The Changes of 2018 Worth Acting On

A year of announcements

This year brought more announcements touching small business websites than most: browser warnings, new privacy rules, two changes to how Google reads sites, and a new editor for WordPress.

For a business with a modest site, most of it was noise. A handful of changes needed somebody to do something, and some still do.

What follows is a plain list of those, with what actually needed doing.

The six that mattered

• Facebook's News Feed change in January, which cut how far page posts travel.
• Chrome's Not secure label on every plain HTTP page from July.
• Mobile-first indexing and the Speed Update, putting the phone version first.
• GDPR in May, and the privacy pages rewritten because of it.
• Breach records, required under federal privacy law since November.
• WordPress 5.0 this month, with a new editor as the default.

The second carries the most visible cost. A visitor sees the warning before reading a word the business wrote.

Facebook pages reached fewer people

In January, Facebook said the News Feed would favour posts from friends, family and groups over public posts from businesses. Page reach, low already, fell further.

What needed doing was not leaving Facebook but ending the reliance on it: keeping customers' email addresses where the business controls them, and using the page to answer people.

Posts that start conversations between people still travel. Posts begging for likes and shares were demoted.

Not secure in the address bar

In February, Google announced that from July, Chrome would label every page served over plain HTTP as Not secure. It did, and since October the label turns red when somebody types into a form.

What needed doing was HTTPS across the whole site: a certificate, often free, redirects from every old address, and links and images updated so nothing loads insecurely.

A site still on plain HTTP has spent five months greeting visitors with a warning. It is the item to finish first.

Phones first, and speed on phones

In March, Google started switching sites to mobile-first indexing, which means judging each site by what its phone version contains. In July, speed became a ranking factor for mobile searches.

The speed change, by Google's own account, touches only the slowest pages. The phone change matters more where the phone version hides text, photographs or whole sections.

What needed doing was a phone version carrying everything the desktop one does, loading in reasonable time. For most sites that meant lighter images, not a rebuild.

Privacy pages and breach records

GDPR has applied since May 25 to organisations anywhere selling to people in the European Union or monitoring them online. For most local Canadian businesses it changed little directly.

What it prompted was overdue: privacy pages that describe what the site actually collects, forms asking only for what is needed, and email lists with consent you can show.

Since November 1, businesses covered by federal privacy law have had to report a breach that creates a real risk of significant harm, and tell the people it affects.

They must also log every breach, reportable or not, and keep each record for two years.

Some provinces have their own laws on private-sector privacy, so which rules apply turns on where a business operates and how it handles personal information. Either way, what needed doing was a simple log with one person responsible.

December: WordPress and PHP

WordPress 5.0 came out on December 6 with the block editor, a new screen for writing pages, as the default.

It needs a decision rather than a click: test it on a copy, check the theme and any page builder, and keep the Classic Editor plugin, supported until the end of 2021, for staff who need the old screen.

PHP 5.6, which many older sites still run on, stops receiving security fixes on December 31. Ask your host or web company which version yours uses.

A worked example

A general contractor with two site supervisors and an office manager, doing home renovations and small commercial fit-outs, had a site built in 2014.

In February it was still on plain HTTP, with a quote form asking for addresses and budgets. HTTPS went in that spring, months before Chrome's label arrived.

Its phone version hid the project gallery behind a button that did nothing, which mattered once Google began reading phones first. That was fixed in the same visit.

The privacy page was rewritten to describe the quote form and the newsletter, and the breach log became a page in the office binder in October.

Finished projects still go on Facebook, but past customers now hear from the business by email.

WordPress 5.0 waits on a copy until January. Nothing on the list was urgent the day it was announced, and each item was dealt with before it could hurt.

What needed nothing

Plenty of this year's news asked nothing of most small businesses.

AdWords became Google Ads in July, a new name on the same account. Search Console's new version left beta in September, with the old reports still alongside.

Voice search was hyped again, along with a claim that half of all searches would be spoken by 2020, which had little behind it.

Google+ will close in April, which for most businesses means removing its buttons from the site and nothing more.

What the six had in common

Almost every change that mattered was announced months ahead: Chrome's label in February for July, the breach rules in April for November.

The sites that met them unprepared were rarely the ones with the least money. They were the ones nobody was watching on the business's behalf.

Which is the real lesson of the year: somebody, inside the business or at its web company, should be reading these announcements and deciding which apply.

The counter-case

For a site built this year on HTTPS, with a good phone version and a current privacy page, this review is a ten-minute confirmation.

A business with no customers in Europe had less to do for GDPR, and one not running WordPress can skip the editor entirely.

But the address bar warning and the phone version apply to every site.

Check the six, finish whatever is left, and put the rest into next year's plan.

Before January

1. Confirm every page loads on HTTPS without warnings.
2. Read the whole site on a phone.
3. Check the privacy page against what the forms collect.
4. Start the breach log if it does not exist.
5. Test WordPress 5.0 on a copy first.
6. Ask which PHP version the site runs.
7. Put the rest into next year's plan.

Step one comes first because it is the only change every visitor sees. Everything else can be scheduled; the warning is on display today.

Turning the rest into next year's work is covered in planning next year's website work in November.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.