Security: change your WordPress login URL

Several of my clients have reported a recent spike in WordPress brute-force password-guessing attacks.

Is this a worldwide increase, or just something we happen to have noticed?

It doesn’t really matter.

There's a good chance that sooner or later somebody is going to start hammering your site with millions of attempts to guess your admin passwords — which leads to two problems:

1. If they get in, you're compromised. That's a problem nobody wants.

2. If they fail, they’re still slowing down your website by using up server resources.

One simple step helps prevent both problems:

Change your WordPress login URL.

It's pretty easy to do and will eliminate all but the most determined of these attacks.

There are multiple free WordPress plugins that can do this for you.

You just need to install and configure the plugin (or have your outside specialist take care of it for you), and then tell your staff about the change, so they can still log in.

You don't have to do it.

But it's not very hard, and it's a big upgrade in your security.

So I strongly recommend it.

All the best,
A.

“You are entirely a star child!”

Behold currently! You are entirely a star child!
Begin your power! Go! Laugh!
Behold currently! You are a master of the music!
Begin your singing! Acquire your wages!

That’s a selection from a longer poetic work. Some might find it inspiring, or just cornball.

Actually, it’s Smash Mouth’s Shrek-famous 1999 hit All Star, translated by this linguist from English to Aramaic, then back to English.

Here’s the original, just in case you want it stuck in your head all day:

Hey now, you're an all star
Get your game on, go play
Hey now, you're a rock star
Get the show on, get paid

Same message, different expression. Probably appeals to a different audience.

So:

What’s the best way to express a message?

Depends on who you’re trying to reach.

All the best,
A.

How I publish daily emails with CivCRM

This daily mailing list is sent through CiviCRM, with archives available on a completely separate website. Here's how I do it:

Two sites:

I use Squarespace for my main website at joineryhq.com.

I also use CiviCRM to handle coaching subscriptions, invoice payments, and more — and to manage this daily mailing list and email courses like my Mastering CiviCRM Crash Course.

Mailing list archives:

I call this an archive, but technically it's not. It’s just a Squarespace blog. Emails like this one get published first as a post in that blog, and then each article is sent as a daily mailing.

The tech stack (how it really works):

1. I write today's email as a post in my Squarespace blog.

2. Squarespace automatically publishes an RSS feed of those blog posts.

3. My CiviCRM site uses the NewsStore extension to pull items from that RSS feed and queue them up as a CiviCRM mass mailing to everyone in my Daily Mailings group.

4. Within a few minutes after I post to Squarespace, list members receive the daily email.

One extra custom piece:

I do have a small CiviCRM custom extension that adds formatting, ensures I don't accidentally send multiple emails per day, and appends the email footer.

Why I went this way:

At first, I planned to compose mailings in CiviCRM, and have some third-party service monitor the list and maintain an archive of sent emails.

But I couldn't find an easy way to make that work with Squarespace.

So I turned it around backwards. I post to Squarespace first; then the NewsStore extension takes it from there.

What this gets me:

This approach is perfect for my workflow:

• I only have to publish the email once. Then it's automatically delivered and available in the archive.

• I have all the usual tools in CiviCRM for open and click tracking, user unsubscribes, and the rest.

• Subscriber information is right there in my CRM, so I still have a centralized view of every person’s interraction with my work.

In short, I get the ability to help my people efficiently at scale, and to assess where each person is in their journey with me, so I can effectively help them to make the next step in that journey.

And isn't that what we all want from our CRM?

All the best,
A.

5 ways to CRM

“CRM” is just shorthand for “keeping track of your people, at scale”. And there's more than one way to skin that cat.

---

You've got a mission. And you've got people. Some of those people help you carry out the mission, others benefit from it directly. Some do both.

The best way to keep track of those relationships will vary, depending on your goals, resources, and limitations.

I talk about CiviCRM a lot on this list, but not all my clients use it. Let's examine some options:

Spreadsheets:

Starting with spreadsheets is easy: create a few columns, and start adding rows.

This can work fine in the beginning, especially if there's only a handful of people who need to work with the data, and they don't need much complexity in the tracking.

But as your work grows, it can quickly become very hard to manage.

• Should all of your staff have access to view and edit all the data?

• Are you just tracking a name and a single email address for each contact? What about the history of event participation, donations, multiple addresses and phone numbers, relationships between contacts, and more?

