# TechEarl > Field notes on shipping real systems by Ishan Karunaratne. Practitioner-oriented, code-first articles on DevOps, networking, privacy/anonymity tooling, MySQL, regex (including web-server regex for Apache and Nginx), bash, the find/grep toolchain, AI engineering, WordPress security and incident response, cloud (AWS/GCP), and security research. ## About - **Author:** Ishan Karunaratne, single-author blog, first-person practitioner voice - **Site:** https://techearl.com - **Author page:** https://techearl.com/author - **Citation policy:** cite by URL with `techearl.com/{slug}`, attribute to "Ishan Karunaratne (TechEarl)" - **Update frequency:** the article list below is generated from the live content tree; the file is regenerated on every publish so it stays in sync with the site ## Highly-cited reference articles - [Tor Country Codes for ExitNodes, ExcludeNodes, and torify](https://techearl.com/tor-country-codes-exit-exclude-nodes): Full ISO 3166-1 alpha-2 reference table for `torrc`, working snippets for `ExitNodes`, `ExcludeNodes`, `ExcludeExitNodes`, `EntryNodes`, `torify` / `torsocks` command examples, `StrictNodes 1` failure modes, and how to verify the exit country. - [MySQL Cheat Sheet](https://techearl.com/mysql-cheat-sheet): Complete command-line and SQL reference for MySQL operators. - [Regex Cheat Sheet](https://techearl.com/regex-cheat-sheet): Pattern reference for grep, sed, awk, JavaScript, Python, and Perl-style regex. - [Bash `for` Loop](https://techearl.com/bash-for-loop): Every working `for` loop form in Bash with copy-pasteable examples. - [Bash `while` Loop](https://techearl.com/bash-while-loop): `while`, `until`, condition forms, and common Bash loop patterns. - [Regex Password Strength Validation](https://techearl.com/regex-password-strength-validation): Production-ready password validation patterns by complexity tier. - [htaccess Regex](https://techearl.com/htaccess-regex): Regex in Apache `.htaccess` for redirects, rewrites, and access rules, with the leading-slash, `RewriteRule` flag, and escaped-dot quirks spelled out. - [Nginx Regex](https://techearl.com/nginx-regex): Regex in Nginx `location`, `rewrite`, and `map` blocks, including match precedence and the trailing-slash and `return` caveats. - [CVE-2026-31431 "Copy Fail"](https://techearl.com/cve-2026-31431-copy-fail): Defensive analysis of the Linux kernel local privilege escalation, affected distro versions, and detection guidance. - [Exposed .git Directory Attack](https://techearl.com/exposed-git-directory-attack): End-to-end walkthrough of the .git source-code-disclosure attack: browser + curl detection, the common-paths-by-CMS map (WordPress, Drupal, Joomla, Magento, Laravel, Node), three runnable reference dumpers (Python, Node, PHP) plus a Bash quick-check, recovering credentials from commits that were "deleted", and the one-line fix for Apache, nginx, LiteSpeed, Caddy, and IIS. Companion lab at github.com/ishankaru/techearl-labs/tree/main/source-code-disclosure. - [find Command Cheat Sheet](https://techearl.com/find-command-cheat-sheet): The GNU/BSD `find` toolchain reference with copy-pasteable patterns. - [How to Cut Your AI API Bill in 2026](https://techearl.com/reduce-ai-api-costs): Every lever that lowers an LLM bill, ranked and stacked: model right-sizing, token trimming, prompt caching, the 50%-off batch API, and skipping server-tool fees, with worked dollar math across Claude, OpenAI, and Gemini. - [LLM Batch API: Cut Your Bill in Half](https://techearl.com/llm-batch-api): Claude vs OpenAI vs Gemini batch processing compared (all 50% off, with differing limits and gotchas), ten high-volume jobs worth batching, the web-search-fee-not-batched catch, and runnable Node code. ## Topical clusters - **SQL injection:** taxonomy of variants (union, error, boolean blind, time blind, out-of-band, second-order, NoSQL) and HTTP request vectors (User-Agent, Cookie, Referer, X-Forwarded-For, Host, Authorization, JSON body, custom headers). Hub: [Web application security vulnerabilities taxonomy](https://techearl.com/web-application-security-vulnerabilities). Learning path (start here): [Learn SQL injection: a structured path from zero to defence](https://techearl.com/learn-sql-injection). Spoke: [SQL injection: variants, exploitation, and defence](https://techearl.com/sql-injection). Breach case studies: [TalkTalk breach (injection as the whole attack)](https://techearl.com/talktalk-breach-sql-injection), [Heartland breach (injection as the front door)](https://techearl.com/heartland-breach-sql-injection). Vector map: [SQL injection in HTTP requests: every vector attackers use](https://techearl.com/sql-injection-http-request-vectors). Per-vector deep dives: [User-Agent SQLi](https://techearl.com/sql-injection-user-agent), [Cookie SQLi](https://techearl.com/sql-injection-cookie), [X-Forwarded-For SQLi](https://techearl.com/sql-injection-x-forwarded-for), [Referer SQLi](https://techearl.com/sql-injection-referer-header), [JSON body SQLi](https://techearl.com/sql-injection-json-body), [Host header SQLi](https://techearl.com/sql-injection-host-header), [Authorization header SQLi](https://techearl.com/sql-injection-authorization-header). Tooling: [best SQL injection tools list (2026)](https://techearl.com/best-sql-injection-tools-2026), [sqlmap cheat sheet](https://techearl.com/sqlmap-cheat-sheet), [sqlmap tutorial](https://techearl.com/sqlmap-tutorial-exploiting-a-vulnerable-app), [sqlmap with Tor and proxychains](https://techearl.com/sqlmap-with-tor-and-proxychains), [sqlmap evasion and anti-detection](https://techearl.com/sqlmap-evasion-and-anti-detection). - **Tor / Onion routing:** torrc directives, country pinning, exit verification, torsocks, hidden services, bridges (obfs4/Snowflake/meek), control port, circuit management. - **MySQL operations:** schema migrations, version upgrades (5.7 to 8.0, 8.0 to 8.4 LTS, MariaDB), column changes, deduplication, CSV import/export, password resets, online schema change tools, backups, performance. - **Regex:** general pattern reference plus task-specific guides (email, URL, IPv4/IPv6, dates, credit-card Luhn, HTML tags), anchors, lookarounds, capturing groups, control verbs, and web-server regex for Apache `.htaccess` and Nginx. - **AI engineering:** building RAG with embeddings, running local LLMs with Ollama, prompt caching, system prompts, JSON-mode reliability, LLM agent tool use, model selection (Haiku/Sonnet/Opus), LLM evaluations, semantic search, LLM API cost optimization (the batch API and caching across Claude/OpenAI/Gemini), bulk WordPress enrichment via the batch API, and bulk image generation with the Gemini Batch API (Nano Banana). - **WordPress security and incident response:** malware removal and persistence mechanisms, entry-point log forensics, file integrity monitoring, fake admin users, hardened `wp-config`, offsite 3-2-1 backups, shared-hosting cross-site contamination. - **Security research:** CVE analysis (CVE-2026-31431 "Copy Fail"), password hashing, hashcat benchmarks, defensive write-ups. - **Bash / shell and find / grep:** loops, conditionals, arrays, functions, and the full `find` and `grep` toolchains for sysadmin and devops work. - **Cloud (AWS / GCP):** EC2 and Compute Engine instance management, EBS / persistent disk operations, IAM policy examples, SSH access. - **Networking / DNS:** DNS health checks, server administration, country code lookups. ## Author credentials - Built and operates [DNS Checker](https://dnschkr.com), an IP/DNS diagnostic tool used as a reference endpoint across multiple articles on this site. - LinkedIn: https://www.linkedin.com/in/ishankarunaratne/ ## All articles by category Auto-generated listing of every published article, grouped by primary category. 534 articles total. ### AI - [AI (topic hub)](https://techearl.com/ai): Building with Claude, GPT, Gemini, Llama and open models: prompt patterns, RAG, agents, evals, and the engineering reality behind every LLM headline. - [AI for WordPress Agency Operations: The Playbook](https://techearl.com/ai-for-wordpress-agency-operations): The agency-ops playbook for AI: proposals, SOWs, onboarding documents, SOP creation, meeting summaries, status reports, internal documentation. Where the per-hour gain is highest, and the rules that keep client trust... - [AI for WordPress Developers: The Playbook](https://techearl.com/ai-for-wordpress-developers): The developer-role playbook for AI on WordPress projects: ACF scaffolding, plugin/theme debugging, WP-CLI orchestration, code review, migration scripts, Figma-to-component, and the senior-review discipline that keeps... - [AI for WordPress Sysadmins: The Playbook](https://techearl.com/ai-for-wordpress-sysadmins): The sysadmin-role playbook for AI on WordPress infrastructure: log triage, deploy verification, config audits, backup checks, security sweeps, fail2ban rule generation, and the strict read-only discipline that keeps p... - [How Small WordPress Agencies Can Use AI in 2026](https://techearl.com/using-ai-in-a-wordpress-agency): AI for a WordPress agency in 2026: what to actually adopt first, what to skip, the budget realities, and the four operational shifts that turn AI tooling from a curiosity into a load-bearing part of the business. - [How Small WordPress Agencies Can Use AI in 2026, by Role](https://techearl.com/ai-for-wordpress-agencies-by-role): AI for a WordPress agency is not just developer tooling. The role-by-role map: developers, sysadmins, SEO, content, agency ops, business ops. Concrete tooling and prompts per role, what to never delegate. - [How to Add Semantic Search to a MySQL App](https://techearl.com/how-to-add-semantic-search-to-a-mysql-app): Add semantic search to an existing MySQL app with MySQL 9's VECTOR type, an embedding model (Voyage, OpenAI), and application-side cosine ranking. No separate vector database needed. - [How to Build an LLM Agent with Tool Use](https://techearl.com/how-to-build-an-llm-agent-with-tool-use): Build an LLM agent with tool use: the agentic loop, the tool-call format on Anthropic, OpenAI, and Gemini, runnable code in JavaScript and Python, plus the common failure modes. - [How to Build RAG with Embeddings and Vector Search](https://techearl.com/how-to-build-rag-with-embeddings-and-vector-search): Build RAG with embeddings, chunking, and vector search. Covers OpenAI / Voyage / Cohere embeddings, chunk sizes, hybrid search, reranking, and when long context replaces RAG entirely. - [How to Choose Between Claude Haiku, Sonnet, and Opus](https://techearl.com/how-to-choose-between-claude-haiku-sonnet-and-opus): Pick the right Claude tier for the job: Haiku for high-volume cheap, Sonnet 5 for the default, Opus 5 for hard agentic work, Fable 5 for the top end. With effort levels, cost math, latency, and a decision matrix. - [How to Cut LLM API Costs with Prompt Caching](https://techearl.com/how-to-cut-llm-api-costs-with-prompt-caching): Cut LLM API costs by 90% with prompt caching on Anthropic, OpenAI, and Gemini. The math, what to cache, the TTL trade-offs, and code in JavaScript and Python. - [How to Get Reliable JSON from an LLM](https://techearl.com/how-to-get-reliable-json-from-an-llm): Get reliable JSON out of an LLM with native structured-output modes (Anthropic tool use, OpenAI Structured Outputs, Gemini schema), plus Zod / Pydantic validation as a fallback. - [How to Pass the PageSpeed Agentic Browsing Audit](https://techearl.com/lighthouse-agentic-browsing-audit): The Agentic Browsing audit is now live in Google PageSpeed Insights, no Chrome Canary needed. Paste your URL, read the fractional score, and pass every check that says whether AI agents can read and act on your site. - [How to Run a Local LLM with Ollama](https://techearl.com/how-to-run-a-local-llm-with-ollama): Run a local LLM with Ollama: install, pull a model, the hardware floor, picking between Llama, Mistral, and Qwen, and when local is faster than cloud (and when it isn't). - [How to Stop an LLM from Hallucinating](https://techearl.com/how-to-stop-an-llm-from-hallucinating): Six techniques that actually reduce LLM hallucination: grounding with retrieved context, citation requirements, tool use for facts, structured outputs, explicit don't-know permission, and LLM-as-judge verification. - [How to Write LLM Evals That Catch Regressions](https://techearl.com/how-to-write-llm-evals-that-catch-regressions): Write LLM evals that catch real regressions: pick the right metrics (exact match, LLM-as-judge, embedding similarity), build a golden dataset, run on every PR, and watch the trend over time. - [Top 5 Claude Code Skills Every Developer Should Install in 2026](https://techearl.com/top-5-claude-code-skills): Five Claude Code skills that turn it from a chat tool into a development environment: impeccable for UI design, playwright-cli for browser automation, gsd for project planning, claude-seo for content and SEO, and bana... - [Top 5 Claude Code Tools for Designers and Frontend Developers in 2026](https://techearl.com/top-5-claude-code-tools-designers-frontend): The five Claude Code tools that change frontend design work: impeccable skill, Figma MCP, claude-in-chrome MCP for visual QA, banana skill for AI image generation, and shadcn/ui MCP. - [Top 5 MCP Servers Every Developer Should Try in 2026](https://techearl.com/top-5-mcp-servers-developers): The five Model Context Protocol servers worth installing today: filesystem, GitHub, Postgres, claude-in-chrome (browser), and Sentry. With install commands, the tools they expose, and the security model. - [Turning Figma Designs Into WordPress Components Using AI](https://techearl.com/figma-to-wordpress-with-ai): The Figma to ACF Flexible Content pipeline used to be the slow part of every agency build. With AI in the loop, you describe the design intent, hand over the Figma JSON or screenshots, and get back working ACF registr... - [Using AI with WP-CLI for Faster WordPress Operations](https://techearl.com/ai-assisted-wp-cli-workflows): The WP-CLI patterns that compose well with AI assistants: multi-step plans with checkpoint approval, generated one-off scripts, database surgery, content migrations at scale, and what to never delegate. - [Using Claude CLI to Manage WordPress Sites](https://techearl.com/using-claude-cli-with-wordpress): How I use Claude CLI to run WordPress and ACF work end-to-end: ACF field group generation, WP-CLI orchestration, log triage, plugin debugging, bulk content ops. Concrete prompts, what it gets wrong, and where it fits... ### CSS - [CSS (topic hub)](https://techearl.com/css): Layouts that hold up across browsers, devices, and the design changes nobody warned you about. - [:is() and :where() in CSS: Grouping Selectors Without the Repetition](https://techearl.com/css-is-where-selectors): :is() and :where() both collapse repetitive grouped selectors into one. The difference that matters: :is() takes the specificity of its most specific argument, :where() always has zero specificity. Both use a forgivin... - [8-Digit Hex Colors: Alpha Transparency in Hex (#RRGGBBAA)](https://techearl.com/css-8-digit-hex-alpha): 8-digit hex (#RRGGBBAA) adds an alpha channel as a hex byte, 00 transparent to FF opaque. The catch the old guides get wrong: the alpha pair is hex, not a percentage, so 50% opacity is 80, not 50. - [A Practical Guide to Flexbox: Axes, justify-content, align-items, and flex](https://techearl.com/flexbox-guide): A practical flexbox guide built around the one idea that makes everything click: the main axis vs the cross axis. justify-content, align-items, the flex shorthand, gap, align-self, order, and the layouts I actually re... - [background-repeat: round and space (Tile Without Clipping)](https://techearl.com/css-background-repeat-round-space): Stop background-repeat clipping the last tile. round rescales tiles so a whole number fits; space keeps tile size and distributes the gaps. Plus the two-value round space syntax for separate horizontal and vertical co... - [Bootstrap Media Query Breakpoints: Bootstrap 5, 4, 3 Complete Reference](https://techearl.com/default-media-query-sizes-for-twitter-bootstrap): Every Bootstrap media query breakpoint with exact pixel value, Sass/LESS mixins, container max-widths, and CSS-only equivalents. Covers Bootstrap 5.3 (xxl, CSS variables), Bootstrap 4 (deprecated mixins), and Bootstra... - [Case-Insensitive CSS Attribute Selectors with the i Flag](https://techearl.com/css-attribute-selector-case-insensitive): Add an i before the closing bracket of a CSS attribute selector and the value matches case-insensitively: [href$=".pdf" i] catches .pdf, .PDF, and .Pdf. Plus the rarer s flag that forces case-sensitive matching. - [CSS :focus-visible: Focus Rings for Keyboard Users, Not Mouse Clicks](https://techearl.com/css-focus-visible): The accessible way to handle focus rings: :focus-visible shows the outline only when someone navigates by keyboard, so you can stop blanket-removing outlines and breaking keyboard users. Native, Baseline, and the old... - [CSS accent-color: Brand-Color Checkboxes, Radios, and Form Controls](https://techearl.com/css-accent-color): Tint native checkboxes, radio buttons, range sliders, and progress bars to your brand color with one line of CSS. accent-color, the controls it affects, the auto-contrast checkmark, and the graceful fallback for old b... - [CSS Custom Cursors with cursor: url() (Hotspots, Fallbacks, Sizing)](https://techearl.com/css-custom-cursor): Set a custom cursor in CSS with cursor: url(). The mandatory keyword fallback you cannot omit, hotspot coordinates, the ~128px size cap (use 32px), PNG/SVG support, the keyword cursors, and the usability rules. - [CSS Gradient Text: Clip a Gradient to Text with background-clip](https://techearl.com/css-gradient-text): Make gradient text in CSS by clipping a linear-gradient to the letters with background-clip: text and a transparent fill. The modern unprefixed recipe, an accessible fallback, animation, and clipping to an image. - [Fixed (Parallax-Style) Background Images with background-attachment](https://techearl.com/css-fixed-background-image): How to pin a background image to the viewport so content scrolls over it (the cheap parallax look), the full cover/center/fixed recipe, why background-attachment is not background-position, and the iOS Safari caveat t... - [Pushing Flex Items Apart: margin-auto, gap, and space-between](https://techearl.com/flexbox-space-between-spacer): Push a logo left and links right in a flexbox nav without an empty spacer div. The three correct tools: justify-content: space-between, margin-left: auto, and gap. - [Run JavaScript When a CSS Animation or Transition Ends](https://techearl.com/css-animation-transition-end-js): Fire a JavaScript callback when a CSS transition or animation finishes, using the transitionend and animationend events. The propertyName filtering, the bubbling trap, the cases where the event never fires, and the mo... - [Smooth Scrolling in CSS with scroll-behavior (No JavaScript)](https://techearl.com/css-smooth-scroll): Smooth scroll without JavaScript: one line, html { scroll-behavior: smooth }, animates every anchor jump. Plus the scroll-margin-top fix for sticky headers, the scrollIntoView companion, and the prefers-reduced-motion... - [Styling the File Upload Button with ::file-selector-button](https://techearl.com/css-file-selector-button): Style the Choose File button of input[type=file] with the ::file-selector-button pseudo-element: hover and focus states, why it does not inherit fonts, and the hide-the-input/style-a-label pattern for full control. - [The CSS :has() Parent Selector: A Complete Guide](https://techearl.com/css-has-selector): CSS :has() is the parent selector we waited 20 years for: style an element based on what it contains. Now Baseline in every engine. Form rows, quantity queries, the previous-sibling trick, and the @supports gate for o... - [Truncate Text with a CSS Ellipsis (Single Line and Multiline)](https://techearl.com/css-ellipsis-truncate-text): Add a CSS ellipsis to truncate text on one line with text-overflow, clamp to a fixed number of lines with line-clamp, and put the dots at the start instead of the end. - [Why Your Responsive Images Look Squished (max-width and height: auto)](https://techearl.com/css-image-height-auto): Responsive images look squished when you pin both a width and a height in CSS. The fix is max-width: 100% with height: auto so the image scales proportionally, plus the width/height HTML attributes for layout stability. ### Database - [Database (topic hub)](https://techearl.com/database): SQL that runs, indexes that earn their keep, and migrations that don't take the site down. - [Elasticsearch Cheat Sheet](https://techearl.com/elasticsearch-cheat-sheet): Practitioner reference for Elasticsearch 9.x: index and document operations, Query DSL, aggregations, vector / kNN search, ESQL, cluster management, version compatibility notes, and the gotchas that bite first-time op... - [How to Add a Column to a MySQL Table](https://techearl.com/mysql-add-column): Add a column to a MySQL table with ALTER TABLE ADD COLUMN. Covers DEFAULT values, NOT NULL on existing rows, AFTER positioning, and ALGORITHM=INSTANT on MySQL 8.0.12+. - [How to Change a MySQL Column Type](https://techearl.com/mysql-change-column-type): Change a MySQL column type with ALTER TABLE MODIFY or CHANGE. Covers data preservation, CAST behavior, INT to BIGINT, VARCHAR widening, and how ALGORITHM applies. - [How to Delete Duplicate Rows in MySQL](https://techearl.com/mysql-delete-duplicate-rows): Delete duplicate rows in MySQL while keeping one per group, using DELETE JOIN, ROW_NUMBER with CTE, or the safe temp-table swap. With dry-run, transactions, and rollback. - [How to Export a MySQL Table to CSV](https://techearl.com/mysql-export-table-to-csv): Export a MySQL table to CSV using SELECT INTO OUTFILE, mysqldump --tab, the mysql client with a piped redirect, or a no-privilege one-liner that works on hosts where FILE is disabled. - [How to Export All MySQL Databases with mysqldump](https://techearl.com/export-or-backup-all-mysql-databases): Back up every MySQL (and MariaDB) database in one command with mysqldump, including --single-transaction for InnoDB consistency, gzip compression, restore steps, and the modern alternatives (MySQL Shell, Percona XtraB... - [How to Find Duplicate Rows in MySQL](https://techearl.com/mysql-find-duplicate-rows): Find duplicate rows in MySQL with GROUP BY HAVING, a ROW_NUMBER window function, or a self-join. Includes NULL behaviour, soft duplicates, and the right index. - [How to Find Rows in One MySQL Table Not in Another](https://techearl.com/mysql-rows-not-in-another-table): Find rows in one MySQL table that do not exist in another using LEFT JOIN IS NULL, NOT EXISTS, or NOT IN. Each method's NULL behaviour and performance trade-off. - [How to Format a MySQL DATETIME in a SELECT](https://techearl.com/mysql-format-datetime): Format a MySQL DATETIME in a SELECT using DATE_FORMAT, common patterns for ISO-8601 and human-readable output, and CONVERT_TZ for timezone-correct dashboards. - [How to Import a CSV File Into MySQL](https://techearl.com/mysql-import-csv): Import a CSV into MySQL using LOAD DATA INFILE, LOAD DATA LOCAL INFILE, or the mysqlimport command. Covers header rows, encoding, the FILE privilege, and broken CSVs. - [How to JOIN Two MySQL Tables](https://techearl.com/mysql-join-two-tables): JOIN two MySQL tables with INNER, LEFT, and RIGHT JOIN. With a real example, when each one matches, and the duplicate-row multiplication mistake everyone makes once. - [How to Migrate from MySQL 5.7 to 8.0 (Step-by-Step)](https://techearl.com/mysql-5-7-to-8-0-migration): MySQL 5.7 has been past its EOL since October 2023. Here is the migration to 8.0: prerequisites, dry-run with mysqlcheck, in-place upgrade, the authentication-plugin change that breaks old clients, and rollback if it... - [How to Reindex Elasticsearch with Zero Downtime](https://techearl.com/elasticsearch-zero-downtime-reindex): The alias-swap pattern I use in production to change Elasticsearch mappings without taking the search down. Walks through the five steps, gives you a parameterized bash script that runs the reindex and rolls back if n... - [How to Reset a Forgotten MySQL Root Password](https://techearl.com/mysql-reset-root-password): Reset a forgotten MySQL root password using --skip-grant-tables, an init-file, or my.cnf. Step-by-step for MySQL 5.7, 8.0, and the changes that landed in 8.4. - [How to Store a bcrypt Password Hash in MySQL: Column Type and Length](https://techearl.com/store-bcrypt-password-hash-mysql): A bcrypt hash is always 60 characters. The right MySQL column is VARCHAR(255) (the future-proof default) or CHAR(60) (the exact fit). Why, plus the app-side hashing and a worked schema for MySQL and MariaDB. - [How to Store a bcrypt Password Hash in PostgreSQL](https://techearl.com/store-bcrypt-password-postgresql): A bcrypt hash is a fixed 60-character string. In PostgreSQL the right column is text (varchar(255) is equivalent). Why text over char(60), app-side hashing, the pgcrypto crypt() option, and a worked users schema. - [How to Store a Boolean in MySQL: TINYINT(1) vs BIT(1)](https://techearl.com/store-boolean-mysql): MySQL has no real boolean type. BOOL and BOOLEAN are just aliases for TINYINT(1). Here is why TINYINT(1) is the idiomatic choice, how BIT(1) trips up ORMs, and a worked is_active schema. - [How to Store a Phone Number in MySQL](https://techearl.com/store-phone-number-mysql): Store a phone number in MySQL as a string, never an integer. Normalize to E.164 and use VARCHAR(16), index it for lookups, and keep the raw input in a second column. Worked schema for MySQL and MariaDB. - [How to Store a SHA-256 Hash in MySQL: CHAR(64) vs BINARY(32)](https://techearl.com/store-sha256-hash-mysql): How to store a SHA-256 hash in MySQL or MariaDB: CHAR(64), VARCHAR(64), or the BINARY(32) you should usually reach for. Storage cost, index size, the SHA2() function, and indexed generated columns. - [How to Store a UUID in MongoDB (BSON Binary Subtype 4)](https://techearl.com/store-uuid-mongodb): How to store a UUID in MongoDB the right way: as a 16-byte BSON Binary of subtype 4, not a 36-character string. Covers mongosh UUID(), driver representations, the legacy subtype 3 byte-order mess, and ObjectId vs UUID... - [How to Store a UUID in MySQL: BINARY(16) vs CHAR(36)](https://techearl.com/store-uuid-mysql): How to store a UUID in MySQL or MariaDB: the readable CHAR(36) string or the BINARY(16) you should usually reach for. Storage cost, index size, UUID_TO_BIN/BIN_TO_UUID, the swap_flag trick, and why random UUID primary... - [How to Store a UUID in PostgreSQL (the Native uuid Type)](https://techearl.com/store-uuid-postgresql): How to store a UUID in PostgreSQL: use the native 16-byte uuid type, not text or varchar(36). Covers gen_random_uuid(), uuid-ossp, why random v4 primary keys hurt index locality, and UUIDv7. - [How to Store an Argon2 Password Hash in MySQL](https://techearl.com/store-argon2-password-hash-mysql): Store an Argon2id password hash in MySQL or MariaDB the right way: VARCHAR(255), never a fixed-width column. The encoded format, why its length varies, computing it in PHP / Python / Node, OWASP parameters, and a work... - [How to Store an Array in PostgreSQL](https://techearl.com/store-array-postgresql): PostgreSQL has native array types: any base type can be an array, declared with []. How to insert with the curly-brace literal or ARRAY[...], query with @>, &&, and ANY(), index with GIN, and when an array beats a jun... - [How to Store an Email Address in MySQL: Column Type, Length, and Uniqueness](https://techearl.com/store-email-address-mysql): The right column for an email in MySQL is VARCHAR(255), utf8mb4, with a UNIQUE index. Why 255, why not TEXT, how to enforce case-insensitive uniqueness, and a worked users schema. - [How to Store an IP Address in PostgreSQL: inet and cidr](https://techearl.com/store-ip-address-postgresql): PostgreSQL has native network types: inet for a host address, cidr for a subnet. Both validate on insert, hold IPv4 and IPv6, and support real containment operators. Why text is the wrong default, plus a worked schema. - [How to Store an MD5 Hash in PostgreSQL: bytea vs text](https://techearl.com/store-md5-hash-postgresql): How to store an MD5 hash in PostgreSQL: the raw 16-byte bytea you should usually reach for, the readable text/char(32) hex string, and the uuid trick. Storage cost, encode()/decode() instead of HEX/UNHEX, and the pgcr... - [How to Store JSON in MySQL: The JSON Type vs TEXT](https://techearl.com/store-json-mysql): MySQL has a native JSON column type that validates on insert, stores a parsed binary format, and gives you path operators like ->>. When to reach for it over TEXT, how to index it with a generated column, and the Mari... - [How to Store JSON in PostgreSQL: json vs jsonb](https://techearl.com/store-json-jsonb-postgresql): PostgreSQL has two JSON types. json keeps an