Building the web since 2000
Practical writing on PHP, MySQL, Linux, WordPress, security and the weird corners of the web, by one engineer who's been shipping them for over two decades.
A WordPress sandbox that boots a real site in your browser, runs the snippet you paste, and links every core function and hook in it to a reference page. No install, nothing uploaded.
Enriching thousands of WordPress posts with AI one request at a time burns money and time. Here is the true batch API flow, 50% cheaper, with a WP-CLI and PHP example that reads your content, batches it, and writes the results back.
Every major LLM batch API is 50% off, but the limits and gotchas differ. Claude, OpenAI, and Gemini batch processing compared, with ten high-volume jobs worth batching and a runnable Node example.
Generating images one at a time is slow and full price. How to halve your bill with the Gemini Batch API and Nano Banana, with the per-image numbers and a Node example from a production cover pipeline.
A practical guide to lowering your LLM API bill: right-size the model, trim tokens, cache the prefix, batch the non-urgent work, and skip the tool fees you do not need. Real numbers, every lever ranked.
Five years ago I bought a domain about a coworker's Dr Pepper habit. Here is what building it in Gatsby, then rebuilding it on Next.js 16, taught me about side projects that outlive their framework.
Error establishing a database connection means WordPress cannot reach its database. Read the MySQL error code to find the real cause (wrong credentials, a stopped server, a connection limit, corrupted tables, or a cloud firewall) and fix that one thing.
Your database recovered but visitors still see the error page. A cache stored it because the error returned HTTP 200. Make db-error.php return 503 with no-store and standard caches (WP Super Cache, Varnish, nginx, Cloudflare) stop storing it.
Thousands of hits to wp-admin/admin-ajax.php are almost always your own site: WordPress Heartbeat and plugins, not a DDoS. How to read the action parameter, when it is a real attack, and why blocking the file breaks your site.
What 'Discovered - currently not indexed' and 'Crawled - currently not indexed' actually mean in Google Search Console, why they are usually normal, and why spamming Request Indexing does nothing.
Thousands of ?replytocom= URLs in Search Console come from WordPress comment reply links. Why they are already nofollow and canonicalized, and why blocking them in robots.txt is the one fix that backfires.
WordPress stores a one-way password hash in wp_users.user_pass, a VARCHAR(255) column. Historically a phpass $P$ portable hash (MD5-based but stretched), and bcrypt for new hashes since WordPress 6.8 in 2025.
When to embed related data as subdocuments and when to reference it by _id in MongoDB. The 16 MB document limit, $lookup joins, access patterns, and the established schema-design patterns.
The column type for a password in MySQL is VARCHAR(255). You store the encoded output of a slow password hash (bcrypt, argon2id, scrypt), never a raw MD5 or SHA-256, and you never query the table by password.
Store an Argon2id password hash in MySQL or MariaDB the right way: VARCHAR(255), never a fixed-width column. The encoded format, why its length varies, computing it in PHP / Python / Node, OWASP parameters, and a worked users schema.
Base64-encode and decode a file from the terminal with the built-in base64 command. The macOS-vs-GNU flag gotcha (-D vs -d), the line-wrapping difference, and building a data URI from an image.
Print a saved Wi-Fi password from the macOS Terminal with the built-in security command: no third-party tool, no install. Reads your own login keychain, with the auth prompt that is supposed to appear.
Toggle Bluetooth on or off from the macOS terminal with blueutil: blueutil -p 1 / -p 0 / -p toggle, read the current state, list paired devices, and connect or disconnect by address. The reliable route now that Apple removed the old defaults hacks.
View a calendar from the macOS Terminal with the built-in cal command (this month, three months, a whole year), then read your actual Calendar.app events with icalBuddy. The TCC permission step is the part that trips people up.
CVE-2026-23111 is a one-character nf_tables use-after-free that escalates any unprivileged Linux user to root through user namespaces, and a public exploit is now out. Here is how I detect it, the user-namespace mitigation that matters most, the kernel patch, and a safe VM lab to reproduce it.
A curated set of git aliases worth keeping: st, lg, last, unstage, amend, undo. How to set them with git config, where they live in ~/.gitconfig, and when you need a shell alias (the ! prefix) instead of a plain one.