• How will you record all the ways each contact has interacted with your organization, and identify the important next steps for each of them?

You can see that this is the easiest method to start, and one of the hardest to maintain long-term.

Multiple outside services:

Spreadsheets don't provide any features for your contacts to take action on their own.

So you might spin up one or more specific services to provide those features:

Eventbrite for event registration.
MailChimp for mailing list management.
A quick PayPal page for donations.
Google Forms or SurveyMonkey for surveys, volunteer sign-ups, and more.

This approach gives you a fairly cost-effective way to get those features. And the data in each of those systems is in some kind of a structured format, so you could export it to Excel or use the service’s own reporting tools to examine the data.

But it's still hard to get a complete view of any one person's history with your organization.

• Which long-time mailing list readers recently donated for the first time?

• Which regular volunteers haven't come to a training recently?

• Who has attended all your events, but hasn’t yet subscribed to your mailing list?

With your contact data spread out across five different systems, these questions are very hard to answer.

CRM-as-a-service:

There's no shortage of online services who will charge you a small monthly fee to serve as the centralized data store for all your contacts.

Most of them are designed for business and sales, but the nonprofit space has plenty of options: CiviCRM Spark (and other CiviCRM-as-a-service providers), Neon One, NationBuilder, and many more.

These will give you many of the online features you would have gotten from your “multiple outside services,” nicely integrated into a single platform for holistic reporting and analysis.

Not bad, and you might stop there. Unless you need features they don't offer. Then you need something customizable.

Salesforce:

Yep, I'll give this product its own category. It has a lot going for it:

• It's incredibly customizable.

• It has thousands of available plugins, apps, and integrations.

• ... plus literally thousands of firms you could hire to build out something with it.

• It has a massive marketing machine; almost everyone you know has already heard of it.

It also has two major limitations:

1. Out of the box, it's fairly limited: you get basic CRM features for your staff, and not much more. You'll need paid plugins or custom development if you want:

public facing donation and sign up forms …
targeted features such as for memberships and events …
mailing list management …

… basically, most of the community-organization features you would get from your CRM-as-a-service or even from your “multiple outside services” approach.

2. It has a reputation for being very expensive, both in development cost and in per-user license fees.

So, for an organization with a very large annual budget, a solid business case for custom features, and an aversion to trying anything they haven't already heard of, it can make sense.

Managing your own CiviCRM instance:

Obviously this is the space I work in most. It's not the right choice for many organizations, who will prefer one of the options above.

But it has some pretty compelling benefits:

• Solid out-of-the-box features for membership management, online contributions, mailing lists, events, case management, and more.

• Literally unlimited customizability, within the bounds of your budget and/or development skills.

• Zero licensing fees.

• An active and sizable (if not 800-pound-gorilla status) community of developers and service providers.

• Gives you complete control of the ownership and privacy of your constituent data.

None of the above options offer all that — and I don’t know any other offering that does.

Of course, this approach also means it’s your system, for better or worse. “Unlimited customizability” does not mean “never needs extra effort or expense.” You’ll eventually want some help from someone with more technical skills than you.

Here's the thing:

None of the above choices are the right answer for every organization. Smart organizations will make an informed decision based on their own needs, goals, and resources.

But more important is this:

In the end, having the fanciest — or simplest, or cheapest, or most well-known — CRM toolset won’t define your success as an organization.

Whether you're running things in six different spreadsheets copied across 15 different laptops, or you're paying $100,000 a year for a system that's the envy of all your ex-bosses, what matters is this:

How are you leveraging that system to build effective relationships … with the people you care about … and the people who want to help you?

All the best,
A.

Tool talk: CiviCRM upgrades

CiviCRM released a security update last week. Here are a few issues I've helped my clients address after upgrading:

• Server memory:
  In some cases this newer version of CiviCRM may require more memory resources than your previous version. You may want to check your server logs for out-of-memory errors, and then adjust your memory limitations accordingly.

• Custom extensions incompatible with CiviCRM:
  This one came up on several sites this past week. Well-maintained and publicly distributed extensions probably don't struggle with this, but if you have custom extensions, you might find that they're causing errors because of changes in the parts of CiviCRM they’re interracting with. This is hard to anticipate before the fact, but when it happens, there should be a notice in your server logs or CiviCRM logs.

