Best practices in Online Registration

Best Practices in Online Registration

tm

Table of Contents

3 The Importance of Registration

4 Know Your Customer

Watch Registration Rates Grow with Social Login . . . . . . .4

Optimize Registration on Mobile Devices . . . . . . . . . . .5

Leverage Progressive Profiling to Increase Conversions . . .6

7 Garbage In, Garbage Out Improving Profile Data Quality

Data Validation . . . . . . . . . . . . . . . . . . . . . . . . .7

Email Verification . . . . . . . . . . . . . . . . . . . . . . . .8

CAPTCHA Spam Prevention . . . . . . . . . . . . . . . . . .9

10 Who Are You?

Lost Login Credentials . . . . . . . . . . . . . . . . . . . . 10

User Profile Pages . . . . . . . . . . . . . . . . . . . . . . 11

12 Registration Infrastructure

Supporting Multiple Social Networks . . . . . . . . . . . . 12

Terms of Service . . . . . . . . . . . . . . . . . . . . . . . 12

Database Schema . . . . . . . . . . . . . . . . . . . . . . . 13

Storing Unified Data . . . . . . . . . . . . . . . . . . . . . . 13

Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Load Handling . . . . . . . . . . . . . . . . . . . . . . . . . 14

16 Conclusion

http://www.janrain.com

Copyright © 2012 Janrain, Inc. All rights reserved. Best Practices in Online Registration | www.janrain.com | 888.563.3082 PG3



A thriving online presence requires the seamless

integration of multiple elements to deliver

an exceptional experience for your site visitor, while also meeting your business

goals. A sophisticated user management platform must support many steps within

the user journey to maximize the site experience. A powerful user management

platform removes hurdles for both end users and business owners, and enables

you to leverage the knowledge and insights gained to deliver the best possible

value to the site audience.

The first critical component of a user management platform is the registration

flow, which acts as the point of entry into your site—where the anonymous visitor

becomes a registered user. This is the moment where site visitors transition into

high-value assets. While online user registration systems can seem deceptively

simple when you consider only the high-level elements (such as form fields, opt-in

boxes, a database of registration records, etc.), there are many opportunities along

the way where things can go wrong. Low conversion rates, users leaving your site

without engaging, and blatantly falsified registration data are obvious symptoms of

a broken registration system.

The cost of building and maintaining the optimal registration system can be high

from a resource perspective, especially if it includes the lost opportunity that

results when your account creation flow is frustrating or leads users to input

false information, like 88% of consumers have admitted to doing. In this paper,

we’ll reveal and discuss key elements of a successful user registration system,

providing direction as you evaluate options to upgrade your existing system.

The Importance of Registration

86% of people have admitted to leaving a site when asked to register with a form

88% admit to providing false and incomplete information .

Know Your Customer

Know Your Customer Grow Your User Base With a Better Registration Experience

One of the key objectives of any registration system

is to collect information on site visitors, not only to

identify who is coming to your site, but to help you

make informed decisions about the site design and

content. Marketers also find value in user profile

data, which they can use to better understand their

audience, how they’re using the website, what

products they like, their offline interests, and who is

in their social networks.

Watch Registration Rates Grow with Social LoginImproving registration conversion begins with

improving the user experience and reducing

“friction” in your “conversion funnel” by removing

obstacles along the way that can lead your users to

abandon your form and leave the site. Third-party

research reveals that 86% of consumers have left a

site when asked to register with a registration form

and forced to create and remember yet another

username/password combination.

Organizations of all sizes and across industries have

increased their registration rates by up to 50% just

by offering social login as an option at registration.

Social login gives visitors the option of using an

existing account with Facebook, Google, Twitter,

LinkedIn, and other providers to quickly register at

your site. Leveraging an existing account and profile

with these popular identity providers means you

can easily authenticate website visitors, collect the

necessary data to begin building a profile, and let

them more quickly participate in the activities that

originally brought them to your site.