exact text copy and reparses on every read; jsonb stores a decomposed binary format you can index with GIN. When to use each, the operators, and a worked products schema wi... - [How to Store MD5 Hashes in MySQL: CHAR, BINARY, and BIGINT Methods](https://techearl.com/how-to-store-md5-hashes-in-a-mysql-database): Four ways to store an MD5 hash in MySQL or MariaDB: CHAR(32), VARCHAR(32), BINARY(16), and the two-BIGINT split. Storage cost, index speed, and when to use each (plus when to use a stronger hash instead). - [How to Store Money in MongoDB: Decimal128 vs Integer Cents](https://techearl.com/store-money-mongodb): Never store money as a BSON double. Use the Decimal128 type for exact decimal amounts, or store integer cents in a 64-bit NumberLong for high-volume ledgers, and always keep the ISO 4217 currency code in its own field... - [How to Store Money in PostgreSQL: numeric vs the money Type](https://techearl.com/store-money-postgresql): Store money in PostgreSQL as numeric (decimal), not the locale-dependent money type and never a float. numeric(19,4) for exact amounts, bigint cents for high-volume ledgers, plus a separate char(3) ISO 4217 currency.... - [How to Upgrade MySQL 8.0 to 8.4 LTS](https://techearl.com/mysql-8-to-8-4-lts-upgrade): MySQL 8.4 is the new LTS branch, with Premier Support through April 2029 and Extended Support through April 2032. The 8.0 to 8.4 upgrade is much smaller than 5.7 to 8.0, but removed options and the new authentication_... - [How WordPress Stores Passwords (and the 2025 Move to bcrypt)](https://techearl.com/how-wordpress-stores-passwords): WordPress stores a one-way password hash in wp_users.user_pass, a VARCHAR(255) column. Historically a phpass $P$ portable hash (MD5-based but stretched), and bcrypt for new hashes since WordPress 6.8 in 2025. - [MongoDB Schema Design: Embedding vs Referencing](https://techearl.com/mongodb-embed-vs-reference-schema): When to embed related data as subdocuments and when to reference it by _id in MongoDB. The 16 MB document limit, $lookup joins, access patterns, and the established schema-design patterns. - [MySQL Cheat Sheet](https://techearl.com/mysql-cheat-sheet): MySQL cheat sheet covering CLI commands, database and table operations, joins, indexes, backups, user management, and transactions, with version notes for 5.7, 8.0, and 8.4. - [MySQL Data Types and Sizes: Complete Reference](https://techearl.com/mysql-field-types-sizes): Every MySQL data type with exact storage size, value range, and when to use it. Numeric, string, date/time, JSON, spatial, binary, and the new VECTOR type added in MySQL 9.0. - [MySQL to MariaDB Migration: Compatibility, Commands, and Gotchas](https://techearl.com/mysql-to-mariadb-migration): MariaDB started as a MySQL fork and is binary-compatible up to a point. Where the wire protocol stays the same, where the SQL dialect diverges, and how to migrate a real database without losing anything. - [MySQL utf8 to utf8mb4 Migration: The Index-Length and ROW_FORMAT Trap](https://techearl.com/utf8-to-utf8mb4-migration): MySQL utf8 is a 3-byte alias for utf8mb3 that cannot store emoji or many CJK characters. utf8mb4 is the real UTF-8 and has been the default since MySQL 8.0. The migration looks like ALTER TABLE but bites on index leng... - [Online Schema Migrations in MySQL: Native, gh-ost, pt-online-schema-change](https://techearl.com/mysql-online-schema-change-tools): MySQL 8.0 made many ALTER TABLE operations instant. For the heavy ones that still rebuild the table — column type changes, charset conversion, primary-key changes — native online DDL, gh-ost, and pt-online-schema-chan... - [TEXT vs BLOB in MySQL: Storing Large Text and Binary Data](https://techearl.com/store-large-text-vs-blob-mysql): TEXT vs BLOB in MySQL: TEXT is for character data and has a charset, BLOB is for raw bytes and does not. The size families, the row-limit and indexing gotchas, and why files belong in object storage, not a BLOB. - [What Column Type Should a Password Be in MySQL?](https://techearl.com/mysql-password-column-type): The column type for a password in MySQL is VARCHAR(255). You store the encoded output of a slow password hash (bcrypt, argon2id, scrypt), never a raw MD5 or SHA-256, and you never query the table by password. ### DevOps - [DevOps (topic hub)](https://techearl.com/devops): Pipelines, deploys, on-call, and the quiet plumbing that keeps production alive. - [.dockerignore Best Practices](https://techearl.com/dockerignore-best-practices): The .dockerignore file controls what COPY . . actually ships into your image. Without it, your image gets node_modules, .git, .env, and every other thing in the project. With it, builds are faster, images smaller, and... - ["exec format error" — Apple Silicon and Multi-Architecture Docker Images](https://techearl.com/docker-exec-format-error): You pulled an image, ran it, and got 'exec format error'. The image is built for a CPU architecture your machine doesn't speak. Here's how to spot it, force emulation, force the native architecture, and check what an... - ["Port is Already Allocated" / "Address Already in Use" in Docker](https://techearl.com/docker-port-already-in-use): The two flavors of port conflict in Docker: another container is bound to it, or a host process is. How to find which, kill or relocate, and the -p syntax quirk that catches people. - [AWS IAM Policy Examples: S3, EC2, Lambda, and Least-Privilege Patterns](https://techearl.com/aws-iam-policy-examples): A working library of AWS IAM policy examples: S3 read-only with prefix, EC2 admin scoped to a region, Lambda execute-but-not-write, MFA-required, IP-restricted, VPC-endpoint-only, tag-based prod-vs-dev isolation, and... - [AWS S3 cp and sync Cheat Sheet: Copy, Move, and Sync Files with the CLI](https://techearl.com/aws-s3-cp-sync-cheat-sheet): A scannable AWS S3 CLI reference: aws s3 cp, sync, mv, rm, ls; recursive uploads and downloads; --exclude / --include filters; storage classes (STANDARD_IA, GLACIER, INTELLIGENT_TIERING); SSE encryption (AES256, aws:k... - [Bash Arrays: Indexed, Associative, and Iteration Patterns](https://techearl.com/bash-arrays): Bash array reference: indexed and associative declaration, the [@] vs [*] quoting gotcha, iterating values and indexes, appending, slicing, deleting, mapfile/readarray for reading lines, and the macOS Bash 3.2 vs Linu... - [Bash For Loops: Syntax, Examples, and One-Liners](https://techearl.com/bash-for-loop): Every form of the Bash for loop with working examples: brace-range, sequence-expression, array, glob, C-style, nested, and parallel. Plus the safe file-iteration patterns, common pitfalls, and macOS Bash 3.2 vs Linux... - [Bash Functions: Definition, Arguments, Return Values, and Scope](https://techearl.com/bash-functions): Bash function reference: two declaration syntaxes, positional arguments via $1/$@/$*, returning data via stdout vs return-code exit status, local variables and the global-by-default scoping trap, recursion, namerefs,... - [Bash if, else, and elif: Syntax, Test Operators, and Examples](https://techearl.com/bash-if-else): Bash conditionals from the ground up: if/elif/else syntax, the [ ] vs [[ ]] vs (( )) test contexts, numeric and string and file operators, the case statement, and the unquoted-variable pitfall that breaks scripts on e... - [Bash While Loops: Syntax, read-line, Retry, and Common Patterns](https://techearl.com/bash-while-loop): Bash while loop reference: condition-driven iteration, reading files line by line with the subshell-scoping fix, retry-with-backoff, wait-for-service-ready, until-loop sibling, and the [[ ]] vs [ ] vs (( )) test conte... - [Cannot Connect to the Docker Daemon — Fix the Permission and Socket Errors](https://techearl.com/cannot-connect-to-the-docker-daemon): Two errors that mean the same thing: the daemon isn't running, or you don't have permission to talk to its socket. How to start the daemon, add yourself to the docker group, refresh the group without rebooting, and ha... - [curl Cheat Sheet: HTTP Requests, Headers, Auth, and Common Flags](https://techearl.com/curl-cheat-sheet): A scannable curl reference: GET, POST, PUT, DELETE; JSON and form bodies; basic, bearer, and digest auth; redirects, retries, timeouts; --resolve overrides, SOCKS proxies; with PowerShell Invoke-WebRequest equivalents. - [docker buildx: Multi-Architecture (arm64 + amd64) Builds](https://techearl.com/docker-buildx-multi-arch): Build a single image that runs on both Apple Silicon and Intel servers. Set up a buildx builder, register QEMU emulation, and push a multi-platform manifest list. With the --push vs --load gotcha. - [Docker Cheat Sheet](https://techearl.com/docker-cheat-sheet): The Docker commands I actually use, grouped by job: images, container lifecycle, run flags, exec and logs, build, networks, volumes, Compose, registry, and the prune/inspect commands for keeping a host clean. - [Docker Compose: Getting Started with docker-compose.yml](https://techearl.com/docker-compose-getting-started): A working docker-compose.yml that runs a web app and a database together, the commands you need (up, down, logs, exec), and the V1-to-V2 change that breaks a lot of older tutorials. - [Docker Container Exits Immediately — Diagnosing the No-Foreground-Process Problem](https://techearl.com/docker-container-exits-immediately): Your container starts, then exits with code 0 (or 1, or 137) before you can do anything. The root cause is almost always one of three things: no foreground process, a crash, or OOM. Here's how to tell which. - [docker exec: Run Commands Inside a Running Container](https://techearl.com/docker-exec): Shell into a running container, run one-off commands, drop down to root when you need to install something, and the difference between an interactive session and a single command. With the alpine sh vs bash gotcha and... - [Docker Image Size Optimization: Multi-Stage Builds, Alpine, Slim, Scratch, and Distroless](https://techearl.com/docker-image-size-optimization): Why your Docker image is 1.5 GB and how to get it under 100 MB. Multi-stage builds, the choice between alpine and slim, when to reach for scratch or distroless, and the docker history command for finding the bloat. - [docker logs: View Container Output and Tail Logs](https://techearl.com/docker-logs): Read the stdout and stderr of a running or stopped container. Follow live output, tail the last N lines, filter by time, prepend timestamps, and the cases where docker logs doesn't help because the app writes to a fil... - [Docker Networking Basics: Bridge, Host, and Custom Networks](https://techearl.com/docker-networking-basics): How containers talk to each other and to the host. The default bridge versus user-defined bridges (and why DNS only works on user-defined ones), the host network, and host.docker.internal for reaching the host from in... - [Docker Restart Policies and Health Checks](https://techearl.com/docker-restart-policies-health-checks): Make containers come back automatically after crashes and reboots, and tell Compose how to wait until a service is actually ready (not just started). Restart policies, HEALTHCHECK, and depends_on: condition: service_h... - [docker run Cheat Sheet: Flags and Common Patterns](https://techearl.com/docker-run-cheat-sheet): Every docker run flag I actually use, grouped by job: detach, interactive shells, ports, volumes, environment, network, restart, resources, platform, user, and the one-shot --rm pattern. - [docker system prune: Free Disk Space Used by Docker](https://techearl.com/docker-system-prune): Docker fills up your disk. The prune commands clean it: docker system prune for the everyday sweep, docker system prune -a --volumes for the nuclear option, docker builder prune for the BuildKit cache, plus the per-re... - [Docker Volumes vs Bind Mounts (and When to Use Each)](https://techearl.com/docker-volumes-vs-bind-mounts): Three ways to persist data with Docker: named volumes, bind mounts, and tmpfs. What each one actually does, where the bytes live on disk, and the right choice for databases, dev workflows, and caches. - [Domain Directing and Virtual Host Setup for WAMP Server (and Modern Alternatives)](https://techearl.com/domain-directing-and-virtual-host-setup-for-wamp-server): Set up Apache virtual hosts on WAMP Server 3.3+, map mysite.local to a project folder, fix the port-80 conflicts that ruin Friday afternoons, and enable HTTPS on localhost with mkcert. Plus when to ditch WAMP for XAMP... - [find Command Cheat Sheet: Search, Filter, and -exec Examples](https://techearl.com/find-command-cheat-sheet): A scannable find reference: search by name, size, time, type, perms; safe pipelines with -print0 and xargs -0; -exec and -execdir; plus the macOS BSD vs GNU find divergences and Windows PowerShell equivalents. - [Force a New Tor Circuit on Demand with NEWNYM and the Control Port](https://techearl.com/tor-new-circuit-newnym-control-port): How to rotate Tor circuits programmatically using the NEWNYM control signal — torrc setup with CookieAuthentication or HashedControlPassword, raw socket script, Python stem, and the rate limit that bites everyone. - [Fork vs Clone in Git: What's the Difference?](https://techearl.com/git-fork-vs-clone): Fork copies a repo into your own account so you can contribute to a project you cannot push to. Clone downloads any repo to your machine. Here is when to use each. - [Git Aliases That Actually Save Time](https://techearl.com/git-aliases): A curated set of git aliases worth keeping: st, lg, last, unstage, amend, undo. How to set them with git config, where they live in ~/.gitconfig, and when you need a shell alias (the ! prefix) instead of a plain one. - [Git Branching Explained for Beginners](https://techearl.com/git-branching-explained): What a Git branch actually is, how HEAD points at your current spot, and the commands to create, switch, list, rename, and delete branches with confidence. - [Git Commit Message Best Practices](https://techearl.com/git-commit-message-conventions): A good Git commit message uses a short imperative subject under 50 characters, a blank line, then a wrapped body that explains why. Here is the whole convention. - [Git for Beginners: How to Actually Get Started](https://techearl.com/git-for-beginners): A practical, no-jargon introduction to Git: the mental model, installing it, your first config and commit, pushing to GitHub, and where to go next. - [Git Hooks: Run Scripts on Commit, Push, and Checkout](https://techearl.com/git-hooks-guide): Git