• Custom extensions incompatible with PHP 8:
  The newest versions of CiviCRM require PHP 8. If you've upgraded PHP to meet that requirement, you might find that some extensions occasionally cause errors. These are errors that even a thorough syntax check won't prevent, so again, you may want to check your server or CiviCRM logs for clues.

If you have a trusted CiviCRM partner or other outside expert maintaining your site, you can probably let them handle this.

But if you're hosting and maintaining it yourself, these are probably worth watching out for.

All the best,
A.

The leaky boat

Almost every boat leaks a little bit somewhere. Usually you pump or bail, and sail on. But when you're leaking faster than you can bail, you've got trouble.

---

I just finished a meeting with a board member at a service organization here in Texas, who feels they have something of a leak in their boat:

Their donors are aging.

Of course everyone's donors are aging. But he's concerned that this hole is leaking faster than they've been keeping up.

He figures, if they don't address this, they have maybe 5 years before things start to get tight. It would probably look something like this:

Donations start to trail off.
Staff begin to feel the pressure.
Morale decreases.
Staffing and program cuts must be made.
The remaining donors begin to wonder if their contribution is well placed.

It's a downward spiral.

The time to start patching this leak has already begun.

That means appealing to a younger crowd of donors. And that works out to changes in three important areas:

1. Messaging

Younger donors typically have a different set of motivations and personal values than this organization’s current older audience. So while they may be very well in tune with the thoughts and feelings of their current donor base, a targeted effort is required to understand the language, images, and emotional cues that will appeal to a younger crowd.

2. Mechanisms

Paper checks, snail-mail letters, and everything else that goes through the postal system probably works great for their over-65 audience. But it's all but useless for the younger audience they need to target.

3. Media

Television and radio PSAs have been a large part of their outreach effort. This channel is, frankly, fading fast. New channels must be explored, and there is no single medium or channel that dominates public information. They'll need to experiment, monitor, and shape their plan as they go.

Here's the thing:

It seems to me this organization has a chance to make the changes they'll need to make. They've got board members who are forward-thinking and goal-oriented.

Of course, an aging donor base may not be the leak in your boat. And though you surely have a few leaks, they may not be severe enough to warrant immediate action.

But when they are, focused effort is surely required.

Maybe you can bail faster. Maybe you can repair the leak.

But when that's your situation, you don't want to use all your effort, er … rearranging deck chairs.

All the best,
A.

Getting their viewpoint

Getting your constituents’ perspective on your next big campaign — or just to refine your ongoing outreach efforts — is hugely valuable.

But it probably shouldn't become a major project in itself.

Here's a common approach, but it has significant drawbacks:

• Set up an online survey with 20 multiple choice questions like, "What's the most important issue for you?” and “How likely are you to give again to our work?"

• Email-blast everybody who's given you a donation in the past year, asking them to complete the survey.

• Wait several weeks to get as many answers as you can.

• Collect the answers into a series of bar charts for your board to review.

That approach has some important limitations:

• It constitutes another ask from a big portion of your potential donors.

• It doesn't give the respondents an opportunity to speak freely.

• It takes a long time to get results that are fairly generic.

Here's an approach I think is significantly better:

• Identify 5 to 10 individuals whom you think could be of a stage of life, demographic, or mindset similar to the people you'll be reaching out to.

• Arrange a short one-on-one phone call with these folks, in which you’ll ask them open-ended questions to tease out their hopes, concerns, and motivations.

• Do your very best to record their exact words — either by fully disclosed audio recording or by taking copious notes.

• Then review your conversations. Look for patterns in meaning. Look for poignant expressions of emotional weight.

• Treat this as a decent snapshot of your audience, and use it to inform your communications, your programs, and your overall outreach.

Here's the difference:

It can certainly feel "safe" to try and collect dozens or hundreds of organized responses to a consistent survey instrument.

That's great for clinical research and peer reviewed studies.

But that's not what you are doing here.

You're just trying to step out of your own viewpoint and into the mind of the people you're reaching out to.

And you don't want that — valuable as it is — to put a significant and needless delay in your actual outreach.

Simple, and personal, is likely to be much better for you.

From my own experience, I would much rather have five simple interviews with the latter method than 100 survey responses from the former method.

Real people. Real conversations. Real insight. Simple.

All the best,
A.

Whose perspective?

If you were designing a new membership program, what would be the best source of information and ideas to shape your plans?

A. Trying really hard to think of something yourself?
B. Brainstorming with your board?
C. Asking open-ended questions of the people for whom the membership is intended?

