SSL Certificates
Why any page that takes a payment or a booking needs a working certificate, and what one actually does.
Read about SSL
Web hosting for spas is a quiet, easy thing right up to the moment you sell your first gift certificate online. That single decision changes what the site is. You are now taking card payments and carrying a promise you will have to honour months later, and most spa sites are not built for either.
Most spa owners do not think of it that way. A voucher feels like a nice extra, something the front desk has always handled with a card from a drawer. Put it on the website and it becomes something else. You are taking money from a stranger, in advance, for a service you have not delivered, and you are holding that obligation on your books until they walk in.
That is a shop. A small one, but a shop. And a shop has requirements a brochure site does not: a way of taking payment that is actually safe, a record of what was sold and to whom, terms the buyer agreed to, and a way to check a voucher at the desk without guessing.
The failure we see most often is a gift certificate page nobody treated as a shop. A form collects a name, an amount and a card number. It emails the details to the spa. There is no expiry policy stated anywhere, no numbering, no record beyond a mailbox, and the card details have just travelled through email. Every part of that is fixable, and none of it is fixed by the hosting plan.
If your gift certificate page collects a card number and emails it to the spa, we will move that payment to a provider and put the terms in front of the button. Call 716-771-2536.
This is the one part of the page worth being firm about. If a card number is typed into a field on your website and then stored, emailed or logged anywhere in your hosting account, you have taken on a problem far larger than the sale was worth.
The point is not that hosting is unsafe. The point is that handling card data brings obligations, audits and liability that a spa has no reason to accept when the alternative is free and takes an afternoon. Payment providers exist precisely so the number goes to them and never to you. You get a confirmation and a payout. You never see the digits, so you can never lose them.
In practice that means the buyer either goes to the provider's own checkout page, or types into a field the provider owns that is embedded in yours. Both are fine. What is not fine is a plain form on your site with a box marked card number, however it is styled.
If your current gift certificate page emails you card details, stop selling through it today and take the page down until it is replaced. That is worth an afternoon of lost sales.
Everything else on the security side is ordinary and cheap. Your site needs a working certificate so the connection is encrypted and browsers do not warn people off, which is covered on the SSL page. If the site runs WordPress with a booking or commerce plugin, it needs to actually be kept updated, which is the subject of WordPress security. Neither is exotic. Both get skipped.
Online gift voucher sales are not spread evenly. For a lot of spas the majority of the year's online revenue arrives between roughly the end of November and Christmas Eve, and a striking share of it in the last few days, bought by people who are late and in a hurry.
That shapes what matters. It is not raw server capacity. A voucher page is small and a shared plan carries the traffic without noticing. What matters is that nothing on the page is broken during the only weeks it is being used, and that a buyer at eleven at night can complete a purchase without a human being involved.
Buy a certificate from your own site with your own card. All the way through, to the confirmation email, on a phone. Then refund it. Half the faults we find are found this way and nowhere else.
The buyer needs something to give. A printable certificate they receive immediately beats a promise that the spa will email one. Late buyers are buying a thing to hand over, and a receipt is not that thing.
Before the payment button, in words, not in a linked policy nobody opens. Gift certificate expiry is regulated differently from state to state and the rules are not intuitive, so check what applies to you with your own adviser rather than copying another spa's page.
December is the worst possible month to discover the backup has been failing since August. See website backups for what a restore actually involves.
People redeem for months. The page that explains how to redeem, and the phone number for questions about a certificate, should not vanish with the holiday banner.
None of that is a hosting upgrade. It is an hour in October that pays for itself the first time a purchase completes at midnight on the twenty-third.
A package is a bundle of services sold at a single price, and once it is on the site it behaves like a product whether or not you sell it online. People arrive having read a description, and they expect the description to be true.
The usual trouble is drift. The seaweed wrap was dropped last year, the couples package changed length, prices moved, and the page still says what it said. Nobody updates it because updating it means contacting whoever built the site. The customer arrives with an expectation you cannot meet, and the argument at the desk costs more than the treatment earned.
That last point is the one that matters for hosting, indirectly. A site you cannot edit is a site that goes stale, and stale beats slow as a source of lost bookings. If you inherited a site and do not know who controls it, taking over a website walks through getting the keys back.
