christmas ecommerce guide - section › assets › sheets › christmas... · average page load...
TRANSCRIPT
How to Prepare Your eCommerceWebsite for the Christmas SeasonWhat you need to do in terms of speed, scalability,and security to get your website ready for an in�uxof visitors around the peak shopping season.
by section.io
INTRO: THE BUSIEST SALES SEASON OF THE YEAR
Lorem ipsum
Website security for ecommerce sites
Each year the end of year period seems to roll around more quickly,
For retailers, end of year sales promotions beginning in mid-October and go all the way through post-season blowouts in January. In the Australia and range of these sales include: Click Frenzy, Black Friday, Cyber Monday, Boxing day, Vogue Online shopping and more.
Is there a downside to this growth in ecommerce during the end of year period? Not if your website is prepared, but each year some stores lose customers, revenue and brand reputation because they haven’t properly prepared their site for the increase in visitors.
Even large websites are not immune to this issue: Just this year Amazon crashed under traffic on its Prime Day, Ticketek had issues through AFL final ticket sales and many more.
Retailers need to be more prepared than ever for mobile and omnichannel shoppers, and several weeks of sustained sales and promotions.
Website security for ecommerce sites
Website security is also even more crucial than usual during the holiday season, when cyber criminals are waiting to take advantage of the increased number of online transactions, and Distributed Denial of Service (DDoS) attacks can be triggered easily due to the high number of visitors already on websites. In September 2018 we saw thousands of Magento sites hacked.
Websites of all sizes see spikes in traffic, consistently higher visitor counts than usual, and increased hacking attempts as more transactions are being processed. While ecommerce sites spend months designing end of year merchandise and coming up with marketing and promotional plans, all of that work is rendered useless if your website goes down in the middle of a traffic surge. Even if your website stays up, a slow down in page load time will result in fewer pages viewed and less revenue.
This guide will go through what you need to know about website speed, scalability, and security as your ecommerce site heads into its busiest season. The preparation you do in the months, weeks, and days leading up to promotions and the month of December will prove its ROI when shoppers come around and are greeted with a fast website and seamless shopping experience.
WHY PERFORMANCE MAT TERS DURING THE HOLIDAYS
Website performance is often talked about in relation to ecommerce websites, but the generic term “performance” could mean different things to different people. After all, you could argue that your website doesn’t perform well if the conversion rate is poor or users are bouncing at a high rate. In this context, when we talk about website performance we’re discussing the speed of your website and the ability for your site to maintain high speeds at any scale. That means your website should stay fast even when experiencing traffic spikes and a higher volume of traffic overall, both of which situations are likely to come around with holiday sales and marketing campaigns.
Why does performance matter? In terms of scalability, it’s pretty simple: If your site goes down due to a higher volume of visitors than it is used to, you’ll immediately lose revenue and trust from customers. Even a short period of downtime in the middle of a key event like Click Frenzy will undoubtedly cost you in both lost transactions and a poor ROI on the marketing dollars you have spent to get visitors to your website.
It can be a bit tricker to quantify the impact of website speed on user experience and your revenue, but several studies have showed a clear effect. Large ecommerce websites have found that speed results in fewer sales: Amazon found that revenue dropped 1% for every 100ms slowdown in page load time, and Walmart found that page speeds of 1-2 seconds were twice as likely to convert as page speeds of 3-4 seconds. Google has also studied the impact of page load time on user experience and found that bounce rate is higher for slower pages. On mobile the numbers are even more stark: over 53% of users will leave a page if it hasn’t loaded on mobile in 3 seconds.
section.io’s own studies of ecommerce sites of all sizes support the findings from larger websites. By running A/B tests with Adore Beauty, the leading online beauty store in Australia, we found that visitors viewed more pages, bounced less, and converted at a rate 16.5% higher when they went through a faster website.
Another section.io study which looked at over 100,000 page views from a number of websites shows clearly that page views are higher and bounce rate is lower for faster loading pages. For users with an average page load time of 2 seconds, the average bounce rate was 9.61%, whereas those visitors with a 4 second page load time have a bounce rate of 17.1% and those with a page load time of 7 seconds have a bounce rate of 32.3%.
