ScriptShark, a New York Times company, is a site for screenwriters who need professional analysis of their work.

The site was developed by Brilliant2, a professional Magento Partner, using ExpressionEngine and Magento.

It is the first of four sites for The New York Times to be developed by Brilliant2 and released using Magento.

Check out the rest of ScriptShark’s website…

Magento Showcase is a place where we display stores we host that have done something interesting with Magento, like a pleasing design, unique integration, large product catalog, or anything else that makes it special and interesting.

Just like the products they sell, the Mia & Maggie website is modern and sleek. They offer a wide variety of products for you and your dog that are natural, eco- and pet-friendly.

I have a Pomeranian puppy named Kali, so I bought her some natural puppy shampoo and a few other things, which is great since it has no harmful chemicals. Here she is after a bath:

So if you’re a dog lover, definitely head on over to their site and check out the great selection of products they have, you’re bound to find something for man’s (or woman’s) best friend.

Check out the rest of Mia & Maggie’s website…

Magento Showcase is a place where we display stores we host that have done something interesting with Magento, like a pleasing design, unique integration, large product catalog, or anything else that makes it special and interesting.

One of the really cool things about specializing in Magento hosting is being able to see stores that you’d otherwise never know about.

Crumbs Bake Shop is one of those stores, especially if you have a sweet tooth.

They have stores in California and throughout the Northeast, so if you live in the area, be sure to check them out if you haven’t already.

Thankfully, the rest of us can order their humongous cupcakes and other baked goods through their website…you know we did!

While reviewing the site, we were too distracted by the tasty looking pictures to get any work done, so we ended up ordering a variety pack of their Signature Cupcakes.

After thirty or so minutes (no joke) of dragging and dropping cupcakes in and out of the muffin tray (more on that later), we finally decided on the following cupcakes:

Sorry for the picture quality, these were taken on my iPhone!

This is what we got (in order from top left over down to bottom right):

• Caramel Chew
• Caramel Apple
• Cookie Dough
• Peanut Butter Cup
• Red Velvet
• Baba Booey

Our personal favorites? Tough choice. I liked the Peanut Butter Cup and Caramel Chew the most, and Rick liked the Baba Booey.

The cupcakes came in a really nice box too, well packaged and insulated to keep them cool and fresh:

And we weren’t joking about these things being gigantic. These things are massive! You can easily share one with two or three other people (yeah, good luck with that).

Anyways, all this talk about cupcakes and this should be about the Magento integration (which, unfortunately, you cannot eat).

They did an excellent job on the site, and I mentioned the drag-and-drop thing earlier, which is really cool. Check out the video on their website to see what I mean.

Oh, and to the people at Crumbs Bake Shop…Arizona needs one of these out here!

Check out the rest of Crumbs Bake Shop’s website…

Magento Showcase is a place where we display stores we host that have done something interesting with Magento, like a pleasing design, unique integration, large product catalog, or anything else that makes it special and interesting.

Happy Valentine’s Day!

Check out the rest of Sucré’s website…

Magento Showcase is a place where we display stores we host that have done something interesting with Magento, like a pleasing design, unique integration, large product catalog, or anything else that makes it special and interesting.

The Naked Man Shop is another well designed site that makes it to our showcase. Great use of whitespace and minimalism, which works really well considering the target audience.

In fact, after browsing the site, I feel like I need a hot shower, close shave, and some moisturizer!

One useful feature I liked was the thumbnail images that showed up when you moused over a product image:

Little things like that really improve the usability of a site.

Check out the rest of Nkd Man’s website…

Magento Showcase is a place where we display stores we host that have done something interesting with Magento, like a pleasing design, unique integration, large product catalog, or anything else that makes it special and interesting.

Don’t stress over the possibility of a botched upgrade ruining your store, breaking your current design, or throwing up errors that you’re not sure how to fix.

Crucial offers a professional upgrade service to all of our clients that will take away the stress and hassle of doing it yourself.

We’ve done countless upgrades and are comfortable dealing with common errors and issues, and we know what to look out for to ensure your upgrade will go as smooth as possible.

How It Works

1. The first thing we do is setup a staging store. If something goes wrong with the upgrade, your primary store isn’t affected.

