SSL Certificates
Why every page carrying a contact form needs a working certificate, and how to tell if yours is doing its job.
Read about SSL
The first legal act your website performs is a disclaimer. Before it sells anything, it has to tell a stranger that writing to you does not make them a client and does not make what they wrote confidential. Get that wrong and your website hands you a problem that web hosting for attorneys cannot undo.
Most attorney websites carry some version of the line. It usually lives in the footer, in small grey type, next to the copyright year. That placement is the problem. A notice is only doing work if the person reads it before they act, and nobody scrolls past a contact form to read the footer first.
Two ideas need to reach the reader, and they are separate things. One, sending you a message does not create an attorney-client relationship. Two, what they send is not confidential and is not privileged until you have agreed to represent them. People understand the first one instinctively. Almost nobody understands the second.
If you can, add a checkbox the visitor has to tick to say they have read it. That turns a passive notice into a deliberate act, and it slows people down at exactly the right moment. Your own adviser or your bar's ethics counsel can tell you what is expected in your state. Treat the version here as the shape of the problem, not as advice.
We will move the disclaimer above your contact form, set it in the same type as the field labels, and cut the message box down so it invites a sentence instead of four paragraphs of case detail.
Here is the failure, concretely. A prospective client finds you at eleven at night, believes the contact form is private because it says "confidential consultation" at the top of the page, and types out four paragraphs of detail: names, dates, dollar amounts, what their spouse or business partner did. You open it the next morning and read it before you know who anybody is.
You now hold unsolicited confidential information about a matter where the other side may already be your client, or may want to be. That is not a hosting problem and no plan tier fixes it. It is an intake problem that your website created, and the website is where you fix it.
The form should collect a name, a way to reach them, the other parties involved, and one short line about the type of matter. Not the story. Every extra open text box on that form is an invitation to tell you everything.
Label the message box in a way that sets a limit. "Briefly, what kind of matter is this?" gets a sentence. "Tell us about your case" gets four paragraphs and a scanned exhibit.
Whoever handles intake should be able to look at names and matter type without reading the narrative. If you are solo and there is no whoever, build the habit anyway: check the names first, then read.
Have a standing answer for the ones that arrive already conflicted. Knowing in advance what you delete, what you retain and what you say back is worth more than any wording on the page.
Do not put a document upload button on a public contact form. It converts a casual enquiry into a delivery of case material, and it puts other people's records on a web server for no reason you can defend later.
The form also has to be encrypted in transit, which is the one part of this that genuinely is hosting. Every page that carries a form needs a working certificate, and the browser needs to show it. Our SSL certificates page covers what that involves. It is table stakes, not a feature, and if your site is still serving a form over an unencrypted connection, fix that this week.
This is the part attorneys tend to know in the abstract and forget in practice. Your website is lawyer advertising. The rules that govern what you may claim in a printed ad generally govern what sits on your homepage, and in some states they reach further than people expect: the words you use to describe your experience, whether you may call yourself a specialist, what a client testimonial has to be accompanied by, whether past results need a caveat, and which jurisdictions you are actually admitted in.
Rules vary by state and they get revised. We are not going to quote one at you. What we can tell you is which parts of a website tend to be the ones flagged, because they are the same parts every time.
Run the finished copy past your own adviser or your state bar's ethics line before it goes live, and again after any rewrite. It is a short conversation and it is much cheaper than the alternative. A web company, including this one, is not the right source of truth on this.
Nobody searches for a law firm. They search for their problem, in their own words, usually badly spelled and usually at a bad hour. They type what happened to them, not what you call the area of law.
A single page listing eight practice areas as bullet points answers none of those searches. Eight pages, each one about a single kind of problem, written the way the person experiencing it would describe it, answers all of them. That is the whole of what people mean by SEO for a small practice, and it is content work rather than hosting work.
That last one converts better than anything else on the page. Telling somebody plainly that their matter is not yours and pointing them somewhere useful reads as competence, and the ones who are a fit trust the rest of the page more for it.
Eight real pages beat eighty thin ones. If a page has nothing in it but the practice area name and a paragraph of filler, it is a liability rather than an asset.
Tell us what your practice site runs on and we will handle the certificate, the backups you have never tested, and moving client mail off the website. If what you already pay for covers it, we will say so.
Less than you would think, and that is worth saying without hedging. A solo practice website is a small number of pages that change a few times a year. Nothing about it is technically demanding.
