Teaching, to learn.

Have you ever presented at a conference? If so, I'm betting you got a lot more out of it than just having your name on the program.

It's surprising at first, but I've found:

Teaching someone about a topic actually gives me a better understanding of the thing itself.

Have you noticed that? How does that even work?!

What's even better is explaining the same thing to many different people:

First, I have to think once again about the underlying principles at play. But then I also have to think about how to explain it from yet another viewpoint.

I've had this experience on all kinds of topics:

• playing the guitar,

• Brazilian jiu-jitsu,

• academic topics like history and biology,

• and of course the business and CRM topics we explore on this list.

You've probably had this experience too:

• With family members

• With your staff

• With your members, event participants, and other constituents.

Teaching is, counterintuitively, a wonderful learning experience.

It's just another example of how giving value to others gets us something we value ourselves.

Here's the thing:

If you're planning to attend CiviCon 2025 in May, you could get a lot out of that event by giving a presentation while you're there.

I know, that can be an intimidating prospect if you've never spoken at a conference before. It certainly was for me, the first time.

But the truth is, you do have a unique perspective. You have stories to tell, wisdom to share, insights people want to hear.

And sharing those with others is a remarkably effective way to increase your own understanding of them for yourself.

Give it some thought.

And if you'd like help fleshing out a topic, hit me up. I believe you've got something to share, and I'll gladly help you find a way to share it.

All the best,
A.

Improving CiviCRM

You might be already planning to attend CiviCon 2025 in May, or at least considering it.

Have you thought about attending the post-conference Sprint too?

What is this Sprint?

The Sprint is a residential working retreat, where writers and users gather to focus on improving the software and its documentation, aiming to make the whole system better for everyone.

It's casual, friendly, and fun, with good food, accommodations, and great people.

Most of us will be in it for the full five days. Some will just stay for a day or two.

Most of us will be CiviCRM professionals: partners, providers, developers. Some will be CiviCRM users and administrators from organizations that rely heavily on the CRM and want to see it continue improving.

Should you attend?

That's up to you, of course.

But if your work depends heavily on this software and the community that supports it, attending the Sprint could well be a worthwhile way to improve the software and to build relationshisp with others in the community.

All the best,
A.

“Is that even possible?”

Knowing what’s possible (and what isn’t) gives you a big head start in getting things done.

Funny example: I founds some folks on Quora asking if Jedi mind tricks could be real.

Like … real real.

Yeah.

These questions appear to be both sincere and literal, surprising as that might be.

But then again:

If it were possible to just wave your hand and get your neighbor to stop parking in front of your mailbox, wouldn’t you want to know about it?

On the other hand, if you already knew it was a mere fiction, you could avoid wasting time trying to perfect it. (“Dang it! Yesterday it worked and they parked in their driveway, but today they’re blocking the mailbox again! Must need more practice!”)

Knowing what’s possible matters a lot.

For example, I got a simple response to yesterday’s email about emailed reports from CiviCRM: “Awesome! I didn’t even know this was possible.”

Likewise, I myself have the experience, now and then, of banging away for hours trying to solve a certain problem, only to find that someone else had already created a simple solution. The problem was already solved — I just didn’t know about it.

Here’s the thing:

It can be hard to know whether your current problems already have a simple solution. Or if your own idea for a solution would even work.

You’ve got three options, as I see it:

1. Bang away for hours (or weeks, or months) on your own, trying to make it work.

2. Try a small proof-of-concept to test the parts you’re least certain about, so you can decrease the uncertainty with a minimum of expense and effort.

3. Ask someone who probably knows more than you. (Hopefully those Quora questioners have saved themselves some time and disappointment!)

Which option you choose is entirely up to you, of course.

All the bset,
A.

Useful CRM notifications by email

How do you keep up with important but infrequent developments in your contact relationships?

The information is in your CRM, and you could easily find it by performing a search, running a report, or even putting a widget on your dashboard.

But will you remember to check those every day, week, or month? Even if those reports are usually empty?

Many of my clients find it's easier to pay attention if they just get an email that only arrives when there's useful information to display, such as:

• New subscribers to a given mailing list in the past month.

• Recurring membership payments that failed yesterday.

• Donations over $1000 in the past week.

• A donation from a first time donor, just now.

They're doing this in one of two ways:

CiviRules extension:

CiviRules can be configured to handle a wide variety of automated tasks. Having it send you an email when a first-time donor gives is just one of them.

