How to create a privacy policy for your website

How to create a privacy policy for your website

How to create a privacy policy for your website 4 Tech Stuff

Privacy policies are one of the most overlooked aspects of most websites. If you stop to look around most of the popular sites you visit, you’ll find they all have unique privacy policies (though the specific page’s traffic is usually low). Even so, these documents are important if you want your website to comply with local and international regulations.

More importantly, you don’t need to be a lawyer to add a thorough privacy policy to your website. In this article, we’ll talk more about why privacy policies are significant and we’ll teach you about some essential clauses. Then we’ll introduce you to three tools you can use to help you create a privacy policy for your website.

Let’s talk privacy!

What Privacy Policies Are (And Why They’re Important)

Privacy policies can look intimidating, but you should always read them when possible.

Privacy policies are legal documents informing users what you do with their data. For example, if you collect email addresses, names, and birthdays during the user signup process, you need to tell users what happens with their information. For example, some websites might use it for internal purposes only (such as customer profiling). Others might sell the information to third-party services, in which case consent is necessary.

As you’ll be aware, privacy policies are usually skipped over by the majority of visitors. However, there are several benefits to adding one to your website:

Although some countries don’t require the use of a privacy policy, you can still be held liable under international law for not following regulations. If you have European Union (EU) users, for example, you need to comply with the GDPR. Given the chances of getting fined for non-compliance, adding a privacy policy to your website is simple – and it’s a smart business move.

Ideally, you’d enlist the help of a lawyer to help you draft your privacy policy. However, that’s not a practical option for the vast majority of site owners. Knowing this, a lot of online services have sprung up to help fledgling websites craft basic privacy policies to cover their bases. However, before discussing them, let’s look at what your privacy policy should contain.

3 Clauses Your Website’s Privacy Policy Should Include

These three clauses won’t, in most cases, be enough to craft a well-rounded privacy policy. Think of them only as the basics that any such document should include. We encourage you to do further research into other critical clauses.

The next section will explore some tools to generate full privacy policies with little input from your end. Even then, it’s essential you have a working understanding of what their basics are.

1. How and What Type of Information You Collect

This clause is the bread and butter of privacy policies. It details the exact information you collect, and how. To recall our earlier example, you can get email addresses and names directly from signup forms. However, there is also data you can obtain without the user knowing. For example, Google Analytics tracks the user’s preferred web browser, which needs to be mentioned.

Ideally, visitors would take a look at this clause and decide if they’re comfortable using your services, but more pertinently, it covers your bases legally. Here’s an excerpt from a common privacy policy, discussing what type of information we collect and how we do it:

Personally Identifiable Information refers to information that tells us specifically who you are, such as your name, email address, or phone number. Downloading information or logging in may allow the Company to “recognize” you to allow us to personalize our service for you.

This first section discusses what we consider to be personal information, as opposed to anonymous data we might collect. It also mentions we may use the information to personalize your user experience. In our case, logging in is only necessary to download products you may have purchased, so it’s not obligatory.

2. What You Do With the Information You Collect

Plenty of websites engaged in the practice of selling or sharing user data. Other services use this to personalize content and ads, among other elements. Other potential applications include using the information to enforce terms of use, improving your website’s services, and more.

Regardless of the application, this clause is critical because although users may consent to share personal data, they might not be happy with how you decide to use it. Here’s a short paragraph from our privacy policy outlining our general use of private information:

For our Clients, we use personal information mainly to provide the Services and contact our Clients regarding account activities, new version and product offerings, or other communications relevant to the Services. We do not sell or share any personally identifiable or other information of End Users to any third parties, except, of course, to the applicable Client whose website you are using.

For example, if your ZenMSP service is about to expire, we send you an email reminder. In this case, we’re using your personal information to provide an update.

In any case, if you’re not comfortable with the way a website uses your information, the GDPR outlines the ‘right to be forgotten‘. This means sites are bound by law to delete your information if you ask them to cancel your account, for example.

3. Your Use of Cookies

Cookies are files on your computer that contain personal settings for specific websites. The term itself supposedly comes from ‘magic cookies’, which are a type of token used by UNIX-based Operating Systems (OS).

In any case, websites use cookies to track what you do within them. For example, cookies enable you to stay logged in even if you leave the website (although there are limitations). According to the European Union’s Cookie Law and new ePrivacy Regulation, sites need to inform visitors about their use of cookies and provide an option to disable them. Here’s an excerpt from a privacy policy’s section on cookies:

We use cookies, tracking pixels and related technologies on our website. Cookies are small data files that are served by our platform and stored on your device. Our site uses cookies dropped by us or third parties for a variety of purposes including to operate and personalize the website. Also, cookies may also be used to track how you use the site to target ads to you on other websites.

The above explains how  cookies are used and what they are. Later on in the policy, we would also discuss how you can opt out of using cookies, including those served by third-party services on our website (such as Google and MailChimp).

3 of the Best Privacy Policy Generation Services to Consider

Although we fully recommend the services we include in this section, you should always review the language of any privacy policy you generate with any of them, just to be safe. Let’s take a look at the options.

1. iubenda

How to create a privacy policy for your website 5 Tech Stuff

iubenda is an online website privacy policy generator that stands out thanks to its ease of use. It uses modules to help you pick the exact clauses your privacy policy should include, and adjust their terms depending on which services you use. For example, if you’re part of the Amazon Associates program, you can add the necessary language to your policy with a single click.

Key Features:

  • Uses simple module system to build a comprehensive privacy policy.
  • Lets you customize your policy using your company’s information.
  • Enables you add necessary clauses for several popular third-party services, including Amazon Associates and Google Analytics.
  • Provides automatic updates to your policy based on any new regulations.

Price: Free and paid plans available | More Information

2. TermsFeed

How to create a privacy policy for your website 6 Tech Stuff

TermsFeed enables you to generate basic privacy policies in minutes, and customize them using your site’s information. Each time you want to create a new policy, the service will walk you through a questionnaire to help you determine the clauses you need. When the process is over, you’ll receive your new policy via email in seconds. The platform also offers you the option of updating your policies automatically as laws change.

Key Features:

  • Enables you to generate custom privacy policies using a simple questionnaire.
  • Lets you adjust your policy to comply with national and international laws.
  • Provides automatic policy updates whenever the law changes.

Price: Free and paid plans available | More Information

3. Shopify’s Privacy Policy Generator

Shopify's Privacy Policy Generator.

Shopify’s Privacy Policy Generator is a bit more narrow in scope than the other tools we’ve discussed. Its clauses are tailored for Shopify websites specifically. However, you can generate one of their policies in seconds and use it to check out essential clauses regarding how to deal with payment information.

Key Features:

  • Lets you generate a privacy policy for your Shopify store.
  • Enables you to outline how you deal with customer payment information.
  • Gives you the ability to customize your privacy policy based on your store and its location.

Price: Free, but you need a Shopify subscription to get the most out of it | More Information

How to Create a Website Privacy Policy Using iubenda

For this portion of the piece, we’ll use iubenda given its ease of use and reasonable pricing structure. To get started, go to the service’s home page and click on the GENERATE YOUR POLICY button to the top right of the page. On the next window, enter your website’s URL and click the blue button:

Entering your website's URL.

The service will ask you to register a free account or log in using Facebook. Either way, when you’re in, you’ll see an option to add any services your website uses to your privacy policy:

Add new services to your privacy policy.

