Rikki

Making security considerations a key part of your community setup and maintenance can save you from many future headaches. You've worked hard to get your community moving. Don't make yourself an easy target and undo that work. Here’s our current advice to our customers. 1. Enable HTTPS HTTPS is fast becoming the standard way to serve websites. In 2016, more than 50% of web requests were served under HTTPS for the first time. Chrome and Firefox now explicitly warn users on login forms that aren’t sending data over HTTPS, and it’s not hard to imagine that in the near future all insecure pages will receive the warning. HTTPS simply means that website data is served over a secure connection and can’t be read or tampered with by a ‘middle man’ hacker. You can identify a site using HTTPS because the address in your browser will show ‘https://’ (instead of http://), and normally a lock icon or the word ‘secure’. Invision Community supports HTTPS by default simply by changing your base URL configuration to include HTTPS. Of course your web host will need to support it as well and our Invision Community Cloud services support it by default. Contact support if you have any questions. Recommendation: Set up HTTPS for your entire community to prevent ‘man in the middle’ attacks. 2. Set up Two Factor Authentication Invision Community supports Two Factor Authentication (2FA for short), and we highly recommend making use of this feature for your users, but especially for your administrator staff. 2FA is a system that requires both a user’s password and a special code (displayed by a phone app) that changes every few seconds. The idea is simple: if a user’s password is somehow compromised, a hacker still wouldn’t be able to log in to the account because they would not have the current code number. You may already be familiar with 2FA from other services you use. Apple’s iCloud, Facebook and Google all offer it, as do thousands of banks and other security-conscious businesses. Invision Community supports 2FA via the Google Authenticator app (available for iOS and Android) or the Authy service, which is able to send codes to users via text message or phone call. You can also fall back to security questions instead of codes. You can configure which members groups can use 2FA, as well as requiring certain groups to use it. Recommendation: Require any staff with access to the Admin Control Panel or moderation functions to use 2FA, to ensure that no damage can be done should their account passwords be discovered. Allow members to use 2FA at their discretion. 3. Configure password requirements The password strength feature displays a strength meter to users as they type a new password, showing them approximately how secure it is, as well as some tips for choosing a good password. While you can leave this feature as a simple recommendation for users, it’s also possible to require them to choose a password that reaches to a certain strength on the meter. Recommendation: Require users to choose at least a ‘Strong’ password. 4. Use Admin restrictions It’s very common that many different staff members need access to the Admin Control Panel depending on the role. You may have design staff, billing staff, community managers, and so on, all with particular tasks they would like to achieve. Invision Community can help improve the security of your Admin Control Panel by allowing you to restrict the functions available to each administrator, granting them access to only the tools needed to do their job. Recommendation: Audit your community’s administrator accounts and applying restrictions where it makes sense to do so. 5. Stay up to date It’s important to ensure you’re always running the latest release of Invision Community. With each release, we add new security features, audit code and fix any issues reported through responsible disclosure. Falling behind can therefore make your community a tempting target for potential hackers. Your Invision Community Admin Control Panel will let you know when a new release is available, and you can also check out our Release page to track releases. For our Enterprise customers, we’ll automatically apply updates for you shortly after release as part of your plan. For our self-hosted and Cloud customers, you can easily apply new updates via the Admin Control Panel with a couple of clicks. Our Invision Community Cloud contains all best practices for security. However, if you are self-hosted, be sure to work with your web host to ensure your server is setup properly. Ensuring that server software, firewalls, and access controls are in place is very important as an insecure server can be your worst enemy. Recommendation: Aim to install latest updates as soon as feasible. 6. IP address restrictions For organizations where staff are centrally-based in one location, or are required to use a VPN, you can improve your community security by restricting access to the Admin Control Panel to the IP addresses your staff will be using. This is a server-level feature, so contact your IT team to have this facility set up your installation. Enterprise customers who wish to utilize IP restrictions should contact our Managed Support team, while Cloud customers can submit a support ticket to have this set up. Recommendation: Where staff all access the community from a small number of IP addresses, restrict Admin Control Panel access to those IPs. Summary Don’t leave security as an afterthought. Invision Community includes a range of tools to help you ensure your data and members protected, as well as industry-standard protections ‘under the hood’. Make use of these features, and they’ll help ensure the wellbeing of your site. As always, if you have any questions or need advice, our support team are on hand to assist you.