Scheduled Jobs to send reports by email:

Instead of just getting a single email from CiviRules every time something happens, you can have CiviCRM send you the contents of any report, by email, on a monthly, weekly, or daily basis.

It works like this:

1. Create a report that filters for the data you want, within the last X days.

2. Add your email address as the recipient under the report's Email Delivery tab.

3. Configure a Scheduled Job to email that report on your chosen schedule (daily/weekly/monthly), and to include the full report data either in the email body or as an attached PDF or CSV file.

4. Use the No Empty Report Mail extension so that you only receive emailed reports when there's actually useful data in the report output.

With either of those two approaches, you can get email notifications from your CRM when there’s actually data that matters to you.

This way you don't have to remember to search for that information — which is hard to remember on a regular basis, especially when there's usually nothing in the search result.

Here's the thing:

Creative use of core features and extensions in your CRM becomes really valuable when you can get clear on the predictable answers you'll need.

If you can do that, it's worth a little effort to configure notifications that will be meaningful in your work.

All the best,
A.

The system that does everything

Would you want to manage a system that does everything?

• A restaurant that makes every conceivable type of food?

• A nonprofit that serves every conceivable need?

• A team that plays every conceivable sport?

Obviously that's not a winning proposition.

It's hard even to call any of those a "system," since predictability is completely off the table.

Now, what about your CRM system? Not just the software itself, but the systematic way you and your team use it.

Do you want that to be a system that does everything?

Probably not. Not if you value your sanity, your mission, and your people.

Here's the thing:

Complex tools like your CRM software are built to handle a vast — though not infinite — array of possibilities.

But efficient and effective systems are built around predictability: in the way they're managed, and in their outcomes.

As in any system, the more you can standardize the way you use your CRM and what you aim to get out of it, the more efficient and reliable those outcomes will be.

And who doesn't want reliable outcomes?

All the best,
A.

The value of good design

What's the value of good design?

For most folks, that's a lot harder to define than the value of other things, like specific functionality or workflows.

For example:

• If you suddenly found that your online forms for donations or event sign-ups were not working, you could probably pin a number on how much that's hurting your mission — in terms of funding, reputation, and other metrics you care about.

• But what if your website were suddenly ugly and hard to use — or the reverse: what if it were suddenly much more beautiful and easy to use? Could you put a number of any kind on that difference?

It's a tough question. I'm still working on the answers.

But Alan Faljic's How to estimate the ROI of design work? makes some good points about how even design professionals are challenged to define the value of their own work.

I expect you're not a designer, but this bit may sound familiar:

We try to explain design’s impact through qualitative thinking: empathy, aesthetics, and user experience, for example. While these are important factors, they’re not what business people understand, nor are they what drives business people towards action.

In other words, we usually think about design in qualitative, subjective terms.

Faljic's article explains a way to put numbers on that value, by tying it to quantitative, objective measurements that business leaders care about: increased income, and decreased expense.

In our world, we can also add: increased mission impact.

Here's the thing:

Good design isn't just about making things look pretty. Or the pride of showing off our fancy new design to our board members.

It's about making the journey smoother as we guide our people to the next step in their engagement with our mission.

That's got to be worth something.

And that's something surely is measurable.

All the best,
A.

Looking up and out

Our work inevitably involves looking down, and in.

That's important if we want to keep everything running smoothly. Our teams, our systems, ourselves.

But we also have to look up, and out.

That's important for keeping things moving forward. Our programs, our relationships, our mission.

Here's the thing:

If your tools, systems, or staff aren't operating smoothly, it's worth some time and effort to get that fixed.

That will require looking down and in, and doing the work on the inside.

But the sooner you can get that resolved, the more you'll be able to look up and out.

So you can do the work on the outside, where your real mission is.

All the best,
A.

Building vs cultivating

If you're a carpenter, you can build a greenhouse anytime you want. Do it all in a weekend, or in fits and starts over the course of many months.

But if you're a gardener, you must cultivate that garden by doing things at the right time, a little at a time, for a long time.

Here's the thing:

Your organization’s programs, policies, and systems are, for the most part, built. You can undertake the work anytime you want.

But your relationships — with donors, service recipients, staff, advocates, and others — must be cultivated. It takes careful effort, applied consistently, over a long period.

That's the difference between building and cultivating.

All the best,
A.

Making time by making space

Does your work require just one type of activity? I’m betting it’s more than that.

In any given week, I probably have a dozen different types of work that need my attention.

