Mike Maynard

Why You Need to Think Again About Web CMSs

I was an engineer, so I can honestly say I find website content management systems (CMSs) fascinating. I remember the early days of the web: in fact, I have used Gopher, had a Compuserve account and remember when AOL was [just about] cool. Anyone who can remember these days will agree that it’s so much easier to make information available today than it was in the early days of the internet.

There have been a couple of things that have driven the dizzying improvements to the web: firstly, the availability of easy-to-use hosting services outside of walled gardens such as Compuserve, and secondly the creation of easy-to-use CMSs.

Website CMSs

For those of you who don’t know, a CMS splits the content from the presentation, or in language that non-geeks might use, it lets you add content to a website without having to be a web programming nerd. The introduction of CMSs meant that content could be posted to a corporate site without needing a team of coders to create and upload HTML and CSS. This meant content updates could be done quickly and easily by the people who had the content, rather than the slow and sometimes painful process required by hard-coded HTML sites.

Websites, however, aren’t like word documents. It’s important to have a consistent look throughout a website, so CMSs use templates. Most CMSs, however, had a philosophy of delivering a single chunk of body copy within the template. This is now rarely the case, with background images, widgets and other layout techniques making page layouts much more complex.

A couple of years ago, the solution was custom coding of the CMS. In fact, I’ve written custom WordPress code for a client to insert related case studies and links to content, based on the specifics of each page; as there wasn’t a good way to achieve the same result using pure WordPress at the time. Today, however, everything has changed.

Why You Don’t Need to Customise WordPress

I’m going to talk about WordPress in particular. Partly because our web team uses WordPress and partly because it’s such a good example of what has happened to CMSs. I also see many WordPress sites that used hard coded content blocks in a customised WordPress environment to create a layout with zero flexibility. Note that I’m not talking about the development of themes: here you still need to hard-code to create a custom layout; I’m referring to the customisations that mean you have to fill in several boxes when you create a page, and the coding will then place each block of content in a specific place on the page.

Today I don’t believe there is a need to customise WordPress to create the layout you want. Firstly, the core WordPress editor has switched to Guttenberg: this is a new approach that allows you to place content in multiple blocks, rather than a title and single piece of content. For some websites, this editor is more than enough to allow you to deploy the layout you need.

Some sites, however, require even more complex layouts and functionality. There are a number of plugins – WPBakery is probably the best-known – that give you almost unimaginable control over your content and layout by simply dragging and dropping blocks. It’s really that easy. You don’t need to be a programmer to create a layout with columns, sidebars, background images or even parallax scrolling. The cost of this incredible power is ludicrous: $45. That’s probably less than the cost of the time to publish a single blog post for most enterprises! Oh, and if you’re using a paid-for 3^rd-party theme, you’ll likely find that WPBakery is bundled for free!

Despite the fact that these capabilities are now easy to deploy and use, and are very, very cheap, I still see clients struggling with hard-coded custom themes. They’ll typically want to have a slightly different page layout for some new content, and either have to pay for additional custom coding or compromise and use the hard-wired layout that almost meets their needs. It’s crazy to have to compromise with the technology that’s available today.

Break Free of Hard-Coded WordPress Customisation!

The reality is that migration away from a hard-coded layout is really simple and typically very quick. Yet companies struggle with their limited hard-coded systems because it’s what they have always done, and they don’t believe that it’s either possible or easy to migrate to a more modern approach. We disagree! If you want to find out how easy it is to move from a limited theme where you have to ask a web developer every time you want to do something different, simply email me and I’d be happy to talk to you about how we could make your website cheaper, easier to use and more flexible than you ever imagined.

by Mike Maynard

How HubSpot Cookies Work and Custom Opt-Out Systems

With the impending GDPR regulations, marketers need to review their cookie policies and ensure that they are compliant. There are many articles on the impact of GDPR on cookies (for example this article about The GDPR, Cookie Consent and Customer Centric Privacy), which give advice on what should be done, but implementation is not always as easy as it seems.