Unlike a regular website, where you write content for each page, target keywords and optimize text, a forum community's content is predominantly written by users. They don't know or care about your site's SEO and just want to interact with other users or find answers to their questions. To keep your community moving forward, Invision Community implements many best-practice SEO techniques and approaches for you automatically, without you needing to lift a finger. Even still, there are a few additional steps you can take to potentially help your site rank better. How Invision Community helps you automatically Invision Community does a lot of automatic SEO for you behind the scenes to help your site rank better or to help search engines understand your content. Some of those include: Sitemap generation A sitemap file helps search engines to locate pages within your site. This helps search engines find pages so they will be crawled quicker. Invision Community automatically generates a sitemap for you that points to all of your content URLs, and submits it to Google. JSON-LD Another way a site can help search engines is by providing metadata about a page. For example, if the page contains a review, additional data can be supplied to the search engine with rating count, average, and so on. There are dozens of items that can be described in this way, and doing so can mean your results in search engines display this additional data. This makes results more useful to users, potentially leading them to click on your result versus another. It can also help search engines understand your content better. Canonical URLs Search engines can penalize your site in situations where the same content can have multiple URLs. With software that generates pages dynamically, such as a community, this can happen frequently because there are URLs to get the last read post, the latest post, the first post and so on, all ultimately pointing to the same topic page. Invision Community takes care of this for you by setting a canonical URL for every page, telling the search engine which is the definitive URL it should use. Semantic markup The HTML markup used to generate a page is possibly the most important factor impacting SEO. Each HTML tag has a specific meaning (e.g. H1 is an important title) and allows search engines to determine the structure of the page. It's therefore important that tags are used correctly and in the appropriate context - known as semantic markup. Invision Community has been built with semantic markup principles in mind right from the start. Responsive theme Google has been transitioning to a mobile-first approach when crawling sites and it's likely this does or will factor into its PageRank system. Now more than ever it is important that your community offers a genuine mobile experience. Invision Community achieves this by supporting responsiveness - where the theme adapts depending on size of the screen being used - by default. What you can do to improve ranking Let search engines see your content One of the most important things you can do to help with SEO might seem obvious, but we've seen many people unwittingly neglect it: ensure that search engines can see your content! It's tempting to lock down your community so that users have to log in before being able to see your content, and for some communities this might be necessary. However, a search engine can only see content accessible to guests, and so by locking your community down a search engine won't be able to see very much at all, and your pages won't show in search results. Wherever possible, we suggest allowing guests to read your content, though you can require registration to reply. Enable HTTPS Even ignoring SEO this is a good idea, because it's more secure for your users and browsers are increasingly alerting users about sites that don't use HTTPS, showing them as insecure. In terms of SEO, research has shown a correlation between between sites using HTTPS and their ranking position, and in 2014 Google indicated that HTTPS would be a “ranking signal” going forward. Given the other benefits of HTTPS, it would therefore be wise to enable it across your community. Ensure your site loads fast A fast-loading site is very important for rankings, and so you should do what you can to keep your community running quickly. This includes: Enable guest caching Invision Community includes a built-in caching system for pages viewed by guests, ensuring they don't have to be re-generated for every page view. This can greatly speed up your site for guest users and therefore search engines. This is automatically configured on our Cloud services. Don't go overboard with plugins A few good plugins can set your community apart from others, but going overboard can significantly slow down your load times or clutter your interface. Be wary of image-heavy themes As with plugins, a great theme is a good thing to have, but try to avoid one with extensive use of very large images. Choose a good host Some website hosts are slower than others, so ensuring your host is up to scratch is important. Of course our Cloud services are a great solution here! Use 301 Redirects if migrating If you're migrating from another community platform, your page URLs will change to reflect Invision Community's architecture. You can greatly improve SEO retention by using special redirects (known as 301 Redirects) to send users from your old URLs to the new. Search engines understand this method and will update their records. We include redirects in our free migration packages to help you retain your