How To Rate A Site

2010-09-25T17:22:49Z

Crabel: moved How To Rate A Site to Participate in the forum: Content was more about "How to downrate a site" then rate it. Most content of the page is more fitting to the new title. The rest will be rewritten.

#REDIRECT [[Participate in the forum]]

Participate in the forum

2010-09-25T17:22:45Z

== How to Rate a Website ==

This text is directed at new members of Web of Trust who would like to know how to check a website and then rate it. It tries to give a simple overview of the things that are important.

Browsing the forum can be intimidating, with all the information the senior members seem to be able to dig out. Following the instructions here, you will be able to close the gap a bit and be able to find out more about a website. Some of the tools described here need some experience to use, but it is not as difficult as it may sound at first. Don't let yourself freak out, simply dive in and try it.
If in doubt or if you don't understand some parts of this text, please ask in the forum. You will be helped and your question may help to improve this guide.

===Check the scorecard===

The first thing you should do is check the WoT Scorecard of the site. You can get there by adding the domain name to the link to the scorecard. e.g. in case of "example.com" go to http://www.mywot.com/de/scorecard/example.com

If there are comments, they might give you a few hints about the site. Please use common sense about them. If the site is commented to host malware, be extra careful. Please try to keep an open mind, not all comments are true. Some might be outdated, some created by the owner to promote his site, some by people who do not like him. With some experience you will get a feeling for the comments.

While you are on the scorecard, you might also want to click the whois link at the top. This will show you who owns the site.

===Check for blacklisting===

Blacklisted means, that the site is on one of various lists that track misconduct like hosting malware or spamming. If a site hosts viruses or is a known attack site, you wouldn't like to go there, won't you? So it's a good idea to check for that before you visit it.

How to check on [[How_To_Check_For_Blacklisting#UrlVoid|UrlVoid]].

How to check on [[How_To_Check_For_Blacklisting#Malwareurl|Malwareurl]].

If a site is detected on a blacklist, give the person who asked for voting the advice to clean up the site and get delisted. Only after you could confirm (e.g. by a delisting) you should consider to vote the site good. Please note: A delisting does not automatically make a site "good". It still has to meet the rest of the conditions like having a good privacy policy.

===Read "How to ask for rating"===

[[How_To_Ask_For_Rating|How to ask for Rating]]

Basically, the same rules that apply to site owners apply to your rating. Contact information, privacy policy, SSL encryption. Look out for them!

A missing privacy policy is the simple case. A more subtle thing is an insufficient or bad privacy policy. Insufficient means that some things are missing and should be mentioned. Bad privacy policys contain passages which are harmful to the people visiting them. An example would be: "We are allowed to share the gathered information with third parties without your consent." That line would basically allow the company to give or sell all collected data to anybody.

===Useful tools===

Firefox plugins:
* NoScript - Blocks javascript code unless you allow it to be executed.
* Ghostery - Lists trackers on the site

===What now?===

If there is a forum request asking for rating, respond to it and write some words to the site owner explaining what he should do. Also add your findings for quick overview. Even if you did not find something, it is good to know what you checked.

2010-08-24T20:48:10Z

Crabel: Created page with "== Your Privacy Statement == describes how you handle information about the visitors of your website. You have to make a clear statement describing how each bit of data you gath…"

== Your Privacy Statement ==

describes how you handle information about the visitors of your website. You have to make a clear statement describing how each bit of data you gather is used.

===HTTP Cookies===

The most common thing that affects privacy are HTTP Cookies. A Cookie is a piece of text that a website stores on your computer. Basically it allows the website to recognize you. Cookies are an essential part of the internet and a lot of pages use them. If you use them, you should tell the users about them and add a Cookie policy.
For a detailed description of cookies [http://en.wikipedia.org/wiki/HTTP_cookies| look here]

===Cookie policy===

A cookie policy is usually part of the privacy policy. It's addressed within it's own section (normally a paragraph) which states what type of cookies are used: session or persistent.

* Session Cookies: Not stored on disk, only last as long the browser is open
* Persistent Cookies: Stored on disk, last a specified time, possibly indefinitely

Your site should offer as few cookies as possible, preferably none. Widgets, advertising, and other third-party interventions may causes your site to drop more cookies on to your visitors computers. When you do use scripts, or browser bars, or social networking link "buttons", etc you should address these in your cookie policy and offer explicit links to the other privacy policies available on these outside sources.

When using third-party advertising such as Google or DoubleClick, reference their usage and include the appropriate links. Google is just one example of many advertising sites.

[http://www.doubleclick.com/privacy/faq.aspx| DoubleClick DART cookie]

[https://www.google.com/adsense/support/bin/answer.py?answer=100557| Google Adsense]

[http://www.google.com/privacy_ads.html| Google Advertising and Privacy]

===Tracking===

A cookie policy should also mention whether the site uses any third-party trackers: Google Analytics and Quantserve are two popular ones. Tracking may also be done by using [http://en.wikipedia.org/wiki/Web_beacons| web beacons] (web bug, tracking bug, tracking pixel, pixel tag, 1×1 gif, clear gif) This should be explicitly mentioned in your privacy policy if your site uses this technology.

===How do I find if and which cookies my page sets?===

An easy way to get a list of all cookies that your webpage sets is to use Firefox privacy mode. How to browse privately? [http://support.mozilla.com/en-US/kb/Private+Browsing#Turn_on_Private_Browsing| Look here].

After starting private browsing mode, enter the url of your site and go to it. Click a bit around, but don't leave your site!