2. After we’ve upgraded your staging store, we’ll go through the frontend and backend to verify that everything is running properly without error.

3. You’re then given a chance to go through the store yourself to see if you’d like to continue with the upgrade process on your primary store.

4. We then schedule a time to upgrade your primary store, usually on the weekend during off-peak hours.

A pre- and post-upgrade backup of your entire site is taken in case you want to restore your site back to the old version.

We keep this on the server for 72 hours in the event you come across an issue that was not originally spotted.

Upgrade Guarantee

If we’re unable to upgrade your store, you will not be charged for the service. We’re confident we’ll be able to upgrade your store though.

Terms & Conditions

We offer an upgrade service for Magento. This does not mean we will fix known version bugs. This is a personal risk you take in upgrading to a new version of software.

We advise our clients to wait at least 2-4 weeks after a new version has been released before upgrading to it.

This gives the developers of Magento time to fix any bugs that they or the community may find.

Our advice to wait is also based on experience, as it’s not uncommon to see another version released in a couple days or weeks.

Ready To Upgrade?

If you’re ready to upgrade your store, please login to the account center and submit a ticket to the Magento department.

A member of our staff will provide you with more information and instructions on how to get started.

A staging area is a duplicate of your primary store that you can use to see if the upgrade process will go smoothly, and also allow you to use both the frontend and backend of your site to see if everything is running properly.

This article is written with our clients in mind, but the principles will apply no matter where you are hosted or what control panel you’re using.

Jump To Section

• Create Staging Subdomain
• Create Staging Database
• Copy Production Store
• Update Configuration
• Upgrade Staging Store
• Cleanup & Permissions
• Professional Upgrade Service

Create Staging Subdomain

The first thing we want to do is setup a subdomain for our staging store:

1. Login to cPanel for your domain, and click on the Subdomains icon.

2. For both the Subdomain and Document Root, we’ll enter staging.

3. Click on the Create button.

Create Staging Database

While we’re still in cPanel, let’s setup a blank database for our staging store:

1. Go back to the main screen for cPanel, and click on the MySQL Database Wizard icon.

2. For the New Database, we’ll enter staging.

3. Click on the Next Step button.

4. For the Username, we’ll enter staging, and for the Password, enter whatever you’d like here.

5. Click on the Next Step button.

6. Click on the box next to ALL PRIVILEGES.

7. Click on the Next Step button.

Copy Production Store

Now that our subdomain and database has been setup, we ned to copy our production store over to the subdomain directory.

1. Login to SSH for your domain, and change to the staging folder:

   • cd staging/

2. Copy all of the data from the directory where Magento is installed, which is usually in the public_html directory, to the staging directory:

   • cp -R ../public_html/* ../public_html/.htaccess .

For the next step, you’ll need to know the database information for the production store. If you don’t remember this, open up the following file:

• app/etc/local.xml

Lines 43-46 will contain your hostname, username, password, and database name.

Next, we need to copy the data from the production database over to our staging database. We’ll be doing this from SSH as well.

• mysqldump -u PRODUCTION_DBUSER –p PRODUCTION_DBNAME > data.sql

You’ll be prompted to enter the password for the user that has privileges to the production database, so type that in and hit the Enter key.

This can take a couple seconds to a couple minutes depending on the size of your database, so just wait until it finishes.

Once it finishes, we need to import this data to our staging database:

• mysql -u STAGING_DBUSER –p STAGING_DBNAME < data.sql

Just like before, you’ll be prompted to enter a password, but this time it will be for the user who has privileges for the staging database.

Update Configuration

Using your favorite text editor, open up the following file from the staging directory:

• app/etc/local.xml

Replace the values for lines 44-46 with the database details for our staging database.

Now we need to do is update the Unsecure and Secure URL for our staging store:

1. Login to cPanel for your domain, and click on the phpMyAdmin icon.

2. From the sidebar on the left, click on the _staging link.

3. Click on the SQL tab, and in the text area, run the following command:

   • SELECT * FROM `core_config_data` WHERE `path` LIKE '%base_url%';

4. Click the Check All link and then click on the pencil icon.

5. Update the value fields with the URL for your staging site.

6. Click on the Go button at the very bottom to save your changes.

Upgrade Staging Store

Now that our staging store is setup, we can upgrade it to make sure everything goes smoothly. These commands will be done via SSH in the staging directory.

