I Blamed the Old Websites. Wedding Photographers Proved Me Wrong.

For years I assumed the wedding photography sites that weren’t secure were the abandoned ones.

A cousin built it in 2011. The copyright line at the bottom still says 2014. The login belongs to a man who moved away and stopped answering his email.

That story is tidy, it lets everybody off, and I told it for a long time.

Then I started opening the failures by hand instead of trusting what I’d already written down, and I couldn’t keep telling it. The ones I keep finding are new. Beautiful work, built in the last two or three years, by a photographer charging properly and by a designer who was paid properly.

The one that finally killed the story for me had a homepage I’d have been proud of, an about page with a real sentence on it, and a warning sitting in front of all of it on my phone.

90.8% of the wedding photography sites I opened answer on a secure address, 45 of 47 among the trades I score, and the ones missing it are not the ruins I expected.

What the check looks like on my screen

My crawler asks every site for the secure version of its own address and writes down whether anything comes back. One word each. No taste, no opinion about the design, no idea what the pictures are of.

The second check I run with my own fingers, because machines get things wrong and I like to watch.

Type an address with nothing on the front of it, press enter, and keep your eyes on the top of the window instead of the page. On a site set up properly the address rewrites itself while you’re still looking at it, and letters turn up that you never typed. 86.9% of these sites do that.

On the rest it just sits there wearing exactly what you gave it.

Plumbers lose more on that second check than on anything else I run them through, because the address nobody ever types is the one that breaks.

Have you ever done that with your own address on purpose, watching the top of the window rather than the photographs underneath it?

Say any of this out loud to a photographer and you’ll hear one of four replies. I’ve numbered them backwards, so the flimsiest goes first and the one that has beaten me every time comes last.

4) “There’s nothing on my site worth stealing”

True, and beside the point.

A browser doesn’t read your page before it decides what to say about the connection. The same words go up over a portfolio as over a bank, and the person seeing them has no way to tell which situation she’s in.

There’s more than pictures on there anyway. Your enquiry form collects a woman’s full name, her email, her phone number, her wedding date and the name of the building she’ll be standing in on that date, which is a tidier little parcel than most people stop to think about.

Does that bother you? It bothers me more than the warning does, and the warning is the part I get paid to talk about.

Weakest answer I get, and the one I get most.

3) “My host charges extra for it”

Some still do. Not many, and not the ones I’d send you to.

94% of everything I audit already answers on a secure address, so a host billing you every year for it is billing you for the floor rather than for anything you’d notice. Denver locks up better than any city I checked, and the padlock still buys those owners less than they think it does.

If yours is one of them, the line to change on that invoice isn’t the certificate. It’s the company printing the invoice.

When did you last read a hosting renewal all the way down, instead of letting it come off the card in February while you were busy?

Holds up for about a minute. Then it turns into a different problem, and the different problem is cheaper to solve than it sounds.

2) “I’m on Squarespace, so it’s handled”

Half true, and the missing half is the one that bites.

28.2% of these sites run on WordPress and 23.0% on Squarespace, so plenty of this trade is sitting on something that does the job without being asked.

The hosted builders really do handle it, right up to the afternoon you point your own domain at the site. That step comes apart quietly, usually for a week, and nobody notices for a year because you only ever open your website by clicking a bookmark.

On WordPress it’s your host doing it or nobody doing it, and “nobody” looks identical from your desk.

Do you know which of those two your own site is built on? Most photographers I ask have to go and look, and there’s nothing embarrassing about that.

Every wedding photography website I put live now gets both checks on launch morning and again a fortnight later, and I only started doing the second one because that gap caught me out with a client’s site in front of her. Both checks, and the rest of what keeps a small site out of trouble, live in my guide to protecting a website.

Half true. The platform did its half. The domain was always yours.

1) “Nobody has ever mentioned it to me”

That one’s true, and I think it explains the whole result better than the other three put together.

Nobody tells you. A woman who meets a warning on her phone doesn’t email to let you know, partly because she’d have to describe what she saw and she isn’t certain what she saw.

Your couples don’t mention it either. They’ve met you, they know your name, they were sent by a friend who raved about you, and they’ll click through anything at that point without registering it.

So the only people it happens to are the ones you’ll never hear from, and their reaction is silence. How would you find out? You wouldn’t, and you haven’t, and the silence is why this check comes back the way it does.

True, and it explains everything except what you do on the Monday after you know. One photographer found both settings in her hosting panel that same week, and what changed afterwards was quieter than she hoped for.

What I’m not claiming

The certificate will not book you a wedding. Nobody has ever chosen a photographer because the connection was encrypted, and I’d be a fraud if I told you otherwise.

It doesn’t earn you anything. It stops you losing something, quietly, on a phone you’ll never hold, and those two are not the same job.

So why give a whole post to a repair that only ever prevents a loss you can’t count? Because it’s the cheapest item on my entire list, and your trade misses it more than almost anyone.

That’s also why it never makes it into a proposal. Nothing in it is fun to sell, nothing in it looks like anything, and it takes less time than choosing a font.

Talk me out of it

Your work arrives through a friend who already raved about you, and you could tell me that puts this trade outside all of it. You might be right, and I’ve been wrong about this trade before, which is how the post started.

Maybe every couple who books you arrives from an app that hides the address altogether. Maybe none of them has ever typed your name into anything.

Make the case. Send me your address, tell me why a warning doesn’t matter for the way you actually get work, and if you change my mind I’ll write the follow up and name the person who changed it.