Website Security
Logins, certificates and the practical side of keeping a private price list private.
Read about website security
A wholesale site has to do two opposite things at once. It has to show buyers what you carry, and it has to keep what you charge them away from the public and away from your competitors. Everything else, web hosting for wholesalers included, is downstream of how you handle that split.
Most trades can put their whole website in public and lose nothing. You cannot. Your price to a dealer who buys ten pallets a month is not the price you would ever want a walk-in to see, and it is certainly not something you want a competitor pulling up on a phone in a customer's office.
So the question that shapes the entire site is not which host you use. It is where the wall goes, and what is on each side of it.
The wall gets built out of a shared password. One login, one password, handed to every account, printed on the bottom of an invoice, forwarded around by email for six years. Staff leave and take it with them. Customers pass it to their brother-in-law. By the time you notice, half your industry can read your price list, and one of your retail customers has worked out they were paying double.
The damage is not only the margin on that one sale. It is that you now cannot change pricing without every buyer seeing the change at the same time, and you cannot tell who saw what.
If your trade pricing is behind a single password today, treat that password as public. Plan on the assumption that everyone already has it, because in practice they usually do.
Tell us how buyers reach your trade pricing today. We will map out what it takes to replace the shared password with a login per account, and where the wall between public catalogue and private price should sit.
The instinct is to hide the whole catalogue. That is a mistake, and an expensive one, because a buyer looking for a new supplier searches by product before they ever search by company. If nothing about what you carry is visible, you do not appear in that search at all.
The workable arrangement is boring and it works. The catalogue is public. The pricing is not.
Part numbers deserve a line of their own. Buyers search for the number on the box far more than they search for the description of it. A catalogue page that carries the manufacturer part number as readable text is the cheapest lead source a wholesaler has, and it costs nothing to add.
A downloadable price list feels safer than a web page because it sits behind a link rather than a login. It is not safer. The moment one buyer has the file, it exists forever, on their desktop, in their email, and eventually somewhere you did not intend. Files leak more readily than pages, because a page can be turned off and a file cannot.
Wholesale accounts are not sign-ups. Somebody applies, you check them, you decide. That process is worth building properly on the site, because the alternative is a form that emails you and then sits in an inbox for a week while the buyer goes elsewhere.
A short form that asks for the business name, the resale or tax registration details you require, and who they buy for now. Keep it on a page you control rather than on a third-party form service, and keep it on an encrypted connection, because you are collecting business tax details.
Someone has to look. A wholesale login is access to your pricing, so the approval step is the security control. Automating it away is how competitors end up with accounts under a made-up shop name.
One account, one login, tied to a named person at the business. Not a company-wide password. This is the whole point, and it is the step people skip.
Buyers change jobs and businesses close, and the login outlives both. Look through the list once or twice a year and switch off anything that has not ordered in a long time. You can always turn it back on.
Keep the applications themselves somewhere sensible. Tax registration numbers and trade references are business records worth protecting, and an unprotected folder of submitted forms sitting on the web server is a quiet liability. The website security page covers the general shape of that.
A retail customer checks price. A trade buyer checks availability first, because they have a job booked and a customer waiting. If your site says a thing is in stock and it is not, you have not saved a phone call. You have moved the phone call to a worse moment and made the buyer distrust the site permanently.
There are three honest positions and they are all fine. Pick one and be consistent.
If you go with live figures, that is where a wholesale site starts asking something real of its hosting. Every page view becomes a query, and the connection out to whatever system holds the inventory has to be handled, cached and allowed to fail gracefully. That is a build decision more than a plan decision, but it is the point at which the entry tier stops being automatic.
Everything short of that, a catalogue with a login on it, is still a small site by hosting standards. Shared hosting carries it comfortably, and the number of accounts you have makes very little difference. Two thousand logins that each place an order a month is a quiet website.
We can set up the account applications, the individual logins and the backups a wholesale catalogue needs, and connect live stock if your buyers rely on it. If your current plan already handles it, we will tell you that instead.
If you sell to the public as well as the trade, you are running a shop with a trade counter, not a wholesale operation. That is a different website and usually a simpler one. Build the retail store properly, then add a trade discount on top of it for approved accounts. Trying to run a two-tier private catalogue when most of your revenue walks through the door is work you will not get back.
Some other cases where the answer is to spend less, not more.
Where the money is genuinely worth spending: real per-account logins instead of a shared one, a live link to your stock system if buyers rely on availability, and a proper backup routine because a catalogue rebuilt by hand is weeks of somebody's life. That last one is the least exciting and the most likely to save you. The website backups page explains what to actually ask for.
AldoMedia has built and looked after websites for Western New York businesses since 1999, and distribution sites with a decade-old shared password on the price list are familiar work. We are an independent authorised reseller rather than the operator of the underlying platform, which means we have no reason to sell you a bigger plan than your catalogue needs, and we will say so when the one you have is already right.
If you are inheriting a site somebody else built, start with taking over a website, which covers getting the access back before anything else. Call 716-771-2536 or tell us what your catalogue runs on.
Yes, in almost every case. Buyers looking for a new supplier search by product and by part number long before they search by company name, and a completely hidden catalogue never appears in that search. Show what you carry, including manufacturer part numbers as readable text, and put only the pricing and account-specific information behind the login.
You cannot revoke it for one account without changing it for everybody, you have no idea who is using it, and after a few years it has been forwarded, printed and saved in enough places that it is effectively public. The usual way people find out is a retail customer discovering the trade price of something they were about to pay double for. Individual logins per account fix all of it.
No, and it is weaker than it feels. Once a buyer has the file, it exists permanently on their machine and in their email, and you cannot withdraw it or change it. A page behind a login can be turned off for one account this afternoon. A file that left your building three years ago cannot.
Usually not. A catalogue is mostly text, and text is small. What actually loads a server is showing live stock levels on every page view, or product photographs uploaded at full camera resolution. Fix the photographs first, and if you do need live stock, that is a build question about caching more than a plan question.
Say them in public, on the catalogue page and on the account application. It reads as unwelcoming and it is not. Every enquiry from somebody who was never going to reach your minimum costs your sales desk time and costs the enquirer a disappointment, and both are avoided by one plain sentence.
They move with the site, because they live in the site's own database rather than in the hosting account. The parts that need care in a move are the email addresses on your domain and anything connected to your stock or accounting system. Plan the order of operations before you start, which is what the website migration page is for.
Logins, certificates and the practical side of keeping a private price list private.
Read about website securityThe plan type a catalogue site belongs on, and what the higher tiers actually change.
Read about shared hostingA catalogue rebuilt by hand is weeks of work. What a backup routine should cover.
How backups should workEvery trade we cover is listed on hosting by industry.
Hero image: Trougnouf, CC BY 4.0, via Wikimedia Commons. Cropped.
Tell us how your trade pricing is protected today and we will tell you what it would take to give each account its own login. If your current plan already covers it, we will say so.
Get Your Web Hosting Plan Get help choosing
Or call 716-771-2536 and tell us what the site has to do. If the plan you are already on is the right one, we will say so.