I changed one setting and broke my own site. Without noticing

I am going to tell you two stories about breaking my own website. I caused both myself, within a few days, while trying to make it safer.

I am not writing them out of penance. I am writing them because in both cases the site opened perfectly normally. No red screen, no error message, nothing. And that is the real subject here, not the technical detail.

First time: the site was wearing somebody else’s clothes

I applied a security setting that is correct and that everybody who knows their trade applies. The setting went in, the site opened, everything worked.

Except the fonts. They had stopped loading, and every visitor was seeing the site in whatever font their own computer happened to have.

Now notice why I did not spot it. My own machine has the site’s fonts installed, because I built it. So to me it looked almost right. On a stranger’s machine it was a different site, a different tone, a different feel.

I opened it dozens of times that week. Nothing screamed.

Second time: the search that did absolutely nothing

The second one is worse, because it was not even hidden. It was in front of my eyes.

The site’s search had stopped working. Not returning the wrong results, not running slowly. Doing nothing.

The field was right there. You could type in it perfectly well. You pressed Enter. And the page stayed exactly as it was.

You will ask the obvious: did you not test it? I did. On my own computer, where it worked flawlessly. And here is the lesson worth more than the rest of this article: the developer’s computer is not your server. It has different settings and does not apply the same rules. A feature can pass every local test and be dead the moment it goes up.

Not everything breaks the same way

Let us separate these, because this is where the substance is.

When a site goes down, you find out. A customer calls, or you see it, or somebody shouts. Unpleasant, but it gets fixed within the hour.

But when the site opens normally and one part of it has stopped working, nobody finds out. The visitor who typed in the search and got nothing does not ring you to mention it. They think «I must be doing this wrong» or «what a terrible site», and they leave.

And nobody counts that person. In your statistics they look like a visit that did not buy. They do not appear anywhere as «tried and could not».

That is why a silent failure costs more than an outage. The outage lasts an hour. The silent one lasts until somebody stumbles on it.

The five things to check after every change

Let us get practical, because you need to know nothing technical to do this.

After any change to your site, and I mean any, an update, a new setting, a new tool, you open the site as a customer and test five things.

The search, with a word you know exists. The contact form, actually sending a message and waiting for it to arrive. The basket and the checkout, if you sell, up to the point just before payment. Downloading a file, if you offer a price list or instructions. And all of the above on a phone, because that is where half your visitors come from, if not more.

Notice what is not on the list: the home page. Everybody opens the home page and a problem there shows immediately. It is the other things that break, the ones customers use and you do not.

The eye that did not make the change

There is a rule here that we all pay for until we learn it: the person who made the change is the worst person to check it.

Not because they are careless. Because they know where to look, and they see what they expect to see. I was opening my site and seeing my site, in its own fonts, because that is how I knew it.

If you have somebody else in the business, let them walk through it. If you are on your own, put some distance in: sleep on it and check in the morning, over coffee, as though you were seeing it for the first time.

And one simple trick that always works. Show it to somebody with no connection to your business and say one sentence: «find me this». Within two minutes you will discover things you would never have seen yourself.

How you find out without going looking

That covers the moment of a change. What remains is the worse scenario: something breaks without you having changed a thing.

It happens, and often. A third-party tool updates itself and changes behaviour. A service your site relies on stops. A certificate expires on a Saturday night.

This is where monitoring comes in, and note what kind. Most tools tell you only whether the server answers. Useful, but it answers the wrong question. «The site is up» does not mean «the site works». In both stories above the site was up, and every such tool would have reported all clear.

What you want is something that tests the important journeys: does the search return results, does the form go through, does the checkout advance. That is not a luxury for large companies. It is the difference between finding out in an hour and finding out three weeks later from a customer who has since gone elsewhere.

So do not change anything, then?

Exactly the opposite, and I want to say it plainly because it is the easy wrong conclusion.

A site nobody touches is not safe, it is forgotten. It ages, it opens holes, it stops being true. If I hesitated to apply security settings because I walked into it twice, I would have a site that is less secure and just as prone to failures. The same applies to everything our article on website security covers.

Change is not the risk. The risk is a change without the ten minutes of checking that should follow it.

Twice, and both times my own doing

I started by saying I broke my site twice while trying to make it better. I would do both again, with one difference: I would have walked through it as a customer afterwards, instead of looking at it as its builder.

Because the real lesson was not technical. It was that a failure which does not scream is more dangerous than one that takes the site down. The failure that takes the site down, you learn about in ten minutes. The silent one looks you in the eye and tells you everything is fine.

If you change things on your site and are not sure what has quietly stopped working, we take that on: we carry out the updates and changes and then check the site as customers rather than as builders. In our maintenance and support plans, stepping in when something breaks is a contractual obligation. Send us through the form your site address and anything that has looked odd lately.

The whole picture: this article covers one part of a larger subject. If you are after the whole of it, from beginning to end, it is in the guide to security and legal on your website.