Ideally, your registration solution should support

a mix of social and other identity providers (IDPs)

that’s appropriate for your site and audience. For

example, consider whether you are managing a B2B

or B2C website, or what accounts your users are

TIP 1 77% of consumers want social login as an option to register . Offer it and watch conversion rates grow .

Best Practices in Online Registration | www.janrain.com | 888.563.3082 PG5Copyright © 2012 Janrain, Inc. All rights reserved.



likely to already have (that make sense in the context

of your site). With a B2B site, leveraging Google Apps,

SalesForce.com, or LinkedIn as providers can give you

more business-focused data for marketing and site

registration use. Once you have launched social login

on your site, review your login counts by provider, and

rank order choices to find the optimal offer for your

audience. Make sure that you have linked the users to

another provider or to a conventional account before

removing the underperforming provider to prevent

account orphaning.

Each website’s audience will adopt social login to

a different degree, so it’s important to consider

offering a traditional username/password

registration for those who still prefer that option.

Offering them side-by-side, with clear descriptive

language, provides the ultimate in choice, flexibility,

and user control.

Optimize Registration on Mobile DevicesMobile and tablet devices represent a rapidly

growing percentage of new and returning users,

who will expect full functionality at your site.

Failing to provide an optimal experience for these

users can result in significant drop-off in visits and

conversions, as users struggle with common hurdles

of a smaller screen: small links, buttons, fields, and

keyboards. Beyond “Fat Finger Syndrome” (and

its related data entry and navigation challenges),

there is also the consideration that mobile browsers

have different set of technical requirements than

their desktop counterparts. Ensuring that the user

experience on a mobile device meets your users’

expectations begins with correctly designed CSS,

and can even include a separate set of UI elements

to be swapped in via user agent detection (browser).

An example of a good candidate for a separate UI

would be any page that requires too much scrolling,

or scrolling that is not intuitive to the experience.

Removing points of registration/authentication/

navigation friction peculiar to mobile devices can

have significant impact on conversions as well as on

repeat visits.

Just like your entire mobile site, your registration flow

should be optimized for the mobile web with small-

screen use cases in mind. Having a well-implemented

social login option for mobile-enabled sites removes

Know Your Customer

Optimize registration on your mobile apps and website to reduce frustration and increase account creation . TIP 3

Don’t assume everyone wants to log in with Facebook or Twitter . Find the right identity provider mix for your audience .

TIP 2

a common mobile registration frustration by potentially

limiting the fields of entry down to one to two for the

selected identity provider.

Leverage Progressive Profiling to Increase ConversionsIn any new relationship, it takes time to get to know one

another and build trust before feeling comfortable

enough to reveal more personal information than the

basics. The relationship with visitors to your site is no

different. They may not be ready and willing to share

their home address, birthday, or friends’ names—

personal details—with you during their first visit to

your site.

Progressive profiling refers to an incremental approach

to collecting profile data from website visitors. Using

this method, you request smaller snippets of user

profile data at carefully staged opportunities. So rather

than being asked to complete a long form, or submit

volumes of personal information up front, the user has a

smoother and more comfortable experience. In this way,

progressive profiling builds consumer trust over time,

which encourages the sharing of information, and allows

you to collect more accurate user profile data while

maintaining a higher conversion rate.

Born in the world of B2B marketing, progressive

profiling is growing in use with consumer brands

as well. This approach is particularly valuable when

users engage with your website repeatedly, over a

span of weeks or months. It requires building some

conditional checking into your sign-in workflow

and forms so your site can correctly gauge when to

prompt a user for specific additional information.

Opportunities to request additional profile information

include user events such as sharing content or

products to a social network, finding friends who are

also on the site, rating a product or leaving a review, or

even revealing more localized content.