Clicking on the button will show you a list of clauses you can add:

A sample of the services you can add to your privacy clause.

As you include more services, they’ll be added to your privacy policy automatically. You can preview it at any time by clicking on the Preview widget to the right of your dashboard:

Previewing your privacy policy.

When you’re done adding services, click on the Next button at the bottom of the page. You’ll now need to enter your company’s name and address, then click on Next again:

Entering your company name and address.

On the final screen, you’ll find options to embed your policy into your website:

Embedding your privacy policy into your website.

That’s it! If you’ve included all aspect of how you collect data, your privacy policy will be good to go. Do remember to give it a full read before publishing it, though!

Conclusion

Website privacy policies don’t get the spotlight they deserve. However, they’re essential elements of any website that takes data protection regulations seriously. On top of enabling you to keep your operations above board, privacy policies also outline how your site handles personal information, which should help put visitors’ minds at ease.

If you don’t know where to start when it comes to creating a website privacy policy, here are three online generators that are easy to use and feature-packed:

  1. iubendaA module-based privacy policy generator that supports dozens of third-party services.
  2. TermsFeedThis simple service enables you to create a basic policy through a questionnaire.
  3. Shopify’s Privacy Policy GeneratorThis generator is tailor-made for Shopify stores.

If you still need help, then feel free to contact me.

Hacked Websites Report 2017

Hacked Websites Report 2017

Hacked Website Report 2017

The Hacked Website Trend report is a report produced by Sucuri. It summarizes the latest trends by bad actors, identifying the latest tactics, techniques, and rules (TTPs) seen by the
Remediation Group (RG). This report will build on the data from the previous quarters, including updated data for 2017.

The one constant you’ll find in this report is the issues pertaining to poorly managed or unmanaged websites.

This report will give trends based on the CMS applications most affected by website compromises, the type of malware families being employed, and updates on the state of website
blacklisting. It does not consider data related to WordPress plugin configurations.

This report is based on a representative sample of the total number of websites the Sucuri RG performed incident response services in the Calendar Year (CY) 2017. A total of 34,371 infected
websites were analyzed in this report. This sample provided an accurate representation of the infected websites worked on by the remediation group in 2017.

If you would like your website managed, feel free to contact me about my website management services.

Qustodio Review

Qustodio Review

qustodio review

Qustodio seems like a popular choice for many parents due to marketing and the endless amounts of affiliate clickbait reviews.  Read my “honest” Qustodio review to find why you should NOT be using Qustodio for your parental controls.

If your kids have multiple devices on different OS’s (Apple, Android, Amazon, Windows, Mac, Linux), then parental control can be a real nightmare, as most apps are not available on all platforms. 

For desktop security, I was using Microsoft Family Safety for time limits and activity reporting plus BitDefender for cybersecurity + openDNS for an additional level of content filtering at the router level.

For my kids mobile devices, I was using MMGuardian + Kid-Control. If your devices support these 2 apps, then I would recommend using these over Qustodio.

Last year I bought Amazon Fire tablets for my eldest boys, and due to their age I could not use the built-in “fire for kids” mode as it was too childish and restrictive, and they just refused to use the tablets.
Sadly MMGuardian is not available on Amazon marketplace, so I had to look for something else, as It quickly becomes very confusing and a lot of hassle if you are using different products on different devices, so I started looking at the limited options available on the Amazon store.

Due to the ongoing issues with Microsoft family safety. I was also looking for an alternative solution for my kids desktop PC’s as well.

 

Qustodio

There was little choice on Amazon marketplace, so I decided to give Qustodio another try.

TL/DR summary: Qustodio has very poor security and is easy for kids to bypass or simply uninstall the app. You definitely cannot rely on Qustodio and will need to be diligent and technically aware enough to also manually check and monitor your kids devices every single day to make sure they have not tampered with Qustodio.

I tried out the trial version of Qustodio a few years back when I wrote my article Cyber Security: How to protect your kids online, but it was lacking in several areas so didn’t bother installing it on my kids devices and  opted to go for MMGuardian + Kid Control at the time, as MMGuardian had better monitoring, better activity tracking, better security and more control but lousy GPS tracking, which is why I used kid-Control as well.

Overall, the first impression of Qustodio is that it seems to do a fairly decent job at blocking content and controlling screen time. It blocks dangerous sites, it enforces safe search in all browsers and on youtube, it allows you to block or allow specific apps and websites either globally or per device, and it also allows you to set time limits.

The interface is not especially intuitive, and until you get used to the app, it is quite an effort to figure out how some features work and where to find the settings as some options are rather disjointed and the web interface does not match the Android app. My wife still struggles to find where or why something is blocked or disabled.

With the screen time, you can enable/disable time controls, by setting which hours of the day the device can be used and you can also set allowed number of hours each say. So you could, for example, say that they can use their tablet for 4 hours per day between 9am – 7pm.

Since I have started using Qustodio, they do seem to have implemented one of my suggestions, and you can now set time limits on specific apps as well, which means you can limit time on games or social media only for example.

All access levels is very much an all or nothing solution though, so you cannot make a change that applies today only for example, so if you block access on Tuesday, it will be blocked every Tuesday until you undo it.

What I really wanted is a time quota solution like Microsoft Family safety, allowing time to added ad-hoc on a daily basis,  so kids have no time by default,  they have to come home from school, do their chores etc, and then they could request time, at which point I would grant the request and give them x number of hours screen time.

This was very flexible and very easy to manage and meant that if they were banned for being naughty, I just did not give them any time that day.

Lack of Monitoring

One huge issue is the complete lack of any social media or chat app monitoring. Qustodio claims on their website to have social media monitoring, but this is not true. The only option they have is for Facebook on desktop pc, which requires the child to install the Qustodio facebook app, which can just as easily be removed by your child, so is essentially useless.

There doesn’t seem to be any support for the facebook mobile app or monitoring for the many other social media websites or apps on mobile devices such as Twitter, Instagram, Google+ or any of the myriad of chat apps such as WhatsApp, Skype, Saraha and all the others.

The whole reason for monitoring your kid’s online activities is to make sure they are not being harassed, threatened, bullied or getting involved with bad people.  In this respect, Qustodio completely fails and is essentially useless. They could be chatting to paedophiles or being groomed by drug dealers, and you will never know.

Location Tracking is Unreliable

Most times I tried to use the location tracking to find out where my kids were, it gave a completely wrong location or was still reporting an old location from hours or even days ago.

For this reason, I do not rely on a single product, as none of them has been perfect. I primary used kid-control for the location tracking, but this has also become unreliable, so I am again looking for alternatives.

Note: I am now using Life360 for tracking, which has been very reliable.

Changes require a reboot

This one really does defy logic for me. If you make any changes to your child’s settings, such as block/allowing an app, adding/removing time etc, this will often not take effect until the next day unless you reboot the device.

So let’s say your child is being naughty or has not done their chores, and you lock their phone as punishment, you think they now have no access. In fact they are sitting up in their room using their phone as normal.

Tomorrow comes, the block has now kicked in, but your child has now gone out with the friends. You remove the lock, but of course, it has no effect. So unless your child thinks to reboot their phone, they are now stuck unable to use their phone or make calls and think you have done it on purpose.

I contacted Qustodio support about this and they confirmed this is intended behaviour. I did point out the above reasons why changes need to take immediate effect or they are pointless, but they were not interested and did not remotely care about the safety of the kids.