Shared hosting is the right product, and the entry tier is normally genuinely enough. What matters is not the size of the plan but three unglamorous things: the certificate works, the site is backed up somewhere you can restore from, and the email is reliable and separate from the website.
That last point deserves attention. Client correspondence should not depend on the same thing your marketing site depends on. Keeping business email on a proper mail service, at your own domain, means a website rebuild or a host change never touches your inbox. It also means you are not conducting client communication from a free consumer address, which looks exactly as it sounds.
For backups, the thing to check is not whether they exist but whether you have ever restored one. An untested backup is a belief, not a plan. The website backups page explains what a usable one looks like.
If you have staff, this page is aimed at the wrong practice.
Everything above assumes one attorney, or two, reading their own enquiries. The moment there is a paralegal, a shared mailbox that several people open, or a formal intake process with a script, the problem changes shape. It stops being about the wording above a contact form and becomes about who has access to what, who is authorised to run a conflict check, what happens to client documents once they arrive, and how mail is retained. Our hosting for law firms page is written for that situation. The difference is not size for its own sake. It is whether more than one person touches an enquiry before it reaches a lawyer.
Staying on this page, here is what a solo practice does not need to buy.
Where spending more is justified: you take payments on the site, you host a portal or a document exchange, you run a practice management system that has to be reachable from the web, or your site carries genuinely sensitive material. Those are real reasons. Volume of clients is not one, and neither is the seriousness of the work.
AldoMedia has built and looked after websites for Western New York businesses since 1999, and solo practice sites are familiar work. We are an independent authorised reseller rather than the operator of the underlying platform, which means we have no reason to talk you up a tier you do not need, and we will say so when the plan you are already paying for is the right one.
We will not advise you on your bar's rules and you should be wary of any web company that offers to. What we can do is make the notice sit where people read it, make the form ask for less, keep the certificate valid and keep your email out of the blast radius. Call 716-771-2536 or tell us what your site runs on.
It is better than nothing and worse than most attorneys assume. A notice only does work if the reader sees it before they act, and nobody scrolls past the contact form to read the footer. Move it directly above the form, set it in the same size type as the field labels, repeat it on the thank-you page, and consider a checkbox the visitor has to tick. Whether the wording meets your state's expectations is a question for your own adviser or your bar's ethics counsel, not for a web company.
That is the situation the intake design is meant to prevent, and it is common. The practical fixes are all upstream: ask for names and matter type rather than the story, label the message box so it invites a sentence and not four paragraphs, and run the conflict check on the names before anybody reads the narrative. Decide in advance what you do with a message you cannot take, including what you retain and what you say back. Handling any specific message you have already received is a matter for your own counsel.
Sometimes, with conditions, and the conditions vary by state and get revised. Testimonials, verdict figures, superlatives such as best or top-rated, and any claim of specialisation are the parts most often flagged. Write the copy, then run it past your own adviser or your state bar's ethics line before it goes live, and again after any rewrite. Never take a competitor's website as evidence that something is permitted.
Not through a public contact form. An upload button turns a casual enquiry into a delivery of case material, and it puts other people's records on a web server for no good reason. If you genuinely need document exchange, that belongs in a proper portal or a practice management system with real access control, and it is a decision worth making deliberately rather than by adding a field to a form.
Less than most are sold. A dozen pages and a contact form is one of the lightest things you can put on a server, so an entry shared plan usually covers it. Put the money into three unglamorous things instead: a certificate that works on every page carrying a form, backups you have actually restored once, and business email kept separate from the website so a rebuild never touches your inbox.
No, and this is where most of the missed work sits. People search for their problem in their own words, not for the name of a practice area, so a single bullet list answers none of those searches. One page per kind of matter, written the way the person living through it would describe it, answers all of them. Eight real pages beat eighty thin ones.
Why every page carrying a contact form needs a working certificate, and how to tell if yours is doing its job.
Read about SSLKeeping client correspondence at your own domain, and separate from whatever happens to the website.
Read about business emailThe difference between a backup you have and a backup you have actually restored.
How backups should workEvery trade we cover is listed on hosting by industry.
Hero image: Aklaklakl, CC BY-SA 4.0, via Wikimedia Commons. Cropped.
Tell us what your practice site runs on and we will tell you whether the plan you are paying for is the right one. If it already is, we will say so.
Get Your Web Hosting Plan Get help choosing
Or call 716-771-2536 and tell us what the site has to do. If the plan you are already on is the right one, we will say so.