We recently worked with a large ecommerce company who was deploying HubSpot (we're a HubSpot partner, although we do work with a range of marketing automation systems). Most systems, including HubSpot, offer an automatically generated banner that allows users to opt out of their cookies, but with over 20 different systems generating cookies on the site, having to accept or decline this many notifications simply isn't a practical option. They've developed code to manage cookies, and allow a single button to opt-out of tracking, and so they wanted to incorporate HubSpot cookies into this system. Should be pretty straightforward, right?

Well the problem is that it's not entirely clear how HubSpot cookies work. We asked and got some conflicting information, so ended up running some experiments to analyse the behaviour of HubSpot to give the client the best possible solution.

This isn't a typical Napier blog post, as it's very technical, but we're pretty sure it's going to be useful to a lot of HubSpot customers.

What HubSpot Tells You About Cookies

HubSpot does have some good information about cookies. They have a page describing the cookies HubSpot uses for tracking, and an article describing how to enable the HubSpot cookie opt-out notifications. You have four options, described in the article as:

• Do not notify visitors that your site uses cookies - Choose this option if your company does not have a presence in Europe. This option will let you collect visit history on your website visitors without asking the user for explicit permission. Please note that if the visitor is using a web browser that has cookies disabled, or if they are using a do not track feature on their browser, HubSpot will not be able to collect visit history for them.
• Notify visitors that your site uses cookies - Choose this option if your company has a presence in Europe and you need to abide by the EU cookie laws. This option will display a banner on your website the first time someone visits your site.
• Notify visitors that your site uses cookies and allow opt-out - Choose this option if your company has a presence in Europe and you need to abide by the EU cookie laws. This option will display a banner on your website the first time someone visits your site. It will prompt the visitor to consent to the placement of cookies on their computer. Once they consent, you will be able to gather visit history on that visitor.
• Do not use cookies at all - Choose this option if you do not want to collect any visit information from your visitors and also abide by the EU cookie laws. Choosing this option will make the analytics and lead tracking portions of HubSpot unusable and is not recommended in most cases.

So the first and the last options are pretty straightforward: always track or never track, but what about the middle two? I want to be compliant with EU cookie law, so which one do I choose, and how do I implement an opt-out without using their notification?

Accepting and Declining HubSpot Cookies

The first thing we found was that the behaviour of the two "EU-compliant" modes is actually quite different. If you select Notify visitors that your site uses cookies, then as soon as the user visits the site, HubSpot drops tracking cookies. But the system doesn't track you individually until you click the accept button. So HubSpot is presumably generating anonymous data using the cookies, but not tracking what individual users do. The one exception we found was that when a user fills in a form, that page view is recorded. As this is necessary for processing forms, it's pretty sensible. As there is no opportunity to decline cookies with this notice, you can either ignore it, which will only allow anonymous tracking or accept, which then switches on individual tracking of page views. So this setting not only notifies the user about cookies, but provides an opt-in for tracking of page views (you're opted out of this tracking by default).

Selecting Notify visitors that your site uses cookies and allow opt-out as the notification option is very different. As the user lands on the site, no cookies are dropped. So you have to click accept to opt-in, and then the cookies are placed and the notification disappears. Opting out will place the __hs_opt_out cookie with a value of yes, and not place any other tracking cookies.

The __hs_opt_out Cookie

The __hs_opt_out cookie is interesting. It's placed on a users computer when they click the accept or decline buttons on any of the notifications. By placing the cookie, any further notification banners are suppressed, so once you've made your choice, you don't get pestered again. Pedants will note that it has an expiry of two years, so if we are being completely accurate, you will get asked again every two years.

The __hs_opt_out cookie seems to do a little more than this. Not only does it suppress the notifications, but when the value is "yes" it also suppresses individual page view tracking, whatever "mode" of operation is chosen for cookies. This means that if someone declines tracking, and then you switch from allowing opt-out to simply placing cookies automatically or just notifying, then the user won't be tracked until the cookie expires.

