Last weeks lesson: IE only web sites are a very bad thing.

The recent vulnerability in Internet Explorer (IE), followed by the rapid spread of the exploit mostly via hacked web sites led to most experts, myself included in full BBC media-tart mode, to advise not to use IE until it is patched which happened on the seventeenth, eight days after the vulnerability became public. Hackers are though continuing to exploit the vulnerability via Word documents.

I recommend wherever possible sticking with Firefox the rest of the time, unless a site absolutely demands IE. I believe Firefox is not only a better implemented browser, it is more secure, which to be fair to Microsoft is in part, (but only in part) because IE is the juicer criminal target due a greater market share. It is disappointing to find web sites that one would hope are among the most security consciousness, not supporting Firefox, despite a 20% market share and more importantly, the occasional need for an alternative to a temporarily vulnerable browser (be it IE, Firefox, Safari or anything else).

For example, my bank, Abbey National on its e-banking login screen warns Firefox users their browser is “not supported”, as it happens, except for some forms, loan applications and the like, it works fine. Nonetheless a message like that hardly projects the impression of a company hot on security.

I suffered more annoyance today on Experian's site , one of Britain's credit record companies. After filling in a few pages of forms to sign up to receive regular updates to my credit record (for a fee) it all went wrong at the final credit card authentication stage. Rather than take my money an on-screen message asked me to call customer services' freephone number. They explained, you’ve guess it, that their site does not reliably work with Firefox but annoyingly you have to phone to find that out, I asked why? “We don’t really want it to say we don’t use Firefox” said the man. Which suggest they are at least aware this is something that might not show them in a good light. The result is annoyed punters, needlessly lost business and again the impression, whether it’s true or not, that a company holding almost every British adults personal details hasn’t prioritised online security as much as they should. It’s plain embarrassing to have tell people to use an all be it temporarily, dangerously insecure browser.

There is of course the obvious lesson of last week that it shouldn’t be your web site that gets hacked to spread malware, some good advice on that from Yuval Ben-Itzhak can be found here.

Just as important though, as highlighted by last week’s events is that all businesses, large or small should ensure their web site works with at least Firefox, IE and for Mac users, Safari. Check which browsers your visitors use via your site’s visitor log. Review and retest every six months or so. Things change, for example Google's Chrome’s share is expected to grow, as are mobile visitors.

For a simple web site that is little more than a bit of promotional blurb compatibility is easy to achieve but even this needs some thought; as well as good browser compatibility sites should minimise their effect on users with high browser security settings and missing plugins. Why use Flash for example if an animated GIF requiring no extra software would work as well? Not everybody has even the essentials, flash and Java, installed. The majority of your visitors probably don’t even know what they are. Things don't always work, so when a page component fails the site should tell the user why and how to fix it, in as user friendly a way as possible.You wouldn't want customer service staff telling customers "Nah, can't do it, go away", Why let your web site give that impression?

To come: Building a web site, who to hire and what to specify.