A little cleanup first:

• rm -rf downloader/pearlib/cache/* downloader/pearlib/download/*

Set the permissions on the pear file so we can run it:

• chmod 550 pear

Initialize the PEAR channel just in case:

• ./pear mage-setup .

And then we can upgrade:

• ./pear upgrade-all

If it tells you that there’s Nothing to upgrade, you’ll need to do this instead:

• ./pear install magento-core/Mage_All_Latest

Cleanup & Permissions

Lastly, we need to clear out any temporary and cached data. These commands will be done via SSH in the staging directory.

• rm -rf downloader/pearlib/cache/* downloader/pearlib/download/*
• rm -rf var/cache/ var/session/ var/report/ media/tmp/

And then reset our file and directory permissions:

• find . -type f -exec chmod 644 {} \;
• find . -type d -exec chmod 755 {} \;
• chmod o+w var var/.htaccess app/etc
• chmod 550 pear
• chmod -R o+w media

You can now open up your staging site in your browser to see if the upgrade process worked or not.

After You Upgrade

After you upgrade your store, don’t assume everything is working correctly because your site is coming up without errors. Use this time wisely to go through your entire site, including the backend:

• If your navigation has dropdown items, make sure they work
• Search for a product to see if anything comes up in the results
• Make sure you can add a product to your cart and purchase it
• Check if your layered navigation is intact
• Create or edit an existing product, making sure you can save it

If you do come across any errors, check the community forum to see if others are experiencing the same issue.

If you can’t find anything, create a new thread to see if anyone can assist you.

It’s also a good idea to search the bug tracker. You can even help by submitting a new bug if you don’t find anything.

Professional Upgrade Service

Need help upgrading your store? Crucial offers a professional upgrade service to our clients.

To learn more about this service, please login to the account center and submit a ticket to the Magento department.

Jump To Section

1. SAQ Validation Types
   • Type 1
   • Type 4
   • Type 5
2. Becoming PCI Compliant
   • Hosting & Data Center Options
   • Type 1 (SAQ-A)
   • Type 4 (SAQ-C)
   • Type 5 (SAQ-D)
3. What Does This Mean?

All merchants fall into one of four merchant levels defined by the merchant’s transaction volume over a year.

A level 4 merchant is defined as "any merchant processing fewer than 20,000 Visa ecommerce transactions per year," and is the most common small business merchant level.

Level 3 merchants are classified as doing 20,000 to 1,000,000 transactions per year.

We’ll be focusing on Level 3 and 4 merchants throughout this article.

Your merchant level defines your PCI compliance validation options.

Level 3 and Level 4 merchants are required by PCI-DSS requirements to complete a Self Assessment Questionnaire (SAQ) and to pass a quarterly network vulnerability scan.

Level 4 merchants, however, may not be required by their merchant acquirer to fulfill either of these requirements. We’ll discuss this more later.

SAQ Validation Types

Every merchant is required to complete a Self Assessment Questionnaire (SAQ) to become certified as PCI compliant. There are five SAQ validation types that determine which of the four SAQ’s to complete.

We’ll look at SAQ validation types 1, 4, and 5, since all online ecommerce systems will fall into one of these categories.

Type 1

SAQ validation type 1 has the easiest requirements to meet. This validation type applies to ecommerce merchants where all cardholder data functions are performed by a PCI compliant third-party, such as PayPal.

No cardholder data can be stored or transmitted to qualify for this SAQ validation type. The purchaser must be redirected to the service provider’s website to complete the purchase.

SAQ validation type 1 does not require PCI compliant web hosting, however it may be necessary to complete the SAQ-A if the merchant services provider requires it.

It’s likely that merchants of validation type 1 will not be required by their merchant acquirer to perform a quarterly vulnerability scan.

Type 4

SAQ validation type 4 applies to most ecommerce retailers. This validation type applies to ecommerce merchants with shopping cart applications that transmit cardholder data via the Internet for processing by the merchant acquirer.

No cardholder data can be stored to qualify for this SAQ validation type.

A simple example of a qualifying SAQ validation type 4 is a Magento shopping cart using Authorize.Net to process transactions. Cardholder data is transmitted to a PCI compliant third-party for processing and no cardholder data is stored.