Creating Your Own Opt-Out Code

Creating your own opt-out code is simple. All you need to do is to set the __hs_opt_out cookie value to "yes" and remove the other cookies. Some PHP code to do this is shown below, using our domain as an example:

$cookie_name = "__hs_opt_out";
$cookie_value = "yes";
setcookie($cookie_name, $cookie_value, time() + (86400 * 365 *2), "/", ".napierb2b.com");
$cookie_name = "__hstc";
setcookie($cookie_name, "", time() - 3600, "/", ".napierb2b.com");
$cookie_name = "hubspotutk";
setcookie($cookie_name, "", time() - 3600, "/", ".napierb2b.com");
$cookie_name = "__hssc";
setcookie($cookie_name, "", time() - 3600, "/", ".napierb2b.com");
$cookie_name = "__hssrc";
setcookie($cookie_name, "", time() - 3600, "/", ".napierb2b.com");

With 86400 seconds in a day, the code sets a two-year cookie for opt out, mirroring the behaviour of HubSpot. The other cookies are removed by simply setting them to expire in the past. We've also removed the session cookies - although this might not be necessary, we've done this as clearing them seemed to create a more robust approach.

For more information about the cookies used by HubSpot, read What cookies does HubSpot set in a visitor's browser?.

Allowing Opt-In to HubSpot Cookies

Opting back into cookies is not as simple as it might seem - you can't just set __hs_opt_out to be "no". The easiest way we found to do this is to remove that cookie, which then triggers the appropriate notification based on the option you selected for your site. This ensures that all the cookies are created correctly, although it does need the accept button to be clicked if one of the two notification options are chosen. Clearing the cookie is achieved by setting the expiry time in the past:

$cookie_name = "__hs_opt_out";
$cookie_value = "no";
setcookie($cookie_name, $cookie_value, time() - 3600, "/", ".napierb2b.com");


Dealing with the HubSpot Banners

If you are creating an option to allow opt-in, or to decline cookies, it's likely you will be using one of the two HubSpot notification banners. You'll therefore want either the accept or decline button to be clicked to enable tracking or disable placement of cookies. You could leave it to the user to do, but this is not great UX, and often not practical. We talked to HubSpot and they suggested that rather than try to replicate the code on the buttons, we simply replicate a button click using JavaScript. The following code is a JavaScript function that clicks the accept button, and you can change it to decline cookies (if the opt-out notice is present) by changing hs-eu-confirmation-button to hs-eu-decline-button.


<script type="text/javascript" >
function acceptHScookie() {
if (document.getElementById('hs-eu-confirmation-button') !== null) {
document.getElementById('hs-eu-confirmation-button').click();
}
}
</script>

Hiding the Notification Banners

Of course if you are automatically clicking the buttons for users, and providing your own cookie notice, you don't want to show the HubSpot cookie notifications. This is actually super-easy to do, as you just need one line in your CSS:


div#hs-eu-cookie-confirmation{display:none;}


Forget about __hs_do_not_track

One of the cookies that HubSpot can place is the __hs_do_not_track. In our testing it wasn't placed at all - it seems to be an opt-out of all tracking, and can safely be ignored when writing code. If it is present, however, there will be no tracking of that user.

Summary

So it's perfectly possible to manage HubSpot cookies for users using your own code to improve their experience on your website. If you are happy for cookies to be placed when the user opts out of tracking, you can select either the do not notify visitors, or notify visitors options, although if you go with the second, then the user won't be tracked until the accept button is clicked (either by your code, or by the user).

If you want the user to opt-out of cookies being placed by HubSpot (other than the __hs_opt_out cookie, obviously), you need to select the notification option that allows users to opt out. You will also probably want to set up code to click the appropriate accept or decline button and hide the banner.

A Final Warnings

This information, however, is not official HubSpot documentation. Although the approach I've described is designed to be as future-proof as possible, you do have to bear in mind that HubSpot could decide to change the way their cookies work and break this code. And they are perfectly entitled to do this (although I do think it's unlikely).

The other warning is that this approach is not supported by HubSpot. Trust me, although HubSpot support is normally great they have no idea of how to manage the cookies. They are pretty clear that it's not something they support, but during the project we got incorrect information from support. Although it was just people trying to be helpful, it set us back a long way, so until HubSpot decides to support management of cookies, I wouldn't recommend discussing this with them.

I hope this is going to be useful to people out there. Please let me know if it is helpful or if you have any problems. I will update the post if I get any more information.

by Mike Maynard