SEO standings after migrating to Invision Community. Write relevant content If your site targets a particular niche, you may see benefit in writing longer-form content as articles on a site blog. This kind of content ranks well and allows you to ensure keywords are used (versus content posted by members, which can be anything). You can also encourage further discussion of the article in the wider community, amplifying its benefit. For a site news page/blog, our Pages app can be used to build an articles section for this purpose. Use social media profiles to your benefit You should register social media profiles for your site on the popular platforms and make them a part of your presence. These sites rank very highly of course, and so if your social profiles can also rank highly for your name, they can be a good way of directing traffic to your site. Use the ‘About' section of the profile to write an interesting blurb about what your site offers. Create eye-catching header images and profile photos to use on the profiles too. Cross-link each social profile to the others (and back to your site, of course). Finally, link to your social profiles from your site too. Invision Community allows you to easily do this and insert icons in your header or footer. Beyond that, you can also use social media to your advantage by cross-linking some of your best content to it. We'll go into more detail on how best to leverage social media in a future article, but the new Promote functionality in Invision Community is a great way of achieving this. Summing Up As always, content is king when it comes to ranking, and that should be your most important focus. Fostering a vibrant community that creates and shares interesting content is key. You can then use SEO methods boosted by Invision Community features to expand your community's reach in search engines. If you have any SEO tips that have helped your site, we'd love to hear them. Share them in the comments below!

Whether you run an existing community or are taking tentative first steps into setting up an online community forum around your brand, an important choice you need to make is between social networks like Facebook or having a community you own and control. Let's take a look at the benefits of an owned community versus a Facebook group - as well as how you can still use Facebook (and other social media platforms) to your advantage. You own your data The biggest point to consider when using Facebook groups is that you do not own your own data. Facebook owns it and does not even allow you direct access to it. If you decide later to move to a different platform, need to run reports to extract meaningful insights, or otherwise work with your community data: you are out of luck. In contrast, with an Invision Community, your data is your data. You can use it in any way that makes sense for your goals; be it analyzing trends, sending promotions to users, or generating reports and statistics. We never hold your data hostage and there's no fee to get it. Beyond owning the data, you also control how it's used and presented. Facebook is notorious for changing algorithms for when (or even if) people see your posts. When you run your own community the experience for your and your users is in your control. Branding opportunities This is a big one. An owned community gives you the tools you need to make your community a seamless part of your user's interaction with your business. This naturally includes your brand styles (your logo, colors, site navigation and so on) but also your community web address (URL). With an owned community, your URL will be easy to find - customers normally opt for something like forum.yourname.com or community.yourname.com. Users will have more confidence that they're in the right place, and more closely associate your community and your message with your brand. Emails sent out by your owned community can also carry your branding, consistently reinforcing that connection between your business and your community. And, of course, when users share content from your community to Facebook and other social networks, they're sending users directly to your website where you have the opportunity to lead with your most important call to actions. More control over user experience All Facebook groups are, essentially, the same experience and yet your business needs almost certainly aren't the same as every other. One size doesn't necessarily fit all when it comes to community! When you control your own community, you have the ability to control your user's experience. Need to show specific types of data in specific places? You can do that (and more) with Invision Community's easy to use Blocks feature. Need to create a custom community application to serve as a resource center for product support? You can do that too. Another huge benefit of this control is that, unlike a Facebook Group, users won't be seeing ads and 'recommended content' from competing businesses and communities. With user attention being pulled in so many directions these days, the last thing your community needs is for users to leave because Facebook has suggested a competitor! No barriers to monetization Not all communities require a monetization strategy. In many cases, the community is part of a larger customer relationship strategy rather than a revenue-generating destination in its own right. But for those communities that do plan to monetize, options with a Facebook group are at best difficult to act upon, and at worst practically non-existent. In contrast, Invision Community gives you the