It might be obvious that the best answer is “C”.

But then again, maybe it's not so obvious.

I've seen more than a few failed or stalling membership programs that are simply not appealing to the potential members, because they weren't designed from their perspective.

Here's the thing:

There are many reasons why your fundraising campaign, advocacy push, or membership drive could fail to meet its targets.

Low staff commitment, ineffective marketing and communications, unrealistic goals.

Those are real problems.

But solving them won't matter a bit, if what you're actually offering is not actually interesting to the people you're targeting.

If you can build your plan around actual conversations with some of those people, that’s best. But in any case, do what you can to see it from their perpective.

Otherwise, how would you expect to motivate them at all?

All the best,
A.

Regular maintenance

Imagine that your home’s air conditioning system just gave up the ghost in the middle of August — and you learn that fixing it requires you to have your house rewired to accommodate the replacement.

Sure, you don't think very often about your home's wiring, or all the other systems that live in your walls and attic. But keeping them up to date is a matter of smart ongoing maintenance.

As it happens, I'm now dealing with several site owners who find themselves in a similar situation:

Now that CiviCRM has announced a security update that will require PHP 8, I and other CiviCRM specialist I know are dealing with a number of sites that need a surprising amount of catch-up work.

The owners of these sites are the unwitting victims of deferred maintenance:

• CiviCRM extensions, CMS plugins and modules, and even the CMS itself, that have not been actively upgraded for quite some time.

• Confusing and non-standard file structures that need significant effort to untangle, to be sure the site will function properly under the new technical requirements.

And it all needs to be cleaned up — right now.

For the site owners, it can feel like a lot of hassle and expense, all at once.

But here's the thing:

They could have avoided it by ensuring someone was responsible for the regular ongoing maintenance of their site.

It could have been an internal team member, or an outside expert. But it would have been someone.

Of course, that comes with some expense, whether in staff time or in outside support fees.

But it would have ensured things were running smoothly day-to-day, month-to-month.

And they wouldn't be dealing with the surprise and stress they're getting now.

It's worth thinking about:

Who's responsible for keeping your CRM well maintained?

If you're not sure, you may be in for some unhappy surprises when the deferred maintenance gremlins start to crawl out of the woodwork — and eventually, they will.

All the best,
A.

Engagement

Engagement.

What a great concept.

It's how we feel when we're switched on. Bought in. Invested. Involved. Belonging. Proud.

You can try to measure it with clicks and registrations and donations and social media shares.

But those are all mere proxies.

What does it take to make your people feel that way?

A clear purpose. A valuable relationship. A welcoming culture. A message worth sharing.

It's fine to measure, but don't get lost in the metrics.

Because people who feel switched on, bought in, proud of your work — those are the people who stick around.

All the best,
A.

What “matters”

Would it matter to you if there were a lack of clean drinking water ...

... on the moon?
... in the Sahara desert?
... in a flood-ravaged village in Nicaragua?
... in a town near you?
... in your friend's neighborhood?
... in your own house?

For any of those, the answer is:

Only if you or people you cared about were trying to live there for more than a few hours.

Otherwise, you have more important things to think about.

Here's the thing:

Your mission is important. And that's obvious to you.

But to anyone else — to all the people whose help you need in carrying out that mission — it's only important if they feel it matters for them or someone to care about.

If that happens to be true, and you can help them to see it clearly, they will at least consider helping you.

As for those for whom it's not true, there's little point trying to convince them.

But even where it is true, it's up to you to connect the dots for them.

Because it's probably not as obvious to them as it is to you.

All the best,
A.

Reasons not to create a CRM strategy

Not everyone spends the time and effort to formulate a clear CRM strategy.

Of course there are reasons to avoid it:

• It's hard to prioritize strategy when you feel like you're already just fighting fires day-to-day.

• It seems a vague notion.

• It's unfamiliar.

• It's not sexy.

• It's not talked about much in the CiviCRM community.

• It doesn't have a quick payoff.

• It's another list of things to get done.

• It's not a sure bet.

• It requires buy-in from key stakeholders, so any strategy you design runs the risk of just sitting on someone's desk.

• The status quo is not so bad. Things are fine, right now.

• It's a commitment.

• It defines measures of success — so it also defines measures of failure.

All of those, and more.

And it's understandable. After all, we probably all have opportunities in our lives that we're avoiding for one reason or another.

