Top Rated Wedding Photographer, Still Not Secure

It’s the middle of August, so every wedding photographer I know is tired, you included.

Two galleries are late, there’s a wedding on Saturday, and your laptop has been running its fan since June. Your website sits somewhere below “buy more batteries” on the list, and I don’t blame you for that at all.

So I’ll keep this to one client and one switch.

Cara shoots weddings. Four seasons on her own after six years of second shooting, a circuit of barn venues, and a phone that buzzes through dinner.

She called me in the spring wanting a rebrand. New fonts, a new gallery, and the word modern used about nine times in the first five minutes.

What I read before I opened her website

I do the same thing before every one of these calls, which is read the Google reviews first, before I’ve looked at a single page of the site I’m being paid to criticize.

Hers were the best I’d read all year. One bride described what Cara did when the rain came at four o’clock, and a groom’s mother thanked her for a photograph of a man who died that winter.

None of it surprised me. Couples give this trade 4.9 stars on average, and nothing else I audit is rated higher.

Have you read your own reviews lately, all the way down, in the order a stranger gets them?

Then I typed her address in

The site came up. Before one photograph had loaded, my browser had put two words to the left of her name: Not secure.

Browsers stopped treating a secure address as an upgrade years ago and started treating the plain one as a fault. So the browser talks over you, sticking its own opinion where your name should be, and on some phones it throws up a full gray page with a button the visitor has to go hunting for.

When did you last arrive at your own website the way a stranger does, from a search result on a borrowed phone, rather than from a bookmark you made in 2021?

That evening I stacked all 47 trades against each other on that one check, and wedding photographers came to rest at 45 of 47, on 90.8% of the sites I opened.

I counted it twice, because a trade this well liked sitting that low looked more like my error than theirs. For years I blamed abandoned sites a cousin built in 2011, and opening the failures by hand took that story away from me. The report has an explorer near the bottom of it, and picking wedding photographers out of the industry menu while leaving the city list alone rolls the whole trade into one card, with the number of sites behind every rate printed underneath. Same answer both times.

Two results that shouldn’t belong to the same trade

96.3% of these businesses hold at least one Google review, which is about as close to everybody as any check of mine ever gets. Couples love you and they say so in public, at length, using your first name.

And then a machine gets to talk first.

A reputation takes years, a hundred small kindnesses and one afternoon in the rain. The other thing takes a host, ten seconds, and a person who knows the setting is there.

Which of those two did your web designer ever bring up with you? A client asked me the harder version of that once, what she was paying a designer for when couples already rate her trade above everybody, and thirty seconds on a call wasn’t an answer.

The warning isn’t for the couple who already booked you, either, because they’ll click through anything with your name on it once they’ve met you and shaken your hand. It’s for the planner forwarding three names to a client, and for the bride’s mother opening your link on an iPad she’s had since 2016, neither of whom owes you the benefit of any doubt whatsoever.

Those are the people my whole argument is about, and you will never hear from a single one of them.

How many of them do you reckon there have been this season?

What she thought was broken

“So the site looks dated.”

Maybe it does. Dated has never once stopped a bride.

“Then what am I paying you for?”

An afternoon, and one setting I didn’t charge her for.

Her host had a free certificate sitting in the control panel with the switch off. It had been there since the day she signed up, three years earlier, and she’d never had a reason to scroll that far down the page.

Nobody had hidden it from her and nobody had sold it to her. Whoever built the site had finished the design, handed over a login, invoiced for the work and gone on to the next job, which is a completely ordinary way for a website to be born and leaves nobody in particular holding the boring half of it.

Turning it on doesn’t finish the job either. Old links, printed cards, the address a bride types from memory, all of those still arrive at the plain version, and unless the site sends those arrivals over to the secure copy by itself, they meet the warning anyway. Hospitality is the worst I’ve found at that second step, locking the front door and leaving the side gate wide open.

Both settings live in the same panel. Cara did them herself, on her phone, in a car park, while I stayed on the line and told her which words to look for.

Would you rather buy a rebrand you don’t need, or spend eleven minutes on the phone with whoever holds your hosting account?

What happened afterwards

Nothing, for about a month.

Her bookings didn’t jump. Her ranking didn’t move. I’d be lying if I sold you either of those, and I’d rather keep this dull and true.

What changed is smaller than that. She emails gallery links to planners and venues all season, and a planner’s phone no longer puts a warning up in front of her name before the pictures arrive.

An interruption like that is impossible to invoice for and impossible to notice, because it happens in the gap between a recommendation and an enquiry, which is the least visible territory in your entire business.

Would you have spotted it stopping? Cara didn’t, and she was the one who pressed the switch.

Her website was never bad, by the way. Wedding photography sites come out at 74 out of 100 across the ten checks I run, which is 16 of 47 and the better half of everything I audit.

Every wedding photography website I take on now starts in the hosting panel instead of the design tool, because the fonts will happily eat an entire afternoon and this takes ten seconds.

Now ignore everything above

Really. The story, the ranking, all of it is background, and none of it is a job you can do tonight.

One job you can do tonight:

Open your own site on your phone. Type the address in by hand, exactly as it’s printed on your card, the way a bride does at eleven at night. Then watch the top of the screen before your work appears.

If anything at all shows up there, ring your host in the morning and ask them to switch the certificate on and send the plain address across to the secure one. That sentence is the entire request. At most hosts it costs nothing and takes them longer to find your account than to do it. Neither setting is the whole of keeping a site safe, and I’ve written up the rest of what a small one needs.

Not the fonts. Not the gallery layout. Not the About page you rewrote in February and still hate.

And if you’d rather I looked first, send me the address and I’ll tell you which of the two is missing, or that neither of them is and you can go back to editing.