The Address Plumbers Never Type Is the One That’s Broken

You’re not in the mood for another list of things wrong with your plumbing website. Fair enough. I wouldn’t be either, not on a Thursday, with a part on order and a callback from Tuesday still sitting on the passenger seat of the truck.

So one thing instead. Five minutes tonight, no login required, nobody sending you an invoice afterwards.

I run an identical list of checks over every small business website I open, and by now the pile of them is embarrassingly large. On the one asking whether a website carries an insecure visitor across to the secure copy, plumbing came to rest at 83.7%, 44th of 47 trades. Nothing else I run drops your trade anywhere near that far.

An hour of one person’s time, and I doubt it appears anywhere on the quote you’re sitting on. Have you ever seen it written on one?

Your website answers to two names

The first begins with https, with the s on the end of it, and a browser considers that version safe enough for a customer to type her phone number into without any comment whatsoever.

The second is the identical name with the s missing. It exists whether anybody meant to create it or not, and it’s the version printed on your older paperwork.

When I check this by hand I open a browser window that has never met me, so my own history can’t quietly do me a favor, and then I type the name with the s deliberately left off. On a website configured properly, the s arrives in the bar by itself, before the page has finished drawing. On the ones I marked down nothing moves whatsoever, and the bare name sits there with a small warning parked exactly where the padlock belongs.

Which is why owners never discover it for themselves. Your phone memorized the secure version of your name years ago and it has been quietly correcting you ever since. When did anybody last open your website from a phone that wasn’t yours?

Do it while the kettle’s on

Open a private window on your phone. Chrome calls it Incognito and Safari calls it Private, and either one begins with absolutely no memory of you.
Type your website’s name exactly the way it’s painted on the van, with no https in front of it, and go.
Look at the top of the screen. Padlock, or warning?
Now run the whole thing again with www on the front, because a website can be configured to catch one spelling of the name and completely ignore the other.

A padlock both times and you’re finished, so go back to whatever I interrupted.

A warning either time and you’ve got a telephone call to make in the morning, and it isn’t to a web designer.

Who is still using the old address?

You’re about to tell me nobody spells out a web address letter by letter anymore. True enough, and I’d have said it myself from the seat of your truck.

But your old address is printed on physical objects, and none of them are coming back for a rewrite. Could you list everywhere yours appears, off the top of your head?

The sticker you slapped on a water heater in 2019 is still on that water heater, and so is the one from the owner before last, on a tank you’ll get called out to sometime this winter.

The magnet on someone’s fridge. The invoice pad. The lettering on the van you sold to your brother in law. A supply house directory nobody has logged into since the fellow who built it retired.

Every one of them points at the bare name.

A homeowner taps it, nothing carries her across, and Chrome has flagged plain addresses as not secure since 2018. On some visits she gets an entire screen of warning before she reads a single word about you.

Picture exactly where she’s standing. An inch of water on the kitchen floor, a towel wrapped around her ankle, ten past nine at night, and yours is the third name on a search she started in a panic.

Does she read the browser warning carefully, or does she go back and tap the fourth name?

You might be thinking you don’t take payments online, so none of this reaches you. I hear that everywhere, and in Kelowna I took that objection seriously and then took it apart.

Nobody in your trade chose the certificate

I’ll give the trade this much.

Certificates arrive free with hosting now and switching one on is a checkbox, which is why 94.2% of plumbing websites serve a secure page without a single owner deciding anything. Nationally it’s 94%, and nobody earned that one either.

Hotels and restaurants split even wider than you do. Nearly every one of those sites serves a secure page, and far fewer carry the insecure visitor across to it.

The hand-off is an entirely different sort of job. Someone has to instruct the server that every arrival on the bare name gets moved over to the secure one and kept there permanently, and Google asks for the permanent variety by name.

Depending on the company keeping your website online, that’s a single line in a configuration file, or a box you tick on a hosting panel. It isn’t a rebuild and it certainly isn’t a design job, which is why it never appears on a quote, and why 88% of the websites I audit already have it while the remainder have no idea they don’t.

Electricians sit near the bottom of my whole list on the padlock itself, and the ones whose addresses never break share four ordinary habits. None of the four is technical.

If you’d sooner look than take my word for any of this, the explorer near the bottom of my report will roll up an entire trade at once: set the industry box, leave the city box showing every city, and every rate comes back with the number of websites printed underneath it. I do exactly that to myself whenever a result arrives looking too tidy to be real. I opened 1,653 plumbing websites to build that card, and the redirect check is the one I ran a second time because I refused to believe it.

Most of what I build these days is for trades that get telephoned at midnight, and I’ve never handed over a plumbing website without this arranged on the day it went live. An hour covers it, and no homeowner ever meets a warning screen with your name above it. Would your builder know how, if you rang him this afternoon and asked?

Two names, one certificate, and the hand-off between them. Keeping a website safe is mostly a handful of jobs like that, and not one of them is interesting enough to sell you.

Now tell me your trade is different

Here’s the part I keep chewing on.

You work in the one trade where people find you in an emergency, off a magnet, off a sticker on a tank, off whatever name happens to be nearest while the water is rising. I’d have bet money on plumbers finishing ahead of every other trade I audit on this one.

The numbers disagree with me, and I’d love to be talked out of it.

So argue with me. Run those four steps, and if the padlock appears both times, write and tell me I’ve got your trade wrong, and I’ll say so out loud.

And if the warning shows up instead? Send me the address and I’ll open it from a phone that has never met you, then tell you which of your two names is quietly letting you down.

Better you hear it from me than from a woman standing in a puddle.