 

Qustodio review - qustodio is not secure

Poor Security, Easy for kids to bypass

Sadly, any good features about Qustodio are rendered completely moot by the fact that the security is terrible and it is very easy for kids to bypass.

The first thing I noticed, is that when the screen time runs out, Qustodio locks the screen whenever you try to do anything, but it takes a few seconds for it to kick in. This means that the kids can still use the device in those few seconds, as they just continually keep opening the apps for a few seconds to read messages etc. It is also possible for them to perform blocked actions if they are quick enough, as they can perform the action before Qustodio blocks it.

For example, even if you have blocked access to the play store, so they cannot arbitrarily install apps, this can be bypassed. Granted it is repetitive and arduous, but kids will go to any lengths to get around restrictions.

All my kids are quite IT literate, and since I wrote this review originally, one of my boys figured out how to completely uninstall Qustodio and told his brother how to do it. Frankly, it wasn’t hard, a quick Google search brings up a youtube video showing you how to do it. It took me a couple of weeks to notice since Qustodio does not alert you that the app has been removed and is no longer being monitored, so that was 2 weeks of unrestricted access for both my boys.

Since then I have discovered an even easier method. You simply uninstall Qustodio in the usual way (hold icon, drag to uninstall link), if you do it quick enough then you will bypass the anti-tampering, as it takes a couple of seconds to kick in.

There is no easy way to stop your kids from doing this either, so my only option was to tell them I was now monitoring for the app being removed and to regularly check their phones. I did contact Qustodio a few months back to report this issue, but they didn’t care.

A few weeks later my kids had then figured out how to bypass Qustodio instead by using the android Guest account, meaning that when I checked their phones, everything seemed fine to me. I only found out about this due to them slipping up and using their phones right in front of me after bedtime when they were supposed to be locked and forced them to show me what they had done. If not for this slip-up, then I would have been oblivious for who knows how long.

I advised Qustodio support about this issue too, and again no real feeling that they care and clealry nothing has been done to address this as it is not exactly a new hack. The best they do is offer a workaround, which is to make yourself the primary user on your kids phones, and then add them as guest accounts. Not ideal.

If all else fails, your kids can simply reboot their Android device in safe mode, which bypasses any parental controls. I have only found 1 app which has a solution to this, which is MMguardian. Thy have a special version of the app which you install during the phone setup, which acts as the phone admin. NOTE: This is not the app you get from the play store.

So if your kids are good with IT and computers, or are even just savvy enough to use Google to search for “how to hack Qustodio”, then they are going to get around Qustodio easily, and it might potentially take you months until you twig.

I would have to recommend MMGuardian over  Qustodio 100%, which while not perfect, is way more secure and does have better monitoring. I have switched back to mmguardian myself and had to resort to just DNS filtering for the Amazon tablets and taking them away at bed time.

SiteGround vs Flywheel WordPress Hosting

SiteGround vs Flywheel WordPress Hosting

SiteGround vs Flywheel WordPress Hosting 7 Tech Stuff

Flywheel

I have had several websites hosted with  flywheel for over 1 year now, and I literally have no complaints about this provider. I have not had a single problem with the sites or the service or the support.

The only issue I ever had was that the speed was not as good as it should have been, and when I queried this I discovered that some performance settings were not enabled for some reason. So what I have learnt over this last year is that you do need to have some technical knowledge to ensure you are getting the best out of the service, as you need to know what tests to run and what questions to ask, even with a host as good as flywheel .

Because flywheel is a dedicated WordPress host, they do not have any hosting control panel since they do not do anything except WordPress. Therefore they provide a set of simple tools just for your WordPress site, such as setting up staging sites, enabling password access etc. To be frank, it is pretty idiot proof and is obviously aimed at non-technical folks.

They also do not support or allow anything other than WordPress. This can obviously be very annoying and inconvenient if you wanted to install another app on your domain, like WHMCS or PHPBB, instead, you have to get more hosting elsewhere and use a sub-domain.

You also have to get your email hosting elsewhere as well, but I suspect that if you are using flywheel then you probably want a more robust email solution as well, such as GSuite or office365. The bundled email that you get from hosting providers really is very basic and provides no business continuity.

Last year Flywheel acquired Pressmastic (now called LOCAL by Flywheel), which creates a local WordPress dev environment (using virtualbox) and syncs it with your live Flywheel sites. You can pull your live sites down to local and vice versa. This obviously makes it very simple to maintain a separate dev and live environment.

PROS

  • Excellent support and customer service
  • Excellent speed with no plugins or configuration required.
  • Advanced security using Sucuri
  • Everything just works
  • You can easily generate a staging site from your live site, although you only get this on the $28 and above plans.
  • You can get a 1 click backup of your entire site (minus core files), which will send you an email with a link once it is complete.
  • You can setup free staging sites for your clients for 1 month.
  • You can change your primary domain, and your entire site and all links and references get automatically updated.
  • Ability to assign collaborators. So if you are the website owner, you can temporarily give access to designers and developers to work on your site or staging site.
  • LOCAL by Flywheel

 CONS

  •  You cannot host anything other than WordPress.
  • No 24/7 support. Although you can escalate tickets and get someone out of bed.
    They now have 24/7 support and are aprt of wpengine
  • Price.
    As with all the dedicated WordPress hosts, it seems quite expensive with limiting quotas on bandwidth and disk space. Plus you have the added cost of needing to get your email hosted elsewhere too.
  • You can only use multisite on the personal plan or above and it costs an extra $10

SiteGround

I have prior experience with Siteground and it was not a pleasant one. They screwed everything up to the point where I would probably have lost all my clients had I actually transferred everything over to their servers.

As I continue to see articles everywhere praising SiteGround and how great they are, I thought I would give them another try. Everyone deserves a 2nd chance and maybe I just had some very bad luck last time.

SiteGround are a generic host and are considerably cheaper than the likes of Flywheel or WPengine, and run cpanel like every other host. They do however optimise their servers for WordPress and also have a few custom features available in their control panel, such as git controls, staging sites, site move, domain name change, which you do not get with other hosts at this price range, so I really want them to not screw up this time as I want to like them.

So I signed up with SiteGround for a GrowBig account and kept my fingers crossed, but had an immediate issue.
I was not able to access my account, it seemed to be stuck in some perpetual setup mode, telling me I could not set it up or manage it because my domain already existed. So I left it a few hours to see if it would complete, but alas the issue was still there. So I had to contact support even just to get my account activated. Not a good start so far.

They also still have that incredibly irritating support ticketing system where they do not actually send you a reply, they just send you a notification that they have replied, and you have to log in to your account to view it. This is so incredibly annoying, inconvenient and time-consuming and I hate it when companies do this.

If you are out and about on your phone, then it means you cannot read the reply until you are back in front of a real pc, at least not without a lot of hassle.  As a result. this type of system also encourages the use of weak passwords, as customers will resort to using a password that is easy to type and remember so that they can login via their phones to read tickets.

Once activated, I setup my spare domain and replicated the site over.
I performed multiple gtmetrix tests on the site with various caching and performance enhancements enabled, and compared them to flywheel. The results of these tests are below.

Obviously, I cannot give any opinion on long-term performance, reliability and support yet, but I do plan to transfer at least one site over to them for a long-term test and will update this article accordingly in a few months. I have so far had a site running for a couple of weeks without any issues.

I kept a site hosted with flywheel for almost 1 year. Checkout my full siteground review for the full horror story.