The number of pages viewed is also affected by page speed, an important metric to ecommerce sites as more pages viewed means more products viewed. section.io found that the number of pages viewed consistently goes down as page speed increases, and those with an average page load time of 2 seconds view 8.9 pages on average, while those with an average page load time of 7 seconds view only 3.7 pages.
Website security for ecommerce sites
Website security for ecommerce sites
MEASURING YOUR SPEED AND SCAL ABILIT Y
Measuring Website Speed
When your website is doing additional traffic during the busy holiday season, it’s even more important to think about how your page load time will affect number of pages viewed and bounce rate. To start preparing your website for the holidays you should first measure your current website performance and think about which metrics need to be improved. The best way to measure your current page performance is by using a Real User Monitoring tool such as New Relic or section.io’s RUM.
Real User Monitoring uses a JavaScript snippet to measure how your visitors are experiencing page load time under real-world conditions. Data can usually be broken down by device and connection type and will show various metrics including time to first byte, start render time, and front end load time. While Google Analytics includes a small amount of RUM page speed data it is not detailed enough to be very useful when determining what parts of your website to optimize. Google includes only one “page load time” metric and this metric is from a sample of only 1% of visitors, which can heavily skew data.
If you don’t currently have RUM metrics you can get free monitoring for 2 weeks from section.io - just contact us to get set up. Another option is to use synthetic monitoring data, which is less precise because it collects data synthetically rather than from your actual visitors, but has some benefits as you can run a synthetic test anytime. We recommend WebPageTest as a free synthetic measurement service, which will provide a number of metrics along with a waterfall view of how your page loads. The waterfall view shows what elements are blocking the rest of the page from loading and which images or other objects are taking longer to load. Google’s Developer Tools will also show a waterfall view of page load time under the “Network” tab.
Whatever service you use to get a baseline measurement of performance you will want to look at a few different metrics:
Page load time: The time from the start of the initial navigation until the time the page is fully loaded in the web browser. This metric will be the longest since it includes all the steps to load your page, but it’s important to look at the smaller metrics to understand where your page load is getting slowed down the most.
Time to First Byte: Also known as the HTML document load time, is the time in which the HTML document (the key to starting any page drawing in the browser) starts to be delivered to the web browser.
Start Render Time: The initial point in time in which the first non-white content (anything that is different from a blank page) becomes visible and is displayed on the web browser.
Document Complete or Document Content Loaded: When the HTML document has finished loading but other elements such as images referenced in the HTML document are still being delivered.
Website security for ecommerce sites
While all these metrics combined will give you a good picture of how your pages are loading, the most important metrics from the above are Time to First Byte, Start Render Time, SpeedIndex, and Page Load Time. Time to First Byte indicates how long your back end server is taking to deliver the HTML document, and a long TTFB means a visitor is looking at a blank page that hasn’t yet sent any information to the browser. We recommend aiming for a TTFB of 200ms or under, which is achievable when you have the HTML document cached. If your TTFB is over 1 second you should look to improve this metric before the holiday season starts.
Start Render Time indicates when content starts appearing on the page, which is important since the visitor will see that the page has begun to load, and this metric should be as fast as possible - we recommend 1.5 seconds or less given how quickly users will bounce if a page doesn’t load in 3 seconds.
SpeedIndex is a little-understood but very useful metric that looks at how the page loads in the browser and how the user will experience page load time. You can read our full explanation of how SpeedIndex is calculated, but it essentially looks at what content loads on the website and how complete the page “feels.” For example, if your page prioritizes loading images above the fold then your page would appear faster even if the below the fold content is not yet loaded. The lower SpeedIndex score the better - fast sites will have a score of 5,000 or under.
While total Page Load time by itself doesn’t give a great indication of how the user has experienced your page speed, it’s still a useful metric to look at. Given the metrics we presented above, you should aim for a total page load time of 2-3 seconds and look for areas of improvement if it is longer.
Measuring Website Scalability
Measuring scalability of your website is quite difficult, which is why we recommend you use the tools outlined below to prepare for high traffic loads during the holiday season even if you think your website will scale well. No scalability measurement tool can fully predict how many visitors you will get to your website during a peak time. You should look at your peak traffic levels during last year’s holiday season to get an idea of the percent increase you will experience during holiday sales, and then apply that percent to your average traffic this year. However, you could outperform all expectations so should prepare your website and servers for even higher numbers.
