- Hey ya'll, welcome to another WordPress Wednesday.
My name is Kori Ashton from AskKori.com.
Be sure to check out over 300 videos that I have here
on my YouTube channel, and subscribe,
because every Wednesday, I'm creating videos just like this
to help you improve your online marketing inside the world
of WordPress.
Today we have a question from British Columbia,
which I'm super excited about.
It's all about security for WordPress,
specifically speaking about like form fill-outs and
information gathered on your website through Gravity forms.
Let's go take a look.
So Paul writes in and says, "I would like to use
Gravity forms in the subscriber part of my website.
I would like to create forms for my clients whereby they
can download or print the pdf.
The forms will be pre-built, waiting for the client
to fill in the blanks.
However, some of the blanks are private,
and I'm concerned about security.
Can Gravity, meaning Gravity forms, and WordPress,
handle this without being a genius security person?
Question mark."
So I absolutely love this, Paul, because so many of us
are not security experts, right?
But here's what I will tell you.
While WordPress itself, the core of WordPress,
is extremely secure as long as we're keeping everything
up to date.
I do get concerned about us collecting information
and having it live in my sequel database, which is what
WordPress actually houses and stores
all of its content in, right?
So this is where you have to start thinking about HIPAA
compliance and all sorts of legal issues, and even for your
own company, if you're a freelancer, if you're an agency
and you're developing these websites for clients,
you should become at least knowledgeable,
maybe not a total expert when it comes to IT and security
and firewalls and all that jazz, but you need
to be educated, right?
So thank you for asking this question.
I think a lot of my viewers out here are going
to be interested in knowing the answer to this.
So while you can be running something like Sucurri,
which is an extra add-on or an extra security plugin
on your website.
This really is more for people trying to hack
into your site, people trying to get that information.
This is also for any type of issues with plugins
that can create holes, if you will, and access points
into your database.
So it's important that you do add extra security,
even if you're adding in an SSL to the site, right.
With Let's Encrypt for free, you can add an SSL
to your site.
All of these things are important extra steps to do.
This gets you that lock up here, which turns to https.
That's great to have.
But ultimately are these things enough to deal with
what Paul's issue is here whenever we're talking
about actually gathering information and having it
live somewhere that could be private.
Maybe we're talking social security number.
Maybe we're talking address even, my personal address
to my home.
Children's names, children's ages, our birth dates,
all that type of information really could be used against us
and we don't wanna just have that out there.
So here's what I suggest.
Absolutely check with your hosting company, 'cause a lot
of this can be handled server side.
Ask them if they actually do have HIPAA compliance
data centers, so Liquid Web is one of the ones
in the industry of WordPress that I know for absolutely
certain that they have HIPAA compliant data centers.
Super important that you step up your level of security
if you're going to be helping folks in the medical industry,
legal industry, insurance, whatever industry might be
collecting that information, right.
Here's what I like to suggest, so overall best practices.
This is what we've done here at WebTegrity all through
the years, is if I'm dealing with a client who needs
to collect data like that, I really try to push back and say
to them, is there something in your industry that already
has a portal-like environment that allows us to gather
that information completely HIPAA compliant securely,
in a lock-down mode, where we can pass off the liability
onto them, right?
So look at those things, especially in the medical industry,
the insurance industry, and the legal industry.
There're already solutions out there that create those
portals that allow people to fill out information,
whether they're applying for a loan, or they're trying to
sign up and talk to their doctor about their medical issues.
All of these things can live inside of that environment.
And what you can do on the WordPress side of things,
is maybe just have a simple form fill where we're gathering
the most minimum amount of information for the lead, right.
That's all we really need.
And then, as we gather that lead, the next step would be
to automatically send them over to that portal area,
and allow them to fill out that kind of more
concerning information or more private information
in that environment.
While that might not be the absolute fix-it you were
hoping for, Paul, I think that that's best practices, unless
you can absolutely talk again with your hosting company.
Be certain that maybe they carry some sort of insurance,
or they have this HIPAA compliance in place,
and that becomes your safety net when it comes to anything
for liability issues, right?
So I hope this helps you.
I know there's a lot to it when we're thinking about
being actually sure that we're providing the right
solution for our clients.
But every single week, I'm trying to help you improve
and do that here on YouTube, and if you're interested
in growing more with your freelance business,
as well as your small agency business,
be sure to check out a link I'll put in the description box
below to join my Vimeo community where we are talking
about this type of stuff consistently every month.
Come be a part of that conversation.
I'd love to see you over there in our live webinars.
Have a great one.
I'll see ya'll on the next WordPress Wednesday.
And, Paul, thanks so much for the question.
You're amazing, bye ya'll.