 

PROS

  • Price.
    Considering the performance is better than any other host I have tried, they are pretty good value for money.
  • Supercacher
    Their own in-house caching system, which clearly makes a big difference based on my tests.
  • 1 click staging
    As with flywheel, a simple solution to setup a staging site for testing. Although it is only available on the most expensive plan, which at £7.95 is still less than 1/2 the cost of flywheel.
  • Can use Multisite on any plan
  • SG-Git – Create a git repository from your site, very handy if you are getting custom work done.
  • Auto Updates
    Every decent managed WordPress host will auto update your WordPress core. Even though this option is built right into WordPress itself these days.
    SiteGround also has the option to auto-update your plugins as well. I haven’t seen this option anywhere else.
  • Being a traditional host, you can host more than just WordPress.
  • Multiple sites/domains allowed on same plan.

CONS

  •  The endless stream of rehearsed and ostensibly polite canned responses for me just comes across as very apathetic and disingenuous. They also have that typical problem with not reading communications properly before replying and have a tendency to be condescending and give completely wrong advice.
  • Potentially low resources
    This 1 simple site caused my inode usage to go up to 20%. So despite the fact that you can host unlimited websites, in reality, I don’t think you could host many before you have consumed your inode quota.
  • An irritating and time wasting ticketing system
  • Cheap pricing is promotional and is only for first year. After this it quadruples and is not such a good deal anymore.

wordpress speed test

For the purpose of this test, I used the site zenmsp.uk, which is the most resource intensive theme (the Fox) and is the slowest loading of all my sites and took the most tweaking to get it to load quickly. This site takes 6-10 seconds to fully load on a regular server/host.

As you can see from the results, on pure performance alone, SiteGround does actually manage to win the challenge by a hair and beats flywheel by shaving about 0.4 seconds off the loading time.
Bear in mind though that with flywheel everything is out of the box and done by them automatically on the server, and doesn’t require any plugins or any other caching or performance tricks.

In the case of SiteGround I did have to manually enable all their caching features, install a special SG plugin and enable their supercacher options, and the fact that you have to do this in order for the caching to work was not clearly documented.

Still I must say I was quite surprised by the results, considering that Flywheel is a dedicated WordPress host and SiteGround is generic host who will have many hundreds of customers per server, I was not expecting them to win.

When enabling CloudFlare via the SiteGround  console, it only redirects the www subdomain through Cloudflare and not the primary domain due to the way they integrate with cloudflare. I also noticed, as you can see in the results, that the speed was actually slower with Cloudflare enabled, the same is true with flywheel as well. So obviously CloudFlare cannot improve on the caching provided by the hosts.

If the price is your deciding factor, or keeping everything in one place (multiple sites, domain names, email etc) then SiteGround wins hands down.

If customer service/support & reliability is more important, and you have the budget to pay for it, then flywheel wins, as the performance difference is negligible enough not to be noticeable based on these tests.

GT Metrix Reports

No other changes or tweaking has been made to the site other than to enable the available speed/caching features. So we are literally only looking at overall performance achieved by the caching/options provided by the host.

Since Cloudflare did not offer any improvements, there is not really and file minimising applied to this site.  For the record, I have tried W3TC and other plugins, but this theme tends to break when CSS and JS files are minimised or combined.

SOLVED: “You don’t have permission to save in this location”

SOLVED: “You don’t have permission to save in this location”

SOLVED: "You don't have permission to save in this location" 14 Tech Stuff

So I have been getting this annoying “You don’t have permission to save in this location” error crop up randomly in Google Chrome when I try to download files. When this happens the only location it would allow me to download to was the “downloads” folder. The issue would often go away after a reboot, but then it would come back again, it seemed very random and I was scratching my head for weeks over it.

Usually, I have been busy when I happened and did not have time to stop what I was doing and find the cause, so I just resorted to saving to the downloads folder and moving the files.

Today I decided I had enough and was going to find the cause. I started the google the error and found a bunch of crazy solutions telling users to change folder permissions and what not, which I definitely was not going to resort to. Then suddenly I remember my old friend BitDefender, my cyber-security/anti-malware software that runs quietly in the background and protects my system and quite often turns out to be the cause of my woes.

Now I am not bashing BitDefender, as it is a great security product, and it does what it says on the tin and I have it installed on every system in my household, and I also provide it as a manged solution for clients also. But annoying I have a habit of just forgetting that BitDefender is there or that it might be blocking things, and I am sure I cannot be the only one. So I recall that one of the features is that BitDefender protects certain folders from being changed, so I decided to go and check the activity and see if it was blocking chrome. Lo and behold there it was.

SOLVED: "You don't have permission to save in this location" 15 Tech Stuff

So all you have to do to fix this is to click the button and change it from “blocked” to “allowed”. Simples!

If you run any other anti-malware app such as Kaspersky or Symantec etc, that offers this same functionality, then simply check in the relevant settings.

Hopefully this might help anyone else suffer form this annoying problem.

WordPress Hosting Reviews

WordPress Hosting Reviews

WordPress Hosting Reviews 16 Tech Stuff

 

For websites and clients that need the best possible speed and performance for WordPress and are prepared to pay extra for it, I tend use FlyWheel, who are up there with the best of the best when it comes to WordPress hosting.  But for those small, simple, low traffic sites this can be a bit pricey, so I have been on the hunt for another hosting provider that had decent performance for WordPress without costing an arm and a leg.

I was originally running my  WordPress multisite installation on my Windows server hosted with Hostek, and while I generally got  pretty decent performance and gtmetrix scores, I knew  it could be better due to the fact that PHP and WordPress do not run as well on Windows, and need the likes of Litespeed on Linux to get the best performance.

Here I will be posting my results with the various hosting providers I have tried. Bear in mind that I have played dumb for the most part in order to test out their skills, support and knowledge, I have not told them I am an ex-hosting provider or have 30 years IT experience

One thing to note, which I have found to be true of every single host I have tried who claims “Managed WordPress”, it is nothing of the sort. At best all they do is set WordPress to auto-update, which is a feature now built into WordPress anyway, and if you are lucky also have some intrusion detection with some WordPress-specific rules. The likes of WPEngine and FlyWheel do provide more features and security and they do provide way more help and support, but you are still expected to maintain the website yourself.

Proper managed WordPress, is the service I provide, where your entire website is managed and maintained for you, plugins, themes, security, backups and monitoring, content, everything.

 

WordPress Hosting Reviews 17 Tech Stuff

 

I used to have my own site hosted with GoDaddy back in 2016 when I was first converted from CFML to WordPress, and while it was OK, the performance, in general, was no better than my Windows server, and often worse. I also had various recurring issues with not being able to upload files via the WordPress admin or via FTP. I can only assume that this was due to GoDaddy’s intrusion detection being overzealous and blocking legitimate activity.

 

This then brings me to the other major issue, GoDaddy support. Whatever problem I had, they would always default to the conclusion that the problem was at my end, and getting them to even look into a problem was a painful process, and getting them to accept the issue was at their end even harder still. Getting through to support was time-consuming. They got rid of ticket support and switched to phone-only support, which meant sitting on the phone for ages in a queue, and some things are impossible to do over the phone, such as providing long complex URLs, or screenshots of your issue. They did eventually introduce live chat, which was all outsourced to India, and brought back ticket support for Pro members, but It was quite normal to have to chase them and wait days or even weeks for a response.