hooks run your scripts automatically on commit, push, and checkout. Where the native hooks live, the common ones, why .git/hooks is not shared, how core.hooksPath fixes that, and the husky v9 setup for JS projects. - [git pull vs git fetch: What's the Difference?](https://techearl.com/git-pull-vs-fetch): git fetch downloads new commits from the remote without touching your working files. git pull does the same fetch and then merges them straight into your branch. - [git reset vs git revert: When to Use Each](https://techearl.com/git-reset-vs-revert): git reset rewrites history; git revert records a new undo commit. Here is the conceptual split, the three reset modes, and why revert is safe on shared branches. - [Git SSH vs HTTPS Remotes: Which Should You Use?](https://techearl.com/git-ssh-vs-https-remotes): SSH and HTTPS are two ways to connect Git to a remote like GitHub. Here is how each authenticates, when to pick which, and how to switch with git remote set-url. - [Git Tags: Create, Push, List, and Delete](https://techearl.com/git-tag-guide): Create, push, list, and delete git tags from the command line. When to use an annotated tag over a lightweight one, why git push leaves your tags behind, and how to delete a tag on the remote. - [Git Workflows for Teams: GitHub Flow vs Git Flow vs Trunk-Based](https://techearl.com/git-workflow-for-teams): A Git branching strategy is the rule for how your team makes and merges branches. GitHub Flow, Git Flow, and trunk-based development compared, and how to pick one for a small team. - [Git: 'failed to push some refs' - How to Fix It](https://techearl.com/git-failed-to-push-some-refs): Git refused your push because the remote has commits you do not have. Pull with rebase first, then push. Here is exactly why it happens and how to fix it safely. - [Git: 'File Exceeds GitHub's File Size Limit' - How to Fix It](https://techearl.com/git-file-too-large-error): GitHub rejected your push because a file is over 100 MB. Here is what the warning and the hard limit mean, and how to purge the file from history so the push goes through. - [Git: 'LF will be replaced by CRLF' Warning Explained](https://techearl.com/git-lf-will-be-replaced-by-crlf): What 'LF will be replaced by CRLF' means, why it is only a warning, how core.autocrlf works, and how a .gitattributes file settles line endings for a whole team. - [Git: 'Need to Specify How to Reconcile Divergent Branches' - How to Fix It](https://techearl.com/git-divergent-branches-reconcile): Git refuses to pull because your local and remote branches both have new commits. Pick how to combine them: merge or rebase. Here is the one-line fix and what each choice does. - [Git: 'Please tell me who you are' - How to Fix It](https://techearl.com/git-please-tell-me-who-you-are): Git refuses your first commit with 'Please tell me who you are' because it has no name or email to author the commit. Set both with git config and you are done. - [Git: 'pre-receive hook declined' - How to Fix It](https://techearl.com/git-pre-receive-hook-declined): The 'pre-receive hook declined' error means the server rejected your push. Here is how to tell which rule blocked you (branch protection, file size, secret scan) and fix it. - [Git: 'refusing to merge unrelated histories' - How to Fix It](https://techearl.com/git-refusing-to-merge-unrelated-histories): Git says 'refusing to merge unrelated histories' when your local repo and the remote have no shared commit. The one-line fix and what it actually means. - [Git: 'remote origin already exists' - How to Fix It](https://techearl.com/git-remote-origin-already-exists): Git says 'fatal: remote origin already exists' when you add a remote that is already set. Fix it by updating the URL with git remote set-url, or remove and re-add. - [Git: 'src refspec main does not match any' - How to Fix It](https://techearl.com/git-src-refspec-does-not-match-any): The 'src refspec main does not match any' error almost always means you have not committed yet, or you are pushing a branch name that does not exist. Here is the fix. - [Git: 'Support for password authentication was removed' - How to Fix It](https://techearl.com/git-password-authentication-removed): GitHub stopped accepting your account password over HTTPS on August 13, 2021. Fix the error by pushing with a personal access token, or switch the remote to SSH. - [Git: 'The Current Branch Has No Upstream Branch' - How to Fix It](https://techearl.com/git-no-upstream-branch): Git says your branch has no upstream branch when you push a brand-new local branch. Fix it with git push -u origin , and the -u flag means plain git push works next time. - [Git: 'Your Local Changes Would Be Overwritten by Merge' - How to Fix It](https://techearl.com/git-local-changes-would-be-overwritten): Git stops a pull when uncommitted edits would be clobbered. Fix it by committing your work, or by stashing it, pulling, then popping the stash back. - [grep Cheat Sheet: Examples, Regex Flags, and macOS BSD Differences](https://techearl.com/grep-cheat-sheet): A scannable grep reference with the flags I actually use, the GNU vs BSD differences that bite on macOS, and the Windows equivalents (Select-String, findstr) for the same patterns. - [Host a v3 .onion Hidden Service with Tor](https://techearl.com/host-v3-onion-hidden-service): End-to-end setup for a v3 .onion hidden service — torrc HiddenServiceDir and HiddenServicePort, key backup, permissions, onion-location header, single-onion mode, and the operational mistakes that get addresses leaked... - [How to Add a Persistent Disk to a Google Cloud VM](https://techearl.com/gcp-add-persistent-disk-to-vm): Create a GCP persistent disk, attach it to a running VM, format it, mount it, and survive reboots with a UUID-based fstab entry. Console, gcloud, and Terraform walkthroughs. - [How to Add Git to an Existing Project Without Committing Junk](https://techearl.com/git-add-to-existing-project): Bring an existing or legacy codebase under version control cleanly. Init the repo, write .gitignore first so you skip the junk, make the initial commit, and push to a new remote. - [How to Change an AWS EC2 Instance Type (Resize Without Data Loss)](https://techearl.com/aws-ec2-change-instance-type): Stop the instance, modify the instance type, start it. The exact gcloud-equivalent AWS CLI syntax, the compatibility matrix for moving between families and generations, the Nitro vs Xen gotcha, the instance-store data... - [How to Change Your GitHub Profile Picture](https://techearl.com/github-change-profile-picture): Swap GitHub's default identicon for a real avatar in under a minute: where the setting lives, the crop step, the size and format that work, and the gotcha that trips people up. - [How to Create a Pull Request](https://techearl.com/git-create-a-pull-request): A pull request proposes merging one branch into another so a teammate can review it first. Here is the full flow on GitHub and GitLab: branch, push, open, review, merge. - [How to Discard Local Changes in Git](https://techearl.com/git-discard-local-changes): Discard local changes in Git with restore, checkout, and clean. How to throw away edits to tracked files, delete untracked files, and reset to the last commit. - [How to Dockerize a Go App (Multi-Stage + Scratch for ~10 MB Images)](https://techearl.com/how-to-dockerize-a-go-app): Go's static binaries are perfect for tiny Docker images. Build in a Go image, copy the single binary into FROM scratch (or distroless), and ship under 15 MB total — no shell, no runtime libraries, nothing else. - [How to Dockerize a Next.js App (with output: 'standalone' for Tiny Images)](https://techearl.com/how-to-dockerize-a-nextjs-app): A Dockerfile for a real Next.js app that ships an image under 200 MB. The standalone output mode, the multi-stage pattern that copies only the runtime files, and the static-assets gotcha most tutorials miss. - [How to Dockerize a Node.js App](https://techearl.com/how-to-dockerize-a-nodejs-app): A Dockerfile for a real Node.js app: multi-stage build, npm ci for deterministic dependencies, the node_modules-volume trick that makes bind-mounted source fast on Mac, and the non-root user that most tutorials skip. - [How to Dockerize a Static Site (HTML/CSS/JS Built Output)](https://techearl.com/how-to-dockerize-a-static-site): Multi-stage Docker for a static site: build with Node, ship with Nginx. The result is a ~25 MB image that serves HTML, handles SPA fallbacks, and sets cache headers correctly. - [How to Export and Import PuTTY Sessions and Settings (Backup Guide)](https://techearl.com/how-to-export-and-import-putty-settings): Back up PuTTY sessions, host keys, and global settings from the Windows registry with a single regedit or PowerShell command. Restore on a new machine, transfer between user accounts, and troubleshoot the common Acces... - [How to Extend an AWS EBS Volume Without a Restart](https://techearl.com/aws-ec2-extend-ebs-volume-without-restart): Grow an EBS volume on a running EC2 instance in four steps. Modify the volume, wait for the optimizing state, expand the partition with growpart, then stretch the filesystem with resize2fs or xfs_growfs. No detach, no... - [How to Increase Google Cloud VM Disk Size Without Rebooting](https://techearl.com/increase-google-cloud-vm-disk-size-without-rebooting): Grow a Google Cloud persistent disk on a live VM in three commands. Resize the disk in GCP, expand the partition with growpart, then stretch the filesystem with resize2fs or xfs_growfs. No detach, no reboot. - [How to Install Docker on Ubuntu, macOS, and Windows (2026)](https://techearl.com/how-to-install-docker): Install Docker the right way for your OS: the official apt repo on Ubuntu (not the distro's docker.io), Docker Desktop on macOS and Windows, plus how to run docker without sudo on Linux and the verification commands. - [How to List the Files Changed in Git](https://techearl.com/git-list-changed-files): List the files changed in git: working tree, staged, the last commit, between branches, or since N commits. Then pipe the list straight into a linter so you only check what changed. - [How to Protect Your Main Branch on GitHub](https://techearl.com/git-protect-main-branch): Set up branch protection rules on GitHub to require pull-request reviews, pass status checks, block force-pushes and deletions, and gate review with CODEOWNERS. - [How to Recover Lost Commits with git reflog](https://techearl.com/git-recover-lost-commits-reflog): Think you lost work to a bad reset, rebase, or deleted branch? You almost certainly did not. git reflog is Git's safety net, and here is how to use it to get your commits back. - [How to Remove a Secret from Git History](https://techearl.com/git-remove-secret-from-history): Committed an API key or password? Deleting it in a new commit does not remove it. Rotate the credential first, then scrub it from all history with git filter-repo or BFG. - [How to Run a Specific PHP Version in Docker (Without Installing PHP)](https://techearl.com/how-to-run-php-in-docker): Test code against PHP 7.4, 8.1, 8.2, 8.3, or 8.4 without installing anything. Run a one-off script, an interactive REPL, Composer, or a local PHP server, then walk away with a clean machine. - [How to Run Adminer in Docker (Database GUI Without Installing One)](https://techearl.com/how-to-run-adminer-in-docker): Adminer is a single-PHP-file database GUI that talks to MySQL, MariaDB, PostgreSQL, MongoDB, SQLite, and more. One Docker container, browser at localhost:8080, no installer, no GUI app to update. - [How to Run Mailpit in Docker (Local Email / SMTP Testing)](https://techearl.com/how-to-run-mailpit-in-docker): Catch and inspect emails your local app sends without bothering a real inbox. Mailpit in Docker gives you an SMTP server on 1025 and a web UI on 8025 — the modern replacement for unmaintained MailHog. - [How to Run MariaDB in Docker (With Persistent Storage)](https://techearl.com/how-to-run-mariadb-in-docker): MariaDB in a container with a named volume so your data survives container removal. The differences from MySQL's official image, the env-var compatibility quirk, and connecting from the host or another container. - [How to Run MinIO in Docker (Local S3-Compatible Storage)](https://techearl.com/how-to-run-minio-in-docker): Run a single MinIO container as a local S3-compatible object store: persistent volume on /data, console on 9001, S3 API on 9000, and how to point the AWS SDK at it for free dev work. - [How to Run MongoDB in Docker (With Persistent Storage)](https://techearl.com/how-to-run-mongodb-in-docker): MongoDB in a container with a named volume on /data/db so your collections survive restarts, an admin user from MONGO_INITDB_ROOT_*, and the replica-set caveat for transactions. - [How to Run MySQL in Docker (With Persistent Storage)](https://techearl.com/how-to-run-mysql-in-docker): Run a MySQL server in a container, give it a named volume so your data survives the next docker rm, set the root password the right way, and connect to it from the host or another container. - [How to Run PostgreSQL in Docker (With Persistent Storage)](https://techearl.com/how-to-run-postgresql-in-docker): Run a Postgres server in a container, give it a named volume so your data survives, set the password the right way, run pg_isready as a healthcheck, and connect from the host or another container. - [How to Run Redis in Docker (With AOF + RDB Persistence)](https://techearl.com/how-to-run-redis-in-docker): Redis is non-persistent by default in the official image — every restart wipes the data. Enable AOF, mount a volume, and set a password before exposing it. The full recipe with practical usage. - [How to Run WordPress in Docker (With MySQL via Docker Compose)](https://techearl.com/how-to-run-wordpress-in-docker): WordPress and MySQL in one Compose file with TWO persistent volumes — one for the database, one for wp-content. Plus the common pitfalls (wp-content mount erasing the default theme, uploads permissions, port 80 in use). - [How to Set Up Git for a New Project](https://techearl.com/git-set-up-new-project): Set up Git for a new project the right way: git init, a starter .gitignore, your first commit, creating the remote, pushing, and turning on branch protection. - [How to Squash Commits with Interactive Rebase](https://techearl.com/git-rebase-interactive-squash): Interactive rebase lets you squash, reword, and reorder commits before a pull request. Here is how git rebase -i works, the pick/squash/fixup/reword