--- title: "Blog | Phát Lâm" url: https://phatdev.net/en/blog lang: en updated: 2026-10-21 alternate: vi: https://phatdev.net/vi/blog markdown: https://phatdev.net/en/blog.md --- # Blog Technical notes drawn from real projects: frontend, backend, AI, security, SEO, media and mobile apps. ## Categories - [Frontend](https://phatdev.net/en/blog/c/frontend.md) - [Backend](https://phatdev.net/en/blog/c/backend.md) - [AI](https://phatdev.net/en/blog/c/ai.md) - [Security](https://phatdev.net/en/blog/c/security.md) - [SEO](https://phatdev.net/en/blog/c/seo.md) - [Media](https://phatdev.net/en/blog/c/media.md) - [Mobile apps](https://phatdev.net/en/blog/c/mobile.md) ## Posts - [Making Your Website Readable for AI in 2026: What Is an Official Standard and What Is Only a Proposal](https://phatdev.net/en/blog/website-ready-for-ai-agents.md) (SEO | 2026-10-21 | 7 min read): An AI answers wrongly about your shop because it cannot read the policy page. A walk through robots.txt, structured data, llms.txt, Markdown pages, MCP Server Cards, AI Catalog and WebMCP, saying which are standards and which are proposals, with phatdev.net as the example. - [What Is a Passkey? Passwordless Sign-In Explained, and Whether Your Website Should Add It](https://phatdev.net/en/blog/passkeys-explained.md) (Security | 2026-10-21 | 6 min read): A strong password is useless when you type it into a fake page. Passkeys block exactly that. How they work in plain words, how to turn them on for Google and Apple, what happens if you lose your phone, and when a site owner should add them. - [What Is MCP? How AI Connects to Your Tools and Data, and the Risks to Know](https://phatdev.net/en/blog/mcp-explained.md) (AI | 2026-10-21 | 7 min read): An AI can write a great email but cannot see your calendar. MCP is the shared socket that connects AI to tools and data. Plain examples, permission and prompt injection risks, the 2026 state of the spec, and a working example. - [Claude, Codex and Gemini: Which AI Coding Assistant for Which Job](https://phatdev.net/en/blog/claude-codex-gemini-for-coding.md) (AI | 2026-10-21 | 6 min read): Three AI coding assistants differ in how you use them, how you pay and what happens to your data. A plain-words comparison from official docs checked on 21 October 2026, including Gemini CLI moving to Antigravity CLI. - [Common Problems When Using AI to Write Code, and How to Avoid Them](https://phatdev.net/en/blog/ai-coding-common-problems.md) (AI | 2026-10-21 | 6 min read): Six familiar traps: invented functions, scope creep, hitting a usage limit midway, forgetting earlier instructions, fake passing tests and leaked secrets. Each comes with signs, causes and prevention. - [Letting an AI Agent Run Commands on Your Machine or Server: How to Stay Safe](https://phatdev.net/en/blog/ai-agent-safety-on-your-machine.md) (AI | 2026-10-21 | 6 min read): Seven steps for letting an AI agent run commands without risking your data: least privilege, sandbox, ask-first modes, no passwords, a separate git branch, backups and reading each command before approving. - [Getting Started with Python in 2026: Install, a Clean Setup and Your First Script](https://phatdev.net/en/blog/python-start-2026.md) (Backend | 2026-10-21 | 6 min read): Typed python and got the Microsoft Store? How to install Python 3.15, use uv for a private environment per project, run your first script and fix common Windows and macOS problems. - [Automating Office Work with Python: Merge Excel Files, Build a Report and Send the Email](https://phatdev.net/en/blog/python-office-automation.md) (Backend | 2026-10-21 | 7 min read): Copying three branches' numbers by hand takes an hour each month. A small Python program merges Excel files, builds the report and sends the email in seconds, tested safely with a fake mailbox. - [Your First API with FastAPI: Products, Input Checks and Automatic Docs](https://phatdev.net/en/blog/python-fastapi-first-api.md) (Backend | 2026-10-21 | 7 min read): When every system keeps its own stock copy, one is always wrong. Build a small FastAPI service, validate input with Pydantic, watch the docs appear by themselves and try it with curl. - [Can an Installable Web App (PWA) Replace a Mobile App?](https://phatdev.net/en/blog/pwa-or-native-app.md) (Mobile apps | 2026-10-21 | 6 min read): What a PWA can do on iPhone and Android in 2026: home screen install, push notifications, offline use, remaining limits and when to choose one. - [Getting Your App on the App Store and Google Play: A 2026 Checklist](https://phatdev.net/en/blog/app-store-google-play-checklist.md) (Mobile apps | 2026-10-21 | 7 min read): Developer accounts, privacy policy, screenshots and description, review times, why apps get rejected and the new 2026 requirements, from Apple and Google's official pages. - [Building a Phone App: Swift/Kotlin, Flutter or React