If you do choose to measure scalability the best way is using an advanced tool such as New Relic. You can also perform a load test to get a basic view of how your website will perform with higher traffic levels. There are many tools that perform load tests. Similar to synthetic performance measuring, these tools will send high volumes of virtual users to your site all at once.
Fully Loaded Time: The time from the initial navigation until there are 2 seconds of no network activity after Document Complete. This will include any JavaScript activity that is triggered after the main page load.
SpeedIndex: SpeedIndex examines the the progress of how the visible page loads and derives a score for how quickly the content appeared. A lower SpeedIndex score indicates better user experience with how your page is loading.
Website security for ecommerce sites
While load testing will show you if your website will fall over quickly under pressure, it is impossible to predict how your visitors will browse through your website. Variables such as user browser types, bots performing crawls, malicious bots, user locations, user network speeds, number of pages viewed, browser caches, actual checkouts or add to cart actions and more make for a huge number of options to consider when building scripts to generate and run a simulated load from a valid distribution of real browsers.
Load testing can be quite expensive and at best will give you only an indication of some of the areas that need to be improved for peak traffic. At worst load testing can give you misleading results, and either way how your site performs under peak traffic will be quite different from how a synthetic load test reacts.
Website security for ecommerce sites
How to keep your site online under unlimited traffic
KEEPING YOUR WEBSITE FAST AND ONLINE IN PEAK TR AFFIC
A layered approach is key to keeping your site online under unlimited traffic. Simply implementing the first step below will ensure you are always online and transacting, as time permits you can then implement the additional optimisations to further improve concurrent users you can sustain:
1. Implement a Virtual Waiting Room
A virtual waiting room, is a solution that enables you to maintain control of the traffic on your website even during periods of extreme traffic.
The implementation of a virtual waiting room enables you to route a nominated proportion of users to a virtual waiting room where they can remain while other users successfully navigate, engage with and transact with your website.
You are able to adjust the number of users on your website and also deliver a branded experience (which can involve discount codes or other marketing content) to anyone waiting.
The implementation of waiting rooms can be something you build and host yourself or a feature from an Edge platform.
Once you have implemented a virtual waiting room you are now set to handle unlimited volumes of traffic, the focus then moves onto enabling as many users as possible to browse and transact on site at once - Which is where dynamic content caching comes into play!
Website security for ecommerce sites
WEBSITESERVER
Edge Point Of Presence (PoP)
Edge Platforms store dynamic content as close as possible to the user
2. Implement Dynamic Content Caching
The most expensive (In time, server CPU, $$$ and almost any other metric) thing that your website does is generate HTML documents. These are called Dynamic Content objects as the application in your hosting environment builds a unique version for every single web page request.
To enable your website to serve as many users as possible you need to make the delivery of HTML documents as fast (and cost effective) as possible - Enter Dynamic Content Caching!
Dynamic Content Caching is the storing of HTML content in a cache (the cache can be implemented in a range of locations with the ideal scenario being as close as possible to the user requesting the page)
When the HTML document is cached whether your website has 100 or 10,000 concurrent visitors, the number of requests to your back end server will stay the same. This is especially important when holiday sales launch or a marketing email is sent out that can cause a large number of visitors to come to your website at once.
Varnish Cache is an open source caching solution that can be deployed on your servers or in an Edge Platform for maximum performance
Website security for ecommerce sites
HTML Document Requests
Serv
ers
need
ed
Time
12
10
8
6
4
2
0 12am 12pm 12am 12pm 12am 12pm 12am 12pm 12am 12pm
Peak tra�c
Average tra�c
HTML document not cached
HTML document cached
3. Review hosting environment
After you have implemented Dynamic content caching, this is the correct time to review the hosting environment. Reviewing the hosting environment before implementation of dynamic content caching is premature as the offload acheived by effective caching totally changes the server requirements (often making hosting costs much cheaper).
The following diagram demonstrates the difference in server requirements when HTML
With appropriate caching implemented your hosting environment then only needs to focus on uncachable actions - such as add to cart and checkout.
If you are expecting significant add to cart or checkout activity you can review autoscaling the number of servers in your enviornment according to load or simply having some additional resources ready “just in case”.