 Over the years I have had many clients who use GoDaddy, so I have had a lot of experience in dealing with them and their live chat support over the years, and can tell you they are completely incompetent most of the time.

As is usually the case with outsourced support, the Indian companies support many other hosting providers as well, and most of the support agents have little to no understanding of how GoDaddy’s systems actually work and will give completely incorrect advice.

I have also on many occasions had problems with DNS updates not working, domain transfers not going through etc, and the person I have spoken to at GoDaddy clearly had no idea how either of these things worked and fobbed me off with nonsense excuses. Had I been the average, non-techy client and blindly believed those excuses, the clients websites would have been down for days or even weeks.

 

I have also had many instances where GoDaddy support has taken a client’s site offline or even deleted it, and been unable to get it back online as their backups were not working and they had no recent backup of the client’s site, and so told them that they will have to go hire a developer to fix it, which of course is also bad advice, as a developer cannot bring back a deleted website that has no backups.

GoDaddy is also not cheap, their prices are actually high compared to a lot of other hosts, and for what you get it just isn’t value for money.  Their so-called Managed WordPress hosting really isn’t anything of the sort. As with all the other hosts who claim to offer “managed WordPress”, all they actually do is automatically update the WordPress core and nothing else, the WordPress knowledge and support seemed very limited.

 

GoDaddy have a Pro member system which allows existing GoDaddy client to assign control of their hosting and domain names over to pro partners for management. 

This seems like a great idea in theory for helping and managing your clients, however, it is very buggy, will constantly log you out or deny you access to the clients account, revoke access and generally be a PITA.

 

Overall I would never recommend GoDaddy hosting for anyone, the only thing they are good for is domain names, and that is about it.

 

 

 

PROS

CONS

  • GoDaddy now own and integrate with ManageWP, so WP management is good
  • GoDaddy Pro account is useful for managing clients
  • Incompetent, Slow & Unresponsive Support
  • No way to access support tickets
  • Poor Troubleshooting skills
  • Intermittent http/ftp issues
  • Oblivious to own Firewall rules & policies
  • Confusing and buggy Interface
  • Poor performance

 

 

HostMedia

 

hostmedia.co.uk

 

HostMedia are one of those El-cheapo, seems too good to be true hosts with hosting that costs only £1. They are quite well known in my old ColdFusion/Lucee circles, and I already had an account with them that I had used to test out their Lucee hosting a while, so I thought I would give them a try with WordPress.
Sadly my experience with this company to date has been less than brilliant. Nothing really worked properly from the outset, and I always had to open tickets right from the get-go to get anything working.

 

What should have been a simple 5 minute job of resetting a password, turned into a 2 day fiasco of wrong passwords being reset locking me out of my account.
Issues with the control panel not working as expected to whitelist IP’s, not being able to remotely access databases and having to explain to support staff how tcp/ip and telnet work and that if you cannot connect via telnet then any amount of password resets are not going to help. Even worse when they do not know the issue is actually caused by one of their own standard operating procedures.

 

Almost every time I used live chat I was asked to open a ticket, so that seems pretty pointless.

 

A lot of companies, especially hosts these days outsource their support to India, especially the cheap ones, as it is the only way they can afford to have a 24/7 helpdesk. Which is fair enough, I have done the same thing myself, but the key when doing this is ongoing performance reviews and quality control, which is clearly where HostMedia needs to invest some time based on my experiences.

 

I can certainly see that that for a non-technical customer who is not able to diagnose issues themselves or understand when they are being given wrong advice, simple problems could drag on for days while you get sent on a wild goose case and end up having to pay someone else (like me) to fix the problems for you.

 

I did finally manage to get a copy of my site running, and upon testing the performance, it was intermittent. Sometimes it was better than my Windows server, sometimes it was worse. Again their so-called “Fully Managed WordPress Hosting” was nothing of the sort, there was very little WordPress knowledge and not a lot of support and nothing being managed.

 

I gave up after 1 week.

 

I would put HostMedia up there with 1&1 Internet. they are cheap as chips, and you get what you pay for. Ideal for folks that only have a token website, but really do not care about their website uptime or support, and just want it as cheap as possible.

 

 

 

PROS

CONS

  • CHEAP
  • Support is quite fast and responsive at least
  • Pointless Live Chat support
  • Sub-par email support
  • Too many things broken by default
  • Intermittent performance and reliability

 

siteground hosting review

My SiteGround review turned out to be far more indepth, so I have turned it into a separate post HERE.

 

Krystal

 

krystal.co.uk

 

I had high hopes with Krystal as they have very good reviews and I have seen several recommendations in forums I use, but sadly things did not go too well.

 

I signed up for their AMETHYST plan, which should have been sufficient as this is more resources than my site currently uses.

 

When I tried to setup a WordPress site, there was no option to have a temporary URL for testing prior to migrating DNS. The only option is to use your hosts file for local testing, but  their installer is not able to setup WordPress if your domain name is not already pointing at their server. So the only way to install WordPress is manually via FTP.

 

I noticed they offered free migration, so I thought I would test out their migration skills and get them to migrate my site for me. They failed miserably at this and all they managed to do was to setup a default WordPress install, the rest I had to do myself.

 

As far as the performance goes,  things did improve on that front. On testing my site with GTMetrix I was getting slightly better performance even without using Cloudflare. By tweaking the settings and enabling Cloudflare I managed to increase the score a few percentages and also shave 3 seconds off the load time.

 

 

Sadly this is where the benefits stopped. I had nothing but problems on the WordPress backend with Divi builder timeouts and 503 errors. So rather than diagnose it myself, I decided to test out Krystal’s troubleshooting skills. Krystal support told me it was because resources were maxed out and I needed to upgrade to a plan with more resources and that this was a common problem with DIVI. Now I know this is not true since DIVI runs quite happily on 128MB, and I have been running with a max setting of 256MB for the last year with no problems, on multiple DIVI sites. The AMETHYST plan has 384MB, so should be more than enough.

I did, however, go through the motions, and upgraded to the Topaz plan which gives 768MB RAM. But surprise surprise, it made no difference, and I still had the same problems.

This was not the end and Krystal continued to try and push me down the upgrade path, telling me that my site still needed more resources. I suspected they would have pushed this until I had my own dedicated server, so I decided to quit while I was ahead.

krystal wordpress hosting statsI checked the resource usage stats, which clearly showed my site was not maxing out at all.

I then did my own troubleshooting and found the cause of the problem, it was, in fact, the minify setting in W3TC, which was causing problems on this server for some reason. Disabling this got rid of the 503 errors and timeouts.

PROS

CONS

  • Responsive support
  • Better than average server performance
  • 60 days money back guarantee
  • Poor migration skills
  • No temp URL for testing
  • WordPress installer did not work
  • No PHP.ini editor
  • Poor Troubleshooting skills
  • Pushy upgrade tactics
  • Quite lowly resource limits

 

I am currently with GURU, whom I have been very happy with so far. Hosting is fast and the customer service/support is brilliant.

Checkout my review here.