Native?](https://phatdev.net/en/blog/app-native-or-cross-platform.md) (Mobile apps | 2026-10-21 | 6 min read): How to choose between separate native apps, Flutter and React Native by budget, timeline, team and features, with the state of each technology in 2026. - [Monthly Website Maintenance: What It Includes and Why Neglect Costs More](https://phatdev.net/en/blog/website-maintenance-monthly.md) (Security | 2026-10-21 | 5 min read): Six monthly jobs that keep a website from dying on the road: updates, backups, security, speed, broken links and renewals, and why neglect always costs more. - [Syncing Stock Between Your Website, Marketplaces and Spreadsheets](https://phatdev.net/en/blog/sync-inventory-web-marketplace.md) (Backend | 2026-10-21 | 6 min read): One last speaker, three orders at once. Why stock drifts apart, five ways to handle it from manual work to API links, and where to start. - [What to Prepare Before Hiring Someone to Build Your Website or Software (With a Brief Template)](https://phatdev.net/en/blog/brief-before-hiring-developer.md) (Frontend | 2026-10-21 | 5 min read): Most troubled projects start with fuzzy requirements. Six things to think through before you talk to a developer, plus a short brief template to copy and fill in. - [AI Chatbots for Your Shop: What They Can and Cannot Do, and How Running Costs Work](https://phatdev.net/en/blog/ai-chatbot-for-shop.md) (AI | 2026-10-21 | 6 min read): A chatbot answering customers at midnight sounds great, but it only knows what you give it to read. This post covers what to hand over, what data to prepare, how costs work and how to limit wrong answers. - [WordPress or Custom Code: Which Should You Pick for Your Website?](https://phatdev.net/en/blog/wordpress-or-custom-code.md) (Frontend | 2026-10-21 | 5 min read): A plain-words comparison of WordPress and custom code on cost, time, editing content yourself, speed and maintenance, with how to choose by real need. - [Website Hacked: How to Spot It and What to Do in the First 24 Hours](https://phatdev.net/en/blog/website-hacked-what-to-do.md) (Security | 2026-10-21 | 6 min read): Signs your site was compromised and a clear order for the first 24 hours: isolate, change passwords, restore a clean backup, find the hole and tell Google, written for non-technical readers. - [Website Backups Done Right: The 3-2-1 Rule and Testing Your Restores](https://phatdev.net/en/blog/website-backup-3-2-1.md) (Security | 2026-10-21 | 6 min read): What to back up, how often, the 3-2-1 rule and why you must test restores regularly, explained for non-technical readers. - [Basic SEO for Online Shops: What Owners Can Do and What Needs a Developer](https://phatdev.net/en/blog/seo-basics-online-shop.md) (SEO | 2026-10-21 | 4 min read): Titles, descriptions, product names, images, Google Search Console and Google Business Profile: what an owner can do in one afternoon, and the technical part to hand to a developer. - [How a Slow Website Costs You Customers, and a 5-Minute Speed Check](https://phatdev.net/en/blog/page-speed-and-sales.md) (SEO | 2026-10-21 | 5 min read): A slow site never shows an error, it just sends visitors away. How to use PageSpeed Insights in five minutes, read LCP, INP and CLS in plain words, and what you can fix yourself or hand to a developer. - [Domain, Hosting, SSL and Domain Email Explained for Beginners](https://phatdev.net/en/blog/domain-hosting-ssl-email-explained.md) (Backend | 2026-10-21 | 5 min read): House address, plot of land, door lock and mailbox: four web concepts explained with everyday examples, how to choose, and two common mistakes, a forgotten domain renewal and email in spam without SPF, DKIM and DMARC. - [Designing an API Other People Will Use: Errors, Paging, Safe Retries and Limits](https://phatdev.net/en/blog/rest-api-design-practical.md) (Backend | 2026-10-19 | 8 min read): Conventions that keep your API from breaking other people's apps: path naming, one shape for errors, cursor paging, versioning, protection against duplicate orders, and call limits. - [Slow Query? How to Read EXPLAIN and Put Indexes in the Right Place](https://phatdev.net/en/blog/mysql-index-explain.md) (Backend | 2026-10-19 | 8 min read): Use EXPLAIN to see what the database plans to do with a slow query, then order index columns correctly, avoid the mistakes that hide an index, and paginate deep without slowing down. - [Making Sure Google Sees Both Languages of Your Next.js Site](https://phatdev.net/en/blog/technical-seo-nextjs.md) (SEO | 2026-10-19 | 8 min read): A two-language site can stay invisible to Google over a few small missing lines. How to declare the main address, the language pair, the sitemap and structured data, plus the root-redirect trap. - [How to Ask an AI So It Gets It Right and Stops Making Things Up](https://phatdev.net/en/blog/prompt-engineering-for-developers.md) (AI | 2026-10-19 | 6 min read): The same AI gives very different results depending on how you ask. A five-part way to write the request, three layers against invention, and a working code check. - [Batch-Processing Videos from the Command Line, Faster with Your Graphics Card](https://phatdev.net/en/blog/ffmpeg-nvenc-automation.md) (Media | 2026-10-19 | 8 min read): Compress, cut, join, subtitle and make vertical versions of a whole folder of videos with FFmpeg, faster with an NVIDIA card. Real measurements, the AV1 limit, and a safe batch script. - [From 95 to 99 on Mobile Speed: What I Did to a Next.js Site](https://phatdev.net/en/blog/core-web-vitals-99-case-study.md) (SEO | 2026-10-19 | 7 min read): A Next.js site's mobile speed score went from 95 to 99. The before and after numbers, each change, why the first 14.6 KB matters, and what didn't improve. - [Using the Claude API in Your Product: Tool Calls, Live Text and Lower Bills](https://phatdev.net/en/blog/claude-api-tool-use-streaming-caching.md) (AI | 2026-10-19 | 7 min read): Let the AI call your functions, show text as it arrives instead of a blank screen, and stop paying repeatedly for the same text. Correct models for October 2026, with Python and TypeScript. - [Handing a Big Job to Several AIs Without Breaking Things](https://phatdev.net/en/blog/agentic-workflow-orchestrator.md) (AI | 2026-10-19 | 6 min read): One AI working on a big job loses track halfway. Split it across several small AIs with one coordinator, check results with your own measurements, and always keep a way back. - [Testing Your Own Website's Defenses With Permission: The Basics](https://phatdev.net/en/blog/authorized-web-pentest-basics.md) (Security | 2026-10-19 | 6 min read): How to legally test your own website's defenses: permission and scope, a five-step process, testing permissions with two accounts, and writing a report others can act on. - [Encrypting Sensitive Data the Right Way with AES-GCM](https://phatdev.net/en/blog/aes-gcm-done-right.md) (Security | 2026-10-19 | 7 min read): How to encrypt phone numbers, addresses and customer notes so a leaked backup is unreadable, with Node.js, Python and PHP code that was actually run. - [Make Your API Faster With Redis: Save Answers So the Database Gets a Break](https://phatdev.net/en/blog/redis-cache-aside-api.md) (Backend | 2026-10-19 | 8 min read): Using Redis as a notebook of saved answers for your API: setting lifetimes, clearing cache safely, stopping a crowd from hitting the database at once, and sharing one Redis between sites. - [Making Your Nginx Website Safer, Step by Step](https://phatdev.net/en/blog/nginx-web-hardening.md) (Security | 2026-10-19 | 6 min read): Five things to do after installing Nginx: security headers, blocking sensitive files, HTTPS, login rate limits and the fake-IP trap via X-Forwarded-For, all built and tested. - [Next.js 14 App Router: Where It Bites in Production (Server Actions, Cache, Deploys)](https://phatdev.net/en/blog/nextjs-app-router-server-actions.md) (Frontend | 2026-10-19 | 8 min read): Why a Server Action is a public door, why a static page shows old data, and why a fresh deploy gives a blank page. Checked on a real Next.js 14.2.35 build. - [Self-Check Your Website's Security with the OWASP Top 10 (2025)](https://phatdev.net/en/blog/owasp-top10-audit-checklist.md) (Security | 2026-10-19 | 6 min read): The ten OWASP Top 10 (2025) items explained for business owners and developers: what each means, how to test with two accounts, plus an automated check script that was run. - [Rotating Login Keys Without Logging Anyone Out](https://phatdev.net/en/blog/jwt-rs256-key-rotation.md) (Security | 2026-10-19 | 6 min read): How to rotate JWT signing keys step by step so signed-in users are not kicked out: RS256/ES256 key pairs, the JWKS key list, and the order of publish, sign and retire. - [Packing Many On/Off Switches Into One Number: Bitmasks for Permissions and IPs](https://phatdev.net/en/blog/bitwise-in-practice.md) (Backend | 2026-10-19 | 7 min read): Store a dozen user permissions in one numeric column, check whether an IP address is in an allowed range, and avoid the traps JavaScript sets when you work with bits. - [One Shared Connection for the Whole App: Using Singleton Properly](https://phatdev.net/en/blog/singleton-pattern-typescript-php.md) (Backend | 2026-10-19 | 6 min read): Why a site freezes with too many database connections when you save files under next dev, how to share one copy with a Singleton (TypeScript and PHP), and when not to. - [A Shared JWT Login Token for Node.js, PHP, Python and C#](https://phatdev.net/en/blog/jwt-across-languages.md) (Security | 2026-10-19 | 6 min read): One login token across services written in different languages: what a JWT is, what to check, where to keep it safely, with code run across three languages. RSS: https://phatdev.net/en/blog/rss.xml