Relationships to build and maintain, tough technical problems to solve, long-term strategic plans to attend to, short-term crises that must be handled.

All of those access different parts of my brain.

And it can be really tough to switch from one mode of thinking to another.

For example, for the last two weeks I've been-neck deep in a fun and challenging custom-development project for a client. This is the kind of project that, if I let it, could easily consume my thoughts — all day, every day.

But in the meantime, I know it's important and valuable for me to spend time on other tasks. Like planning and organizing for CiviCon 2025, generating useful contact to my daily mailing list, and answering inquiries from new potential clients.

To make sure I don't get stuck in one thing, I have a simple practice:

I make time by making space.

For writing my daily emails, I get away from my desk and go outside. For planning and strategy, I get away from my desk and take paper and pencil to a cafe or a kitchen table.

And I stay there until the task is done.

Your situation is not so different.

What practical steps do you take to help your brain switch from one mode to another?

Does a short drive or a walk around the block help you clear your mind? Is it worth blocking out an hour each week, or even each day, to focus on important matters that are hard to get your head around?

Here's the thing:

In an ideal world you’d probably have a large team of people to lean on for all kinds of different tasks. But in the real world, most of us don't have that.

It's up to us to make the time and space to focus on all the things that fall to us for the success of our mission.

All the best,
A.

You can’t steer a parked car

When your car is parked, you can do a lot of things to it. Change the oil, air up the tires, top up the gas.

But the one thing you can't do is adjust its course. You can't notice where it's off track and make corrections to reach your destination.

To do that, you have to start it up and get it going.

It's the same for any new program or endeavor you might undertake.

At some point, when you're clear on your objective, you have to start.

You can make adjustments as you go.

But you have to start.

All the best,
A.

Triple your results?

Say I had an idea that would triple your fundraising results in the next 12 months. Say it was a perfect fit for you.

What would you pay me to implement it for you?

The truth is:

You couldn't say — couldn't even know if it was worth the time to hear me out — until you first thought what the value might be.

Always consider the value first.

All the best,
A.

Beyond Advanced Search

Your constituent data loses a lot of its value if you can't access it in the ways that are useful to you.

So let’s talk about searches in CiviCRM.

CiviCRM’s familiar Advanced Search tool is great for what it does. But when it's not enough for your needs, here are three other tools you might want to try:

SearchKit:

This relatively new feature really is the future of searching in CiviCRM.

(In fact the excellent search tools I mention below are getting harder to find in newer versions of CiviCRM, as the focus shifts to SearchKit.)

With SearchKit, you really can build just about any type of search you might think of.

And it’s not just for finding contacts, either. With SearchKit, you can search for any type of record in CiviCRM: participants, contributions, cases, even more obscure things like line items, notes, and option lists.

The hard part is: SearchKit presents a rather steep learning curve, requires very careful thinking on your part, and assumes you have a pretty good idea of how CiviCRM structures its data internally.

Nonetheless, I do have some fairly non-technical clients who are getting what they want from it.

So you may want to give it a try.

You can find it directly under the search menu at Search > SearchKit.

Include/Exclude Search

If you're making active use of groups and tags, you may sometimes want a list like one of these:

• All contacts who are in Group A but are not in Group B.

• All contacts who are in any of Groups A, B, and/or C; but who are not in tagged with any of Tags D, E, and/or F.

Yes, you could also do this with SearchKit, but the Include/Exclude Search provides a very simple and straightforward interface. So it's more limited in what you can do, but much easier to use.

Traditionally, you should be able to find this under Search > Custom Searches > Include/Exclude Search.

But newer versions of CiviCRM have been hiding this menu item, so you may need to access this (and a few other so-called “Custom Searches”) directly from the URL:

• WordPress:
  ://[example.org]/wp-admin/admin.php?page=CiviCRM&q=civicrm%2Fcontact%2Fsearch%2Fcustom%2Flist&reset=1

• Drupal:
  ://[example.org]/civicrm/contact/search/custom/list?reset=1

Search Builder

Search Builder allows you to find contacts according to very complex AND, OR, and NOT criteria.

Because it's a little more open-ended in its purpose, the interface is a little more complex than the Include/Exclude Search. So you'll need to think a little more carefully about turning the question in your mind into the criteria to use in this search.

But it's still a lot easier to use than SearchKit, and a lot more powerful than Advanced Search.