Constantly losing Internet connection over WIFI

Constantly losing Internet connection over WIFI

Constantly losing Internet connection over WIFI 20 Tech Stuff

This issue has plagued us for a few weeks now with our WiFi connection apparently dropping. The WiFi icon in the system tray would show no problems, strong signal, no errors, yet for some inexplicable reason we would keep losing Internet access and web pages would not load. This would last anywhere from a  few seconds to a few minutes, with Google chrome giving errors like:-

“err_name_not_resolved” or “dns_probe_finished_nxdomain”

This issue was not limited to just 1 PC either, it was affecting multiple devices and was causing some major problems with games, remote desktop sessions, saving pages, submitting forms etc. I tried literally everything I could think of, and every solution I found online, nothing worked. So now I needed to start thinking outside the box. I thought I would share my solution in case it helps others.

Constantly losing Internet connection over WIFI 21 Tech Stuff

The first thing I decided to do was to check whether I was even able to access the router web admin interface when the issue occurred, and it turns out I couldn’t. So I decided to run a continuous ping in the background to see if there was packet loss, there was, in fact, it was now happening as often as every few minutes when 4 or more packets would be dropped and the ping would timeout.

The most obvious conclusion would be that it was the router, however, I had already swapped out the router a while back, so it seemed unlikely that I had 2 routers with the same issue.

Then there is the common problem with interference. However I had already changed the channels to that of neighbouring routers, I had also already tried turning off all possible interference devices such as TV’s in between me and the router or other wireless devices.

Perhaps there was some device on the network that was screwing up the routing tables or causing packet loss? So I reset the WiFi password so that only my PC could connect, and unplugged all wired devices and crossed my fingers. Sadly no dice.

Then I recalled an issue I had a few years ago in my old office where I lost my internet connection, and it turned out to be caused by the power adaptor from my VOIP phone, which was plugged in right next to my router and had become faulty and was leaking electrical interference. Needless to say, it took me a while to figure that one out, and I had blamed my ISP at the time and moved to Zen Internet, and had the same problem. It was thanks to the troubleshooting skills of the ZEN support techs that we found the cause, quite quickly I might add.

Constantly losing Internet connection over WIFI 22 Tech Stuff

So I unplugged all devices near the router, but again no change. The only device still connected was my  Netgear 24 port switch, which I use to extend the number of ethernet ports on the router, surely this could not be the cause? So I unplugged it. Lo and behold, the packet loss stopped. I kept the ping running for several more hours, and have not experienced the random connection drop since.
I guess due to the age of the switch, it had developed the same fault with its internal power supply and was leaking electrical interference.

Constantly losing Internet connection over WIFI 23 Tech Stuff Constantly losing Internet connection over WIFI 24 Tech StuffI have now replaced the switch with a much smaller and more appropriate 5 port switch I had lying around, which seems to be working fine.

Are you GDPR compliant?

Are you GDPR compliant?

Are you GDPR compliant? 25 Tech Stuff

The EU General Data Protection Regulation (GDPR) takes effect on 25th May 2018, so there is not much time left to take the appropriate steps to achieve GDPR compliance and review what you still need to do.

Does the GDPR apply to me?

The Regulation is huge in scope, unifying data protection laws across the EU. Its scale has led to many companies presuming that it only applies to companies that process large volumes of personal data. However, depending on a handful of factors, no matter what size a company is, it may be subject to the Regulation’s requirements. Here are a handful of questions to determine whether you need to pay attention to the GDPR:

1. Do you process EU residents’ personal data?

If you do, then the GDPR probably applies to you.

It doesn’t matter whether you are based in an EU state or not – if your company processes, stores or transmits personal data belonging to EU residents, then you will almost certainly be required to comply with it.

2. Are you engaged in economic activity?

The one caveat to that that the GDPR does not apply to people processing personal data in the course of exclusively personal or household activity. This means you wouldn’t be subject to the Regulation if you keep personal contacts’ information on your computer or you have CCTV cameras on your house to deter intruders.

To fall within the remit of the GDPR, the processing has to be part of an “enterprise”. Article 4(18) of the Regulation defines this as any legal entity that’s engaged in economic activity. You must be careful not to mistake business conducted from home for household activity.

3. Does your organisation have fewer than 250 employees?

The GDPR broadly expects all small and medium-sized enterprises (SMEs) to comply in full with the Regulation, but it makes some exceptions for organisations that have fewer than 250 employees.

The Regulation acknowledges that many SMEs pose a smaller risk to the privacy of data subjects than larger organisations. For example, Article 30 of the Regulation states that organisations with fewer than 250 employees are not required to maintain a record of processing activities under its responsibility, unless “the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data […] or personal data relating to criminal convictions and offences”.

 

Are you GDPR compliant? 26 Tech Stuff

Fix it Fast! Apply GDPR to Your Company in 10 Simple Steps is a plain-language guide to implementing the European General Data Protection Regulation’s requirements to your organization. This isn’t a legal book, it’s a roadmap to compliance. Fix it Fast will help you to implement the key requirements of GDPR. It contains templates, outlines, examples and plain-English explanations to help you: • Complete your data inventory • Start and finish your data map • Draft and institute a Privacy Impact Assessment process • Plan how you’ll deal with a Data Breach • Implement Data Privacy Policies and Privacy Notifications • And much more This book’s 10 Simple Steps will take you from beginning to end of your GDPR readiness and implementation project.

So, does the GDPR apply to you?

If you’ve now realised that the GDPR applies to your organisation, you should find out what your obligations are and how you can achieve compliance. You can do this based on the Data Protection Commissioner’s (DPC) compliance checklist, which is summarised below and outlines what organisations need to do before the 25 May 2018 deadline.

 

1. Learn about what’s coming

If you’re reading this, you’re probably familiar with the GDPR. But according to our GDPR Report, published in July 2017, only 66% of senior management have been briefed on the Regulation.

Senior management will have a big say on how their organisation prepares for the Regulation, so it’s paramount that they know what’s coming, what they need to do and the risks of failing to comply. Everyone else in the organisation responsible for regulatory compliance and data processing will also need to understand their obligations.

2. Become accountable

The Regulation includes provisions that promote accountability, so the DPC advises organisations to make an inventory of all the personal data they hold and examine it under the following questions:

  • Why are you holding it?
  • How did you obtain it?
  • Why was it originally gathered?
  • How long will you retain it?
  • How secure is it, both in terms of encryption and accessibility?
  • Do you ever share it with third parties, and on what basis might you do so?

3.  Review personal privacy rights

Data subjects have a number of rights pertaining to the way organisations collect and hold their data. These include:

  • The right to be informed
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • The right to access

Most of these rights are similar to those in current data protection laws, but there are some significant changes. It’s important to familiarise yourself with those changes and plan accordingly.

4. Communicate with staff and service users

You’re not the only one who needs to know about data subjects’ rights. When collecting personal data from staff, clients or service users, you need to inform them of their rights.

5. Learn about legal grounds

Organisations need to prove that they have a legal ground to process data. Most organisations currently use consent by default, but the GDPR toughens the rules for getting and keeping consent.

There are five other lawful grounds for processing data:

  • A contract with the individual
  • Compliance with a legal obligation
  • Vital interests
  • A public task
  • Legitimate interests

Organisations should learn when these grounds can be sought and adjust their data collection policies appropriately.

6. Change your consent requests

There will be times when consent is the most appropriate lawful ground, so you need to know how it must be sought. The GDPR lists specific requirements for lawful consent requests.

7. Research child consent policies

The GDPR states that children cannot give lawful consent because they “may be less aware of the risks, consequences and safeguards” of sharing data. The default age at which someone is no longer considered a child is 16, but the Regulation allows member states to adjust that limit to anywhere between 13 and 16.