Credit card payments are made at the merchant’s website, whereas validation type 1 must deliver the client to a third-party website for payment collection, such as PayPal Payments Standard.

SAQ validation type 4 requires that all third-party service providers are certified as PCI compliant. The ecommerce merchant is required to perform due diligence to ensure the operating service provider is a PCI-DSS certified service provider. This includes the web hosting provider and data center.

A careful review of the service provider certification should be made before choosing any PCI compliant third-party service providers.

SAQ validation type 4 merchants must complete the requirements of the SAQ-C. Due to additional complexities introduced by the SAQ-C requirements, including the fact that service providers must also be certified PCI compliant, traditional shared hosting options become impossible.

Type 5

SAQ validation type 5 applies to all ecommerce merchants that do not fall into validation types 1 or 4. The defining issue that separates a type 4 from a type 5 is the storage of cardholder data.

Merchants identifying themselves as eligible for validation type 5 must comply with the requirements in SAQ-D. These are the same requirements that are required of PCI certified service providers and are typically out of the financial and technical reach of most small ecommerce retailers.

The SAQ-D requirements for PCI compliance are a very serious undertaking for even highly skilled IT professionals. Lawyers, CPAs, and other legal means may often be needed to draft PCI audit policies and procedures. The cost of validation type 5 PCI compliance can easily run over $50,000.

Becoming PCI Compliant

Acquirers (merchant account providers) are responsible for enforcing merchant compliance with the PCI requirements.

Level 4 merchants may not be required by their acquirer to submit vulnerability scan reports or the SAQ, which is the case with PayPal Payments Standard.

If you are required to provide either the PCI scan or SAQ, you will be notified by your merchant provider. The notice will be delivered in the form of postal mail and will include your merchant level and compliance requirements with regards to the SAQ and vulnerability scans.

Merchants that do not meet the requirements of the PCI-DSS may also be fined by the merchant acquirer. Often called a compliance fee, this charge can range from $19.95 to many thousands of dollars monthly.

Many level 4 merchants choose to pay the fee over becoming PCI compliant, but it is important to remember that compliance is required and merchant accounts do get shutdown.

Hosting & Data Center Options

Each SAQ validation type brings with it a new level of complexity to achieving PCI compliance. Third-party service providers’ PCI compliance is an important factor for type 4 and 5 merchants.

Service providers are any third party who has access to cardholder data. This would include web hosting companies and data centers.

Type 1 (SAQ-A)

SAQ validation type 1 has the lowest level of hosting requirements. In this case the payment system, such as PayPal, is the only system involved with the cardholder data transaction. The main website does not need to be hosted with a PCI compliant service provider.

An example of an ecommerce SAQ validation type 1 merchant would be a Magento shopping cart application using the PayPal Website Payments Standard payment option.

All cardholder data is input on the PayPal website and no cardholder data is stored or otherwise transmitted by the originating ecommerce website.

If necessary, the SAQ-A will need to be completed and delivered to the merchant acquirer to complete the PCI Compliance process.

Type 4 (SAQ-C)

SAQ validation type 4 merchants have very specific requirements which mandate the use of certified PCI compliant third party service providers such as web hosting companies and data centers (SAQ-C 12.8).

The many barriers to becoming a PCI compliant service provider eliminates the merchant’s shared hosting options, and all but mandates the use of a dedicated server to achieve PCI-DSS compliance under the SAQ-C.

Restrictions placed on PCI compliant web hosting providers make it impossible to offer a PCI compliant, multi-tenant shared hosting environment.

As a result, many type 4 merchants maintain a PCI compliant hosting environment themselves using a dedicated server hosted with a PCI compliant data center.

An example scenario would be to purchase a dedicated server from a certified PCI compliant data center, such as SoftLayer.

In this scenario, the ecommerce application (Magento) would reside on the dedicated server and communicate cardholder data to a third-party payment processor, such as Authorize.Net. No cardholder data can be stored by the merchant in this scenario.

The dedicated server would need to be configured to pass the required quarterly vulnerability scans. Tuning a server to meet PCI-DSS compliance for SAQ-C is not a complicated task, however it will require a competent System Administrator.