actions, and how to bail out safely. - [How to Squash Git Commits (Interactive Rebase and Friends)](https://techearl.com/squash-git-commits): Squash Git commits into one with interactive rebase: change pick to squash or fixup, fold into the line above, abort cleanly, or flatten a whole branch with git merge --squash. The whole workflow, including the force-... - [How to SSH into a Google Cloud VM Without gcloud](https://techearl.com/gcp-ssh-into-vm-without-gcloud): Connect to a GCP VM using plain OpenSSH, no gcloud required. Add a public key to instance metadata, fetch the external IP, and ssh in like any normal Linux box. Plus OS Login, IAP, and a Windows PuTTY path. - [How to SSH into an AWS EC2 Instance](https://techearl.com/aws-ssh-into-ec2-instance): Connect to an EC2 instance four ways: plain SSH with a key pair, EC2 Instance Connect, Session Manager, and EC2 Instance Connect Endpoint. Default usernames, security group rules, and the troubleshooting matrix that f... - [How to Undo (Almost) Anything in Git](https://techearl.com/undo-changes-in-git): A by-situation map for undoing things in git: discard a change, unstage a file, undo a commit, undo a pushed commit safely, delete untracked files, and recover with reflog. Modern restore and switch, not just checkout... - [How to Undo the Last Git Commit](https://techearl.com/git-undo-last-commit): Undo your last Git commit without losing work. When to use amend, reset --soft, reset --mixed, reset --hard, and revert, plus the rule for commits you already pushed. - [How to Use .gitignore (with Examples)](https://techearl.com/git-gitignore-explained): A practical guide to .gitignore: pattern syntax, per-repo vs global ignore, ready-made templates, and the gotcha that trips everyone up - already-tracked files keep showing up. - [How to Use git stash](https://techearl.com/git-stash-explained): How to use git stash to set work aside without committing. Save, list, pop, apply, and drop stashes, stash untracked files, do a partial stash, and switch branches cleanly. - [How to Use Regex in .htaccess (Apache mod_rewrite)](https://techearl.com/htaccess-regex): Use regex in .htaccess with Apache mod_rewrite: how RewriteRule and RewriteCond patterns work, the per-directory quirk that breaks everyone, and copy-paste rules for HTTPS, www, trailing slashes, 301s, clean URLs, and... - [How to Use Regex in Nginx (location and rewrite)](https://techearl.com/nginx-regex): Use regex in Nginx with location blocks and the rewrite directive: how location modifiers and matching priority work, why return beats rewrite for redirects, and copy-paste config for HTTPS, www, trailing slashes, 301... - [How to Write a Dockerfile (FROM, COPY, RUN, CMD, ENTRYPOINT)](https://techearl.com/how-to-write-a-dockerfile): A Dockerfile that actually builds, line by line: the instructions, the order that controls layer caching, the difference between CMD and ENTRYPOINT, and the small habits that keep builds fast and images small. - [Running Docker Containers as a Non-Root User](https://techearl.com/docker-non-root-container): By default, processes inside Docker containers run as root, which is risky. Switch to a non-root USER, fix permissions on volumes and ports, and configure Compose and Kubernetes to refuse to run root containers. - [SSH Cheat Sheet: Connect, Tunnel, Copy, and ssh-keygen Quick Reference](https://techearl.com/ssh-cheat-sheet): A scannable SSH reference: ssh-keygen, ssh-copy-id, port forwarding (-L, -R, -D), ProxyJump, ~/.ssh/config blocks, scp and rsync over SSH, with the Windows OpenSSH differences and PuTTY equivalents. - [The Git Staging Area Explained](https://techearl.com/git-staging-area-explained): The Git staging area (the index) is the in-between layer where you assemble exactly what goes into your next commit. Here is what git add really does, and why it exists. - [Tor Bridges Explained: obfs4, Snowflake, and meek (with Setup)](https://techearl.com/tor-bridges-obfs4-snowflake-meek): When your ISP or country blocks Tor, bridges and pluggable transports keep you connected. Compares obfs4, Snowflake, and meek, how to add each to torrc, and how to get fresh bridge lines from bridges.torproject.org or... - [Tor Country Codes List: Set Exit Nodes by Country (torrc)](https://techearl.com/tor-country-codes-exit-exclude-nodes): The full Tor country code list (ISO 3166-1 alpha-2) and how to set exit nodes by country in torrc: ExitNodes, ExcludeNodes, EntryNodes, ready-to-paste Five/Nine/14 Eyes blocks, torify and torsocks examples, and the St... - [torrc Cheat Sheet: Complete Tor Configuration Reference](https://techearl.com/torrc-cheat-sheet): Every torrc directive worth knowing in 2026, grouped by what you're trying to do: SOCKS and control ports, circuit construction, country pinning, hidden services, bridges, logging, and performance tuning. - [Use Tor as a SOCKS5 Proxy with curl, Python, and Node](https://techearl.com/tor-socks5-proxy-curl-python-node): Route a single command, script, or HTTP client through Tor's SOCKS5 proxy, curl with --socks5-hostname, Python requests with socks5h://, Node with socks-proxy-agent, and avoid the DNS leak that catches everyone first... - [Where Are Docker's Files on a Mac? (Inspecting the Virtual Disk Image)](https://techearl.com/where-are-docker-files-on-mac): On macOS, all your Docker images, volumes, and containers live inside a single virtual disk image, not at host filesystem paths. Here's where that disk lives, how to inspect it, and how to compact it when it won't shr... - [Why Bind Mounts Are Slow on Mac and Windows (and What to Do)](https://techearl.com/docker-bind-mounts-slow-mac-windows): Docker Desktop's virtualized filesystem makes bind mounts noticeably slow on Mac and Windows. VirtioFS helps a lot, the node_modules-as-named-volume trick helps more, and moving the project into WSL2 on Windows fixes... ### Experiences - [Experiences (topic hub)](https://techearl.com/experiences): Personal stories from years of shipping, breaking, and rebuilding production systems. - [Meeting Matt Mullenweg for the first time in Torino, Italy](https://techearl.com/meeting-matt-mullenweg-wordcamp-europe-2024): My experience meeting WordPress co-founder Matt Mullenweg at WordCamp Europe 2024 in Torino, Italy. A journey filled with inspiration, connections, and memorable moments. - [The interview question that cost me the job, and what I'd ask now](https://techearl.com/interview-question-that-cost-me-the-job): I aced the coding test and walked into the interview with the job nearly in hand. One vague question at the end sank it. The lesson: if you don't understand what they're really asking, ask for context. - [The Joke Domain That Outlived Gatsby](https://techearl.com/the-joke-domain-that-outlived-gatsby): Five years ago I bought a domain about a coworker's Dr Pepper habit. Here is what building it in Gatsby, then rebuilding it on Next.js 16, taught me about side projects that outlive their framework. ### Hardware - [Hardware (topic hub)](https://techearl.com/hardware): GPUs, mining benchmarks, and the bare-metal side of running real workloads. - [NVIDIA GeForce GTX 1070Ti Ethereum Mining Review](https://techearl.com/nvidia-geforce-gtx-1070ti-ethereum-mining-review): NVIDIA GTX 1070 Ti Ethereum Mining review: Hashrate, overclocking settings, and power efficiency analyzed for miners. ### JavaScript - [JavaScript (topic hub)](https://techearl.com/javascript): Frontend and Node patterns that survive contact with real users, real bugs, and real deadlines. - [Catching Errors from Node.js child_process (spawn, exec, execSync)](https://techearl.com/nodejs-child-process-error-handling): Why a try/catch around execSync doesn't save you, why spawnSync returns instead of throws, and the one check that actually tells you a child process failed: the exit status, not whether stderr has text. - [Copy and Paste with the Clipboard API (navigator.clipboard)](https://techearl.com/navigator-clipboard-api): Copy and paste in JavaScript with navigator.clipboard: writeText/readText, write/read with ClipboardItem for images and HTML, the secure-context requirement, the user-gesture rule, and the clipboard-read vs clipboard-... - [Fill an Array With Values or a Number Sequence in JavaScript](https://techearl.com/javascript-fill-array): Fill a JavaScript array with a constant value, build a number sequence, or do a partial fill: when to use Array(n).fill() versus Array.from({length: n}, mapper), and the reference trap that bites everyone. - [Fix NODE_MODULE_VERSION Mismatch in Node.js](https://techearl.com/fix-node-module-version-mismatch): The NODE_MODULE_VERSION mismatch error means a native addon was compiled against a different Node ABI than the one now running it. Here is what the numbers mean, the one-line fix, and the Electron, Docker, and CI vari... - [Generate a UUID in JavaScript: crypto.randomUUID() (Browser and Node)](https://techearl.com/javascript-generate-uuid): Generate a UUID in JavaScript with the built-in crypto.randomUUID(), no library needed. The secure-context gotcha that returns undefined on plain http, how it works in the browser vs Node, and when you need a v7 libra... - [Get a Random Item From an Array in JavaScript (and Shuffle One Correctly)](https://techearl.com/javascript-random-array-item): Pull a random element from an array in JavaScript with one line, then shuffle the whole array correctly with Fisher-Yates. Why arr.sort(() => Math.random() - 0.5) is biased, and when to reach for crypto.getRandomValue... - [How async Functions Really Work in JavaScript](https://techearl.com/javascript-async-function-internals): What an async function actually is under the hood: it desugars to a generator plus a built-in runner. Plus async generators with for await...of, the AsyncFunction constructor, and why detecting async-ness is a trap. - [How to Add a Timeout to fetch() with AbortController](https://techearl.com/fetch-timeout-abortcontroller): Add a timeout to fetch() the modern way: pass AbortSignal.timeout(5000) as the signal. Plus AbortController for manual cancel, combining signals with AbortSignal.any, and catching AbortError. Works in the browser and... - [How to Check Your Node.js and npm Version](https://techearl.com/how-to-check-node-version): Run node --version and npm --version to see what you have installed. This covers every way to check Node and npm, finding which install is on PATH, reading the version inside a script, and the gotchas with version man... - [How to Install Node.js on Linux, macOS, and Windows](https://techearl.com/how-to-install-nodejs): How to install Node.js the right way on Linux, macOS, and Windows. Covers nvm, fnm, Volta, the official nodejs.org installer, apt/dnf via NodeSource, Homebrew, winget, Chocolatey, Docker, and how to verify the install. - [How to Merge Two Arrays in JavaScript](https://techearl.com/javascript-merge-arrays): Merge two arrays in JavaScript three ways: copy-merge with spread [...a, ...b], merge in place with a.push(...b), or copy with a.concat(b). Which to pick by mutation, memory, and the spread arg-count limit that bites... - [How to Read Environment Variables in Node.js (without dotenv)](https://techearl.com/node-environment-variables): Read and set environment variables in Node.js with process.env, and skip dotenv entirely: Node 20.6+ loads .env files natively with --env-file and process.loadEnvFile(). Plus the NODE_ENV convention, reading required... - [How to Uninstall Node.js (Every Install Method)](https://techearl.com/how-to-uninstall-nodejs): How to uninstall Node.js cleanly on Linux, macOS, and Windows: version managers (nvm, fnm, Volta, n), the official installer, apt/dnf/brew/winget/choco, Docker, plus the leftover npm/cache/PATH files everyone forgets... - [How to Update Node.js: nvm, fnm, Volta, Direct Install (2026)](https://techearl.com/how-to-update-node-js-version): Every reliable way to update Node.js on Linux, macOS, and Windows. Covers nvm, fnm, Volta, n, the nodejs.org installer, apt/brew/winget, Docker, GitHub Actions, per-project pinning, and the rebuild-native-modules step... - [JavaScript Array.reduce, Explained: Sum, Build Objects, and When Not to Use It](https://techearl.com/javascript-array-reduce): How Array.reduce really works: the accumulator and current value, summing numbers, the empty-array TypeError that bites everyone, building objects and Maps, and when Object.groupBy or map/filter is the better tool. - [JavaScript Promises Explained: A Complete Guide](https://techearl.com/javascript-promises-guide): How JavaScript promises actually work: the three states, .then/.catch/.finally, async/await as the default modern style, and the gotchas that bite (the explicit-construction antipattern and the await-in-a-loop seriali... - [JavaScript: Force Page to Scroll to the Top on Browser Refresh](https://techearl.com/javascript-force-page-position-to-top-of-page-on-browser-refresh): Every modern way to force a page to the top on browser refresh: window.scrollTo, the scrollRestoration API, React Router ScrollRestoration, Next.js Link scroll prop, and the events that fire on unload. Plus the hydrat... - [Merge and Deep-Clone Objects in JavaScript (Spread, Object.assign, structuredClone)](https://techearl.com/javascript-merge-objects): Merge objects in JavaScript with spread or Object.assign, and learn the three gotchas that bite: spread is shallow, the last value wins, and undefined overwrites. Plus structuredClone for a real deep clone and a small... - [Modern JavaScript Array Methods: at, flat, toReversed, and groupBy](https://techearl.com/javascript-array-methods): The array methods worth reaching for in modern JavaScript: at() for negative indexing, flat(Infinity), the copying toReversed/toSorted/toSpliced/with that fix the mutation trap, and the corrected grouping API (Object.... - [Node.js in GitHub Actions: setup-node and the Version Matrix](https://techearl.com/nodejs-github-actions-setup-node): How to configure GitHub Actions setup-node properly: the minimal workflow, dependency caching, a version matrix across LTS lines, reading .nvmrc so CI matches local dev, private registry auth, and the version-drift an... - [Node.js LTS vs Current: Which Version Should You Use?](https://techearl.com/nodejs-lts-vs-current): Node LTS vs Current explained: what the even/odd version lines mean, the 30-month support window, when Current is worth it, and how to pick the right line for production, libraries, and CI. - [nvm vs fnm vs Volta: Which Node Version