Technical
File permissions: fix access without opening the entire application
An upload folder chmod 777 "so it works" becomes a webshell entry six months later. Permissions need surgery, not blanket fixes.
No results for this search
Technical
Fail2ban: useful against noise, insufficient against a deliberate attack
Fail2ban quiets weekend SSH scans — until the attacker slows below the threshold or hits the API directly.
Technical
SSH bastion: reduce administrative surface without slowing the team
Every VPS with port 22 open to the Internet is scan bait. A bastion concentrates access — if the team can still connect without friction.
Technical
OAuth proxy: protect an internal tool without rewriting authentication
Grafana, Jenkins, phpMyAdmin — tools without native SSO rushed online. An OAuth proxy adds a front door without rewriting the app.
Technical
Rate limiting: protect an API without punishing good clients
A legitimate partner gets throttled during a spike while a scraper rotates IPs. Good rate limiting protects without punishing.
Technical
Reliable webhooks: sign, replay, and deduplicate events
Stripe retries after your 500 — and you double-credit the customer. A reliable webhook signs, idempotents, and is observable.
Technical
Reverse DNS: the detail that weighs on email deliverability
SPF and DKIM are green, yet mail lands in spam: PTR does not match HELO. This invisible detail weighs heavily at major filters.
Technical
Split-horizon DNS: serve internal and external users without confusion
Your team sees the right IP on VPN while customers see another — or worse, the same private IP. Split-horizon fixes that, but only if the boundary is documented.
Technical
SPF, DKIM, DMARC: align the three email protections
Mail sends, but Gmail spam-filters it: SPF passes, DKIM signs, DMARC fails alignment. The three protocols do not replace each other — they stack.
Technical
Anycast DNS: understand the gain before paying for redundancy
Checkout fails while internal DNS monitoring stays green: anycast only helps if you measure from outside. Here is how to evaluate it before the premium invoice.
Technical
DNS TTL: prepare a migration without promising instant propagation
"The DNS switch will be instant" — reassuring and false. Without lowering TTL upfront, a host migration drags 24–48 h in ISP caches.
Technical
ACME: monitor certificate renewal before expiry
Certbot "always worked" — until silent renewal failed because DNS changed and nobody monitored certificates, only HTTP uptime checks.
Technical
Configuring TLS: prefer maintainable settings to esoteric lists
A config copied for an SSL Labs A+ grade can block an enterprise client the next month. How to choose maintainable TLS — Mozilla Intermediate, renewal, HSTS — without incomprehensible cipher lists.
Technical
HTTP/2: what multiplexing really changes for web assets
HTTP/2 fixes six parallel TCP connections — not twelve synchronous scripts blocking render. Multiplexing helps; it does not replace front-end optimization.
Technical
Lazy loading: speed up the first screen without hiding useful content
loading="lazy" on the hero logo and first product photo — LCP explodes and Google penalizes what you thought was optimization.
Technical
WebP and AVIF: deliver better images without breaking old browsers
Switching the whole site to AVIF without fallback leaves 5% of visitors with broken icons — often B2B clients on frozen corporate browsers.
Technical
Brotli or gzip: compress without adding server latency
Brotli level 11 on every dynamic response — fewer bytes, more CPU, TTFB climbing. Useful compression separates static assets from on-the-fly HTML.
Technical
HTTP cache headers: make browser, CDN, and app cooperate
Inconsistent Cache-Control between nginx, PHP, and Cloudflare — users get stale content or origin saturates because nothing is edge-cacheable.
Technical
Alerts: reduce noise before it hides urgency
Twenty Slack alerts per night, all "CPU > 70%" on staging environments — until prod fails in the morning and nobody watches the on-call channel anymore.
Technical
Distributed tracing: follow a request beyond the web server
Logs say the API timed out; Prometheus shows a high p95 — but neither reveals which SQL query on the catalog service took seven seconds. The trace shows it in a single span.
Technical
Prometheus: choose metrics that explain slowness
The dashboard is green while checkout takes eight seconds — a sign you measure the machine, not the path that blocks. How to pick useful Prometheus metrics before drowning Grafana.
Technical
Centralized logs: retain context for a distributed outage
SSH into three servers to grep the same request_id — while the incident grows. Without correlated centralized logs, a distributed outage stays an incomplete puzzle.
Technical
Health checks: tell an open port from a healthy application
Open TCP 443 and a live PHP process do not guarantee the app can serve an order or reach its database. A useful health check tests what the user expects.
Technical
Canary release: expose a release gradually with guardrails
Deploying to 5% of traffic protects nobody if nobody measures error rate or knows how to roll back in thirty seconds.