Vendors such as McAfee Secure can provide the PCI vulnerability scans and PCI compliance certificates, as well as a wealth of information to help you pass your PCI-DSS requirements.

The SAQ-C, along with the successful completion of the quarterly vulnerability scan, should be submitted to your merchant account provider to show compliance with the requirements of PCI-DSS.

It’s easiest to subscribe to a scanning service such as McAfee Secure for ongoing PCI compliance scanning.

Type 5 (SAQ-D)

The SAQ Validation Type 5 is the highest level of PCI compliance and is the same level required by PCI-DSS certified service providers.

This level of PCI compliance requires legal council and a budget in excess of $50-100k to achieve. The decision to take on this type of PCI compliance should only be made by true enterprise-class merchants.

Beyond the certified DSS service provider requirements mandated by type 4 merchants, type 5 merchants must also be prepared for a significant investment in hardware infrastructure, public and private information security policies, and technical compliance challenges.

An example of this level of compliance would be a managed, PCI compliant product from RackSpace. RackSpace is a PCI compliant data center capable of managing this level of PCI compliance for their clients.

A typical RackSpace SAQ-D PCI compliant hosting arrangement would include the following specs:

• Hardware firewall
• Mid-Range web server
• Mid-Range database server
• File integrity monitoring
• Log management service
• Intrusion detection system
• 1-2 GB bandwidth
• 3-5 dedicated IPs

This RackSpace PCI compliant product is available for approximately $3200 per month, depending on a 1 or 2 year contract, plus a a $2300 setup fee.

The configuration of your ecommerce application to use such an environment and the tuning of a multi-system hosting environment for advanced ecommerce applications such as Magento are the responsibility of the merchant.

The SAQ-D will need to be completed along with the many information security policies that it requires to be publicly and privately maintained. This hosting system will also be required to pass a quarterly network vulnerability scan to be PCI-DSS compliant.

The best advice one can give to a SAQ validation type 5 merchant is, if there is a way to become type 4 merchant, do it.

The primary factor that distinguishes type 4 from type 5 for ecommerce merchants is the storage of cardholder data. Unless this is absolutely necessary it should be removed from the business model.

What Does This Mean?

The PCI-DSS requirements are a clear indication of what we can expect from the ecommerce ecosphere in the near future.

Credit card companies are making great efforts to push ecommerce into a restrictive SAQ validation type 1, where the likes of Yahoo! Stores, Google Checkout, PayPal, and similar SaaS solutions will become the norm.

Online merchants who wish to use an integrated payment system, such as Authorize.net, are forced to spend hundreds, if not thousands of dollars per month to comply with the PCI-DSS requirements. This is true of even the smallest ecommerce merchants.

The PCI compliance requirements introduce a true pay-to-play culture within Internet ecommerce.

PCI-DSS compliance introduces a new power to control merchants that appears to disproportionately penalize the smallest of the struggling small businesses by applying the same rules and structures that large corporations face.

VISA and other card providers do their very best to protect their cardholders through the PCI-DSS standard. The cost of this protection is the loss of entrepreneur freedom.

The Internet small business landscape is changing and the ability of the small entrepreneur to accept credit cards in an integrated hosting environment is rapidly disappearing.

I really like the design of this site. Very playful and has a wonderful vibe that really matches the products they sell.

Each section of the site uses a different color, which really changes the feel as you browse through the site:

The individual product pages are very open and clean. And with Valentine’s just around the corner, this is the perfect place to pick up (alliteration for the win) some really cool cards!

You can customize wedding invitations directly from the website, changing things like the color and font:

Hello!Lucky also takes advantage of the multi-store feature in Magento, so the UK site shares the same codebase and backend as the US site does.

Check out the rest of Hello!Lucky’s website…

Magento Showcase is a place where we display stores we host that have done something interesting with Magento, like a pleasing design, unique integration, large product catalog, or anything else that makes it special and interesting.

Setting up Google Apps for your domain is simple, and this short tutorial will show you how to integrate Google Apps for your domain.

Jump To Section

1. Register With Google Apps
2. Verify Domain Name
3. Setup MX Records
4. Setup Webmail Friendly URL
5. Create User Accounts
6. Conclusion

Register With Google Apps

You will first need to register the domain you wish to use with Google Apps.

