Building the web since 2000
Practical writing on PHP, MySQL, Linux, WordPress, security and the weird corners of the web, by one engineer who's been shipping them for over two decades.
Five years ago I bought a domain about a coworker's Dr Pepper habit. Here is what building it in Gatsby, then rebuilding it on Next.js 16, taught me about side projects that outlive their framework.
The Agentic Browsing audit is now live in Google PageSpeed Insights, no Chrome Canary needed. Paste your URL, read the fractional score, and pass every check that says whether AI agents can read and act on your site.
bcrypt is the hash you mostly cannot crack, and that is the point. I cover the hashcat command (-m 3200), why bcrypt is deliberately glacial, how the cost factor multiplies crack time, realistic GPU expectations, and the only attack worth running against it. Tested on hashcat 7.1.2.
MD5 is the easy case: fast, unsalted, and broken for passwords, which makes it the perfect place to learn cracking. I cover the hashcat command, salted MD5 variants, why MD5 decrypt sites are not what they claim, and why MD5 has no business storing a password. Tested on hashcat 7.1.2.
NTLM is the hash behind Windows and Active Directory passwords, and it is fast and unsalted, which is why a password audit cracks weak ones in seconds. I cover the hashcat command, where the hashes come from, realistic crack times, and the NetNTLMv2 distinction. Tested on hashcat 7.1.2.
How to recover your own WPA/WPA2 Wi-Fi password: capture the handshake or PMKID, convert it to the hashcat 22000 format, and crack it with a wordlist. I cover the full toolchain, realistic expectations for this slow hash, and why WPA3 resists the whole approach. Lab use only. Tested on hashcat 7.1.2.
Forgot the password on an encrypted ZIP, RAR, PDF, or Office file? John the Ripper extracts a crackable hash from it and recovers the password. I walk the *2john workflow with real output, the hashcat alternative, and why a wordlist beats brute force here. Tested on 1.9.0-jumbo-1.
Thousands of hits to wp-admin/admin-ajax.php are almost always your own site: WordPress Heartbeat and plugins, not a DDoS. How to read the action parameter, when it is a real attack, and why blocking the file breaks your site.
What 'Discovered - currently not indexed' and 'Crawled - currently not indexed' actually mean in Google Search Console, why they are usually normal, and why spamming Request Indexing does nothing.
Thousands of ?replytocom= URLs in Search Console come from WordPress comment reply links. Why they are already nofollow and canonicalized, and why blocking them in robots.txt is the one fix that backfires.
Thousands of ?wordfence_lh=1&hid= URLs in Google Search Console come from Wordfence's Live Traffic feature. The setting that stops them, the check to run first, and why robots.txt is the wrong fix.
WordPress stores a one-way password hash in wp_users.user_pass, a VARCHAR(255) column. Historically a phpass $P$ portable hash (MD5-based but stretched), and bcrypt for new hashes since WordPress 6.8 in 2025.
When to embed related data as subdocuments and when to reference it by _id in MongoDB. The 16 MB document limit, $lookup joins, access patterns, and the established schema-design patterns.
The column type for a password in MySQL is VARCHAR(255). You store the encoded output of a slow password hash (bcrypt, argon2id, scrypt), never a raw MD5 or SHA-256, and you never query the table by password.
Store an Argon2id password hash in MySQL or MariaDB the right way: VARCHAR(255), never a fixed-width column. The encoded format, why its length varies, computing it in PHP / Python / Node, OWASP parameters, and a worked users schema.
Base64-encode and decode a file from the terminal with the built-in base64 command. The macOS-vs-GNU flag gotcha (-D vs -d), the line-wrapping difference, and building a data URI from an image.
Print a saved Wi-Fi password from the macOS Terminal with the built-in security command: no third-party tool, no install. Reads your own login keychain, with the auth prompt that is supposed to appear.
Toggle Bluetooth on or off from the macOS terminal with blueutil: blueutil -p 1 / -p 0 / -p toggle, read the current state, list paired devices, and connect or disconnect by address. The reliable route now that Apple removed the old defaults hacks.
Take a photo with the Mac camera from the Terminal using imagesnap: install it, list devices, pick one, add a warm-up delay, and fix the Camera-permission gap that makes a CLI capture fail silently. Plus the ffmpeg avfoundation alternative.