We will buy a certificate from your own site on a phone, follow it to the confirmation, and check the backups are really running. If everything works, we will tell you that and change nothing.
Two honest limits here, and the second one is important.
A spa website that lists services, shows the room, gives hours and a phone number and links out to a booking system is one of the lightest sites there is. Shared hosting at the entry tier covers it comfortably. Nobody books more massages because the plan has a bigger number on it. If your gift certificates are still sold at the desk and over the phone, that is a legitimate choice and it keeps the whole merchant question off your plate.
Spend more when there is a real reason: the site itself runs the booking calendar rather than linking to one, you sell retail product online, or you have several locations sharing one site. Volume of clients is not a reason on its own.
A medical spa offering injectables, laser treatment or anything performed under medical supervision has advertising and disclosure obligations that a day spa does not, and they change what you are allowed to put on the website. Before and after photographs, claims about outcomes, and who is named as the supervising clinician are all constrained in ways that vary by state. Read hosting for med spas instead. The difference is not the hosting, which is much the same. The difference is that this page is about selling a service you can describe freely, and that page is about a website where the wording itself carries risk. If you do both, treat the medical side as the stricter rule and check your own copy with your adviser.
AldoMedia has built and looked after websites for Western New York businesses since 1999. We are an independent authorised reseller rather than the operator of the underlying platform, so what we can actually do for you is the practical part: get the certificate page off a form that emails card details, make the terms visible before the button, get the site editable by whoever is at the desk, and make sure the backups are real.
If the current site is somewhere you cannot reach, or on a host you inherited with the business, start with a conversation rather than a plan change. Call 716-771-2536 or tell us what the site runs on and we will tell you what actually needs doing, including when the answer is nothing.
Yes, as long as the card number goes to a payment provider and never to you. Either the buyer completes payment on the provider's page, or they type into a field the provider owns that sits inside yours. What you must not do is collect a card number in an ordinary form on your site and email it to yourself. That is the single most common fault we find on spa websites, and it puts liability on you for a sale worth a hundred dollars or so.
It depends where you are, and the rules are less intuitive than most owners expect. What matters for the website is that whatever policy you settle on is written on the page the buyer reads before paying, in plain words, and that the same wording appears on the certificate itself. Decide the policy with your own adviser, then make the site say it. A page that is silent about expiry is the version that causes arguments at the desk.
The traffic side almost certainly, because a voucher page is small and a shared plan absorbs that easily. The part that fails in December is usually not capacity. It is a payment step that has quietly broken since last year, a confirmation email that no longer sends, or a certificate the buyer cannot print. Buy one from your own site in October, on a phone, all the way to the confirmation, then refund it.
Barely, and that is good news. If bookings happen on the provider's system, your site is mostly pages of text and photographs and the entry tier covers it. The two things to watch are that the widget does not load half a dozen scripts before your service list appears, and that you still have your own page describing each treatment. Provider pages rarely get found in search, and they are not yours.
Treat the stricter one as yours. Once medical treatments are in the mix, the wording, the photographs and the way practitioners are described are all constrained in ways that vary by state, and that is a copy problem rather than a hosting one. Start with hosting for med spas and have your own adviser read the site text before it goes live.
No, but it causes more lost bookings than any hosting fault will. Prices move, packages change, and a page that needs a phone call to update stays wrong for a year. Make sure someone on site can change a price and a description without asking permission. If you do not know who controls the site at all, start with taking over a website.
Why any page that takes a payment or a booking needs a working certificate, and what one actually does.
Read about SSLWhat a real backup covers, how often it should run, and what restoring one involves before December.
Read about backupsGetting control of a spa site nobody at the spa can edit, including who holds the domain.
How to take it backEvery trade we cover is listed on hosting by industry.
Hero image: MKFI, Public domain, via Wikimedia Commons. Cropped.
Tell us how your spa sells vouchers online and we will tell you whether the page is safe to keep selling through. If it already is, we will say so and leave it alone.
Get Your Web Hosting Plan Get help choosing
Or call 716-771-2536 and tell us what the site has to do. If the plan you are already on is the right one, we will say so.