my budget requirements within my desired timeframe. They also said building a Magento site is easy because all you have to do is install Magento, add a low-cost theme extension for the design, and any other extensions needed for custom features or integration.”

Sounds simple right? Wrong. Here’s why. There are a lot of developers, agencies, freelancers, etc. out there who claim to know Magento. It’s important for merchants to understand that Magento is a complex infrastructure that requires a knowledgeable developer. A truly experienced Magento developer will be able to help merchants walk through their needs, while properly setting expectations on a timeline, budget, and technical requirements. Through experience, we’ve put together three key areas to look out for when building a new Magento site.

3 pitfalls to avoid when building a Magento 2 site:

1. Inexperienced Developers

While Magento is open-source, it is vastly more complex (due to its object-oriented architecture) than other open-source platforms like WordPress or OpenCart. Agencies with open-source platform experience often assume that developing in Magento requires the same effort required for less complex, script-based, open-source platforms. Sadly, these inexperienced developers unintentionally mislead merchants into projects with scope and complexity way beyond their ability to execute. What’s worse is that these projects typically end over budget, with a half-baked and bug-filled solution that either can’t be launched or the new site is often too littered with bugs and performance issues for the merchant to use and maintain.

Simply avoid this first pitfall by locating a thoroughly experienced Magento developer that is certified and knowledgeable.

2. Unrealistic Budget Expectations

While inexperienced developers can certainly botch a project, unrealistic budget expectations can also derail a new Magento site build. Over the years, we’ve worked with a wide range of merchants and learned a good rule of thumb when scoping out, building, and launching new sites. Through experience, we’ve found that most Merchants need to budget roughly 5-10% of online annual sales for building a quality Magento site that will help grow their business.

Think of it this way, if a merchant doing $5 million hired an inexperienced developer with half the recommended budget at $50,000, just one small negative impact on sales will make the cheaper site feel like a raw deal. Unfortunately, we’ve seen this happen many times. Merchants have come to us with cheap and poorly coded sites that have cut online sales by as much as 50%. Let’s repeat that, sites that cut online sales by as much as 50%.

Avoid this pitfall by setting clear budget expectations amongst all key stakeholders. Running a successful eCommerce business is stressful enough. Cutting corners will not make things easier.

3. Poor Quality Extensions

The third pitfall to avoid when building a new Magento site are poor quality extensions. There seems to be a misconception among merchants that all Magento extensions are turnkey or “plug and play.” This is simply not true and here is why. Due to the open-source nature of Magento, extensions are built by literally anyone including experienced and inexperienced developers. Notably, due to the higher costs of building a good quality extension from a certified developer, development is often outsourced to inexperienced developers. Inexperienced developers can take on projects without understanding the full scope of Magento. In the case of extensions, it usually means low-quality functionality with little to no testing.

Don’t get us wrong, we love Magento extensions and use them all the time for clients. However, we have also seen cheap, bad, or unnecessary extensions create headaches for merchants. An experienced developer will know Magento’s out-of-the-box functionality and will prevent merchants from falling into a Magento customization trap.

If you’re in the market for a new Magento website, do yourself a huge favor and avoid the 3 pitfalls above.

Choose an experienced onshore partner who has a team of certified experts that will avoid poor quality, performance issues, and conversion hits. In addition, an experienced Magento developer will set a realistic plan for building a Magento site that will grow your business. Magento is probably the best eCommerce platform for growth in the market today. When executed correctly, Magento has helped many merchants grow by leaps and bounds. However, buyer beware. There are no pink unicorns, as is with most things, you get what you pay for.

Any of this sound familiar? Building a new Magento site should be an exciting experience and opportunity growth. Contact us to get started on a new Magento site or to have us pick up the pieces on a current Magento build.  

How to setup Magento eMail Templates for M2

When a customer makes a purchase, or changes their password, they are automatically sent an eMail from your Magento store. It’s important that merchants update these triggered and transactional template eMails to match their brand. Notably, Magento makes it easy to customize these types of eMail templates to match the design of your website for branding purposes. In addition, merchants can also create eMail templates for different store views for different languages or sub-stores within Magento.