CVE-2026-23111 is a one-character nf_tables use-after-free that escalates any unprivileged Linux user to root through user namespaces, and a public exploit is now out. Here is how I detect it, the user-namespace mitigation that matters most, the kernel patch, and a safe VM lab to reproduce it.
A curated set of git aliases worth keeping: st, lg, last, unstage, amend, undo. How to set them with git config, where they live in ~/.gitconfig, and when you need a shell alias (the ! prefix) instead of a plain one.
Git hooks run your scripts automatically on commit, push, and checkout. Where the native hooks live, the common ones, why .git/hooks is not shared, how core.hooksPath fixes that, and the husky v9 setup for JS projects.
List the files changed in git: working tree, staged, the last commit, between branches, or since N commits. Then pipe the list straight into a linter so you only check what changed.
The array methods worth reaching for in modern JavaScript: at() for negative indexing, flat(Infinity), the copying toReversed/toSorted/toSpliced/with that fix the mutation trap, and the corrected grouping API (Object.groupBy, not the Array.prototype.group that never shipped).
How Array.reduce really works: the accumulator and current value, summing numbers, the empty-array TypeError that bites everyone, building objects and Maps, and when Object.groupBy or map/filter is the better tool.
Fill a JavaScript array with a constant value, build a number sequence, or do a partial fill: when to use Array(n).fill() versus Array.from({length: n}, mapper), and the reference trap that bites everyone.
Generate a UUID in JavaScript with the built-in crypto.randomUUID(), no library needed. The secure-context gotcha that returns undefined on plain http, how it works in the browser vs Node, and when you need a v7 library instead.
Fire a JavaScript callback when a CSS transition or animation finishes, using the transitionend and animationend events. The propertyName filtering, the bubbling trap, the cases where the event never fires, and the modern Web Animations API promise alternative.
Add an i before the closing bracket of a CSS attribute selector and the value matches case-insensitively: [href$=".pdf" i] catches .pdf, .PDF, and .Pdf. Plus the rarer s flag that forces case-sensitive matching.
Stop background-repeat clipping the last tile. round rescales tiles so a whole number fits; space keeps tile size and distributes the gaps. Plus the two-value round space syntax for separate horizontal and vertical control.
How to pin a background image to the viewport so content scrolls over it (the cheap parallax look), the full cover/center/fixed recipe, why background-attachment is not background-position, and the iOS Safari caveat that breaks it on mobile.
Set your hash file, wordlist, hash mode, and mask once at the top, and every command below fills in with your values, ready to copy and run. Then the full flag reference grouped by task, the mask charset table, and the common -m modes. Tested on hashcat 7.1.2.
A mask attack is brute force with a brain: you tell hashcat the shape of the password and it skips the quadrillions of strings nobody picks. I cover the charsets, custom charsets, increment mode, the keyspace maths, and the masks that actually crack real passwords. Tested on hashcat 7.1.2.
hashcat slow? Most of the speed is in two things: the workload flags and the order you run attacks. I cover the workload profile, optimized kernels and their length cap, device selection, benchmark-driven tuning, and why attack ordering beats every flag. Tested on hashcat 7.1.2.
Rules are the highest-yield technique in cracking: one wordlist word becomes hundreds of plausible variants. I cover the rule functions, best64 with real generated output, stacking, writing your own, and the big public rulesets. Tested on hashcat 7.1.2.
NVIDIA GTX 1070 Ti Ethereum Mining review: Hashrate, overclocking settings, and power efficiency analyzed for miners.
How to add a custom sitemap to Yoast SEO so rewrite-driven pages with no WordPress post still get indexed: append a <sitemap> to the index with wpseo_sitemap_index, register a named sitemap, and generate its <url> entries.
How to add a custom rewrite rule in WordPress with add_rewrite_rule: the regex, the index.php query target, registering the query var so it actually populates, loading a template, and flushing once without flushing on every request.
Intercept requests that would 404 in WordPress on template_redirect, then resolve them to real content with status_header(200), 301 to the right URL with wp_safe_redirect(), or let them fall through. A fallback router for dynamic and legacy slugs you cannot enumerate.