Manager?](https://techearl.com/nvm-vs-fnm-vs-volta): nvm vs fnm vs Volta, compared by speed, auto-switching, platform support, and pinning model. Which Node version manager to pick in 2026, with install commands, the .nvmrc vs package.json question, and honest caveats f... - [Pin a Node.js Version Per Project With .nvmrc and engines](https://techearl.com/node-version-pinning-nvmrc): How .nvmrc node version pinning actually works, plus .node-version, package.json engines, and Volta. Which file each tool reads, how to make installs fail on a mismatch, and how to keep CI on the same version as local... - [Stream a fetch() Response in JavaScript (NDJSON, line-by-line)](https://techearl.com/fetch-streaming-readablestream): Read a fetch() response as it arrives instead of buffering the whole body. Async-iterate response.body, decode with TextDecoderStream, and split NDJSON line by line with a dependency-free TransformStream. The same pat... - [The fetch() API: A Practical Guide](https://techearl.com/javascript-fetch-api-guide): A practical guide to the fetch() API: the request/response model, why response.json() returns a promise, and the one surprise that bites everyone, fetch does not reject on 404 or 500. Plus headers, methods, bodies, cr... ### Linux - [Linux (topic hub)](https://techearl.com/linux): Terminal-first guides, real shell scripts, and field notes from years of sysadmin work. - [Bash Job Control: fg, bg, jobs, and nohup](https://techearl.com/bash-job-control): Bash job control reference: suspend with Ctrl-Z, resume in foreground with fg or background with bg, list with jobs, target jobs by %1/%+/%-, and keep a process alive past logout with nohup, disown, or setsid. - [bat: A cat Clone With Syntax Highlighting](https://techearl.com/bat-cat-command-replacement): bat is a cat command replacement that adds syntax highlighting, line numbers, and Git change markers. Install it, alias cat to it carefully, and know the --plain, --style, and --paging flags that make it behave well i... - [BSD find vs GNU find: Every macOS vs Linux Difference That Matters](https://techearl.com/find-bsd-vs-gnu-macos-linux): macOS ships BSD find; Linux ships GNU find. The two share a name and most of an interface, but -printf, -regextype, and the stat format strings diverge hard enough to break scripts shipped between platforms. The full... - [Change or Remove an SSH Key Passphrase](https://techearl.com/change-ssh-key-passphrase): Add, change, or remove the passphrase on an existing SSH key with ssh-keygen -p. No need to regenerate the key or reinstall it on any server. - [Chmod Calculator: Permissions to Octal, Live](https://techearl.com/chmod-calculator): An interactive chmod calculator: tick the read/write/execute boxes for owner, group, and other to get the octal and the exact chmod command, or type 644 to see what it grants. - [Copy to the Clipboard From the Command Line: pbcopy, pbpaste (and Linux, Windows)](https://techearl.com/pbcopy-pbpaste-clipboard-command-line): Copy command output to the clipboard from the terminal with pbcopy and pbpaste on macOS, plus the Linux (xclip, xsel, wl-copy) and Windows (clip, Set-Clipboard) equivalents, and the trailing-newline gotcha. - [Crontab Builder: Make and Read Cron Expressions](https://techearl.com/crontab-builder): An interactive crontab builder and explainer: pick a schedule to generate a valid cron expression, or paste an expression like 0 9 * * 1 to read it back in plain English. - [Download a YouTube Playlist or Entire Channel with yt-dlp](https://techearl.com/download-youtube-playlist): Download a whole YouTube playlist or entire channel free with yt-dlp: point it at a playlist or @handle, use a download archive so re-runs skip what you already have, organize files with output templates, and rate-lim... - [Download Every Video From a TikTok Profile with yt-dlp](https://techearl.com/download-tiktok-profile): Download all TikTok videos from a user free with yt-dlp: point it at the profile URL, pass browser cookies (TikTok needs them for the full listing), and use a download archive so re-runs only grab new clips. The natur... - [duf: A Friendlier df for Disk Usage](https://techearl.com/duf-disk-usage-df-replacement): duf is a df replacement that prints grouped, color-coded disk usage tables instead of df's raw columns. Install it, filter to the devices you care about, sort by usage, and pipe --json into scripts. - [Extract a Thumbnail or Frame From a Video with ffmpeg](https://techearl.com/ffmpeg-video-thumbnail): Grab a thumbnail or a single frame from a video with ffmpeg: pull a frame at a timestamp, let the thumbnail filter pick a representative one, sample one every N seconds, and control JPEG quality with -q:v. - [find -exec vs xargs: Which to Use (and the {} + Trick That Beats Both)](https://techearl.com/find-exec-vs-xargs): find -exec ... {} + and find -print0 | xargs -0 are roughly equivalent for batch operations on matched files. find -exec ... {} \; forks once per match and is much slower. The decision matrix: when -exec is enough, wh... - [find -regex vs -name: When to Use Regex in find](https://techearl.com/find-regex-vs-name): find -name takes a shell glob and matches the basename; find -regex takes a full regular expression and matches the whole path. That whole-path detail is the number one surprise: -regex '.*\.txt' works but -regex '.tx... - [find vs locate vs mlocate: Which File Search Tool to Use](https://techearl.com/find-vs-locate-vs-mlocate): find walks the live filesystem every time it runs: always current, sometimes slow. locate queries a prebuilt database: instant, but stale until the next updatedb. This breaks down the locate family (mlocate, plocate,... - [Fix SSH "Host Key Verification Failed"](https://techearl.com/ssh-host-key-verification-failed): Why SSH warns that the remote host identification has changed, when it is safe to clear, and the one command that removes the stale known_hosts entry: ssh-keygen -R. - [Fix SSH "Permission denied (publickey)"](https://techearl.com/ssh-permission-denied-publickey): The ordered checklist for SSH Permission denied (publickey): is the key loaded, is it the right key, is the public half on the server, and are the server-side permissions sane. - [Fix SSH "Permissions Are Too Open" (UNPROTECTED PRIVATE KEY FILE)](https://techearl.com/fix-ssh-key-permissions-too-open): SSH refuses your key with WARNING: UNPROTECTED PRIVATE KEY FILE. The one-line fix is chmod 600, plus the full set of ~/.ssh permissions and ownership SSH actually checks. Linux, macOS, Windows. - [Force a Password Change at Next Login on Linux](https://techearl.com/force-password-change-linux): Expire a password with chage -d 0 or passwd -e so the user must set a new one the next time they log in. The difference from locking, and how to undo it. - [grep Regex: BRE vs ERE vs PCRE Explained](https://techearl.com/grep-regex-bre-ere-pcre): grep has three regex engines and the default one surprises everyone: in basic regex (BRE) the characters + ? | ( ) { } are literal text until you backslash-escape them. -E switches to extended regex (ERE) where they w... - [grep vs ripgrep vs ag: Which Search Tool to Use](https://techearl.com/grep-vs-ripgrep-vs-ag): grep is on every system and searches exactly what you point it at. ripgrep (rg) is the fast Rust-based default for code search: it skips .gitignore'd, hidden, and binary files unless told otherwise. ag (the_silver_sea... - [Harden sshd: Disable Password Authentication](https://techearl.com/harden-sshd-disable-password-auth): Lock SSH down to keys only: disable password and root login in sshd_config, the settings that actually matter, and how to apply them without locking yourself out. - [How to Add a Right-Click Quick Action to macOS Finder](https://techearl.com/mac-finder-context-menu-quick-action): Add a custom right-click action to macOS Finder with Automator. Build a Quick Action that runs a shell script on the files you select, with the PATH gotcha that makes it silently do nothing. - [How to Add a User to a Group on Linux (usermod -aG)](https://techearl.com/add-user-to-group-linux): Add a user to a group with usermod -aG without wiping their existing groups, why the -a matters, and how to confirm membership took effect. - [How to Add an SSH Key to GitHub and GitLab](https://techearl.com/add-ssh-key-to-github): Paste your SSH public key into GitHub or GitLab, then confirm it works with ssh -T. The whole flow, with no password or token prompts on git push after. - [How to Add or Replace the Audio Track in a Video with ffmpeg](https://techearl.com/ffmpeg-merge-audio-video): Combine a silent video with an audio file, or swap out an existing soundtrack, using ffmpeg. The -map and -shortest flags that make it work, plus how to fix audio that drifts out of sync. - [How to Archive Files Matching a find Pattern with tar](https://techearl.com/find-and-tar-archive): find locates the files, tar archives them. The safe pairing is find -print0 piped into tar reading a NUL-delimited list from stdin: no breakage on spaces or newlines. The flag breakdown, the macOS BSD tar vs GNU tar d... - [How to Base64-Encode or Decode a File From the Command Line](https://techearl.com/base64-encode-file-command-line): Base64-encode and decode a file from the terminal with the built-in base64 command. The macOS-vs-GNU flag gotcha (-D vs -d), the line-wrapping difference, and building a data URI from an image. - [How to Blur Faces or Regions in a Video with ffmpeg](https://techearl.com/blur-faces-in-video-command-line): Blur a fixed region in a video with ffmpeg using crop, boxblur, and overlay, and blur moving faces automatically with deface. The honest note: ffmpeg alone has no face tracking. - [How to Change a User's Login Shell on Linux (chsh)](https://techearl.com/change-user-shell-linux): Change a user's default login shell with chsh or usermod, check the valid shells in /etc/shells, and see the current shell from /etc/passwd. - [How to Change the Speed of an Animated GIF (gifsicle and ffmpeg)](https://techearl.com/change-gif-speed-command-line): Speed up or slow down an animated GIF from the command line: set a uniform per-frame delay with gifsicle, re-time it with ffmpeg's setpts filter, and avoid the browser delay floor that quietly caps how fast a GIF can... - [How to Change the System Volume From the macOS Command Line](https://techearl.com/mac-volume-command-line): Set the macOS system volume from the terminal with osascript: the modern 0 to 100 scale, mute and unmute, reading the current level, input volume, and a one-line alias. No sudo needed. - [How to Combine Animated GIFs Into One With gifsicle](https://techearl.com/merge-gifs-command-line): Combine animated GIFs into one from the command line with gifsicle. Merging is the default mode, the loop quirk that makes it look broken, plus matching sizes, the 256-color ceiling, and the ffmpeg alternative. - [How to Convert a Video to Black and White (Grayscale) with ffmpeg](https://techearl.com/ffmpeg-grayscale-video): Convert a video to grayscale with ffmpeg two ways: hue=s=0 to desaturate, or format=gray for a true single-channel gray file. Plus a custom black-and-white mix and a sepia tone with colorchannelmixer, and why this re-... - [How to Convert an Image to Grayscale From the Command Line (ImageMagick)](https://techearl.com/image-grayscale-command-line): Convert an image to grayscale from the command line with ImageMagick: the one-line magick command, the difference between perceptual Gray and linear gray, batching a folder with mogrify, sepia, and a built-in macOS al... - [How to Convert Images to WebP (and AVIF) From the Command Line](https://techearl.com/convert-image-to-webp-command-line): Convert JPG, PNG, and animated GIF to WebP from the command line with Google's cwebp and gif2webp, batch a whole folder, and go further with AVIF via avifenc. ImageMagick's magick as the fallback. - [How to Convert SVG to PNG From the Command Line](https://techearl.com/convert-svg-to-png-command-line): Convert SVG to PNG from the command line with rsvg-convert, Inkscape, or ImageMagick. Set the output size explicitly, keep transparency, and avoid the blurry low-density trap. - [How to Count Matches with grep -c (and the Line-vs-Occurrence Trap)](https://techearl.com/grep-count-matches): grep -c counts matching LINES, not occurrences. A line with three hits still counts as 1. The fix is grep -o piped into wc -l, which puts every match on its own line first. Per-file counts, filtering out the :0 noise,... - [How to Count Unique Matches with grep, sort, and uniq](https://techearl.com/grep-count-unique): The grep -o 'pattern' file | sort | uniq -c | sort -rn pipeline is the classic log-analysis one-liner. Why sort must come before uniq, how each stage works, worked examples for top IPs and status codes, the awk one-pa... - [How to Create a User on Linux (useradd vs adduser)](https://techearl.com/how-to-create-a-user-on-linux): Create a Linux user with useradd or adduser, give it a home directory, shell, and password, and understand the difference between the low-level and friendly commands. - [How to Create an SSH Key in 2026](https://techearl.com/how-to-create-an-ssh-key): Create an SSH key in one ssh-keygen command. Which key type to pick in 2026 (Ed25519 vs RSA), whether to set a passphrase, and the file permissions SSH needs, on Linux, macOS and Windows. - [How to Crop a Video with ffmpeg](https://techearl.com/ffmpeg-crop-video): Crop a video with ffmpeg's crop filter: crop=w:h:x:y from the top-left origin, centered crops with in_w/in_h expressions, square crops for social, and cropdetect to strip black bars automatically. - [How to Delete a User on Linux (userdel)](https://techearl.com/how-to-delete-a-user-on-linux): Remove a user with userdel, including the home directory and mail spool with -r, plus what to do about files they owned elsewhere on the system. - [How to Disable Root Login on Linux](https://techearl.com/disable-root-login-linux): Disable direct root login over SSH and on the console, lock the root password, and move everyone to a normal account plus sudo, without locking yourself out. - [How to Download a Facebook Video with yt-dlp](https://techearl.com/download-facebook-video): Download a Facebook video free from the command line with yt-dlp: public watch links and fb.watch shorts need no cookies, private and group videos use --cookies-from-browser firefox, and you pick the resolution yourself. - [How to Download a TikTok Video with yt-dlp](https://techearl.com/download-tiktok-video): Download