Another example of progressive profiling in practice

is offering an exchange of value. This is where you

offer your users a quid pro quo by granting them

access to a download, a discount, additional site

features, or some similar benefit in exchange for

sharing additional information about themselves. If

what you’re offering can be directly correlated to the

information you’re requesting, your success rate will

improve. The bottom line is to be clear about what

data you are asking for and why you are asking for

it, and to make sure that the context for the requests

is appropriate to the the users’ actions or value

exchange messaging.

PROGRESSIVE PROFILING

Know Your Customer

Request minimal information at the initial point of registration, and look for opportunities to request additional snippets of data over time to progressively build user profiles .

TIP 4

Improving Profile Data Quality

A database is only as valuable as the quality of data

within it, and with 88% of consumers admitting that

they have provided incomplete or false information on

traditional registration forms, your database may not

contain the quality data you need. Poor data quality

can cost an organization 10–20% of annual revenue in

lost sales, ineffective direct marketing, administration

overhead, and preventable shipping errors.

One approach to improving data quality is by

offering social login. People typically keep

their social profile details current, as well as

representative of their authentic self, since these

are channels through which they communicate with

family, friends and co-workers. When site visitors

choose an existing identity using social login to

create an account, you can rest assured you are on

your way to building a user profile that is rich with

accurate, actionable information.

Providing a means for users to automatically and

manually map social accounts with their existing site

user records can help you to avoid duplicate records

while giving you the opportunity to gather accurate

user intelligence from outside sources. With user

profile pages, you can allow people to self-manage

their public and private profiles on the site, as well

as allow them to map multiple social profiles to one

user record. This also gives registered users an

opportunity to provide additional data they want you

to have, details of their persona they may want to

share with other members of a community in their

public profile, and allows them to more seamlessly

carry out some action like sharing.

Data ValidationBuilding sensible data validation rules right into

your registration system is another important

consideration. Our recommendation is a hybrid

strategy that includes a two-part approach for

validation of standard fields built in to your

registration system, including length and type

validation at the front end, paired with the

appropriate database constraints on the back end.

An example of a front-end validation task for sites

that are available to younger users, or that need

be compliant with the Children’s Online Privacy

Protection Act (COPPA) standards, would be to parse

suggested usernames through dirty word filters to

ensure that they don’t contain offensive words.

When leveraging social login on your site, you not

only smooth the user’s return experience, but you

can access profile data during registration to pre-

Garbage In, Garbage Out Improving Profile Data Quality

Improve the quality and depth of your user database by tapping into social profiles .TIP 5

populate a form which then just needs validation by

the user. When taking this approach, you want to

include clear messaging before and after the social

authentication about the data you want to access

and how doing so is a benefit to them, or you will

confuse most users and thus degrade their on-

site experience. Upon each return visit to the site,

changes to their social profile should refresh the

profile fields in your database to ensure you always

have the most current information.

Email Verification Adding an email verification step to the registration

flow has become a common step to ensure your

new user is human and is providing a valid email

address at which you can later contact them. This

is an important exercise for marketers in the pursuit

of data integrity, and an efficient use of marketing

dollars spent against ensuring database quality.

Unfortunately, for most website visitors, this

places yet another obstacle between them and

the action they wanted to take on your site, and

creates additional opportunity for them to leave.

Our recommendation here is to use this two-

step verification only when necessary (contest

registration, for example). If you have other

verification methods in place, like CAPTCHA or

social login, you can usually forgo this additional

step in the registration process.


Pre-populate fields with as much data as possible and ask users to confirm the accuracy to ensure high quality data without requiring them to enter the data .

TIP 6

Networks that provide verified email addresses

Facebook

Google

Yahoo!

Windows Live

PayPal

Salesforce

LinkedIn

When users choose an identity from Google,

Facebook, Yahoo!, LinkedIn, or another provider to

sign in, they are also providing you with a verified

email address which removes the necessity of

this additional burden. Make sure you request

permission to access the email address, and if you

need to make the user choose a specific email

address (such as a business-related one), pre-

populate their account creation form with this data

so they don’t need to enter it themselves.