Website security for ecommerce sites
Once you have made your site highly available no matter how much traffic you receive, it’s time to make things fast!
There are several key areas to work on here:
1. Dynamic Content Caching
Again, Dynamic Content Caching comes to the rescue! The first thing that happens in every pageload is the delivery of the HTML document. If the HTML document is delivered slowly, it doesnt matter how fast the images and other content are downloaded you have already lost the battle for a fast website!
2. Image Optimisation
Image optimization is one of the most important things to do to improve the performance of your website. Ecommerce websites often have very image-heavy pages that can result in slow load times. You should first examine the number of images on your home page and other landing pages. If there is a chance to reduce the number of images you have on each page you should consider removing some images so the total page load time is shorter. If you are unable to reduce the total number of images on each page you can cache images using one of the solutions discussed above, or minimize the size of each image.
When sizing images you should keep in mind the maximum size they will appear on your website, and consider using an adaptive website platform that generates one image size for mobile and another image size for larger desktop resolutions - Gulp is one tool that will do this. Remember if you resize images within HTML (for example
“width=500px”) that will not reduce the size of the image that a user has to download.
Another option for improving page load time if your web pages have a large number of high quality images is to employ lazy loading. Lazy loading will first load the images that are above the fold so that it appears the page is fully loaded before it is actually complete. This feature will load images as a user scrolls down the page, so if you have a long page with many images below the fold the user will not need to load those images unless they actually navigate to the lower portion of the page. This both improves the perceived speed for the user and reduces load on your server as it is not generating images that are never viewed.
Some content delivery solutions will offer image optimization as one of their tools - at section.io we offer Google’s PageSpeed module, kraken.io and Cloudinary which performs a variety of front end optimizations including image resizing, lazy loading, CSS minification, and JavaScript deferral.
Keeping your site fast
Website security for ecommerce sites
3. Static Content Optimisation and Browser Rendering Improvements
There are several other types of files that can be improved in addition to images. An important feature is to minify CSS, JS and HTML: CSS and HTML files need to load before your page is viewable, and many CSS and HTML files have unnecessary code if they have been edited a lot or not properly coded. Every extra space and line will add to the load time of your website. Minifying these files will flatten them so that superfluous code is removed and the file size is reduced. Google’s PageSpeed module will do this for you and there are several other free tools for minifiying HTML, CSS, and JavaScript.
Manage 3rd Party JavaScript: Having many 3rd Party JavaScript snippets is one of the most common ways web pages get slowed down. These snippets can measure user behavior, add recommended item modules, and provide valuable metrics. However, they are also a huge burden for web pages to load - each snippet connects to a different host and if they are
We recommend regularly checking the 3rd Party JavaScript that is installed on your website, as often snippets are kept even if the information they provide is no longer being used. You can also use tools like PageSpeed to defer JavaScript so that it does not delay the loading of critical page components, and use the “async” tag to load JavaScript asynchronously.
Website security for ecommerce sites
PROTECTING YOUR SITE FROM AT TACKS AT PEAK TR AFFIC TIMES
If your servers are already struggling to keep up with high volume traffic during a holiday sale, a
malicious actor could take advantage of that and take your site down more easily due to the organic
There are other security considerations during the holiday season too.
scraping bots from competitors may kick into high gear as products go on sale more often so they can
keep up with your offerings and prices. Bots can also hold or complete a purchase of the in-demand
items that often sell out during the holiday season, keeping your real visitors from getting a fair
chance at the gifts they are looking to buy. If you send a marketing email advertising the launch of a
hotly anticipated item and sell out immediately due to a high number of automated bots, customer
trust will decrease and some shoppers may not return to your website.
A secondary impact of malicious bots is that they can significantly change the marketing analytics
you track, making you think that certain advertisements or keywords are performing well in terms of
click-through rate when they are really only attracting bot traffic. This can cause you to lose
marketing spend if you invest in certain areas due to the bot traffic.
Attackers can also take advantage of the higher number of credit card transactions going through
your website and try to intercept them or attempt to login using the credentials of your real visitors.
Hackers may think fraudulent transactions will go unnoticed during such a busy season and make
in a loss of revenue for your website when the purchase needs to be refunded to the true account
owner.
maliciously
access your website using known vulnerabilities will likely go up during the holiday season. Every
platform out there has a range of vulnerabilities known to attackers, and if you have not kept up to
date with security patches the holidays are a great time for hackers to try to get into your website.