a TikTok video free from the command line with yt-dlp: no app, no sketchy site. yt-dlp pulls the source MP4 TikTok serves, follows short links, extracts audio, and uses your cookies for gated clips. For the p... - [How to Download a YouTube Video (Any Quality) with yt-dlp](https://techearl.com/download-youtube-video): Download a YouTube video free from the command line with yt-dlp: install it, grab the best quality, pick a resolution, handle Shorts, and get past the bot check. youtube-dl's free, maintained successor. - [How to Download an Instagram Reel or Video with yt-dlp](https://techearl.com/download-instagram-reel): Download an Instagram Reel or video free from the command line with yt-dlp. Instagram needs you logged in, so cookies are mandatory: how to pass them, keep them fresh, and grab reels, feed videos, IGTV, or just the au... - [How to Download YouTube Audio (M4A, MP3, or Opus) with yt-dlp](https://techearl.com/download-youtube-audio): Download YouTube audio free with yt-dlp: extract to M4A or Opus with no quality-losing re-encode, tag it with cover art, or convert YouTube to MP3 for older players. The free, maintained youtube-dl successor. - [How to Edit the sudoers File Safely (visudo)](https://techearl.com/edit-sudoers-safely-visudo): Edit sudo rules without locking yourself out: why visudo syntax-checks before saving, drop-in files in /etc/sudoers.d, and the rules you actually need. - [How to Exclude a Directory in find (the -prune Pattern Explained)](https://techearl.com/find-exclude-directory-with-prune): find -path './node_modules' -prune -o -type f -print skips a directory subtree instead of walking into it. The pattern looks strange because -prune is an action, not a test, and the trailing -print is mandatory once y... - [How to Exclude Files and Directories from grep](https://techearl.com/grep-exclude-files-directories): grep does not read .gitignore, so skipping node_modules, .git, and build output is on you. The flags that do it: --exclude for filename globs, --exclude-dir for whole directories, --include for the inverse, --exclude-... - [How to Exclude Matches with grep -v (Invert Match)](https://techearl.com/grep-invert-match): grep -v 'pattern' file prints every line that does NOT match. The flag reference, how to exclude multiple patterns, the strip-comments-and-blank-lines pipeline, the double-negative trap where -v of an OR becomes an AN... - [How to Extract a YouTube Transcript (Captions) with yt-dlp](https://techearl.com/download-youtube-transcript): Pull a YouTube video's transcript free from the command line with yt-dlp: list the caption tracks, download the subtitles without the video, convert SRT/VTT to clean plain text, and transcribe with Whisper when no cap... - [How to Extract Audio From a Video with ffmpeg](https://techearl.com/ffmpeg-extract-audio-from-video): Pull the audio out of a video with ffmpeg: copy the stream untouched when you just want to demux (fast, lossless), or re-encode to MP3, AAC, or WAV when you need a different format. Plus how to check the source codec... - [How to Find (and Delete) Empty Directories and Files](https://techearl.com/find-empty-directories): find . -type d -empty lists every empty directory; find . -type f -empty lists every empty file. The catch is what 'empty' means (a hidden file makes a directory not empty) and the -depth trap that lets find -delete c... - [How to Find a Saved Wi-Fi Password From the macOS Terminal](https://techearl.com/get-wifi-password-mac-terminal): Print a saved Wi-Fi password from the macOS Terminal with the built-in security command: no third-party tool, no install. Reads your own login keychain, with the auth prompt that is supposed to appear. - [How to Find and Delete Files Safely with find -delete](https://techearl.com/find-and-delete-files): find -delete removes every matched file with no confirmation and no undo. The safe pattern is to write the command with -print first, eyeball the list, then swap -print for -delete. Plus the directory-depth-first trap... - [How to Find Files by Extension (One or Many) with find](https://techearl.com/find-files-by-extension): find . -type f -name '*.txt' lists every file with one extension. For many extensions you group -name tests with escaped parens and join them with -o. This covers the single one-liner, the multi-extension OR pattern,... - [How to Find Files by Owner, Group, or Permission with find](https://techearl.com/find-files-by-owner-permissions): find -user www-data lists every file owned by a user; -group developers filters by group; -perm matches the mode bits. The subtle part is -perm -mode (all of these bits set) versus -perm /mode (any of these bits set).... - [How to Find Files Containing Specific Text (find + grep)](https://techearl.com/find-files-containing-text): find ... -print0 | xargs -0 grep -l 'PATTERN' finds every file containing a piece of text. The combo handles weird filenames, scales to huge trees, and replaces three other common but broken pipelines. When to use gre... - [How to Find Files Larger Than a Size with find -size](https://techearl.com/find-files-larger-than): find . -size +100M lists every file larger than 100 megabytes. The unit suffixes (c, k, M, G), the +/- sign convention, how to combine with sort to find the biggest files on disk, the BSD vs GNU divergence for printin... - [How to Find Files Modified in the Last 7 Days (find -mtime)](https://techearl.com/find-files-modified-last-7-days): find -mtime -7 lists every file modified in the last 7 days. The catch is the off-by-one: -7 means less than 7 days ago, +7 means more than 7 days ago, and exact-7 almost never matches what people expect. The flag ref... - [How to Find Files Not Modified in the Last N Days (Stale File Detection)](https://techearl.com/find-files-not-modified-since): find . -type f -mtime +30 lists every file NOT modified in the last 30 days. The +N sign means older than N days, the exact inverse of -N. The full reference for -mtime, -mmin, -newer markers, the -atime vs -mtime dis... - [How to Find the Largest Files on Disk (find, sort, du)](https://techearl.com/find-largest-files-on-disk): find / -xdev -type f -printf '%s %p\n' | sort -rn | head -20 gives you a ranked list of the biggest files on a full disk. The GNU one-liner, the BSD/macOS stat variant, why -xdev matters, human-readable output with nu... - [How to Get Image Dimensions From the Command Line](https://techearl.com/image-dimensions-command-line): Get an image's width and height from the terminal: ImageMagick's identify, the built-in sips on macOS (no install), file for a quick guess, ffprobe for video, plus a batch loop over a whole folder. - [How to Give a User sudo Access on Linux](https://techearl.com/how-to-give-sudo-access-linux): Grant sudo by adding a user to the sudo or wheel group, or with a sudoers drop-in, and how to scope it to specific commands instead of full root. - [How to grep and Print a Specific Column (grep + awk)](https://techearl.com/grep-and-print-column): grep filters lines, awk extracts fields. The classic pipe is grep 'pattern' file | awk '{print $2}'. This covers awk field basics ($1, $NF), custom separators with -F, multi-column output, the cases grep -o and cut co... - [How to grep Case-Insensitively (grep -i)](https://techearl.com/grep-case-insensitive): grep -i 'pattern' file matches regardless of case. The flag pairs with -r, -w, -v, and -c the way you would expect, but -i only folds ASCII case reliably. Non-ASCII case folding (accented characters, the Turkish dotte... - [How to grep Recursively Through a Directory](https://techearl.com/grep-recursive): grep -r 'pattern' . searches every file under a directory tree. The catch is the path argument people forget, the -r vs -R symlink difference, and the unfiltered crawl into node_modules and .git. The flag reference, t... - [How to Inspect an Animated GIF (Frame Count, Size, Delay) From the Command Line](https://techearl.com/inspect-animated-gif-command-line): Inspect an animated GIF from the command line: read its dimensions, frame count, loop count, and per-frame delays with gifsicle, count frames and detect whether it animates with ImageMagick, extract the first frame, a... - [How to List Only Filenames with grep -l](https://techearl.com/grep-list-filenames): grep -l prints the name of each file that contains a match and stops reading at the first hit, which makes it the fast answer to 'which files contain this string'. The lowercase -l, the inverted -L for files missing a... - [How to List Users and Groups on Linux](https://techearl.com/list-users-and-groups-linux): List every user and group from /etc/passwd and /etc/group with getent, tell human accounts from system ones by UID, and see which groups a user belongs to. - [How to Make a Contact Sheet (Thumbnail Grid) From a Video with ffmpeg](https://techearl.com/ffmpeg-contact-sheet-preview): Make a contact sheet from a video with one ffmpeg command: sample a frame every N seconds, scale it, and tile the frames into a single thumbnail-grid image with the tile filter. Keyframe sampling, padding, and multi-s... - [How to Make a File Executable on Linux (chmod +x)](https://techearl.com/make-file-executable-linux): Make a script runnable with chmod +x, why the shebang line matters, and how to run it with ./ once the execute bit is set. - [How to Match a Whole Word with grep -w](https://techearl.com/grep-whole-word): grep cat also matches category, concatenate, and scatter. grep -w cat matches only the standalone word. The whole-word flag, what grep counts as a word boundary, the regex equivalents with \b and \< \>, the stricter -... - [How to Normalize Audio Volume From the Command Line](https://techearl.com/normalize-mp3-volume-command-line): Normalize MP3 and audio volume from the command line: ffmpeg's loudnorm filter for EBU R128 loudness (one-pass and the accurate two-pass), rsgain for ReplayGain tags across a whole library, and why loudness beats peak... - [How to Optimize and Compress a GIF From the Command Line (gifsicle)](https://techearl.com/optimize-gif-command-line): Compress and optimize an animated GIF from the command line with gifsicle: -O3 optimization, the --lossy flag most guides miss, --colors reduction, and resizing. Plus the honest truth about when to ditch GIF for MP4/W... - [How to Optimize JPEG Images Using jpegoptim](https://techearl.com/how-to-optimize-jpeg-images-using-jpegoptim): Use jpegoptim to losslessly or lossy-compress JPEGs from the command line, in bulk, and inside CI pipelines. Includes the install path on macOS/Linux/Windows, mozjpeg / squoosh-cli / sharp comparisons, and the paralle... - [How to Remove Audio From a Video (Mute It) with ffmpeg](https://techearl.com/ffmpeg-mute-video): Remove audio from a video with ffmpeg in one command: -an drops the track, -c:v copy keeps the video lossless and instant. Plus muting only part of a clip and dropping one track from a multi-track file. - [How to Reverse a Video with ffmpeg](https://techearl.com/ffmpeg-reverse-video): Reverse a video with ffmpeg using the reverse filter for picture and areverse for sound. Why you must write to a new output file, and why you trim before you reverse. - [How to Reverse an Animated GIF From the Command Line](https://techearl.com/reverse-animated-gif): Reverse an animated GIF from the command line with ImageMagick or ffmpeg. The -coalesce step is mandatory (GIF frames are diffs), plus a boomerang that plays forward then backward. - [How to rsync Only the Files find Selected](https://techearl.com/find-and-rsync-selective): rsync has no native time filter, so the standard trick is to let find pick the files and feed the list to rsync. The one-liner is find ... -print0 | rsync --files-from=- --from0, and the failure mode is always the sam... - [How to Run a Command as Another User (sudo -u)](https://techearl.com/run-command-as-another-user-linux): Run a command as a different user with sudo -u or runuser, including as a service account that has no login shell, and the difference between the two. - [How to Run find in Parallel with xargs -P](https://techearl.com/find-and-xargs-parallel): find . -type f -name '*.log' -print0 | xargs -0 -P 4 -n 1 gzip compresses every matched file four at a time. The flags that make it work: -P for parallel workers, -n 1 so each worker gets one job, -0 paired with find'... - [How to Search Multiple Patterns with grep](https://techearl.com/grep-multiple-patterns): grep can OR several patterns three ways: -e per pattern, -E with alternation, or -f reading the list from a file. The one-liner is grep -E 'ERROR|WARN|FATAL' file. Here is when to pick each, how -F speeds up literal m... - [How to Set or Stop an Animated GIF's Loop From the Command Line](https://techearl.com/gif-loop-count-command-line): Control how many times an animated GIF loops from the command line with gifsicle: play once, repeat a fixed number of times, or loop forever, plus the off-by-one count that trips everyone up and the inverse loop numbe... - [How to Set the Date and Time From the macOS Command Line](https://techearl.com/mac-set-date-command-line): Set the system clock from the macOS command line the right way. The BSD date set form is MMDDhhmm[[CC]YY], not the GNU date -I flag that gets copied around. Turn off network time first or macOS resyncs. - [How to Set the Desktop Wallpaper From the macOS Command Line](https://techearl.com/set-mac-wallpaper-command-line): Set the macOS desktop wallpaper from the terminal with one osascript line that covers every display at once, plus the modern caching gotcha and how to script a random wallpaper. - [How to Set Up Passwordless sudo (NOPASSWD)](https://techearl.com/passwordless-sudo-linux): Configure NOPASSWD in a sudoers drop-in for a user or a specific command, the security trade-offs, and how to scope it tightly so it is not a free root shell. - [How to Show Lines Before and After a grep Match (Context)](https://techearl.com/grep-context-lines): grep -C 3 'pattern' file prints the matching line plus 3 lines on each side. The three context flags (-A after, -B before, -C both), how the -- group separator works between match blocks, asymmetric context, recursive... - [How to Speed Up or Slow Down a Video with ffmpeg](https://techearl.com/ffmpeg-change-video-speed): Change a video's speed from the command line with ffmpeg: setpts for the video, atempo for the audio, why you still chain atempo in steps of 2.0 even though it now accepts up to 100, and keeping both tracks in