Hosting Infrastructure

I have been through all accounts in the hosting and made some changes to the infrastructure that the websites run on. If you see anything broken, or any odd behaviour please bring it to my attention ASAP. These changes will impact your website and email handling (in certain cases).

PHP7.3

PHP is the scripting language which is used on the server to support the websites. It is a type of operating system for servers. The wordpress websites make requests to the operating system for various support functions. Up until yesterday (12/11/19) we had quite a large range of versions in use. I have upgraded all of them to above version 7.1 most are at version 7.3 the highest version available.

Why is this important?

I saw some reports coming from WordPress installation monitors that advised to update above version 7 because there were some security vulnerabilities in the PHP 7. That was the motivation to make the changes. Continue reading Hosting Infrastructure

Annoying Bug

This is for anyone working with Office 365 and the latest version of Outlook having problems with setting up a new or existing email account.

At the time of writing it is not clear whether this bug relates to something that Office 365 Outlook is doing, or within the hosting we are using. What we do know is under certain circumstances an email account that can be accessed with a known password using the webmail interface (https://stackmail.com) cannot be set up in Outlook when using Office 365. This type of problem can drive you mad and waste hours.

Circumstances

You have just installed the latest version of Office 365 on your computer, and you wish to connect with an existing or very recently set up email account. You know the email account works, you know the password and you know the email address, and have accessed it ok through webmail (https://stackmail.com).

When you try to auto set this up in Outlook, or use the manual instructions I have provided it reports an error. It does not matter what you change in terms of ports and encryption protocols, it reports an error every time.

Resolution

1). Firstly, make absolutely sure that the email address and password combination works by logging into stackmail.com. Do that even if you are 100% sure.

2). Go back to Outlook configuration and try it again using exactly the same information for the email address and the password. You should be able to use Auto settings. If that does not work, use the last guide I created for Outlook.

3). If it did not work. Stop trying to resolve it in Outlook. Go back into webmail and locate the setting which allows you to change your password through webmail. When you locate it, overwrite the old password with THE SAME PASSWORD. Yes I know that is counterintuitive. It forces the encoding of the password to be re-performed in the hosting. It also ensures any other email accounts you are using will still work without any modification.

4). Go back into Outlook, it is probably best to delete any partially set up account and start again. You will find that it will work this time.

Make sure any local IT person working in your office is aware of this if they run into problems. This problem does not occur all of the time withe latest version of Office 365, but it happened to me last weekend while setting up a new PC, and I have at least one other case like this. It is very odd. The hosting company when they watch the protocol exchange observe that the password you are using is rejected, probably because Outlook is not using the right key exchange protocol or encoding. Resetting the password seems to resolve it.

Cautionary notes about email and your website

I have had a few cases where mysteriously the website is suddenly not sending emails out allegedly. Further investigation shows it is sending emails out, but the recipient is not receiving them, so what is going on?

Local IT at work?

Inevitably it is because a local IT company has installed Office 365 for you and you are now running over Microsoft Outlook servers. Your local IT person who works with you in your office, had been granted access to the hosting settings to redirect email to the new servers. However the they have omitted to test something.

Are you tied to your service provider?

If your primary email address for your website does not end in your website name, then the chances are you are tied to one of the email addresses issued by your service provider, or perhaps you are using a gmail, hotmail or yahoo free address? Here are some things to think about…

If your email address is one issued by your broadband supplier, this means your organisation is tied to your broadband supplier, you cannot move to a lower cost provider because you will lose your email address. Then how do people contact you? You may be paying extra for additional email addresses. Those default email accounts issued by BT tend to be 1GB in size too which is not a lot of email.

What should you do?

If you have a website and it is your intention to retain the website address, and it is associated with the business or charity then you should use your domain name for your main and any subsequent email addresses. For example if you have a website called www.mycoolsite.co.uk then you can have an email address called info@mycoolsite.co.uk. If you do this and I am hosting you, you can have 10GB email boxes, as many as you need and at no additional cost. It also means you can review your broadband supplier prices and see if there is anything better around. I changed from BT to John Lewis, a better package and saved over 30% of the cost just over a year ago. I could only do that because my primary email address was not a BT one.

Continue reading Are you tied to your service provider?