The process for updating Magento templates is fairly simple. The admin between Magento 1 and Magento 2 is laid out differently, but the steps are essentially the same for updating eMail templates. This also applies to both versions of Magento Open Source (previously referred to as Community Edition) and Magento Commerce (previously referred to as Enterprise Edition).

1. Creating Custom eMail Templates – Getting Started

To access the transactional eMail section go to MARKETING > Communications > eMail Templates

The drop down box shows all of the default Magento templates available. Notably, all of the templates will utilize your store logo and have quite a few dynamic variables. Out of the box, nothing is hard coded to say Magento. At InteractOne, we really emphasise creating a consistent branding experience across our merchant’s sites and eMail communication. And in some cases, we will simplify the eMail templates to display properly on mobile.

As shown above, there are many template options such as “New Order,” “New Credit Memo,” as well as a “For Guest” options. Templates that do not note “for guests” are intended for registered users. See below:

So select the template you wish to edit and click load template.

Special Tip: Load a template eMail to view the HTML code to use as a guide for eMails you’re trying to create. This is helpful when you need an example of code but do not need to edit a full template eMail.

After the template has loaded, give it a name and add a subject line. You can create anything you want, or stick to something simple. The default is usually simple and includes with your store name. See below:

2. Creating Custom eMail Templates – Let’s talk about variables

You’ll notice that there are several variables available throughout the template. These are dynamic variables that will pull settings from your magento configuration into the content of the eMail. For example, these could be the subject line or the body. The store prefix is a store view level prefix, meaning you can give your website a different name on the store level. Or, you can have different settings for your order increment ids, phone, or address based on the store view level. Those examples can be dynamically inserted into the template. See below:

3. Creating Custom eMail Templates – Mobile Friendly eMail.

A popular request among merchants is to create a responsive or mobile friendly eMail. Notice the templates use table settings which by nature are not mobile responsive or mobile friendly.

Special Tip: It’s best to have a developer create an overwrite to the existing layout files if you want to change anything in those sections. Any further directions on how to actually edit those would need to come from an experienced developer.

4. Creating Custom eMail Templates – Template Styles

The Template Styles section is CSS and requires typical ID and class statements that can be built out in line. Editing or adding CSS to the Template Styles section will pull the styles into the Template Content section above.

5. Creating Custom Templates – Check Your Work

After your template is setup, save it. Once saved, you’ll be directed back out into the eMail Templates window where the new custom template will be available. See below:

To apply the new eMail template, open a new tab, go to STORES > Settings > Configuration > SALES > Sales eMails.

Need help with Magento eMail Templates?

In addition to our tutorial above, Magento offers excellent documentation on editing eMail templates. Magento offers even more detail including how to edit headers and footers. However, if you don’t feel Magento savvy or don’t have time to customize your eMail templates, we can help! Contact us today to talk to a Magento expert about Magento eMail templates or give us a call 513-469-3345.

Magento UX Examples From Top Brands

Customers expect more from the businesses they buy from more than ever before. They want an excellent product. They demand high quality customer service. They need a seamless way to look at products, find out about them, and purchase them. For this reason, in order to compete in any industry whether it be consumables, fine art, or apparel, merchants must invest in creating an unparalleled user experience (UX) on their website. Here are a few Magento UX examples from well-known merchants that have gotten UX right for their customers.

1. Magento UX Examples from Canon Australia

Canon Australia used a highly custom Magento theme to completely revamp the UX on their website. The main improvements were features that they added to the site to create a better pre-purchase, purchase, and post-purchase experience. One example is the use of bundled products.

To fully utilize the product bundle tool, Canon partnered with other industry brands, allowing customers to purchase kits that would supply them with everything they needed for their photography project. This included products such as cameras and lenses, alongside accessories like tripods and memory cards from other brands.

In addition, Canon Australia utilized Magento’s product finder tool.

