Technical notes drawn from real projects: frontend, backend, AI, security, SEO, media and mobile apps.
A strong password is useless when you type it into a fake page. Passkeys block exactly that. How they work in plain words, how to turn them on for Google and Apple, what happens if you lose your phone, and when a site owner should add them.
Beginner
Six monthly jobs that keep a website from dying on the road: updates, backups, security, speed, broken links and renewals, and why neglect always costs more.
Beginner
Signs your site was compromised and a clear order for the first 24 hours: isolate, change passwords, restore a clean backup, find the hole and tell Google, written for non-technical readers.
Beginner
What to back up, how often, the 3-2-1 rule and why you must test restores regularly, explained for non-technical readers.
Beginner
How to legally test your own website's defenses: permission and scope, a five-step process, testing permissions with two accounts, and writing a report others can act on.
Beginner
How to encrypt phone numbers, addresses and customer notes so a leaked backup is unreadable, with Node.js, Python and PHP code that was actually run.
Intermediate
Five things to do after installing Nginx: security headers, blocking sensitive files, HTTPS, login rate limits and the fake-IP trap via X-Forwarded-For, all built and tested.
Intermediate
The ten OWASP Top 10 (2025) items explained for business owners and developers: what each means, how to test with two accounts, plus an automated check script that was run.
Intermediate
How to rotate JWT signing keys step by step so signed-in users are not kicked out: RS256/ES256 key pairs, the JWKS key list, and the order of publish, sign and retire.
Advanced