Samsung reported a 34% increase in email open

rates and 63% increase in email click-through rates

as a result of improved email marketability of their

user database with social login. With more than

40% of new registrants choosing to use social login

to register at their site, this gives them access to

a verified email without the hassle of the two-step

verification they previously used.

CAPTCHA Spam PreventionData integrity and quality concerns also apply to

user-generated content. Though it is too expensive

to hand-moderate every post and comment, there are

a few basic steps that you can take to prevent rampant

abuse of your public spaces. The first is requiring

registration and authentication before allowing posts/

comments, and another is some sort of human-

verification (Turing test) tool for first time registrations.

Many of the tools for incorporating a Turing test into

your site (such as CAPTCHA) are free, but the task

of implementing them and staying on top of new

releases is not. Ensure that your registration solution

supports CAPTCHA functionality “out of the box” to

reduce your development burden.


Remove the email validation step in your main registration process by requesting a verified email from social providers with social login .TIP 7

Improve Your Registration Experience

When users get frustrated while trying to sign up for

an account or sign in to your site with a username

and password they’ve forgotten, they have three

options: keep trying and let the frustration increase,

ask for help (if available), or leave your site. All three

options are costly for you as you’ve either lost a

potential sale, or will spend resources to help them

remember or reset their password. One important

goal of any registration system must include

improving customer service for these very reasons.

Lost Login CredentialsWith 40% of people admitting to using the Forgot

Password feature at least once a month, this is a

growing challenge for users as they create more

username/password combinations across the web (or

worse yet, re-use the same credentials). People have

come to expect an easy way to get access to your

site when this happens, or they will potentially leave.

Having a secure method for verifying your users’

requests for lost credentials, and taking the

necessary steps to integrate it into your existing

registration flow, must be part of the registration

system design stage. In order to keep the trust you

have worked hard to build with your audience, take

the necessary steps to avoid exposing information

(such as passwords) that would leave users

vulnerable to a potential breach.

The most universally applicable best practice for

password resets is sending a one-time-use link to a

secure page on your site, where the user can reset

the password, to their primary email address. Never

include users’ passwords in an email when they

request a password recovery, register for the first

time, or reset their password.

With social login enabled on your site, you remove

the hurdle of remembering an additional username

and password, thus removing the additional

Who Are You?Improve your registration experience to enhance customer service

Key considerations for your Forgot Password flow must include ease and security with which users can retrieve or reset their password .TIP 8

2 in 5 feel that scrubbing a toilet would be better than coming up with a new password

Forgot Password obstacle to entering your site,

and potential customer service resources. When

shoppers at a commerce site, in particular, are

ready to buy and can’t remember their username or

password, the easier option is to leave and purchase

at another site that solves this problem for them, or

check out with a guest account, which leaves you

little quality contact data to use in future marketing

programs. The best practice for preventing this

dilemma is to encourage users to choose the social

option for creating an account on your site, and

having them easily reuse that identity on return visits.

User Profile PagesToday’s users, being savvy about the web and social

media, expect to be provided with tools to manage

the data they share with you and the public and to

control how and when you or other site users can

contact them. When your site includes community

features like blogs, comments, or reviews, people

will always want the ability to manage their public

persona on your site. This is best done through a

profile page that enables them to change their vital

stats, interests, notification methods and frequency,

avatar image or photo, etc. Giving users control

over their profiles (both public and private) in this

way can help people be more comfortable sharing

information with you, and in turn decrease the

amount of inaccurate profile data you collect.

Profile management screens should, at minimum,

provide the ability to specify information as public

or private at a field level, the ability to change their

password if applicable, and manage the social

identities they have associated with their profile.

Improve Your Registration Experience

Offer users profile pages to manage what personal data is public or private, and to map additional social identities to their profile on your site .TIP 9

Registration Infrastructure

World-class registration systems don’t just happen

by accident, nor do they come for free. Creating a site

experience that supports the business objective of

converting anonymous site visitors to registered users

requires strategic planning and critical consideration

of all aspects of the registration infrastructure. Proper

attention to the details of your registration flow will

help to reduce user frustration, protect the data you

collect, and future-proof your solution.