Luckily, there are several steps you can take to protect your website during peak traffic times. The
first section of suggestions are security measures you should absolutely put in place before the
holiday season, and most are quite simple to implement. The second category of security fixes are
recommended for all sites and will more fully block bots, attackers, and DoS attacks, however may
take more time and effort to implement.
but is especially crucial during the holiday season when you are experiencing
higher-than-normal volumes of real traffic. As we mentioned above, your
website can go down due to an influx of real visitors that your servers are
unable to handle, and these extra visitors also make your site more
susceptible to Denial of Service or Distributed Denial of Service attacks. DoS
attacks are just an overload of malicious visitors or requests to your website,
and look the same as a large amount of real visitors. If your servers are
already struggling to keep up with high volume traffic during a holiday sale, a
malicious actor could take advantage of that and take your site down more
Prepare for the Holiday Season
Prepare for the Holiday Season
may not protect your site from particularly large or sophisticated attacks (see the following section for
those solutions), these will ensure you are taking regular steps to protect your site and your customers
during the holiday season and into the rest of the year.
Scan your website for security vulnerabilities: The first thing you should do when examining
your website security is to do an audit of where you currently stand. There are many tools that
will scan your website for malware and known vulnerabilities from platforms including
Sucuri and Quttera.
Once you know what your vulnerabilities are, you can start patching them and evaluating what
additional tools your site needs to block threats.
Another way you can examine your site for potential threats is to look at your logs. If you use a
log management tool or ELK stack logs (a combination of ElasticSearch, LogStash, and
Kibana) you can search logs to see where requests come from and identify if your site is
getting unusual requests. For example, if you sell exclusively in the US and get a lot of
suspicious traffic from other countries, you could see that and try to block that traffic from
accessing your site.
Use SSL/TLS encryption for your entire site:
encryption protocol on their payment pages through the payment gateway they use, however
(which has an 59% market share on desktop) will label your site as insecure in the URL bar if it
also improve SEO.
Qualys SSL Labs tool to evaluate the quality of your SSL
configuration. You should aim for an A+ rating which indicates the certificate itself is valid, and
that the protocol support, key exchange, and cipher strength are also strong. Just having an
are deployed and if your certificate is expired it could also expose you to attacks and harm
your reputation with customers.
Stay on top of security patches: 44% of attacks are because of known vulnerabilities in the
platforms websites use. Some bots will scan your website regularly for vulnerabilities so that
an attacker can take advantage of those found without manually searching. Always stay up to
date on patches for these issues, which will be in a developer or security section on the
risks.
Prepare for the Holiday Season
Use strong passwords and 2-factor authentication for admin accounts: Administrator
accounts are particularly vulnerable to hacking attempts by bots or individual attackers. You
should regularly audit the people who have administrator access to your website or database
a strong, randomly generated password that is unique from any other logins is important.
If you can enable 2-factor authentication for logins that will go a step further in protecting your
administrator accounts. In addition, there may be platform-specific steps you can take to
bots can continue to try login combinations. To protect yourself from this, you can enable
brute-force protection.
Be PCI Compliant:
required to be
security standards to protect your customers when they are submitting payment details online.
There are several levels of verification depending on the number of transactions you process
each year, ranging from a full network-level assessment to a self-assessment for smaller
merchants.
server network, Content Delivery Network, and payment gateway (such as Stripe or
Use trusted platforms, extensions and themes: It is crucial that you stay on top of updates
for the platforms that you are using. In addition, you should use trusted platforms, extensions,
and themes as these can open you up to vulnerabilities: Last year ecommerce platform
Magento found that several third party extensions were at risk of SQL injection attacks.
52% of
and 11% coming from themes.
To find trusted themes and plugins that are less likely to have vulnerabilities, download directly
can also check how many other extensions a company has created, the number of downloads
or reviews each extension has, and the length of time they have been creating extensions as a
good indicator of if they are a trustworthy business.
expect a high growth in traffic over the holiday season should strongly consider getting more
Networks are often thought of as website performance tools, CDNs provide network-layer security
Below we lay out the different types of advanced website security available to ecommerce websites,
and how you should go about choosing between solutions.
