How Unprotected Download Pages Are Costing You Sales

If you are selling products that can be downloaded, I have some shocking news for you. See, I was browsing Google lately, as I often do, and stumbled upon something that surprised me. Not many things do that any more, but after considering the source, I wonder if the person knows how many sales they are losing.

Do you monitor your website statistics frequently? Do you ever wonder why your product download page appears to be accessed more than your sales page or that your sales receipts show?

What I discovered was a link in Google for a purchase confirmation page for a product selling for $97. That same product is being offered as a bonus on another product that is selling for $147.

When I visited the link, I realized that the confirmation page was not protected. It allowed anyone to download the videos, PDF files and other recordings, without paying!

Looking into the cause of listing that page in the search engines, I realized that unencrypted PayPal order forms will show the return link and are seen by Google as just another page to index.

The return link is the confirmation page. If not protected, it is like giving your product away free to anyone who either searches for the product, or views the page source.

Please note that PayPal is not the only payment processors who uses order forms like that. Others also use return links in plain view. ClickBank is one of the few that keep the return link hidden by being stored in a database on their servers.

I have used PayPal for many years and like their activity history, shopping carts and order buttons. They have an option to create an order button online and encrypt it by default.

Sometimes encrypting the form can trigger anti-virus programs to display false warnings. In that case, you can still use an unencrypted form, but should only do so if you protect your thank you page.

Any payment processor who uses forms like PayPal should have a method of verifying the payment before accessing the thank you page. By using that, anyone who discovers the thank you page will be redirected to your sales page until they purchase.

For those use ClickBank, there is a simple 5-line piece of PHP code you can put at the top of your confirmation page to help protect it.

First of all, your confirmation page file name should end in .php, not .htm or .html unless your website is configured to use PHP in HTML files. At the very top of the file, the starting with the very first character, put the following lines and change YOUR SALES LINK HERE to the link to your sales page:

<?php if(!isset($_GET["cbreceipt"])) {
header("Location: YOUR SALES LINK HERE");
exit;
}
?>

Now upload that file to your website and know that nobody will
be able to get into that page unless they go through the
ClickBank order process first.

Yes, there is still a way to get past that by faking a receipt number, but first they will have to know the download page name. That alone can deter most people, if you create one that is not so obvious.

Only the dishonest will take the time to figure out how to get there. Fortunately, those people are a minority.

PayPal and other payment processors have payment integration guides to help you implement the order confirmation process. The one from PayPal is currently 86 pages. Yes I know that is a lot of information to absorb, just to begin protecting your pages.

If you are not comfortable doing this yourself, have your webmaster do it for you. If you do not have a webmaster, contact Website Managers to host your website and help you secure your sales receipt pages.

Jim Hutchinson
__________
Copyright © 2008 Website Managers, LLC. You may reprint this article providing that this copyright notice and resource links all remain intact.