Online Referral Form

From time to time I am asked about whether it is possible to add an online referral form. While anything is possible they can get very complicated and if you wish to add conditional elements into the form as well, the complexity rises further. If one also considers making some fields mandatory, then the complexity rises further and you run the risk that the form cannot be submitted because some element is missing.

Just for the record

I have looked at a number of solutions, but so far have not found one that universally works for all. But if there is significant interest I can look again.

Form Using Standard Form Plugin

I currently favour Contact Form 7 as a contact form plugin. It is one of the most popular ones out there. I also use several add on plugins as well. I know there are some additional plugins which can be used to control the formatting and make conditional entries into the form. But for a newbie (i.e. you), it is going to be a bit difficult to get your head around all of the things the form can do.

But it is possible, however the form would likely be submitted in several parts for very complicated forms.

Adobe Form Solution

I am aware that if you subscribe to one of the Adobe products relating to PDF management that it is possible to embed a PDF form in your website which a user can fill in online. However this solution is very expensive (for charities), so I have not looked at this in any further detail.

Google Forms

Here there are several choices, but from my earlier experience there were limitations which might affect your users. Google offers a suite of programs available to people with gmail accounts. If you are a chrome book user (very simple low cost computer), you will know that while you cannot run MicroSoft Applications on your chrome book, you can run equivalent applications which are compatible with the popular Office Apps. All of this is free. But you need to be using Chrome as a browser. Not all computers will have Chrome installed. So this may block this path.

G-Suite

There is a business version as well of G Suite, which is not particularly expensive. There is the basic version of G Suite at 6$ per month, Business at $12 and Enterprise at $25. It includes secure communications, office type apps run online, calendering and various other things. Find out more here: https://gsuite.google.com/

The detail about Google Forms can be found here: https://gsuite.google.com/products/forms/

What I am not sure about is from a privacy standpoint where is the data collected and stored (you need to know this from a GDPR perspective,) whether it is encrypted, and whether copies are held somewhere. But most fundamentally, will it work in FireFox, Safari, Edge, MS Explorer etc, in other words anything apart from Chrome. If it does not, then it is a non starter.

Add a special Form Manager

There are websites that can be built exclusively for collecting data. I know there are some free ones available within the hosting, I have played with one in the past called Lime Survey, but if you are not editing things on a daily basis, then the learning curve might be a bit steep, if you need to edit something.

Use an iFrame

Some of you are now using a 3rd party system in the office to replace MESH (Home-Start users). Some of you will have your own systems. When you view a video on your website, you are looking at an iFrame or a window, through which you can see another website. In the video case it is YouTube. It is potentially possible to show the form you use to enter data into a system from a form submitted to you, but display the form directly to the user through the website. It largely depends on your form, and whether there is a way of displaying it and limiting what the end user can see of the rest of the system.

But this might be worth exploring if you are interested.

Where to from here?

The fundamentall problem is research in this area, and subsequent development is very time consuming, I am sure there are solutions out there, but so far I have not found one that fits all of the requirements. If you are interested in solving this problem let me know. If I can find enough interested parties I may look into it more detail later this year. Let mew know if you are interested.

One last point which is also potentially possible

Part of the problem for the back office is processing the incoming form data copying it across from one system to another. There are generally scripts that can be created for the receiving system which will populate a form from a document that is submitted to it. Contact Form 7 allows very precise formatting of the incoming data. It is conceivable that someone could write a script that takes the incoming form via email, identifies the fields and copies the data across automatically at the touch of a button. I cannot do all of this, but if there was an agreed standard for the submission from your website to your organisation, then someone associated with your organisation could write the backoffice processing script which would overcome the manual re-entry and save a lot of time.

Accessibility and Websites

There are some accessibility standards for websites that can be quite stringent. The majority of websites do not get anywhere near 100% compliance to the most complex variants, and there are generally very large price tags around developing websites like this.

While I have not seen any yet, I am sure there are lots of people out there that can help you given a suitably large wedge of cash.

Look up WCAG 2.0 or WCAG 2.1

Guidelines from central government are tending to require that local government websites need to conform to these standards. It is likely to roll out further than that over time.