Supporting Multiple Social NetworksAs was previously mentioned, presenting more than

one option for social login is important. So if you’re

planning to implement social login on your own and

not use an “off-the-shelf” solution, it’s important to

consider the number of disparate social network

APIs your developers will need to learn, support,

and maintain. Each social network has its own set

of APIs, which can result in significant up-front

development costs and ongoing code maintenance

of your site to keep pace with changes to each

social network API.

The optimal solution for this challenge is an

abstraction layer or single, unified API that handles

all social network interactions for your site,

eliminating the need to learn any specific social

network APIs. The additional peace of mind—

knowing that your direct API connection won’t break

as providers make updates or changes—means

less resources dedicated to the mundane task of

ensuring that your customers can still access their

accounts and new visitors can still sign up with

those third-party credentials.

Terms of ServiceAn important step when registering a new user

is to capture his or her acknowledgement and

acceptance of your terms of service (TOS). It seems

pretty straightforward; and it can be, at least the

first time. But if your organization needs to update

those terms of service, you’ll need to ensure that

your users have accepted the most recent version,

and store that information, and do so in a way that

doesn’t annoy them with another box to click, and

possibly drive them away from your site.

Ensure that your registration system can

track updates to your TOS automatically, and

consequently remind customers to acknowledge

these updates as part of your normal sign-in flow

if they haven’t already. Not all systems include this

functionality, and it’s easy to overlook its importance

until a problem arises. So, include this on your

checklist of requirements.

Registration InfrastructureBehind the scenes of a best-in-class registration system

Consider a single unified API to manage and support multiple network APIs . TIP 10

Database SchemaWhen thinking about ways to ensure data integrity

within your registration system, it is imperative to

enforce structure and rules for profile information

that is stored by leveraging data types and a well-

designed schema. A carefully-defined schema

typically results in more-accessible data, which

makes for faster and easier queries and more-

granular customer segments. Having a well-thought-

out schema also better enables the feeding of user

profile data into different systems (such as email

marketing, business intelligence, or personalization

engines) for targeted campaigns, better business

decisions, and more effective programs. When

designing your schema, be sure to include all the fields

you need to record, use the correct data types for all

fields, and don’t try to use the profile store for more-

granular transactional data (such as raw clickstreams).

Storing Unified DataConventional profile data, when combined with

social profile data and other user information, can

provide a full 360-degree view of your users that

can then be leveraged to maximize digital marketing

efforts and enhance the site experience of those

users (both directly and indirectly).

Strategically designing your user store today, to

account for the data returned by the variety of social

networks that you’re likely to support tomorrow, can

present a challenge. Having a unified API that also

normalizes the data from the various providers into a

single format is extremely helpful. Pre-planning your

schema to be capable of accepting all of the data


Make sure your registration system monitors updates to your TOS to effectively manage the appropriate user acknowledgements .TIP 11

Future-proof your user database by planning your schema today for tomorrow’s unidentified needs so that you can maximize the usability of the data you collect .

TIP 12

that each of the providers can return is critical to

the smooth growth of your integration, whether you

choose to act on that data today or not. Also make

sure to store the data from the different providers

side by side, without overwriting similar fields’

values (email for example).

Even if you’re not currently planning to store

information about your registered users beyond their

authentication details, you still need to consider a

solution that provides an easy migration path for

when your business needs change, and the ability

to store richer user profiles (not to mention mine

such data for targeting and segmentation) becomes

important. In short, your registration and database

solution should ensure that you have a clear

path to future expansion and expression as your

requirements change, and the flexibility to handle

unexpected integration requirements.

PasswordsBy now everyone knows that you need to encrypt

your users’ sign-in credentials, but how do you

handle encryption considerations when importing

and migrating user data?