The git branch commands I reach for daily: print the current branch, find a remote's default branch, jump to the previous branch, rename, and delete a branch locally and on the remote. Modern git switch syntax throughout.
When you need to force push in Git, plain --force can silently clobber a teammate's commits. Use --force-with-lease (and --force-if-includes) so the push refuses if the remote moved.
Convert a NodeList, Set, arguments object, or string into a real array with Array.from or spread. When each one works, and why Array.from's map callback still earns its place over [...x].
The array methods worth reaching for in modern JavaScript: at() for negative indexing, flat(Infinity), the copying toReversed/toSorted/toSpliced/with that fix the mutation trap, and the corrected grouping API (Object.groupBy, not the Array.prototype.group that never shipped).
How Array.reduce really works: the accumulator and current value, summing numbers, the empty-array TypeError that bites everyone, building objects and Maps, and when Object.groupBy or map/filter is the better tool.
A clean modern JavaScript debounce in about ten lines: const, rest params, a leading-edge option, and a cancel method. Plus throttle, when to use which, and the React notes for 2026. No Underscore or lodash needed.
Fire a JavaScript callback when a CSS transition or animation finishes, using the transitionend and animationend events. The propertyName filtering, the bubbling trap, the cases where the event never fires, and the modern Web Animations API promise alternative.
Add an i before the closing bracket of a CSS attribute selector and the value matches case-insensitively: [href$=".pdf" i] catches .pdf, .PDF, and .Pdf. Plus the rarer s flag that forces case-sensitive matching.
Stop background-repeat clipping the last tile. round rescales tiles so a whole number fits; space keeps tile size and distributes the gaps. Plus the two-value round space syntax for separate horizontal and vertical control.
How to pin a background image to the viewport so content scrolls over it (the cheap parallax look), the full cover/center/fixed recipe, why background-attachment is not background-position, and the iOS Safari caveat that breaks it on mobile.
bcrypt is the hash you mostly cannot crack, and that is the point. I cover the hashcat command (-m 3200), why bcrypt is deliberately glacial, how the cost factor multiplies crack time, realistic GPU expectations, and the only attack worth running against it. Tested on hashcat 7.1.2.
MD5 is the easy case: fast, unsalted, and broken for passwords, which makes it the perfect place to learn cracking. I cover the hashcat command, salted MD5 variants, why MD5 decrypt sites are not what they claim, and why MD5 has no business storing a password. Tested on hashcat 7.1.2.
NTLM is the hash behind Windows and Active Directory passwords, and it is fast and unsalted, which is why a password audit cracks weak ones in seconds. I cover the hashcat command, where the hashes come from, realistic crack times, and the NetNTLMv2 distinction. Tested on hashcat 7.1.2.
How to recover your own WPA/WPA2 Wi-Fi password: capture the handshake or PMKID, convert it to the hashcat 22000 format, and crack it with a wordlist. I cover the full toolchain, realistic expectations for this slow hash, and why WPA3 resists the whole approach. Lab use only. Tested on hashcat 7.1.2.
NVIDIA GTX 1070 Ti Ethereum Mining review: Hashrate, overclocking settings, and power efficiency analyzed for miners.
How to add a custom sitemap to Yoast SEO so rewrite-driven pages with no WordPress post still get indexed: append a <sitemap> to the index with wpseo_sitemap_index, register a named sitemap, and generate its <url> entries.
How to add a custom rewrite rule in WordPress with add_rewrite_rule: the regex, the index.php query target, registering the query var so it actually populates, loading a template, and flushing once without flushing on every request.
Intercept requests that would 404 in WordPress on template_redirect, then resolve them to real content with status_header(200), 301 to the right URL with wp_safe_redirect(), or let them fall through. A fallback router for dynamic and legacy slugs you cannot enumerate.
How to build a custom product URL structure in WooCommerce: change or remove the /product/ and /shop/ bases from Settings > Permalinks, do it in code with a permalink filter plus add_rewrite_rule, and avoid the 404 collisions that come from a base-less product slug.
The five online regex testers I actually use, ranked: Regex101, RegExr, RegexPlanet, Debuggex, and Rubular. What each is good at, where each falls short, and which flavor each one supports.