Web Application Firewalls:
specific websites, rather than traffic between servers which traditional firewalls inspect.
and acts as a proxy for the website origin server so that it can inspect traffic and either block it
or pass it through to the origin.
websites and apps from unknowingly letting hackers into their system or sharing user data.
ModSecurity and many
others base their initial rulesets off of the
10 list, which has published a list of the top website attacks since 2003. The current list can be
viewed here.
known for a high number of false positives which block your legitimate users - not something
you want during the holiday season.
Prepare for the Holiday Season
set initial rules and continue to adjust them according to traffic patterns they see. This takes
they are not blocking threats.
There is a new batch of security solutions which take away some of the pain of traditional
information such as location, device, time, and on-site behavior. By removing the rulesets that
traditional solutions use, modern systems can stay one step ahead of attackers as they do not
know what rules are being used against them. In addition, legitimate traffic that might set off
one rule in a rules-based traffic is let through.
Bot Blocking:
attacks, some ecommerce sites who are particularly hard hit by bad bots will want to deploy a
amount of effort to manually update blacklists.
to any vulnerable pages on their website which will force
users to prove they are human by solving a problem or typing out a word. Although this is
effective at keeping out bots, it can also lead to a decrease in conversion rate. Newer solutions
like make it easier for legitimate users to pass through a verification
There are other basic bot blocking tools available for specific ecommerce platforms, often
deployed as extensions, which will make it easier to manage bad bots while allowing in the
use rules to determine if a user is real or a bot, which can block legitimate traffic while at the
same time failing to catch newer types of bot attacks.
On example of a more advanced solution is , which blocks bots while protecting
real shoppers by giving each visitor a “Risk Score.” This score is based on behavioral analysis
that includes factors such as mouse and click movement and timing, unusual web application
requests, and hidden clicks. These techniques are able to defend against even the most
sophisticated bots that use real browsers to take over accounts and can slip past older
security methods.
Distil Networks is another popular bot mitigation tool which uses machine learning to defend
against bots without you having to manage rules manually. They look for anomalies in your
Prepare for the Holiday Season
Content Delivery Networks: As mentioned earlier, CDNs are popular tools for both website
performance and security. Reverse proxy software deployed within a CDN can cache content,
the performance and scalability benefits mentioned earlier, by deploying a CDN for your
Network protection: Since Content Delivery Networks intercept traffic before it hits
Depending on the CDN you use, this DDoS protection may be backed by industry
addresses) through their platform even if you have not deployed a specific security
on your origin server which again protects your origin from large-scale attacks.
Because the security of your website is linked to how much content you are able to
cache, we strongly recommend using a solution which caches both static objects like
images and dynamic content like your HTML document. Modern solutions including
section.io make this simpler than older CDNs like Akamai, and section.io has the
added benefit of a local development environment so developers can test their
configuration before pushing to production.
CDN Security Solutions:
are deployed within the CDN as reverse proxies. Using a Content Delivery Network for
network-layer protection along with another security tool can be beneficial as it brings
your performance and security into one platform. This can save you cost compared to
having separate CDN and security solutions, and will also make it easier for your
developers to manage.
Content Delivery Network you choose includes the tools necessary to view traffic and
quickly adjust security settings when needed. To properly manage security for an
ecommerce site, you should have access to detailed, searchable logs, real-time
metrics, and the ability to fully tune your solution without engaging professional
update security rules, and see how your new configurations are impacting traffic to
This will also enable your team to quickly identify, troubleshoot, and resolve any
problems that arise using a DevOps workflow. Unfortunately, many Content Delivery
Networks do not provide this level of detail or integration with DevOps and Agile
logs for all reverse proxies deployed within the network, detailed metrics and
monitoring, code-level configuration control, and a local testing environment.
Although modern CDNs provide some of these features,
is the only solution to provide all of the above including a virtual machine so
developers can tune their security and test configurations before pushing them to
production.
In addition, we recommend using a CDN that is open and flexible in the security
the more appropriate solution for your websites, or decide you want to upgrade from a
and allow you to switch security solutions when necessary. section.io offers a library
of reverse proxies for both security and performance and allows customers to add or
change proxies.