For example, the UK, the Republic of Ireland and Spain are expected to set the age at 13, Germany and the Netherlands will stick with 16 and Austria is opting for 14.

Data controllers must know the age of consent in particular countries and avoid seeking consent from anyone under that age.

8. Appoint a data protection officer

The GDPR states that a data protection officer (DPO) should oversee an organisation’s data protection strategies and compliance programme.

Although only certain organisations need to appoint a DPO, the Article 29 Working Party recommends that all organisations appoint one as a matter of good practice.

9. Plan for data breaches

One of the biggest challenges that the GDPR presents to organisations is its data breach notification requirements. Organisations must report data breaches to their supervisory authority within 72 hours of discovery, and provide them with as much detail as possible.

10. Adopt a privacy-by-design approach

Organisations should adopt a privacy-by-design approach to data protection. To do this, they will need to conduct a data protection impact assessment (DPIA) before undertaking new projects or initiatives.

DPIAs help organisations see how changes to the business will affect people’s privacy, and their results can be used to anticipate and mitigate problems well in advance.

DPIAs help organisations see how changes to the business will affect people’s privacy, and their results can be used to anticipate and mitigate problems well in advance.

#1 Best Seller

Are you GDPR compliant? 27 Tech Stuff

The Ultimate GDPR Practitioner Guide provides those tasked with implementing Data Protection processes, useful information on how to achieve compliance with GDPR. The book is crammed with advice, guidance and templates and also includes a copy of the full regulation text and the supporting recitals. Topics include:

  • The Data Protection Officer
  • Data Protection Policy
  • Data Protection / Privacy Notices
  • Data Protection Impact Assessments (DPIA)
  • Data Protection / Privacy by Design
  • Outsourcing
  • Subject Access Requests
  • And Much Much More!

Hit by ransomware? This free decryption tool for might help

Hit by ransomware? This free decryption tool for might help

Hit by ransomware? This free decryption tool for might help 30 Tech Stuff

Victims of one the newest – and most unusual – families of ransomware could now be able to recover their files without giving into the demands of criminals because decryption tools have been released for free.

A GandCrab ransomware decryption tool has been released as part of the No More Ransom initiative, following a joint operation by Bitdefender, the Romanian Police, the Directorate for Investigating Organized Crime and Terrorism (DIICOT) and Europol.

GandGrab first appeared in January and has already claimed over 53,000 victims around the world, making it what Europol describe as “one of the most aggressive forms of ransomware so far this year” costing each victim anything from a few hundred dollars to a few thousand.

This variant of the file-locking malware is unusual in a number of ways: not only is it spread via the use of exploit kits – a tactic usually reserved for the likes of trojans and cryptocurrency miners – it is also the first form of ransomware to ask for payments in Dash. Most other forms of ransomware demand the ransom be paid in bitcoin or Monero.

The spread of GandGrab has also been helped along by a cybercrime-as-a-service scheme which offers a toolkit for deploying the ransomware in exchange for wannabee crooks giving the original authors a cut of their profits.

It’s unknown which specific cybercriminal operation is behind GandGrab. However, the ransomware is advertised on Russian hacking forums, with the authors explicitly instructing those who become a part of the partnership scheme not to target Russia or any other country in the Commonwealth of the Independent States of former Soviet republics.

gandcrab-ransomware-note.png

GandCrab demands ransom payments be made in Dash.

Image: Malwarebyes

But regardless of who might be distributing GandCrab, now victims don’t need to pay a ransom to those looking to cash in on it, because the decryption tool is available for free from the No More Ransom portal and from Bitdefender.

“Ransomware has become a billion-dollar cash cow for malware authors, and GandCrab is one of the highest bidders,” said Catalin Cosoi, senior director of the investigation and forensics unit at Bitdefender.

In order to help prevent falling victim to ransomware, Bitdefender recommends regularly back-up sensitive data and to be wary of suspicious email attachments and malicious links.

Launched in 2016, the No More Ransom scheme brings law enforcement and private industry together in the fight against cybercrime and has helped thousands of ransomware victims retrieve their encrypted files without lining the pockets of crooks.

The portal is available in 29 languages and since its launch has received over 1.6 million visitors from a total of 180 countries.

The release of GandCrab decryption tools comes shortly after an operation involving Europol, the Belgian National Police and Kaspersky Lab led to the release of free decryption tools for Cryakl ransomware.

Hit by ransomware? This free decryption tool for might help 31 Tech StuffREAD MORE ON CYBERCRIME

The dangers of using public WiFi

The dangers of using public WiFi

public wifi

How often do you use public WiFi? Are you aware of the dangers of using public WifI? Do you know how to protect yourself from harm? These are some of the questions that I will answer in this post, so if you or your kids are not currently securing your mobile devices, keep reading.

The Dangers Of Using Public WiFi

Everyone has several points during their day when they find themselves somewhere in public, and they just happen to catch a break. In those times, most people will simply take out their phone and check their favourite social network, email, and similar things.

However, to do so, they need an internet connection, and if they do not have a mobile signal then they will next try to scan the area for public WiFi. Some people even have their devices set to connect to any public WiFu automatically. If you do that, you might think that you are lucky having free internet access. However, you might just be about to enter a hacker’s trap.

Any free public WiFi that you find could actually be a trap set by hackers, but even if it is legit, with such poor protection there’s pretty much no difference. We understand that sometimes you don’t have the time or patience to think about this sort of thing. You might be in a hurry, or maybe you are waiting for an important email, or message.

The dangers of using public WiFi 32 Tech Stuff

Even if you use it for a little bit, your phone, tablet, or laptop can still get compromised.

So in this article, I am going to mention some of the most common and dangerous threats that you may come across when using public WiFi. And also some of the methods that you can use to protect yourself from them.

Snooping

Snooping is possible when you use any WiFi network that doesn’t have encryption, and most public WiFi networks don’t, which makes them different from your home network. When you use your private WiFi network at home, it has password protection, as well as encryption (or at least it should).

Public WiFi networks are different, and many don’t even have password protection at all, so as to easily make them available to anyone. Such as tourists and guests of hotels, restaurants, and alike. However, this also makes them vulnerable, as well as convenient.

When you use a network with encryption, your online actions are hidden from others. If you use one without protection, then everything you do is out in the open for everyone else to see. And if you use such networks to connect to your bank or social network, you will make your privacy available to others.
It is basically like sitting in an office with glass walls, everything you do is visible and nothing is private.

If you use public WiFi to connect to your bank, social network or anything else, you will make your privacy available to others

Compromised Devices

When you are using your laptop or some other device in public, and you connect to an open WiFi, make sure to mark it as a public network. If you do so, the device that you are using will lock down the connection. If you fail to do so, your device will treat it as a safe connection, which might lead to exposure.

In case that someone hacks your device, they might get access to all of your private content and info. That includes pictures, potential credentials, business documents, and everything else that you have.

Malicious WiFi Hotspots

The most dangerous thing that can happen to you is to connect to a fake public network.

They will often have a name like “Free WiFi“, or “Public Network“, or something like that. These are networks that hackers themselves set up, and then leave open, and without protection.

They do so in hope that someone would connect without realizing the danger, and most people will do just that. Not everyone knows about this method, and in fact, the majority doesn’t have a clue that this can even happen to them.

The dangers of using public WiFi 33 Tech Stuff

Several public WiFi Hotspots are set in place by hackers and left open to steal your online credentials, your business documents, contacts list, messages, emails, and everything else

But, when they do connect to one such network, hackers will see everything that they do.