Some years back I worked as a volunteer for three months on a project for a visually impaired group. I tried really hard to meet all of their needs with customised CSS. It was the project from hell for me, especially as it was all free. We got there in the end, however it was a big learning point for me to keep away from specialist groups. Right at the end, the punch line was each member of this group had special (non standard web browsers) that did most of the functions anyway.

Accessibility standards can mean = ££££

Because you are likely to end up with a highly customised website with a lot of special code in it. This will ultimately become a support problem for the client, and a business opportunity to the supplier!

I work on the basis that the amount of customised code is at a minimum, so 99.9% of the website is standard. I also try to use some standard (popular and at least 4* rated) plugins to provide additional functions.

Can you crack the WCAG standard with plugins?

Continue reading Accessibility and Websites

Blackmail via Email

I have received this message, and several of you out there have received them too. It is a bit disconcerting when you see it because it appears it has been sent from your email address to your email address. The person sending it states they have hacked into your email account, which is what it looks like. – Chances are though it is not real. First take a look at an example ( note the highlighted parts):

The format of the message is the same, I have seen it in multiple places over the past month. The message is often an image file embedded in the message, not editable text. The reason they do this is to get around spam filtering which would normally trap messages like this.

The first thing to note is it appears as though it was sent to and from the same mailbox. If that was your mailbox, it means someone has hacked into it? No, probably not. But I can understand why someone would be concerned about receiving a mail like this.

It is seeking payment in Bit Coins which I don’t think can be traced to people, unlike a bank payment or “normal financial transaction”. Which is probably why this scam is operating.

If you get one of these, don’t panic. It is most likely a spoofed message, meaning someone has manipulated the email headers to make it appear that they have sent the message from your email box. By checking the header of the email, it is possible to detect where the email really came from. If the sender address is not via your mail box, it did not come from your mailbox. On the examples I have taken apart they all come from compromised servers which have a newsletter function built into them. Someone has figured out how to use the bulk mailing feature in the newsletter function. So it is highly likely that hundreds of these spoofed messages go out each time. They have also never been the same server, and each server is in a different country. This one came from Argentina, but was initiated from the USA.

Drop me a line if you are worried, I can check the email header (a part of the email that is normally hidden from you).

Why do things go into junk mail?

I thought I would make a few comments on this, as I am asked this question in various ways each month.

The particular problem I was asked to look at related to an organisation using an external bulk mail provider; Survey Monkey.

In this case the client wished to use an external service called Survey Monkey (although it could be any bulk mail provider) to send emails out on behalf of the organisation. An example would be Fred; fred@mycoolsite.org.uk decides to send a survey to Fred’s clients. The email which is sent out by Survey Monkey, says it is from fred@mycoolsite.org.uk so you are more likely to accept it and open it because you know Fred.

However it goes into your junk mail so you never see it unless you choose to look in your junkmail, why?

Is email secure?

I met with an IT friend of mine and we had a discussion about security and email. I have been recommending that everyone uses SSL or TLS to connect to their server when they are reading or writing emails.

Using SSL or TLS secures your connection to your server and ensures that your login details cannot be compromised by a third party. Email programs that do not use SSL or TLS send the login details in plain text. If this was intercepted by a third party, then the password details could be read, and a potential spammer could use your SMTP (sending email server) to send out lots of spam messages. Or read your mail and access your account.

Once your email has reached your sending server, it may then be handled in plain text across the internet over multiple hops (Mail Relays) to the destination server, because that connection is generally not encrypted.

There are several systems out there, and they all need to play nicely together, but the bottom line is we should consider at the worse case all email to be insecure. Even though we may be applying best practices at the send and receive server end of the system.

Have I been Pwned?

No that was not a typo. There is a website that has access to data breach information. It is not clear whether it lists all data breaches in the public domain, or a select few of them. The website asks you to enter an email address into the site, it will check through the information it holds and will respond if a match is found.

I tried one of mine and it returned several results indicating that my email address and an associated password to access an online account is in public circulation. It also shows if your email address is in spam lists as well.

I have seen two sets of results on data breaches, one indicated your email address exists in a list somewhere that is in circulation, (typically a junk mailing list). You cannot do anything about this. The other case tells you the website and your email AND a password is in circulation. In the latter case you should be concerned about it if you were previously unaware.