Prepare for the Holiday Season
Network protection: Since Content Delivery Networks intercept traffic before it hits
Depending on the CDN you use, this DDoS protection may be backed by industry
addresses) through their platform even if you have not deployed a specific security
on your origin server which again protects your origin from large-scale attacks.
Because the security of your website is linked to how much content you are able to
cache, we strongly recommend using a solution which caches both static objects like
images and dynamic content like your HTML document. Modern solutions including
section.io make this simpler than older CDNs like Akamai, and section.io has the
added benefit of a local development environment so developers can test their
configuration before pushing to production.
CDN Security Solutions:
are deployed within the CDN as reverse proxies. Using a Content Delivery Network for
network-layer protection along with another security tool can be beneficial as it brings
your performance and security into one platform. This can save you cost compared to
having separate CDN and security solutions, and will also make it easier for your
developers to manage.
Content Delivery Network you choose includes the tools necessary to view traffic and
quickly adjust security settings when needed. To properly manage security for an
ecommerce site, you should have access to detailed, searchable logs, real-time
metrics, and the ability to fully tune your solution without engaging professional
update security rules, and see how your new configurations are impacting traffic to
This will also enable your team to quickly identify, troubleshoot, and resolve any
problems that arise using a DevOps workflow. Unfortunately, many Content Delivery
Networks do not provide this level of detail or integration with DevOps and Agile
logs for all reverse proxies deployed within the network, detailed metrics and
monitoring, code-level configuration control, and a local testing environment.
Although modern CDNs provide some of these features,
is the only solution to provide all of the above including a virtual machine so
developers can tune their security and test configurations before pushing them to
production.
In addition, we recommend using a CDN that is open and flexible in the security
the more appropriate solution for your websites, or decide you want to upgrade from a
and allow you to switch security solutions when necessary. section.io offers a library
of reverse proxies for both security and performance and allows customers to add or
change proxies.
CONCLUSION AND STEPS TO TAKE BEFORE THE HOLIDAYS
of your website you could end up losing shoppers and revenue on what should be the biggest
revenue-generating time of the year. Online shopping for holiday presents is becoming more and more
complete transactions during this time. At the same time ecommerce shoppers are becoming more
impatient when it comes to issues like website speed and overall user experience on a site, and are
likely to leave your site (and perhaps visit a competitor site) if your pages are not loading slow enough.
time can cripple your business, and malicious bots can provide price and product information to other
websites so shoppers looking for a deal buy product elsewhere.
To ensure you are ready for the holiday season, we recommend starting to take some of the actions
outlined in this guide by mid-September. This will give you time to measure your current performance
and scalability, make any needed updates to your back end, front end, and security setup, and test
and deploy your new configurations with plenty of time to go before Black Friday.
If you decide to switch hosting providers or use a content delivery solution to help improve your site
performance and security, this will also give you time to research options and make changes before
have plenty of time to make sure they are acting as expected and positively impacting your speed,
making any major infrastructure changes.
make them, we recommend finding a tool that can help you improve several areas of your website at
picking a content delivery solution, you should think about the tools they offer (do they offer a choice
level of control given to your developers. A fully configurable CDN llike section.io with real time logs,
metrics, and a local testing environment like section.io will give you the best results any time of year,
including during the holiday season.
Prepare for the Holiday Season
Get the best in website security and performance with section.io
Need help implementing the tips above? section.io is an Edge PaaS that works with leading ecommerce brands including Appliances Online, Booktopia, Accent Group, City Beach, and Thrifty Car Rentals to help keep their sites fast and secure during times of peak traffic. Websites on section.io have seen traffic spikes of over 20x their normal levels during sales and Christmas promotions and stayed consistent in terms of website performance.
section.io gives users a choice of website performance and security tools to speed up and protect their website, including Varnish Cache for caching, PageSpeed, for front end optimisations, Threat X for intelligent threat blocking, ShieldSquare for real-time bot mitigation, Signal Sciences for next-generation security, and ModSecurity for a rules-based WAF.
In addition, section.io provides many core features, including a global server network, SSL certificates, HTTP/2 ELK stack logs, real time metrics, real user and synthetic monitoring, and a local development environment, all included at no extra cost.
Contact section.io at section.io/contact us/ to learn more about our Edge PaaS and see a demo of our product.