Traditionally you will find this under the Search menu at Search > Search Builder. But because newer versions of CiviCRM have begun hiding this menu item, you may need to access it from the URL directly:

• WordPress: ://[example.org]/wp-admin/admin.php?page=CiviCRM&q=civicrm%2Fcontact%2Fsearch%2Fbuilder&reset=1

• Drupal: ://[example.org]/civicrm/contact/search/builder?reset=1

Here's the thing:

When you need a search that you can't perform with Advanced Search, then you've probably got a complex set of criteria that requires careful thought.

But if you expect the search results to be valuable in your work, it may be worth the extra time and effort to get familiar with the above search tools.

All the best,
A.

No easy answers

What's the best way to tie a bow?
Or to catch fish?
Or to improve your health?

For these questions and a thousand others, there is no “one right answer,” except perhaps this:

It depends.

It depends on where you're starting from.
It depends on what you're trying to achieve in the long run.
It depends on the options and resources that are available to you.
It depends on your unique situation.

If you Google those questions, you’ll find dozens of clickbait articles offering easy answers. If you're lucky, one of those answers will fit your situation.

But chances are, none of them is exactly right.

Here's the thing:

The same is true both for your CRM strategy and for any particular tactic you might implement to achieve that strategy.

In terms of tactics, your open source CRM may offer a dozen ways to accomplish any particular task.

In terms of strategy, the possibilities are even more open-ended.

Either way, there's usually no easy answer — no "one best way."

But if you consider your goals, limitations, resources, and starting point, you can probably find a way that's good enough. (And because resources are always limited, “good enough” really is good enough.)

And if you need help, your CRM coach can probably suggest some options you hadn't thought of.

So you can find the one best way for you.

All the best,
A.

Why I’m here

On this daily email list, you'll find me talking about a variety of things (like announcements about CiviCon 2025, coming in May).

But the core elements are these:

• Escaping the Overhead Myth

• Building relationships at scale

• Naming the value first, then the cost

• Mastering your tools and systems

• Frequent goal-setting and assessment for real growth

These are also the same major topics I work through with my coaching clients.

What’s more, they're the areas that I beleive are most lacking in small and mid-size nonprofits who are struggling to get meaningful results with their CRM systems.

If you're a subscriber to this list, I hope it’s helping you to improve in each of these areas.

That, in a nutshell, is why I'm here.

All the best,
A.

The Overhead Myth

Would you fault a single parent for making time to go back to college and get a degree?

Or a church for spending money on a new roof?

Of course not. Most of us understand these expenditures are valuable ways to keep things moving forward.

Unfortunately many non-profit leaders can't seem to justify the equivalent in their own work.

They feel significant pressure to minimize so-called overhead expenses, on the simplistic assumption that it would take precious resources away from their mission driven programs.

The irony, of course, is that organizations that don't invest in education staffing and infrastructure are at risk of starving the very programs they're trying to support.

That's why three major nonprofit ratings organizations got together a while back and issued a letter to address what they call the Overhead Myth.

"We write to correct a misconception,” they say. "The percent of charity expenses that go to administrative and fundraising costs—commonly referred to as “overhead”—is a poor measure of a charity’s performance."

They continue:

In fact, many charities should spend more on overhead. Overhead costs include important investments charities make to improve their work: investments in training, planning, evaluation, and internal systems—as well as their efforts to raise money so they can operate their programs. These expenses allow a charity to sustain itself (the way a family has to pay the electric bill) or to improve itself (the way a family might invest in college tuition).

What's the harm of the Overhead Myth?

The letter, backed by a number of academic sources, cites a laundry list of common underinvestments:

• Limited/no staff for administrative roles (e.g. finance, development, operations)

• Limited investment in staff training and development

• Inexperienced staff for administrative roles

• Poor IT infrastructure

• Poor donation management systems

• Poor performance management systems

... which lead to meaningful problems for the mission:

• Limited ability for organization to manage/monitor finance, development, etc.

• Increased turnover among staff, particularly those looking for ongoing professional development

• Difficulty building senior team from within

• Poor work quality

• System crashes, downtime

• Loss of data/information, limited information sharing

• Inability to track donors and fundraising progress

• Limited ability to target fundraising

• Limited ability to track beneficiary outcomes, particularly across sites

• Limited ability to easily generate reports for grantmakers

In short, overemphasis on cutting overhead leads to a cycle of starvation for the organization and its mission.

Here's the thing:

Most of us have felt the pressures of the Overhead Myth — from grantors, board members, donors or other stakeholders … or even from ourselves.