But sometimes …
eventually …
you get the feeling …
that the status quo is not good enough.
That you're just treading water.
That there are real opportunities to make an impact.
That it would actually be enjoyable and thrilling to go after them.

When you start to feel that, it's time to start asking what your real goals are, and how to make a plan to achieve them.

That's what a CRM strategy is about.

All the best,
A.

Your CiviCRM site needs PHP 8. Now.

Are you running CiviCRM? Are you sure it's running on PHP 8? It will suddenly matter in just a few days.

---

The CiviCRM project has announced an upcoming security update, to be released next week.

So be prepared to update.

But there's a catch. Since around March of this year, all new CiviCRM versions have required PHP 8.

That means, as of next week, the only way to get the latest available security updates for CiviCRM is to be sure your site is running on PHP 8.

I've mentioned this before on this list (see "Get ready now: Why PHP versions matter” from back in April).

So maybe you've got it all sorted out by now.

But if you’re not sure, please read that email, and talk to someone who can help you.

It used to be a "someday this could be a problem" kind of thing.

Now it's a "next week it will be a problem" thing.

Please don't wait.

All the best,
A.

OBBBA: Tax deductibility and you

You've probably heard a lot about how the One Big Beautiful Bill Act will impact charitable giving.

Of course, the thing is obviously Big (leaving "Beautiful" for separate debate) — so big that all of its effects may be very hard to predict.

But a couple of things seem pretty clear:

• For small donors: The charitable giving deduction for non-itemizing taxpayers is an incentive for individual giving.
  
  It's not that people haven't been giving to support things they care about. GoFundMe and other providers of small-scale fundraising have been very popular, regardless of any consideration of tax deduction. This change in deductibility doesn't make folks more likely to give, but it may make them more likely to give to recognized charities.

• For large donors: The 35% cap on charitable deductions for those in the top tax bracket reduces the incentive for some of the end-of-year giving you might be used to.

  Large end-of-year donations are often made not merely because deep personal alignment with the cause, but because a financial advisor suggested, "You might want to off-load $500,000 to charity this year." Of course you thank the donor sincerely, but did you assume too much about their love for your cause? If so, you might be surprised by how this change impacts their giving next year.

What this probably means for you:

1. It's time to re-engage small donors.

Do they know about this rule change? It's not huge, but it's a genuine benefit to them. Why not work this into your year-end appeal or annual campaign? A $1000 gift is now a "tax-smart giving level," which will be enough to encourage some donors to stretch above their previous giving.

2. Donors should be told their gift is now tax-deductible.

It's worth mentioning specifically — in your receipts, email confirmations, and other follow-up messaging — that even their small gift is now tax-deductible whether they itemize or not. Why not give them another reason to be glad they helped you?

3. End-of-year giving summaries have more value now.

An end-of-year giving summary, sent by email from your CRM, has always been a great opportunity to say "Thank you" once again, and remind donors how much their gifts have helped a cause they care about. With this change in non-itemizing deductibility, the end-of-year summary is also a genuine convenience for your donors. A reminder of your work, that's also helpful to the donor? It's a win-win.

4. Major gift cultivation is critical.

The 35% cap means fewer large donations will be made merely for tax-incentive reasons. That means if you still want to capture these donors' attention, it's all about relationship-building and shared motivations. Last year's list of large donors needs to feel strongly assured that your work matters to them, and that their support matters to you.

Here's the thing:

The landscape is always changing. Sometimes you might wish it wouldn't, because every time it changes, you have to keep up — or fall behind.

But then again, you're not the only one trying to keep up. So are your donors and prospective donors.

When things change, they'll be thinking again about where to give. Which means they may be ready consider you, where they would not have before.

You can be ready to help them act on that. And that's where the change in landscape becomes an opportunity, not merely a challenge.

All the best,
A.

Any race car you want

Imagine you were planning to drive in a race next year, and you had an unlimited budget to build or buy any race car you wanted.

What car would it be?

Think about that for a second. I'll wait.

...

...

...

Okay got it?

I hope not.

Because I haven't told you anything about the race itself.

No matter how much time, money, and expertise you have, there's no way to answer this question intelligently if you don't know whether you're preparing for the Indy 500, the Baja 1000, or the 24 Hours of Lemons.

Now compare this to your CRM software:

You can have the fanciest, fastest, most feature-filled CRM software in the world …

… but what's the value in that, if you’re not very clear on what you're trying to achieve?