All too frequently, media headlines share news of

some high-profile website’s account profile system

being hacked and the credentials getting into the

wrong hands. In order to combat this, account

data must be encrypted well enough to withstand

brute-force attacks that are the inevitable result

of garnering a large base of user information.

The encryption should always be handled

programmatically, and password comparisons should

always be handled in an encrypted state.

However, sometimes user stores need to be

merged or users migrated from legacy systems.

These scenarios can present significant challenges

to staying compliant with best practices, and

sometimes legislation, related to data-handling

and maintaining a good user experience. The two

most common solutions, since de-encrypting the

passwords is not a best practice (or legal in some

jurisdictions) are to:

1. Ask your users to choose a new password

(which creates a poor user experience)

2. Programmatically re-encrypt passwords

(which is time consuming, involves significant

downtime, and may create a compliance issue)

A user store that can support password hashes at

the user record level eliminates the need to force

users to change their passwords, or to schedule

significant downtime and develop some sort of

re-encryption routine. Since passwords can be

migrated while still encrypted, along with the

hashing keys that encrypted them, your users and

their data can transition seamlessly.

Load HandlingIf your business holds online events or promotions

that might (hopefully) cause a surge of traffic to

your site, it’s important to architect and provision


Protect your business, reputation, and user data security by never transmitting passwords unencrypted or revealing them via email .TIP 13

your code and infrastructure to withstand spikes in

registration and sign-in activity. Do you know how

many concurrent transactions your authentication

and registration system should be able to support?

Or how your page loading times will be affected

during such peaks?

One technique for shortening load times is to

leverage the browser’s ability to load code and

resources asynchronously, by placing properly

designed JavaScript in the HEAD of the web page.

The HEAD section often loads fastest by a significant

margin on many modern, dynamic pages. Using one

of several “non-blocking” design patterns prevents

the JavaScript execution from delaying (blocking)

other content from being loaded or rendered. A very

basic example of one way of achieving this idea is

using the defer attribute on <script> tags:

<script type=”text/javascript” defer src=”foo.js”></

script>

Widgets should be loaded as static content from a

content distribution network that puts them relatively

close to the user. Also, correctly using CSS3/HTML5,

and not loading widgets or other dynamic elements

within iframes, can speed up load times even more.


Plan today for potential surges in site traffic related to marketing promotions or events to ensure your registration systems have been designed to deal with peak loads .

TIP 14

First Name*

Last Name*

Email Address*

Re-enter Email Address*

Birth Date*

Another Tedious Question*

Username*

Password*

Re-enter password*

YesN o Conclusion

Clearly, there are many critical elements to consider

when developing or updating an online

user registration system. Simultaneously attempting to reduce friction in order to

increase your user base, while still collecting the information you need about your

users, requires a very deft approach. Ensure that your site’s design elements and data-

collection workflow blend together to increase conversions and foster trust from the

users whose information you seek to acquire.

As a final suggestion, to free your development resources to focus on the core

competency of your business, consider implementing a user management platform

solution for which design and workflow considerations have been market-tested by

major brands, and refined over time to provide best-in-class approaches to user data

collection, validation, and infrastructure.

About Janrain

The Janrain User Management Platform (JUMP) helps organizations succeed on the social web by providing leading

technology to leverage the popularity of social networks and identities for user acquisition, engagement, and

enhanced customer intelligence. Our solutions, including social login, social sharing, social profile data collection

and storage, access to the social graph, and digital strategy services, improve the effectiveness of online marketing

initiatives for leading brands like Fox, Universal Music Group, Whole Foods, MTV, Purina, Samsung, Macy’s and Dr

Pepper. Founded in 2005, Janrain is based in Portland, Oregon. For more information, please call 1-888-563-3082 or

visit www.janrain.com and follow @janrain.


http://janrain.com

Best practices in Online Registration

Documents

Transcript of Best practices in Online Registration