Now lets take a look at what cookies were set. Click Tools menu -> Options -> Privacy and choose "remove individual cookie". In this window you see all cookies that your page has set, including those set by external content.

Please explain what purpose the cookies you set have. In case cookies, which do not belong to your site are set, explain them too. If you use some kind of advertisement, chances are high that they set cookies. Take the relevant part of the privacy information of the ad company and add it to your cookie statement.

===Do you use Flash?===

Flash uses something called [http://en.wikipedia.org/wiki/Local_Shared_Object| Local Shared Objects] to store information on your computer. They are also referred to as "zombie" or "super" cookies. Quoting from Adobe:

<blockquote>Local shared objects, sometimes referred to as "Flash cookies," are data files that can be created on your computer by the sites you visit. Shared objects are most often used to enhance your web-browsing experience. A website can write a cookie on your computer, and the next time you visit it will load that cookie and its information in a way that provides a more customized experience. For example, you may have asked a site to remember your login name. That information is stored in the cookie and retrieved on your next visit so that the website displays your name in the login field on the site.</blockquote>

The interesting thing about LSO's are that when you delete your cookie cache, the LSO is able to rewrite the cookie. This causes the LSO to be used not only for tracking, but for spyware as well. The only time your site should use Adobe Flash LSO's are when you have created Flash files (.SWF / .FLV) to share with your visitors and these local stored objects should not be abused with the intent on spying upon your site visitors.

For more information [[Local_shared_object| look here]]

===Children's Online Privacy Protection Act.===

For sites hosted within the USA, or on US servers it is required to adhere to COPPA and if so, it should also be referenced within your site's privacy policy.

Websites that are collecting information from children under the age of thirteen are required to comply with Federal Trade Commission ( FTC ) Children's Online Privacy Protection Act (COPPA).

[http://www.coppa.org/| COPPA - Children's Online Privacy Protection Act]
[http://www.ftc.gov/privacy/privacyinitiatives/childrens.html| The Children's Online Privacy Protection Act]

===Do people enter any information?===

It basically doesn't matter what kind of information you collect. Whether you have a shop and store orders and addresses or something else, you should tell users what you store, for how long and how you use it. Be honest and try to be complete.

These links might be helpful
[http://www.ftc.gov/infosecurity/| Federal Trade Commission's Guide for Business]
[http://www.oecd.org/document/39/0,2340,en_2649_34255_28863271_1_1_1_1,00.html| OECD Privacy Statement Generator]
[http://www.the-dma.org/privacy/creating.shtml| OECD Direct Marketing Association Privacy Policy Generator]

===Do you have logfiles?===

Please tell us what you do with your logfiles. How long you keep them, do you analyze them, ...

How To Ask For Rating

2010-08-24T20:30:50Z

Crabel: Created page with "== Getting started == Since there's no way to predict your experience level, this guide has elements directed to novices. Before asking, please do a quick check of your website…"

== Getting started ==

Since there's no way to predict your experience level, this guide has elements directed to novices.

Before asking, please do a quick check of your website and answer the following questions to yourself. Please fix the issues you find. Regular voters will notice these things and ask you to correct them anyway. Please note: The rules here might seem a bit harsh, but Trust is one of the most coveted goods on the internet. Easy to lose, difficult to gain.

== Do you have a Contact Information/Impressum? ==

While it may or may not be required by your local law, we frown upon missing contact information. Please understand, laws differ by country, we cannot take that into account. We use the simple rule that you need one. While you might not agree, you should add one or be prepared to explain why you haven't.

Think about it, would you trust someone who declines to tell you his name?

A Contact Us page should include:
* Company name
* Your name
* Phone number
* A physical address
* A business email address

== Do you have a Privacy Statement? ==

With a privacy statement you declare what you do with collected information. People are increasingly sensitive about these things.

Since privacy is a big concern, it has its own page. If you have no privacy statement or are not sure about it, [[How_To_Privacy_Policy|look here]] for more information.

Basically you need a privacy statement when you:

* Use HTTP Cookies
* Flash Cookies (LSO)
* Have input forms (collecting any, even anonymous, data)

== Do you need SSL Encryption? ==

If you collect any sensitive information e.g. so called [http://www.mywot.com/wiki/Personally_Identifiable_Information_%28PII%29|Personally Identifiable Information(PII)], you should use https to do so. A login box may require SSL depending on the content it unlocks.

Basically it's the difference between a postcard and a sealed letter. Ask yourself: "Would I write my creditcard/account information on a postcard?". Use common sense to decide whether you need SSL or not. If you are unsure, SSL is the safe bet. If unsure, ask for opinions.

== I have an adult site, should I still ask for a rating? ==

There is no reason not to. But of course, you should expect the Adult Content category to be rated RED. The other categories will be rated independently.

Please note: We do consider all content that is inappropriate for children adult material. If you have violent pictures on your site, we will rate it as adult content.

== Important things about asking ==

The first an foremost thing: Be polite. The answers/questions you get in response may sound hostile to you. People look at your website and try to find something thats wrong. It's similar to a test in school. The teacher tries to find the mistakes. While this may feel hostile, it isn't. We just want to make sure your site is safe.

Also, please take into account that a lot of people (probably you, too) in the forum are not native speakers and may not even know that their answers sound gruff.

== Time to ask! ==

To speed up things, please give us the following information:

* Mention the domain name in the title
* Link to your site
* Link to your privacy statement
* Link to your contact info
* If you are not the owner, tell us your affiliation to the site
* Give us a few words about your site, tell us what it is, a shop, a blog, ...

Remember: Be polite.