opportunity to explore monetization strategies that work for you. These might include paid subscription plans (a particularly attractive option for fan club communities), traditional advertising through Google AdSense and other networks, or sponsorship deals with other businesses that might be relevant to your members. Invision Community has tools for each of these approaches built in, allowing you to start monetizing with minimum fuss. Fine-grained permission controls Facebook groups struggle to reflect the real-world roles that staff members play in your organization, limiting your choices to 'administrator' or 'moderator'. And the same is true of users, too - your options for recognizing different levels of user (such as VIPs, or brand ambassadors) are limited. Invision Community is different. Since you are creating and configuring each member group, you can precisely control who can see what, and how they are recognized within the community. You can even sync these roles via Single Sign-On (SSO) making setup and assigning users to groups painless. For staff groups, you can limit access to key community functions based on roles or responsibilities, ensuring access is granted on an as-needed basis only. For users, you can get creative and find a group structure that works best for your specific needs. For example, support communities often find that recognizing the most knowledgeable and helpful members with a new member group (complete with elevated permissions) is a great way of engaging users. And finally, with this control over access, it's very easy to create restricted areas of the community. Whether you want to create a private subforum that staff can use to coordinate tasks or a file repository that's only available to subscribers, Invision Community can achieve it. You can still reap the Facebook benefits Setting up your community within Facebook's walls might not be the best approach for you. That doesn't mean you should ignore Facebook, however. On the contrary, it's an influential platform and there's a very good chance your users are already using it. Invision Community offers a number of tools that allow you to benefit from Facebook while avoiding the drawbacks we discussed. We'll go into more detail on utilizing social media in a future article, but to summarize: Invision Community features social sign-in options, enabling users to register and log in using their existing social media accounts, substantially reducing onboarding friction. Content can promoted by staff back to your social network pages, automatically and on a schedule you decide. Invision Community supports automatic embedding of a wide number of social networks (and other services), allowing users to share their favorite Facebook and Twitter posts and spark a whole new conversation - but this time in your community. Summary When you are creating an online community for your business or hobby it is important to think about your goals and future growth by choosing a platform that is there to work for your needs. When you establish your community on Facebook, you're helping to grow someone else's business (including, potentially, your competitors!) and hoping that some of those spoils fall to you. With an owned community, the rewards of your hard work belong to you and your business alone. Invision Community has been enabling users and businesses to communicate online since 2002, and we're proud of our reputation as a platform that puts control in your hands. Contact us if you'd like to discuss how we can help you too.

Whatever the purpose of a community - be it customer support, fan engagement, interest-based groups and so on - there's usually a need for site staff to communicate important information to users. Of course, in some cases this information is best suited to a site announcement, which by design has a lot of visibility and authority. But it's important that day to day staff posts stand out too. As we'll discuss in future articles, a key part of engagement is that users see your organization's team interacting with the community. In many cases, users will expect and appreciate acknowledgement from your community team, and by highlighting those responses you can add a visible stamp of authority. Invision Community has a few different tools to help you highlight staff posts, so let's take a look at them in more detail. Group badges With group badges you can upload a small image that is shown beside a user's posts. It's shown alongside the user's group name, so you don't need to repeat that text. Each group can have a different badge, perfect for communities that structure their staff groups based on role type. It's common to color-code group badges for easier identification - support as green, product development as blue, and so on (and you may want to coordinate these colors with the prefix and suffix you use, which we cover later in this article). It's not just staff groups that can have badges, either; your regular member groups can too. However, a word of caution! If every group has a badge, they may lose their distinctiveness. We recommend reserving group badges for those groups you specifically want to draw attention to. Post highlights Second is a feature more explicitly designed to highlight a post rather than simply draw attention to the author. Group settings in Invision Community enable you to choose to have posts by users in each group show with a distinctive background color and border. The color is defined by your theme and so is easily configurable, too. As with group badges, it may be tempting to highlight every