Naturally we want to be careful with the precious resources that are aloted to us.

But if an arbitrary aversion to “any expenditure” is preventing you from investing wisely in your long-term mission and organizational health, that can't be good.

I encourage you to read the letter for yourself, and consider how the overhead myth may be limiting your work, and then to foster conversations about mission priorities within your own team, with your board, and with your grantors and donors.

Because your primary concern as an organization is not your so called “overhead ratio,” but the difference you’re actually making in the lives of the people you care about.

All the best,
A.

“the contact has disappeared”

Ever have data just “go missing” for no apparent reason?

Here’s a question I got this week via email (shared with permission):

I am running a year end donation report and noticed that one of our donation contacts is no longer showing up in civi. It seems like it was there on a report that was run on 9/2/2024, but now the contact has completely disappeared out of civi along with all the donation history. The contact was entered as (OCF),Anonymous. Do you have any insight as to why this might have happened?

Thank you,
Fiona

It’s not a terribly uncommon question, so I thought I’d share my reply with you:

Hi Fiona,

Hard to say without taking a deeper look at your data (and even then, it may be hard to know with certainty), but here are some ideas:

• With a name like "(OCF),Anonymous", it seems possible that one of your staff may have deleted the contact. It may still be in the Trash, which you can search by using the "Search in Trash" option in Advanced Search.

• Or, It could be that one of your staff changed the name to something else, either intentionally or inadvertently. If you know some specific contribution date/time and amount, you may be able to find that contribution, and thus learn what contact it's attached to, by using the Find Contributions search.

• Finally, if all your searching proves fruitless, it would seem that someone deleted the contact completely (even out of the Trash), and it will be essentially impossible to find a record of who did that and when -- unless you happened to have CiviCRM's logging option enabled (which I don't think you do). This Logging feature does a good job of capturing every single change in the database, who made it, and when, although it requires some technical skill to be able to extract all of the necessary information for any given "who did that?" question. I wrote about it recently in my Daily Mailings list, in the post, “I didn’t edit that”.

By the way, this is not a terribly uncommon situation in any CRM, considering there are any number of staff who might be making changes at a given organization.

- A.

Looks like I wasn’t far off the mark. Fiona wrote back to say they’d found the contact in the Trash. A staff member had indeed deleted it, “as she thought they were malicious accounts because they did not have a contact email or address attached to them.”

With contacts restored now from the Trash, life is good, Fiona says.

What this means for you:

1. Training staff can be a gradual process. Proceeding with grace is as valuable as proceeding with care.

2. Sometimes contacts look surprising or “suspicious,” but it might be worth looking closely before deciding to delete them.

3. If “what happened to my data?” is a common question in your work — and you can’t seem to get answers — you might consider turning on CiviCRM’s logging features for a while, to get a better idea what’s happening.

All the best,
A.

CiviCon 2025: Registration is open

Is your CRM software at the top of your “Things I Love to Talk About” list?

I’m betting it’s not.

You want it to work when you need it, and otherwise it should just be there waiting for you.

Meanwhile, you’ve got more important things to consider:

• Building better relationships with your people.

• Making it easier for them to support your mission.

• Serving the needs of the folks you care about.

• Leading your team to set smart goals and work towards them effectively.

Of course, as it turns out, your CRM is a valuable tool to help you in all of those areas.

If it’s ever not working smoothly for you, you’re going to notice, because that limits you in the things that do matter.

That’s why I encourage you to make time to keep your CRM tools sharp. You can’t always focus on your tools, but their mastery is worth some investment.

Here’s a good opportunity to do that:

If you’re looking to up your CiviCRM game and make connections with like-minded folks, there’s nothing better than an in-person CiviCRM conference to make that happen.

Open registration has just been announced for CiviCon 2025, happening May 21-22 in Oakland, California (in the San Francisco Bay area). Besides the 2-day, 3-track conference, there will also be:

• Admin & User Training in the 2 days before the Conference (May 19-20)

• Developer Training in the 2 days after the Conference (May 23-24)

• Residential Working Retreat (“the Sprint”) for developers and documentation writers, in the 5 days after the Conference (May 23-27)

Participants can attend any or all of the segments listed above, but I think readers here will benefit most from the Admin & User Training (May 19-20) and the main CiviCon event (May 21-22).

You can read more at the announcement page on civicrm.org: Register now for CiviCon San Francisco 2025

I’ll definitely be there, and I hope you will too!

All the best,
A.