How to build a custom product URL structure in WooCommerce: change or remove the /product/ and /shop/ bases from Settings > Permalinks, do it in code with a permalink filter plus add_rewrite_rule, and avoid the 404 collisions that come from a base-less product slug.
The five online regex testers I actually use, ranked: Regex101, RegExr, RegexPlanet, Debuggex, and Rubular. What each is good at, where each falls short, and which flavor each one supports.
Use regex in Nginx with location blocks and the rewrite directive: how location modifiers and matching priority work, why return beats rewrite for redirects, and copy-paste config for HTTPS, www, trailing slashes, 301s, clean URLs, and access blocking.
Use regex in .htaccess with Apache mod_rewrite: how RewriteRule and RewriteCond patterns work, the per-directory quirk that breaks everyone, and copy-paste rules for HTTPS, www, trailing slashes, 301s, clean URLs, and access blocking.
Capturing groups, named groups, non-capturing groups, and backreferences in regex. JavaScript / Python / PHP examples, engine notes, common mistakes, and the duplicate-word and swap-fields use cases.
I aced the coding test and walked into the interview with the job nearly in hand. One vague question at the end sank it. The lesson: if you don't understand what they're really asking, ask for context.
My experience meeting WordPress co-founder Matt Mullenweg at WordCamp Europe 2024 in Torino, Italy. A journey filled with inspiration, connections, and memorable moments.
The agency-ops playbook for AI: proposals, SOWs, onboarding documents, SOP creation, meeting summaries, status reports, internal documentation. Where the per-hour gain is highest, and the rules that keep client trust intact.
The developer-role playbook for AI on WordPress projects: ACF scaffolding, plugin/theme debugging, WP-CLI orchestration, code review, migration scripts, Figma-to-component, and the senior-review discipline that keeps quality high.
The sysadmin-role playbook for AI on WordPress infrastructure: log triage, deploy verification, config audits, backup checks, security sweeps, fail2ban rule generation, and the strict read-only discipline that keeps production safe.
The Figma to ACF Flexible Content pipeline used to be the slow part of every agency build. With AI in the loop, you describe the design intent, hand over the Figma JSON or screenshots, and get back working ACF registration plus template partials. Here is the realistic workflow.
sudo iftop -i eth0 shows a live, per-connection bandwidth table: which host pairs are moving traffic and at what rate. The interface flag people forget, the -n and -P switches that make the output readable, the 2s/10s/40s columns, the filter syntax, and when nload or iftop is the right tool.
The nload command draws a live graph of incoming and outgoing bandwidth per interface, right in the terminal. Install it, run nload, switch interfaces with the arrow keys, and read the In/Out, Avg, and Max numbers. The -m multi-interface view, the -u/-U unit flags, the refresh interval, and where iftop and nmap fit instead.
Practical nmap command examples I reach for: host discovery, the default port scan, service and version detection, OS fingerprinting, scoped scans with timing control, and the scripting engine, with notes on when each one needs root.
Switch to TCP BBR congestion control with two sysctl lines and a reboot-safe config file. The throughput it buys you on lossy long-haul links, the fq qdisc it needs, the kernel version that ships it, and when CUBIC is still the right default.
A scannable ffmpeg reference: convert containers, stream-copy without re-encoding, trim and cut, resize and crop, extract or replace audio, high-quality GIFs with palettegen, x264/x265/AV1 quality with -crf and -preset, change speed, concat, subtitles, and the fixes for the errors you actually hit.
A scannable yt-dlp reference: install and update, format selection, audio extraction, subtitles, playlists and channels, cookies and auth, rate limiting, output templates, and post-processing. The free, maintained youtube-dl successor.
The Docker commands I actually use, grouped by job: images, container lifecycle, run flags, exec and logs, build, networks, volumes, Compose, registry, and the prune/inspect commands for keeping a host clean.
A scannable AWS S3 CLI reference: aws s3 cp, sync, mv, rm, ls; recursive uploads and downloads; --exclude / --include filters; storage classes (STANDARD_IA, GLACIER, INTELLIGENT_TIERING); SSE encryption (AES256, aws:kms); --dryrun safety; the trailing-slash gotcha; concurrency tuning via max_concurrent_requests and multipart_chunksize; cross-account profiles.