group's content, but we recommend not doing so as that reduces the overall impact of the feature. Keep it reserved for your key staff groups, and especially those that regularly interact with the community. Group prefix/suffix Invision Community allows you to define a custom prefix and suffix for each group. This is used in key locations, including to highlight usernames in the Active User block and to style member group names alongside content. An important part of this feature is that it accepts HTML tags, which gives you a lot of scope for customizing the display by adding an opening and closing HTML tag to the prefix and suffix settings, respectively. For example, let's say we want to add a shield icon before the name, and make the text purple. Prefix: <span style='color: #9013FE'><i class='fa fa-shield'></i> Suffix: </span> Simple! Now our staff members will display in the Active User block and elsewhere like this: Bonus feature: Staff activity streams I wanted to also mention a feature that achieves a slightly different goal to those we covered above, but nonetheless is an important way to bring additional visibility to staff content: activity streams. As well as an overall “All Activity” stream that shows everything happening in the community, Invision Community allows you to define pre-made streams that are available to all users. You can use this to build streams of content with particular tags, certain types of content - or, as in this case, content by users in specific groups. Simply create a new activity stream in the Admin Control Panel, set the configuration so that it only pulls content from members in your staff groups, and you're done. Users will now be able to visit the stream page to get a handy overview of everything staff members are doing in your community. I recommend checking out the other filter options available for streams while you're setting this up - there's a huge amount of power available! Summing up I hope this quick overview of content highlighting features has been useful. When users visit your community, they're usually looking for authoritative information and that often comes right from your own team. By utilizing the features we've discussed here, you can make that information stand out more against the other content in your community.

One of the bigger decisions a community manager has to make as a community grows is whether to employ proactive or reactive moderation (or a combination of both). This isn’t always a conscious decision; sometimes forum moderation features are toggled without giving much explicit thought to the style of moderation desired and the pros and cons of doing so. It’s worth taking a moment to consider the reasons behind each type, and come to a justification for one or the other. Firstly, let’s discuss what we mean by proactive and reactive moderation. Proactive Moderation With a proactive approach to moderation, the goal is to prevent bad content from ever appearing in public. The primary way that this is achieved is by having moderation staff review all content posted, and manually approving it after deciding whether it is acceptable. Another feature that could be classed as proactive moderation is administrator screening of new registrations. When a new user registers in the community, their account can be placed in a ‘validating’ state, requiring an administrator to review the information submitted and deciding whether to approve the account. As you might expect, proactive moderation is the safest way to ensure bad content doesn’t make it to public view. However, the significant drawback is that users won’t see their content immediately, which can be frustrating and severely stifle productive discussion. At worst, it can push users away from your community altogether. Heavy-handed moderation is often viewed negatively by members who are trying to participate, and can ultimately backfire. With a proactive moderation approach, it’s important that you communicate with members one-to-one if they post content with good intentions but which doesn’t meet your criteria. This can reduce resentment over wasted effort, and gives them the opportunity to adjust their approach for future content. Reactive Moderation In contrast, a reactive approach to moderation allows user to post freely, without explicit pre-screening of content, with moderators reacting to issues as and when they arise. Reactive moderation is, generally speaking, a more pleasant experience for users because it allows them to engage fully with the community. However, there is of course the risk that unsuitable content is seen in public, at least temporarily. Choosing a reactive approach doesn’t have to mean a free-for-all. There are many features you can use to make identifying and dealing with bad content a quick and painless process, while still allowing users to contribute freely to the community: Report center Allows users to identify bad content and submit notifications to moderation staff for prompt action. Badword filter, URL filtering and keyword triggers Prevent common swear words and other divisive terms from being used by censoring them or replacing them with ***. You can also blacklist undesirable URLs from being used within posts. Plus, automatically watch and moderate posts that contain terms you specify. Warning system Where a user has proven to be problematic, the warning system in Invision Community allows you to track infractions and apply punishments to the account. These can range from a simple warning message, to suspension, to complete ban. Users can be required to