To enhance the post-purchase experience, Canon Australia added a utility where consumers can print their photos, create photo books, and even save their images to a cloud-based photo storage.

For their cloud-based storage offering, Canon Australia used the Irista photo storage extension and, to allow finance purchasing, they used the Society One extension. Finally, to streamline B2B ordering, reordering, and order management processes, they decided to employ Web Sales Orders, a Magento-developed B2B suite.

2. Magento UX Examples from Virginia Hayward

Virginia Hayward envisioned a labor-saving UX design due to their unique product offering. Partially, the “Build a Hamper” feature is built with the customer in mind. Shoppers can choose a hamper or multiple hamper types, fill them with the products that they want, add branding and custom messaging and ship to one or more locations.

3. Magento UX Examples from Absolut Art

In order to make their website as mobile and modern as possible, Absolut created a site featuring a swipe right or left capability.

Another goal was to allow customers to become more connected to the art pieces by getting to know the artists. They embedded auto-playing videos about the artist to accomplish this.

4. Magento UX Examples from the Atlanta Hawks

In order to meet growing sales and site traffic peaks during game time, The NBA Store for the Atlanta Hawks built their new Magento site with the customer in mind. The new site focused heavily on category flexibility, responsive web design, and a mobile-friendly content.

The new site integrated One Step Checkout and the Moneybookers payment gateway to streamline their checkout process.

Get Started on a UX Focused Design of Your Own

The Magento platform offers unbelievable scalability that allows merchants to design with each unique customer in mind. The merchants noted above span multiple verticals with very different customer needs. Magento allows merchants to implement what they need. With Magento, great UX can be achieved out-of-the-box, with extensions, or even with custom code. If done correctly, sites will run at peak performance and delight customers.

To learn more about Magento UX examples for your store, contact us or call us to talk to Magento expert at 513-469-3345.

Security Patch SUPEE 10266 and Magento 2 updates have arrived.

Last week, Magento released new Magento 2 updates as well as SUPEE 10266 to Magento Open Source and Magento Commerce. The updates include numerous security changes and enhancements that work to prevent your website from data leaks, cross-site request forgery, and authenticated Admin user remote code execution vulnerabilities.

These updates include:

• Magento Open Source and Magento Commerce 2.1.9
• Magento Open Source and Magento Commerce 2.0.16
• Magento Commerce 1.14.3.5
• Magento Open Source 1.9.3.6
• SUPEE-10266 (patch for earlier Magento 1.x versions)

What the security updates and patches address

Per Magento:

“These releases contain almost 40 security changes and enhancements that help close cross-site request forgery (CSRF), unauthorized data leak, and authenticated Admin user remote code execution vulnerabilities.”

These critical security issues are why Magento 2 updates or SUPEE 10266 need to be applied as soon as possible.

In addition to these vital patches to Magento security, the release also includes a couple general fixes to common problems related to image reloading, payments using one-step checkout, and updates to the USPS API.

• One fix involves an issue where uploaded images were twice their original size.
• The other adds an informative message to the payment information section of the one-page checkout that works to alert customers that no payment is due for orders that total 0.0.
• On September 1, USPS changed their “First-Class Mail Parcel Service” to “First-Class Package Service – Retail”. Because the First-Class Mail Parcel is no longer available after September 1, Magento 1.x and 2.x merchants offering this service must change this service name in the Usps.php as soon as possible. If merchants do not take action, stores will not support checkout using the new “First-Class Package Service – Retail” option.

What to update

Although Magento released multiple new security patches, all of them address problems with unauthorized access. Depending on what version of Magento you are using, there are different required solutions to updating your security.

 Magento 1 merchants will need to either upgrade to Magento 2 or apply the SUPEE-10266 patch.

Magento 2 merchants will need to update both Magento Source (formerly known as Community Edition) and Magento Commerce (formerly known as Enterprise Edition).

Regardless of whether you are on Magento 1 or 2, keeping your security up to date is VERY important. By Ignoring Magento Security Patches and Upgrades, your website is exposed to vulnerabilities that exist throughout your Magento installation.