This is how they steal your online credentials, your business documents, contacts list, messages, emails, and everything else.

They can later use this info to break into your bank account, steal your identity, hijack your social networks, and generally ruin your life for their own gain, or simply for their amusement.

Malware

Getting malware on your device via WiFi hotspot that hacker controls is much simpler for them, and much more dangerous for you. Hackers can use malware for many things. Some of them might only steal your files, photos, and similar data.

There is always a worse option, which is when malware actually downloads even more malware. Eventually, the hacker might get complete control over your entire device. If that happens, there is no limit to what they can do, from locking down your phone, to making it a part of a botnet.

WiFi Sniffing

This method is pretty simple when it comes to its concept. Basically, hackers will monitor network traffic and record big swathes of data that passes through. They can inspect this data later, and try to find some useful information.

This method can lead to discovering someone’s credentials, and other personal information. The consequences are many, and they might steal your money, your identity, or blackmail you if they find some secret.

And the worst part is the fact that sniffing through packets of data is not even illegal most of the time. It depends on the country’s laws, but not many choose to bother about things like this, that only affect several people at once.

Doing these things is actually very easy. Most people imagine that you need a lot of technical knowledge, or maybe some expensive equipment to do so. The truth is that almost anyone can do these things with an app or two, or some program of a higher quality.

The real technical knowledge is pretty much not even needed, and most instructions on how to do these things can be found pretty easily online.

You should have in mind that all of these dangers are a real threat, whether you are in your hometown, or in a foreign country.

Free WiFi can be a real danger whether you are in your hometown, or in a foreign country

How To Protect Yourself From WiFi Dangers

Now that you know what threats are out there, you should also learn how to recognize the danger.

Also, once you do recognize it, how to protect yourself. Some of these methods are something that you will just have to remember, and others will do most of the job by themselves.

The dangers of using public WiFi 34 Tech Stuff

Your job is to try to remember as much as you can, and when you can, you should avoid public WiFi. It might not be as convenient, but it is always recommended to wait until you get home. Now, let’s see what the methods of protection are.

Double-Check The Network Before Using It

False assumptions are what leads to most of this kind of problems. In short, you shouldn’t assume that a WiFi network is legitimate just because it says so. You shouldn’t really use any unknown WiFi since you don’t know who it belongs to.

It might belong to a restaurant, coffee shop, or a nearby hotel, or it might belong to someone fishing for easy targets.

Stick With HTTPS

Google Chrome lets you know when the site you’re visiting uses an unencrypted HTTP connection rather than an encrypted HTTPS encryption by labeling the former “Not Secure.” Heed that warning, especially on public Wi-Fi.

When you browse over HTTPS, people on the same Wi-Fi network as you can’t snoop on the data that travels between you and the server of the website you’re connecting to. But Over HTTP? It’s relatively easy for them to watch what you’re doing.

Thankfully all major sites are using HTTPS now, meaning that data is encrypted, but a lot of smaller sites are still using HTTPS and apps on your mobile device also may not be using a secure connection to connect to servers.

Update Your Software And Antivirus

Your OS will get updates on a regular basis, which goes the same for all legitimate apps on your phone or tablet. Installing these updates might be boring and annoying, but it is one of the best ways for you to stay safe.

New vulnerabilities are always being found and patched. If you have a system that did not patch old vulnerabilities, hackers might still bypass your protections. Most of these updates will install themselves automatically, only if you allow that in your settings.

And the same goes for your antivirus, that won’t help much if you connect to a network that hacker controls. However, it will help a lot if they try to send you a malware. That is why you need to keep it fresh and operational.

Forget A Hotspot When You Leave

If you have no choice and it is an emergency, you will simply have to connect to a hotspot and do what you need to do. However, we recommend doing what you must as quickly as possible. And after you finish, forget the hotspot immediately.

You don’t want to risk your phone remembering it and reconnecting automatically every time when you get close to that hotspot. That way, you might allow someone access without even knowing that you are in danger.

Having your phones remember WiFi that you use is practical and convenient, but also very dangerous. This is a danger that you must not overlook, otherwise, trouble is sure to follow.

Use A VPN

Finally, the best thing that you can do to protect yourself is to use a VPN. Using them is cheap, it is easy, and they will follow you always, and protect you no matter where you are. Even if you connect to a public WiFi.

VPN stands for Virtual Private Networks, and their main purpose is to help you stay safe online. They have multiple methods of doing so, which all add up to one big protective app that you can download on any device.

Depending on a VPN, there are different features that you can use to enhance your protection.

The dangers of using public WiFi 35 Tech Stuff

However, three main features are what they all have in common;

  1. First of them are security protocols. In order to keep your data safe, VPN can create a protective tunnel around your data flow. Your data goes through this tunnel, and while it is inside, nobody can use it, see it, or record it. With this method, your online actions are safe and under strong protection.
  2. The tunnels are not perfect, and there might be a leak. Still, there is nothing to worry about, because VPN’s also encrypt your data, just in case something like this happens. They use strong encryption that will keep everything you do protect. Even if someone somehow manages to get through your tunnel’s protection, they won’t know what they are seeing. And these protections are so strong, that some of them have never been breached before.
  3. Finally, they offer large server networks that can change your IP address. Thanks to this, nobody will connect you to your online actions, since they will go to another IP address, while you will remain completely safe and anonymous.

As mentioned, VPN’s offer a lot of extra features. Some of them serve as an enhancement to the existing methods of protection. Such as DNS leak protection, that will make sure that your tunnel has an extra layer.

Others will make sure that your protection will remain even if something disturbs the connection. This is what kill switches do.

All in all, whatever features they offer, the best VPN’s will protect you as best as they can. They will do it by blocking out hackers, stopping malware, and even by blocking ads.

To buy a VPN service is economical. You can subscribe to one of the best VPN starting from as little as £2.45 per month. Considering that your privacy and safety is at stake, it is well worth to give it a thought.

You can also use a VPN router, here is a guide to buying the best VPN router.

One thing to be aware of, many people believe that using a VPN hides your online activity and makes you completely anonymous, this is not true. Your online activity is tracked by more than just your IP address. Your apps on your mobile devices and the cookies in your browsers are sending information about your activity all the time, allowing advertisers to track you around the internet.

Which VPN To Choose?

Because of their sudden popularity which keeps on increasing, there are now hundreds and hundreds of different providers. Choosing one is hard enough, but choosing a good one can be even worse.

Here are some of the most popular VPN providers. I personally use Tunnel Bear right now, and each account allows up to 5 devices to be connected. So depending on the size of your family, then a single account could be used for your entire family’s smartphones.

According to sources, all of these are strong, fast, cheap, and they will give you the best protection that you can find, at the time of writing anyway.

Conclusion

Using public WiFi hotspots can be risky without a VPN, but you sometimes can’t help it. It is understandable, but you should still try to avoid doing it when possible unless you have a VPN to protect you.

However, when you find yourself in a situation that you have to use one, try to remember what you should and shouldn’t do. Do not log into social networks, emails, and especially don’t connect to your bank account. Also, try not to pick something that looks like it is offering itself too strongly.

And of course, subscribe to a VPN, and always have it on your devices. Many VPNs allow multiple connections at once, which means that with one subscription, you can protect 3-5 of your devices at the same time.

So remember these things next time when you choose to connect to a public WiFi hotspot and try to stay safe.