Missed some emails?

I learned today that many list members haven’t been receiving the emails for some time now.

In case that affected you, here’s a quick catch-up on what you might have missed:

• Identifying a goal

  Friend of the list Rose Lanigan wrote in with a great response (shared with permission) about setting goals and taking care of aspirations … [read more]

• Ready for anything

  Life is full of surprises, so it's important to be ready for anything. A word like “anything,” though, is incredibly broad. And there are any number of ways to “be ready.” … [read more]

• Snowplows?

  My little North Texas town got about seven inches of snow one day of last week. My county road crew, as far as I know, does not own a single snow plow. … [read more]

• Texas is not Minnesota

  Of course my local road department could get one of these to plow the snow. But is it worth it? …[read more]

• Spare keys

  Would you let me make 100 spare keys to your house and scatter them around your neighborhood? … [read more]

• Rookie mistakes

  The folks at CivAcademy have put together a great little video on their most frequently encountered CiviCRM rookie mistakes. … [read more]

• Easy vs hard?

  When you have several things on your to-do list, some of them will be harder than others. But “easy versus hard” is not the most important question here. The more useful question is … [read more]

• Forklifts are risky

  Driving a forklift is not especially hard. But just for laughs, head over to YouTube and search “forklift fail.” It’s warehouse mayhem and destruction. That’s why operators are given training … [read more]

• Email passwords matter

  Weak email passwords can punch a big hole in your security. … [read more]

• Slow news day: CiviCRM version 6, and Standalone CiviCRM

  In the next few months, you might start to hear more about a couple of developments in CiviCRM that sound like they might be a big deal … [read more]

Thanks to the folks who chimed in and let me know about the problem.

It’s resolved now, so everybody should be getting the emails they signed up for!

All the best,
A.

Slow news day: CiviCRM version 6, and Standalone CiviCRM

It’s a slow news day here at the CiviCRM desk.

In the next few months, you might start to hear more about a couple of developments in CiviCRM that sound like they might be a big deal:

• CiviCRM version 6.0

• CiviCRM Standalone

The short story is not quite as exciting (or risky) as one might think. If you’re fascinated by upgrade-related drama, you’ll be disappointed here.

So what’s up?

In March of this year, CiviCRM plans to relesae version 6.0, which sounds like it might be a major upgrade (with lots of potential for breaking things) from the long-standing 5.x series.

In truth, the upgrade from 5.x to 6.0 is expected to be as boring and uneventful as an upgrade from 5.81.0 to 5.81.1.

One thing that will change — which you still probably won’t even notice — is that as of CiviCRM 6.0, the project will officially support a Standalone installation.

That is, if you could install and CiviCRM without a content management system (e.g. Drupal, WordPress, etc.) if you wanted.

If that gets your attention because you’ve always wanted to do that, then this is great news of course.

For the rest of us, who are quite content running under Drupal or WordPress (or something similar), it’s a polite yawn.

So why am I telling you about it? Two reasons:

1. Maybe you are interested in a Standalone version of CiviCRM — or know someone who might be. In that case, this is a hint to keep your ear to the ground in March.

2. Maybe you’ll hear about Standalone and CiviCRM 6.0 from somebody else, and wonder what trouble it might mean for you. (After all, a “major version upgrade” sometimes means lots of headaches.) In that case, this is a word of assurance: this is no major version upgrade at all. Just a little rebranding, and barely even that.

We now return to your regularly scheduled programming.

All the best,
A.

Email passwords matter

Weak email passwords can punch a big hole in your security.

Ever forget your password for an important website? Maybe even for the WordPress or Drupal site that contains your CRM?

Fortunately, both WordPress and Drupal (and most of ther website platforms) offer a way to recover your password by email.

You just click the “Forgot my password” link, and it will send you an email with a special link you can use to set a new password.

Now you’re back in. Yay!

Can you see a potential security flaw in this design?

It’s this:

• If a slimy criminal can guess your email password, they can log in and read all your emails.

• If they want to get into your CRM, all they need is to click “Forgot my password”, then check your emails, and now they’ve got a link that will let them into your site.

Bada-bing, bada-boom.

Here’s the thing:

You are (hopefully) enforcing some password strength requirements for staff users on the website that contains your CRM.

But are you also insisting that your team members use strong passwords (or 2-factor authentication) on their email accounts?

All the best,
A.

P.S. This flaw is also one reason for the rising use of 2-factor authentication at the website level — something else you should probably also consider