Here's the thing:

Strategy matters. And clarifying your goals and limitations is a critical part of sound strategic planning.

There's no point investing in an amazing race car, if you don't know what race you're trying to win.

All the best,
A.

The newsletter with purpose

So let's say you have a clear strategy for your newsletter and aren't merely doing it "just because."

How can you make it perform well?

Here are a few thoughts based on my own experiences and those of my clients:

1. Define success.

Assuming it's part of a clear strategy, you should know why you're doing it and what you hope to get out of it.

My own daily mailing list aims to help my readers gain mastery of their CRM systems and strategy. And let’s be honest, it also aims to position me as an authority in that space.

In line with that, I have specific goals that I'm trying to achieve, in terms of subscriber count, engagement, and starting new conversations.

2. Ensure the content is valuable to your readers.

The Child and Family Guidance Center in north Texas, where I serve on the board, does a great job of this. See my previous email on this topic here: “Content that helps”

3. Find and acquire the subscribers you're missing.

Last week I met with the executive director of a regional symphony orchestra.

Patrons who buy their tickets online have a chance to provide their email address and sign up for the mailing list. But he realizes that people who buy tickets at the door are being left out. I'll be working with them on an incentive program to help sign these people up, too.

4. Make subscribing easy.

The same symphony orchestra, like a few other organizations I've seen, have a sign up form on their website, but it's broken.

When I pointed that out, I learned that for some time now the only new subscribers they've gotten through the site have been people who took the time to ask via their Contact Us page.

Getting this fixed is sure to increase their subscriber count.

5. Track the metrics that matter.

Recent changes in email privacy features have made it harder to get meaningful measurements of open rates and click-through rates. Still, there are ways around that.

But more important: you may not even care so much whether people are opening the emails. You might rather be interested in more meaningful engagement from your mailing list:

Are people hitting reply to ask questions or start conversations? Are they signing up for events or memberships?

In short, are they taking the next steps that you want them to take in their journey with you?

Here's the thing:

A newsletter or mailing list without a purpose is one without real value, at best. (And worse, may even diminish your reputation as an organization.)

Consider its purpose for existing.
Set goals that help fulfill that purpose.
And find the changes you can make in order to reach those goals.

Because a newsletter with a strategic purpose is a valuable asset — to your mission, to your organization, and to your people.

All the best,
A.

“We have a newsletter” is not a strategy

Is your organization sending a monthly email newsletter?

Do you have evidence that it's actually helping your mission?

If not, you might be making a common mistake: assuming that "maintaining a newsletter" is equivalent to "having a strategy for engagement."

You'd be in good company. Many organizations are in a situation like this:

• Their newsletter content is centered around the organization itself.

• They can't name the specific outcomes they want to achieve through the newsletter.

• They're not monitoring the effectiveness of the newsletter in achieving those outcomes.

In short, their newsletter is a tactic without a strategy.

Of course, some organizations use their newsletter as a great tactic in support of a strategy. That usually looks like this:

• Its content is meaningful and valuable to the reader (instead of yet another installment of "News About Us").

• Its purpose and desired mission outcomes are clearly understood by the staff who manage it.

• Those staff are actively monitoring subscription numbers, opens, clicks, and other metrics to gauge its effectiveness against those outcomes.

Here's the thing:

Your organization is probably closer to one of the above scenarios.

The former is a recipe for a lot of work without meaningful results.

The latter is part of an effective overall strategy for helping your people achieve important next steps in their journey with you.

Which do you prefer?

All the best,
A.

More lessons on security

A couple of additional take-aways from that "$4000 billing nightmare" I mentioned on Wednesday:

1. Sloppy homegrown backups have a way of leaving sensitive files lying around where bad actors can get their hands on them. I see more often than you might expect. 

2. Direct leakage of your website passwords or constituent data is not the only way your organization can be harmed by a lapse in security.

3. You don't have to be a big organization or a “major target” to be the victim of this kind of automated attack. These criminals operate at scale and often just go about scanning any site they find.

And on the bright side: 

1. There are additional layers of security available to you. SendGrid, for example, allows you to lock down your account so it's only accessible from one or a few IP addresses. That kind of protection would have stopped this attack in its tracks.