InteractOne can help migrate, update and patch all versions of Magento. Contact us to get your site updated or patched up. Or, call us to talk to a Magento expert at 513-469-3345.

Commonly Asked Questions:

• “What’s the difference between Community Edition (CE) and Enterprise Edition (EE)?”
• “What does Magento 2 have to do with it?”
• “Which one do I need?”

Once we talk them through their first set of questions, the next line of questioning goes something like:

• “How much does it cost to create a Magento 2 site using CE vs EE?”
• “Why should I choose the paid version over the free version?”  
• “Can I create the same advantages of EE on CE if I use extensions?”

It’s tough to answer these questions at a brief, high-level without an in-depth understanding of your business. Every merchant is unique and every merchant has a unique set of needs, but we can detail some key differences between CE and EE so merchants have a better understanding of where to start before they have those in-depth calls with us or another developer.

Magento 1 vs Magento 2

We have covered the differences between M1 vs M2 in detail and have discussed how and why you should upgrade to Magento 2. Read about those here, here, and here. However, below is a cheat sheet comparing the key benefits of what Magento 2 has to offer over Magento 1 for both CE and EE.

New Extension Processes for Magento 2

When Magento 2 launched, Magento also revamped how merchants access extensions. Merchants can go to the Magento Marketplace for access to hundreds of extensions and they are grouped in the following categories: Accounting & Finance, Marketing, Content & Customization, Customer Support, Payments & Security, Reporting & Analytics, Sales, Shipping & Fulfillment, and Site Optimization.  

Many of the extensions are free but some can cost hundreds, even thousands of dollars. The important things to consider are the quality, reliability, and available support for any extension. A benefit of Marketplace is that all the extensions have been reviewed and tested through the Extension Quality Program.

Magento 2 Enterprise – New Out-of-the-Box Features

To the right set of merchants, we recommend Magento 2 Enterprise Edition over Magento 1 Enterprise Edition. In Magento 1, there was little incentive for merchants to purchase EE. There were not enough additional features over Community to make Enterprise worth the investment. Notably, we saw many merchants on CE utilizing extensions to get the power of EE without the price tag. That worked for some, but it can be tricky to manage and maintain a healthy website. Those M1 Frankenapp sites can create some seriously expensive headaches.

However, that is not the case for Magento 2 Enterprise. Magento has packed the latest Enterprise Edition with a multitude of exciting out-of-the-box features – no complicated extensions (or Frankenapps) required!

What About Costs?

Community Edition is a free option for Magento – there is no additional cost to use the platform.

Enterprise Edition is a paid option for Magento – total costs vary depending on merchant revenue.

Specifically for EE, the higher gross merchandise sales value (GMV) of a store, the higher the annual fees will be. With that in mind, larger merchants usually determine that the benefits of EE are worth the investment. Smaller merchants often start by utilizing the free Community Edition, until they can grow their sales to justify the investment of Enterprise.

However, when considering CE over EE, it’s important to also calculate the costs of extensions into your investment. Consider not just the overall cost of the extension, but also the time it will take to install, set-up, and configure (which includes ensuring that all extensions play nicely together). There are also ongoing expenses for updating and maintaining extensions over time.

While it might be more economical to start with CE and a few extensions, it’s important to think about the long-term game plan. If over the next couple of years dozens of extensions will need to be installed to get the right features needed, then it very well could be worth it to invest in EE from the get-go.

Need help fast? Tell us about it!

By Greg Reedy, PHP/MySQL Developer at InteractOne

Ignoring SUPEE Patches Could Cost You Big Time Down The Road.

Magento released two critical security patches this year for Magento 1: SUPEE-9652 and SUPEE-9767. The latter was just recently released May 31.

The first patch (SUPEE-9652) addresses Zend library vulnerabilities. Specifically, “the Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1.” The patch is scored as critical but to be affected, a merchant would have to use Sendmail as the mail transport agent or have specific, non-default configuration settings.