As we step through this tutorial, we’ll use iptables.com as our example domain. Replace this with your own domain name where appropriate.

Start out by selecting Administrator: I own or control this domain on the default start screen and entering your admin account email address, e.g. webmaster@iptables.com. Click the Get Started button.

The next page will have a form where you will need to establish your account. Simply follow the on-screen instructions and click Continue.

On the third step of the registration processes, the username you select should be an administrative account for the domain, such as admin.

Verify Domain Name

There’s two different ways to verify your domain name, the easy way and the hard way, but we’ll cover the easy way.

From the Google Apps dashboard, follow the link that is circled in the graphic below, Verify Domain Ownership:

On the next page, select Upload an HTML file as the verification method.

Create a file called googlehostedservice.html with the code provided. This file should be visible when you try to access it via a web browser, e.g.:

http://www.iptables.com/googlehostedservice.html

Once you have placed this file on your website, click the Verify button. The verification process can take from a few minutes to a few hours.

There’s no need to wait before we move on making the necessary MX record changes to our DNS zone file.

Setup MX Records

This step requires modifying your DNS zone file. Crucial Web Hosting clients should submit a ticket to technical support, and once we update you, you can move ahead to the next step.

If you don’t have direct access to edit your DNS zone file, the easiest thing to do is contact your DNS administrator and request them to setup the following MX Records for your domain:

• MX Server Address        Priority
• ASPMX.L.GOOGLE.COM.        10
• ALT1.ASPMX.L.GOOGLE.COM.   20
• ALT2.ASPMX.L.GOOGLE.COM.   20
• ASPMX2.GOOGLEMAIL.COM.     30
• ASPMX3.GOOGLEMAIL.COM.     30
• ASPMX4.GOOGLEMAIL.COM.     30
• ASPMX5.GOOGLEMAIL.COM.     30

If you want to access your account with an easy to remember address, we recommend requesting to have a CNAME record created called mail that points to ghs.google.com. This will allow email users a simple and an easy to remember address to access their email.

Now that we have setup our DNS zone file with the new MX records, we can activate the email service with Google Apps.

Back on the Dashboard screen of Google Apps, click the Activate Email link in the Email section. The instructions here have already been completed above, so click the I have completed these steps button to continue.

It may take up to an hour or two for the Google Apps dashboard to show your email account as active, but for me, things start working rather immediately.

Setup Webmail Friendly URL

Now that the DNS zone file is setup, we can configure our Google Apps email to listen for the CNAME we created above, so users can go to the following URL to access their mail:

http://mail.iptables.com

In the Google Apps window, we need to configure this for our email service. To edit this value, from the Google Apps dashboard, click on Service Settings then Email.

We need to change the default address:

http://mail.google.com/a/iptables.com

…to our newly created CNAME address:

http://mail.iptables.com

Click on Change URL in the web address section. Then, click on the custom URL option and enter mail into the text field. Click continue to move on to the next step.

We’ve already requested this CNAME be setup in a previous step, so there is no need to do anything further here.

Create User Accounts

The only thing left is to create your email users. The free edition of Google Apps allows up to 200 email accounts on your domain, each with a 7 GB disk space limit.

The paid version introduces 25 GB storage per user, has no ads, comes with a 99.9% uptime SLA, and costs $50/year for each user, or $4.16 a month.

You can compare the features for both the free and paid version by going here.

To setup your first account, click on the Create new users link from the dashboard of your Google Apps account. Follow the on-screen instructions to walk through the simple user setup and click Create New User to complete the user creation process.

Conclusion

Now you have a robust email service that’s accessible via your favorite browser or phone, such as the iPhone and Android. Best of all, it’s free!

In the settings of each user account, you will find instructions for setting up POP3 and IMAP access for all the popular email clients.

Take the time to become familiar with your Google Apps account and explore the advanced features, such as filters, labels, and remote mail server access (POP3 and IMAP) from your Google Apps account.

Email is just one part of Google Apps, and I recommend that you explore the other collaborative tools included with your new Google Apps account, including document sharing, calendar collaboration, chat.

You’re no longer limited to the confines of your hosting company’s email package. Consider the Google Apps Email service a solution for your company’s professional email needs.