acknowledge the warning before being able to see the community again. Moderation queue Individual users can be placed into the moderation queue, requiring all content they post to be screened by a moderator before being visible - a good compromise that means you don’t need to screen all content, just that from troublemakers. Spam service The IPS Spam Defense Service is a free service that automatically reviews new registrations to your community to determine whether they match any known spammers, using data crowdsourced from other Invision Community sites. The service can virtually eliminate known spammers from your community, preventing them from ever causing a problem. One-click spam cleanup If a spammer does make it into your community, removing their posts and banning them is a one-click action for moderators. Saved actions Saved actions make it quick to apply multiple moderation actions in one go. For example, if members often post support topics in a non-support forum, a saved action would allow moderators to move the topic and reply to let the member know what happened - all with a single click. Which is the right approach for your community? Every community is different, so there’s no one answer here - that’s why Invision Community includes features that enable both approaches, to allow you to determine which to use. In general, we suggest thinking of reactive moderation as the default stance, and increasing the amount of oversight you make depending on the circumstances. There are exceptions of course. For example, in a situation where a user posting personally-identifying information in a public forum could have a profound implication for personal safety, a proactive moderation approach might be more desirable. Similarly, if it’s essential that users receive correct information that has been vetted by your staff, you may want to review content before it appears (though in this case, other techniques might be considered, such as staff labelling content once it is ‘approved’ by them). Your choice need not be entirely one or the other, either. While Invision Community has moderation settings that apply to the entire community, it’s also possible to apply different settings on a per-forum or per-member group basis. Communities often make use of per-group moderation as a way of screening new members. This is achieved by putting new members into a ‘limited’ group that requires content to be reviewed by a moderator. Then, using Invision Community’s group promotion tools, the member is automatically moved to a regular member group once they have a specified number of approved posts (usually a low number; one to five works well). This approach reduces the danger of a rogue member signing up and creating a problem, without requiring the resources to screen every new post to the community. Finally, whichever approach to moderation your team ultimately finds work best, we recommend creating a clear, detailed set of community guidelines that outlines the boundaries of the community, and what you consider acceptable and unacceptable from members. Most users don’t set out to create problems for you, and referring to your guidelines can often put the lid on any trouble before it starts. We hope this overview proves helpful to both new and established communities. If you have any approaches to moderation that you think others might be able to learn from, please go ahead and share them in the comments below!

This is an entry about our IPS Community Suite 4.2 release. You are probably already familiar with our content embedding feature in IPS Community Suite. When a link to content in the community is pasted into the editor (e.g. a topic, or a post, or a gallery image, etc.) it is automatically expanded into a preview of the content, usually with an accompanying image, allowing users to click through to that content if they are interested. An embedded Gallery image in IPS Community Suite 4.1 While it has proved a useful feature to members, each embed used essentially the same structure - a small thumbnail on the left, a title, and a few lines of text. This works fine for topics, but isn't ideal for other kinds of rich content that might be posted. In IPS Community Suite 4.2, we greatly improved upon our embedding handling, giving every type of content within every application its own customized embed style, allowing that content to be displayed however works best. This means larger high-res previews of Gallery images, a button to download a file right from the embed for Downloads files, showing a map for Calendar events, and so on. We worked to keep a consistent overall style between apps, but allow each to display its own relevant information. For users, things will work exactly as they do now - they simply paste a link to content, and it will continue to expand automatically. The changes are also backwards compatible. Any existing embeds in your community will automatically show the new styling you see below - no rebuilding necessary. So with that in mind, let's take a look what the new embeds look like! I won't show every single embed here because there's a huge number, but I'll try and give you a feel for how we approached the embed styles for each app. Gallery Image Comment on a Gallery Image Gallery Album Forum Topic Downloads File Review on a Downloads File Calendar Event Comment on a Calendar Event Commerce Product Record from a Pages database I hope that gives you a good overview of what to expect when your users try out the new embeds for themselves. As always, please share your feedback in the comments below!