2. It's always worth trying to negotiate a surprise bill like this one. Some providers do hire human beings with common sense, and empower them to operate with a margin of grace for the occasional slip. Kudos to this provider (SendGrid) for helping my client resolve the problem without budget-breaking damage.

All the best,
A.

Service billing nightmare: a cautionary tale

It was supposed to be $20/month. But this month it was over $4000. What happened?!

---

Just recently I helped a client deal with this service billing horror. I think it highlights an important lesson for all of us.

It goes like this:

Client has a subscription to an outside service that's priced at around $20/month.

All's well for a few couple of years.

But one day Client gets an invoice from this service for over $4000 in charges — for a single month!

It doesn't even seem possible — but it is.

The service was a reputable outbound email provider (like SendGrid, SparkPost, or whomever you're using to handle outbound email sent from your live site).

There was no shady practice going on — not by Client, and not by the service provider.

But somebody was being very shady.

Somebody got their hands on Client's private API key for this service.

Somebody used that API key to send millions of spammy emails through Client's account, within just a couple of days.

And the billing nightmare?

Well, Client's service plan was priced so that they were indeed charged just $20/month to send up to X thousand emails — and then for any additional email messages over that limit, they'd be billed just a fraction of a cent each.

They'd never actually exceeded that "X thousand" emails limit. So they happily paid the $20 each month.

But once the baddies went to town on their dime, the "faction of a cent each" charges added up very quickly.

The result?

• Client is on the hook for over $4000 in usage fees.

• Client must deal with the damage to their domain's email sender reputation — since their account just launched millions of "This one bedroom trick changed my life" emails (and worse).

• Client can't send any outbound emails from their live site at all — because the outbound email service has suspended Client's account for malicious activity.

So: how did the bad guys get that API key?

It turns out, Client was running a clunky home-grown backup system on their live site, which resulted in all site files (including one containing the API key) being downloadable by anyone on the internet.

Once the spammers managed to stumble across that file (likely through a bot that simply downloads everything it can find, across as many websites as it can crawl through), they had everything they needed to a) make the Client miserable and b) spam the good people of the world with annoying sales emails.

Here's the lesson:

Well, there are many. I may try to get into those more in a separate email.

But for now, the lesson is this:

Be aware of where and how you store your account credentials. And that's not just passwords for your website. Email passwords and third-party service API keys are part of the picture too.

In the end:

We were able to communicate with this email provider, and — with a lot of convincing — they agreed to waive the overage fees (so $4000 in billables literally just went away) and to reinstate Client's ability to send emails again.

Any damage to their email sender reputation was already done and beyond anyone's control, but even that began to fade away quickly once we got things locked down again.

So they were lucky. In the end, they got off light.

But of course, luck is not a plan.

Be careful out there, folks.

All the best,
A.

“CRM Strategy Sessions update”

Today I sent out an update to the folks who’ve registered for the CRM Strategy Sessions. Below is what I told them.

BTW, if you’ve been meaning to grab a spot, I do have one left. Please shoot me an email to reserve, if you’re ready to think carefully about your CRM strategy.

Hi!

As promised, I'm writing here with some details about your CRM Strategy Session: what to expect, how to prepare, and how to schedule.

How to reserve a time:

(This is the next step for you, so do this now if you can. But please read the rest of this email so you're prepared to get the most out of our time together.)

Scheduling your call is super easy:
1. Visit my Coaching Calendar (https://joineryhq.com/coaching-calendar) and find a "Coaching available" slot that works for you.
2. Hit "reply" on this email to tell me the date and time you've selected.
3. Watch for an email response from me with connection details for our scheduled call.

That's it! Do it now if you can, and come back to read the important info below.

What this is all about:

Community-driven organizations rely on a diverse collection of relationships to achieve their goals. At some point, they grasp the idea that tracking these relationships in a CRM system would have some benefit.

Unfortunately, managing contact records in a software system is not the same thing as building real relationships with real people.

In the CRM Strategy Sessions,  I want to help you get past all the technical jargon and "feature focus" of working in your CRM software, and instead drill down to the real reason you started using it in the first place: building valuable relationships at scale.

What we'll be doing in your CRM Strategy Session call:

First, here's something we won't be doing: clicking through your CRM to discuss features. The CRM Strategy Sessions are about your relationships with your people, not about software.

So on this call, we'll be discussing these topics, in order to help you focus on the outcomes that matter:

1. Who are your people?
2. What do they want?
3. What do you hope for in your relationship to them?
4. How can you nurture those relationships -- at scale -- to achieve those outcomes?
5. What are the immediate next steps, and interim goals, that you can aim for?