Use regex in Nginx with location blocks and the rewrite directive: how location modifiers and matching priority work, why return beats rewrite for redirects, and copy-paste config for HTTPS, www, trailing slashes, 301s, clean URLs, and access blocking.
Use regex in .htaccess with Apache mod_rewrite: how RewriteRule and RewriteCond patterns work, the per-directory quirk that breaks everyone, and copy-paste rules for HTTPS, www, trailing slashes, 301s, clean URLs, and access blocking.
Capturing groups, named groups, non-capturing groups, and backreferences in regex. JavaScript / Python / PHP examples, engine notes, common mistakes, and the duplicate-word and swap-fields use cases.
600+ 'there are two types of people' jokes in one place, sorted by who they are about: developers, sysadmins, Linux users, parents, remote workers, office life and everyday habits.
425+ jokes on one page, grouped by subject: agile coach jokes, scrum master jokes, sprint planning jokes, sprint retrospective jokes, jira ticket jokes, and more.
475+ jokes on one page, grouped by subject: gps navigation jokes, smart tv jokes, smartwatch jokes, spam call jokes, online banking jokes, and more.
125+ jokes on one page, grouped by subject: azure jokes, google cloud jokes, and more.
I aced the coding test and walked into the interview with the job nearly in hand. One vague question at the end sank it. The lesson: if you don't understand what they're really asking, ask for context.
My experience meeting WordPress co-founder Matt Mullenweg at WordCamp Europe 2024 in Torino, Italy. A journey filled with inspiration, connections, and memorable moments.
The Agentic Browsing audit is now live in Google PageSpeed Insights, no Chrome Canary needed. Paste your URL, read the fractional score, and pass every check that says whether AI agents can read and act on your site.
The agency-ops playbook for AI: proposals, SOWs, onboarding documents, SOP creation, meeting summaries, status reports, internal documentation. Where the per-hour gain is highest, and the rules that keep client trust intact.
The content-role playbook for AI on WordPress sites: outlines and briefs, article refreshes, title generation, format conversion, fact-check passes, content QA at scale. Plus the strict rules on what stays human-written end to end.
The developer-role playbook for AI on WordPress projects: ACF scaffolding, plugin/theme debugging, WP-CLI orchestration, code review, migration scripts, Figma-to-component, and the senior-review discipline that keeps quality high.
sudo iftop -i eth0 shows a live, per-connection bandwidth table: which host pairs are moving traffic and at what rate. The interface flag people forget, the -n and -P switches that make the output readable, the 2s/10s/40s columns, the filter syntax, and when nload or iftop is the right tool.
The nload command draws a live graph of incoming and outgoing bandwidth per interface, right in the terminal. Install it, run nload, switch interfaces with the arrow keys, and read the In/Out, Avg, and Max numbers. The -m multi-interface view, the -u/-U unit flags, the refresh interval, and where iftop and nmap fit instead.
Practical nmap command examples I reach for: host discovery, the default port scan, service and version detection, OS fingerprinting, scoped scans with timing control, and the scripting engine, with notes on when each one needs root.
Switch to TCP BBR congestion control with two sysctl lines and a reboot-safe config file. The throughput it buys you on lossy long-haul links, the fq qdisc it needs, the kernel version that ships it, and when CUBIC is still the right default.
A scannable ffmpeg reference: convert containers, stream-copy without re-encoding, trim and cut, resize and crop, extract or replace audio, high-quality GIFs with palettegen, x264/x265/AV1 quality with -crf and -preset, change speed, concat, subtitles, and the fixes for the errors you actually hit.
A scannable yt-dlp reference: install and update, format selection, audio extraction, subtitles, playlists and channels, cookies and auth, rate limiting, output templates, and post-processing. The free, maintained youtube-dl successor.
The Docker commands I actually use, grouped by job: images, container lifecycle, run flags, exec and logs, build, networks, volumes, Compose, registry, and the prune/inspect commands for keeping a host clean.
A scannable AWS S3 CLI reference: aws s3 cp, sync, mv, rm, ls; recursive uploads and downloads; --exclude / --include filters; storage classes (STANDARD_IA, GLACIER, INTELLIGENT_TIERING); SSE encryption (AES256, aws:kms); --dryrun safety; the trailing-slash gotcha; concurrency tuning via max_concurrent_requests and multipart_chunksize; cross-account profiles.
