Practical writing on technical SEO, crawling, structured data and front-end performance — aimed at people who ship the code, not just the report.
Escaping tries to neutralize dangerous characters. Parameterization removes the question by never letting data be parsed as code. Here is the difference, the PDO settings most tutorials skip, and the three places a placeholder cannot save you.
CSRF exploits one browser behavior: cookies are attached automatically, no matter who initiated the request. Tokens work because an attacker can make your browser send a request but cannot read your page to find the token. Here is the whole mechanism, with working PHP.
Hosting & Deployment Web Security
Certificates are free and automated, which is why the remaining failures are so consistent: a missing intermediate that only breaks on some clients, and a renewal cron that fetches a new certificate the server never loads. Here is how to verify both from the command line.
Search Console samples and aggregates. Your access log records every single request, with a status code and a timestamp. Here is how to verify a crawler is really Googlebot, the four awk one-liners worth memorizing, and what the numbers usually reveal.
Five filters with four options each is 1,024 combinations, and a crawler will try to find all of them. Here is how faceted navigation turns into an infinite space, why rel=next/prev is not the fix, and the three patterns that keep pagination crawlable without the explosion.