Outcomes worth aiming for:

The ideal outcome for your session will be an actionable strategy that's tailored to your goals, limitations, and audience. It's worth noting that, as with any strategic plan, the value comes in the implementation. And that implementation will be yours to do.

Depending on where you're starting from, your first steps in implementation may actually consist of research or internal team dialog. Or, you might already be at a stage where you can begin shaping your interactions with your audience(s).

Either way, be prepared: The intended outcome here is a workable strategy. And that strategy will require someone (surely yourself) to implement it.

Preparing for your CRM Strategy Session:

To get the most out of our time together, I recommend you take some time to prepare. Look through your CRM records; consider your own knowledge of your organization, and your experience so far. And let your mind wander broadly as you consider:

1. Who are your people?

Hint: They're probably not just donors. Are they also: Staff members? Board members? Successors to your own job? Service recipients? Service providers? Sponsors? Vendors? Legislators? Students? Community advocates? Potential (or dormant) contacts in any of those areas? Anyone, in area, may be "your people."

Consider as many categories as you can, and why you believe they're important to your work.

2. What do they want?

People are complicated. Their decisions are virtually never based on any single factor. They have complex motivations and desires.

Put yourself in their shoes. Consider their day-to-day motivations, hopes, and fears. Family, career, health, sense of belonging, curiosity, responsibility, obligation, sense of purpose and fulfillment ... all these things and more shape their decisions every day.

Remember, you're trying to do this from their viewpoint -- you're not looking to force a connection between them and your work. You might eventually find a natural connection, but that comes later. First, start by striving to understand them, as much as you can, through their own eyes.

3. What do you hope for in your relationship to them?

Why are you thinking of these people at all? If you could push a magic button and achieve the relationship with them that you want, what would that relationship look like -- and what would be the result of it?

4. How can you nurture those relationships -- at scale -- to achieve those outcomes?

(You'll notice these questions are getting progressively harder to conceptualize. That's okay. It's simply because each one is farther in the future from where you are now.)

Here's where the ideas start to shape themselves into a plan. This is where your abilities, creativity, and resources begin to intersect with the desires and interests of your people.

But don't get too specific just yet. Don't worry whether you'll have the funding, technical skill, or time to make things happen. Again, imagine you could push a magic button that would allow you to take action, and ask:

What actions could you take to begin building the relationships you want with these people?

If you happen to think of actions that would impact many people at once ("at scale"), that's great. But even if it would mean only reaching one individual at a time ... what actions would help to nurture that relationship in the direction you want?

So, that's the prep work.

I admit, that's a lot of preparation. If you can't get clear on all of it, that's fine. But at least start with #1 ("Who are your people?") and see how far you can get. We'll work through the rest of it -- as far as we can -- together on the call.

"Do I need a web cam for the meeting?"
We won't be screen-sharing on this call, because it's not about your website or your CRM system. So if you have a webcam, seeing each other's faces in real time can certainly help. But if you don't have one (or just don't want to use it), voice-only is fine.

"Will there be a report or written plan after the meeting?"
That's up to you. I won't be creating it, because it will be your plan. I encourage you to take notes throughout the call, and to schedule time afterward (or at least the following day) to go through those notes and actually write up a plan. If you'd like me to record the call, please ask at the beginning, and I'll happily share that recording with you afterward.

"Will there be any follow-up after this one call?"
I would actually love to follow up with you. If you're open to it, I'd like to meet with you again after one month, and then once more after two more months, to help keep you on track, tweak the plan where necessary, and hear about your progress.

"Will you be offering your services to help implement my strategy?"
No. You can always ask me for help if you want, but I will not be suggesting any billable services as a result of this call. (FWIW, this is hard for me. I have a habit of wanting to help, then suggesting solutions, then realizing it would be billable, and then, well, you know. Please forgive me if I have to catch myself mid-sentence on something like this.)


Your next steps right now:

Please hit reply and ask any questions you might have. I'll be glad to answer as quickly as I can.

But first chance you get, please scroll back to the top of this email and follow the steps to schedule your call.  You may feel like you're embarking on a big journey here -- at least I hope you do! -- but any journey begins with the first step. And scheduling your call is your first next step right now.

I look forward to hearing from you!

All the best,
A.