The new vulnerability has been found in a Zend Framework 1 and 2 email component used by all Magento 1 and Magento 2 software and other PHP solutions. This is a serious threat and can lead to remote code execution attacks if your server uses Sendmail as a mail transport agent. However, the attacker would need to target this vulnerability specifically by finding your store’s email “Set Return-Path” set to “Yes,” along with your server using Sendmail, at which point your store is vulnerable to this exploit.

The second patch recently released (SUPEE-9767) addresses an issue with form validations and attackers gaining access to the admin side of the site. Once access is obtained, attackers are disabling a configuration protection and uploading malicious code hidden in an image. Use of the AllowSymlinks option in Magento’s configuration settings can enable the upload of an image containing the malicious code. Although the option is normally turned off by default, an attacker can enable it once gaining admin access and upload infected images in multiple locations.

By ignoring or avoiding Magento Security Patches and updates, merchants are opening themselves up to a much larger problem.

We’ve encountered several merchants over the last year or so who have ignored security or bug patches and have severely delayed the upgrading of their Magento sites. Further, we often find that “discount developers” who have previously worked on said sites have broken the “Golden Rule” of Magento development: Never customize or alter the core code outside of official Magento patches and upgrades!

Core edits not only weaken the overall fallback built into Magento, but can cause patches and upgrades to be ineffective if these alterations occur in a way that circumvents the fallback as well.

The sad part is that these issues can be easily fixed if they were handled in a timely manner instead of “waiting it out” until the next redesign or other major site updates. By ignoring Magento Security Patches or avoiding updates, merchants are opening themselves up to the much larger problem of legal indemnification since many maintain publicly that they are PCI compliant while leaving gaping security holes in their site’s infrastructure.

Did You Know That 90% of breaches impact small businesses?

According to a FirstData analysis on the costs of a data breach, merchants can expect to deal with a lot of unexpected costs and paperwork.

“When a breach of payment data is reported (or even suspected), it kicks off a series of unavoidable and costly actions that range from forensic analysis of the merchant’s payment system to mandatory reporting requirements.”

The analysis continues, to address the massive expenses that can incur.

“If your business is unfortunate enough to have this happen, you can expect to incur significant expenses. For example, the cost of a data breach for a small business merchant averages $36,000 and can reach or exceed $50,000.”

This, of course, is in addition to the publicity mess and potential loss of business from nervous consumers. The study found that 90% of breaches impact small businesses, reporting that as much as 31% of customers terminated their relationship with the targeted business after a breach was discovered.

Another recent report by Computer Business Review found that attackers were using “tried and tested methods. Leading a resurgence of ‘classic’ attack vectors [such as] adware and email spam… at levels not seen since 2010.” Spam was found to account for 65% of email, with 8-10% identified as malicious.

Do we need to go back and review SUPEE-9652? It covers email vulnerability. Although perhaps rare for some merchants, the Computer Business Review report indicates the severity of email spam.

It’s simple, invest now in Maintenance and Support so you don’t have to take out a loan down the road to recover from a major data breach or hack.

The common reason why merchants avoid regular site maintenance and support is due to up-front costs. The concern is that site maintenance could run hundreds or even thousands of dollars with little perceived return. The irony is that regular site maintenance often makes the experience better for customers and administrators alike as bugs are fixed and improvements are made. Plus, merchants are obviously saving much more money in the long run as they’ve done all they can to assure their website is secure and truly compliant with eCommerce laws.

Applying security patches is often very quick, especially when a site is up-to-date and properly maintained. Notably, version upgrades will include multiple patches, so it’s usually best to upgrade to the latest versions as they are released regardless if a previous patch has already been installed. This ensures that all applicable patches and bug fixes have been included and the system is hardened against attacks.

So, Ignoring Magento Security Patches and putting off upgrades is just never a good idea. Save yourself time and Tylenol and stay on top of your site’s maintenance and support.

Need a Magento Security Patch or an upgrade? Contact us to see how we can get you patched up.