sync. - [How to Take a Photo With the Mac Camera From the Command Line](https://techearl.com/mac-camera-command-line): Take a photo with the Mac camera from the Terminal using imagesnap: install it, list devices, pick one, add a warm-up delay, and fix the Camera-permission gap that makes a CLI capture fail silently. Plus the ffmpeg av... - [How to Toggle Dark Mode From the macOS Command Line](https://techearl.com/mac-dark-mode-command-line): Toggle macOS dark mode from the terminal with one osascript line: instant, no restart. Force it on or off, read the current state, and skip the dead _HIEnableThemeSwitchHotKey trick. - [How to Trim or Cut a Video with ffmpeg](https://techearl.com/ffmpeg-trim-cut-video): Trim or cut a video from the command line with ffmpeg: the fast lossless -c copy way, the keyframe gotcha that makes your cut land early, and the frame-accurate re-encode. With -ss and -to/-t explained. - [How to Turn an Image Into ASCII Art From the Command Line](https://techearl.com/image-to-ascii-art-command-line): Turn any image into ASCII art from the terminal: jp2a for the classic monospace look (with ANSI color and an invert flag for dark terminals), and chafa for truecolor, Unicode-detail, and even animated GIFs. - [How to Turn Bluetooth On or Off From the macOS Command Line](https://techearl.com/mac-bluetooth-command-line): Toggle Bluetooth on or off from the macOS terminal with blueutil: blueutil -p 1 / -p 0 / -p toggle, read the current state, list paired devices, and connect or disconnect by address. The reliable route now that Apple... - [How to Verify a File Checksum on macOS (SHA-256)](https://techearl.com/verify-checksum-mac-command-line): Verify a file's SHA-256 checksum on macOS from the command line: compute it with shasum -a 256, check it against a published hash with -c, and know why SHA-256 (not MD5 or SHA-1) is the right choice in 2026. - [How to ZIP Multiple Directories Into Individual Files](https://techearl.com/how-to-zip-multiple-directories-into-individual-files): Batch compress each folder in a parent directory into its own ZIP, tar.gz, or 7z archive on Linux, macOS, and Windows. Covers the for-loop one-liners, encryption, symlink handling, and the BSD vs Info-ZIP differences. - [iftop: See Bandwidth by Connection in Real Time](https://techearl.com/iftop-command-linux): sudo iftop -i eth0 shows a live, per-connection bandwidth table: which host pairs are moving traffic and at what rate. The interface flag people forget, the -n and -P switches that make the output readable, the 2s/10s... - [Installing VirtualBox Guest Additions on Ubuntu (22.04, 24.04, and 26.04 LTS)](https://techearl.com/installing-virtualbox-guest-additions-on-ubuntu): Install VirtualBox Guest Additions on Ubuntu 22.04, 24.04, and 26.04 LTS guests for shared clipboard, drag and drop, shared folders, and dynamic display resolution. Covers VirtualBox 7.0 and 7.1, both install methods,... - [Linux ACLs: getfacl and setfacl Explained](https://techearl.com/linux-acl-getfacl-setfacl): Grant one user access to a file without changing its group, using POSIX ACLs with setfacl, reading them with getfacl, and setting defaults that new files inherit. - [Linux File Permissions Explained (chmod and Octal)](https://techearl.com/linux-file-permissions-explained): Read and set rwx permissions, the octal numbers behind 644 and 755, the difference between files and directories, and symbolic vs numeric chmod. - [nload: Watch Live Network Bandwidth in the Terminal](https://techearl.com/nload-command-linux): The nload command draws a live graph of incoming and outgoing bandwidth per interface, right in the terminal. Install it, run nload, switch interfaces with the arrow keys, and read the In/Out, Avg, and Max numbers. Th... - [nvtop: Monitor NVIDIA, AMD, and Intel GPUs on Linux](https://techearl.com/nvtop-gpu-monitoring-linux): nvtop is an htop-style GPU monitor for Linux. One install (sudo apt install nvtop), one command, and you get live per-GPU utilization, memory, temperature, and a sortable per-process list across NVIDIA, AMD, and Intel... - [Open Apps, Files, and URLs From the macOS Command Line with open](https://techearl.com/open-command-mac-apps-urls): The macOS open command launches apps, files, folders, and URLs from the Terminal: open a file in its default app, reveal it in Finder, open a URL in a specific browser, and the zsh quoting gotcha that breaks URLs. - [Set Password Expiry and Account Aging on Linux (chage)](https://techearl.com/set-password-expiry-linux): Set maximum password age, warning days, and an account expiry date with chage, and read the current aging with chage -l. The full password-lifecycle reference. - [setuid, setgid, and the Sticky Bit Explained](https://techearl.com/setuid-setgid-sticky-bit): What the s and t bits do, why /usr/bin/passwd is setuid and /tmp is sticky, how to set them, and how to audit a system for risky setuid binaries. - [ShellCheck: Catch Bash Bugs Before They Bite](https://techearl.com/shellcheck-lint-bash-scripts): ShellCheck is a static analysis linter for Bash and POSIX sh: install it, run it on a script, read the SC codes, suppress false positives with disable directives, and wire it into CI. - [The ffmpeg Command Cheat Sheet](https://techearl.com/ffmpeg-commands-cheat-sheet): A scannable ffmpeg reference: convert containers, stream-copy without re-encoding, trim and cut, resize and crop, extract or replace audio, high-quality GIFs with palettegen, x264/x265/AV1 quality with -crf and -prese... - [which vs type vs command -v: Find a Command Path](https://techearl.com/find-command-path-which-type): which vs type vs command -v for finding where a command lives: which is an external program with portability problems, command -v is the POSIX-standard choice for scripts, and type tells you the most. - [yt-dlp Cheat Sheet: Download Video, Audio, and Subtitles From the Command Line](https://techearl.com/yt-dlp-cheat-sheet): A scannable yt-dlp reference: install and update, format selection, audio extraction, subtitles, playlists and channels, cookies and auth, rate limiting, output templates, and post-processing. The free, maintained you... ### Network - [Network (topic hub)](https://techearl.com/network): DNS, packets, proxies, and the wires that turn a server into something the internet can reach. - [How to Block AI Bots (robots.txt, Nginx, Apache, Cloudflare, WordPress)](https://techearl.com/block-ai-bots): The full reference for blocking AI crawlers: which bots matter, what each one does, robots.txt and server-level rules, Cloudflare's managed approach, WordPress paths, and the bots that ignore robots.txt entirely. - [How to Block the Wayback Machine from Archiving Your Site](https://techearl.com/block-wayback-machine): How to block the Internet Archive's Wayback Machine from future crawls with robots.txt, how to request removal of existing snapshots by emailing info@archive.org, what the 'This URL has been excluded' message means, a... - [How to Run a DNS Health Check on Your Domain](https://techearl.com/dns-health-check): A practical DNS health check covers nameservers, A and AAAA records, MX, SPF, DKIM, DMARC, and CAA. Here is the full checklist, what each record actually tells you, and how to verify all of them in one pass. - [Should You Block AI Bots? An Honest Strategic Guide](https://techearl.com/should-you-block-ai-bots): I blocked every AI bot I could when they first started slamming my servers. A few months later I unblocked most of them. This is the decision framework I wish I'd had at the start. - [Speed Up a Linux Server With TCP BBR](https://techearl.com/tcp-bbr-congestion-control-linux): Switch to TCP BBR congestion control with two sysctl lines and a reboot-safe config file. The throughput it buys you on lossy long-haul links, the fq qdisc it needs, the kernel version that ships it, and when CUBIC is... ### PHP - [PHP (topic hub)](https://techearl.com/php): PHP that ages well: WordPress, frameworks, and the production patterns that outlived the criticism. - [How to Remove Empty Values from an Array in PHP](https://techearl.com/how-to-remove-empty-values-from-an-array-in-php): Drop empty, null, or false values from a PHP array with array_filter and the right callback. Includes the '0 gets removed' gotcha, the array_values re-index pattern, multidimensional cleanup, and a performance compari... - [Install Gearman PHP Module on Ubuntu (PHP 8.x)](https://techearl.com/installing-gearman-module-for-php7-on-ubuntu): How to install the Gearman PHP extension on Ubuntu 22.04 and 24.04 LTS for PHP 8.2, 8.3, and 8.4. Two install paths (apt and PECL), php.ini wiring, gearmand service setup, a working client/worker test, and when Gearma... - [PHP Memory Limit: How to Fix 'Allowed Memory Size Exhausted'](https://techearl.com/how-to-increase-php-memory-limit): Increase the PHP memory_limit via php.ini, .htaccess, ini_set(), the -d CLI flag, PHP-FPM pool config, or wp-config.php. Covers the modern PHP 8 defaults, the OPcache caveat, and the Composer/PHPUnit/WordPress out-of-... ### RegEx - [RegEx (topic hub)](https://techearl.com/regex): Patterns that match what you mean, even when the input doesn't. - [How to Match a Date with Regex (Multiple Formats)](https://techearl.com/regex-match-date-formats): Match a date with regex in ISO 8601, US, EU, and relaxed formats. Month/day validation, leap-year notes, JavaScript / Python / PHP examples, engine notes, common mistakes. - [How to Match a Domain Name with Regex](https://techearl.com/regex-match-domain-name): Match a domain name with regex. Basic labels, RFC 1035 length rules, subdomains, IDN punycode, trailing-dot form, JavaScript / Python / PHP examples, engine notes, and common mistakes. - [How to Match a URL with Regex](https://techearl.com/regex-match-url): Match a URL with regex. Covers http/https schemes, protocol-relative URLs, ports, paths, query strings, fragments, runnable JavaScript / Python / PHP, engine notes, and the URL parser alternative. - [How to Match an Email Address with Regex](https://techearl.com/regex-match-email-address): Match an email address with regex. The practical pattern, the strict RFC 5321 pattern, examples in JavaScript, Python, and PHP, edge cases, engine compatibility, common mistakes, and a validation test table. - [How to Match an IPv4 and IPv6 Address with Regex](https://techearl.com/regex-match-ipv4-and-ipv6): Match an IPv4 or IPv6 address with regex. Octet-bounded IPv4, compressed and full IPv6, CIDR, IPv4-mapped IPv6, parser fallback, engine notes, and common mistakes. - [How to Match Numbers with Regex](https://techearl.com/regex-match-numbers): Match integers, decimals, signed, scientific, thousands-separated, currency, and percent numbers with regex. JavaScript / Python / PHP examples, engine notes, common mistakes, test table. - [How to Use Capturing Groups and Backreferences in Regex](https://techearl.com/regex-capturing-groups-and-backreferences): Capturing groups, named groups, non-capturing groups, and backreferences in regex. JavaScript / Python / PHP examples, engine notes, common mistakes, and the duplicate-word and swap-fields use cases. - [How to Use Regex Lookaheads and Lookbehinds](https://techearl.com/regex-lookaheads-and-lookbehinds): Regex lookaheads and lookbehinds assert what comes before or after a match without consuming characters. Full reference with syntax, password validation, variable-width vs fixed-width support per engine, and examples... - [How to Validate a Credit Card Number with Regex](https://techearl.com/regex-validate-credit-card-luhn): Validate a credit card number with regex. Visa, MasterCard, Amex, Discover, Diners, JCB patterns, plus the Luhn checksum, JavaScript / Python / PHP examples, engine notes, common mistakes. - [How to Validate a US Phone Number with Regex](https://techearl.com/how-to-validate-us-phone-number-using-regex): Validate a US phone number with regex. The practical pattern, a stricter NANP version, runnable examples in JavaScript, Python, and PHP, what it still lets through, common mistakes, and a test table. - [How to Validate Password Strength with Regex](https://techearl.com/regex-password-strength-validation): Validate password strength with regex. Length checks, character-class requirements, lookahead patterns for mixed-case/digit/special enforcement, examples in JavaScript, Python, and PHP, engine notes, and common mistakes. - [Regex Anchors](https://techearl.com/regex-anchors): Regex anchors are unique tokens that assert positions within a string without matching characters. Discover their role in pattern matching across languages. - [Regex Cheat Sheet](https://techearl.com/regex-cheat-sheet): Regex Cheat Sheet including regex symbols, ranges, grouping, assertions, syntax tables, examples, matches, and compatibility tables. Definitive Regular Expressions Quick Reference! - [Regex Word Boundaries: \b, \B, and Lookaround Equivalents](https://techearl.com/regex-word-boundaries): Regex word boundaries (\b and \B) match positions between word and non-word characters with zero width. The full reference with engine differences, Unicode handling, lookaround alternatives, and worked examples for wh... - [Top 5 Online Regex Testers for 2026](https://techearl.com/top-5-online-regex-testers): The five online regex testers I actually use, ranked: Regex101, RegExr, RegexPlanet, Debuggex, and Rubular. What each is good at, where each falls short, and which flavor each one supports. ### Security - [Security (topic hub)](https://techearl.com/security): Hands-on web security: SQL injection, XSS, SSRF, RCE, and the labs to practice all of them. - [Application-Layer DoS: The Complete 2026 Practitioner Guide](https://techearl.com/application-layer-dos): Application-layer (L7) denial of service: Slowloris-class slow reads, HTTP/2 Rapid Reset and CONTINUATION flood, ReDoS, decompression bombs, hash flooding, GraphQL abuse, and the defences that actually hold. - [Argument Injection: Why escapeshellarg Is Not Enough](https://techearl.com/argument-injection): Why dashes survive shell escaping, the dig -f trick, curl -K, find -exec. The argv-array safe pattern. Field notes plus a lab. - [Authorization Header SQL Injection: Custom Token Schemes That Lookup From the Database](https://techearl.com/sql-injection-authorization-header): Authorization header SQL injection lives in hand-rolled API key schemes that query a tokens table by the bearer value. JWT-based auth is mostly safe; custom token schemes are not. The vulnerable code, manual exploit,... - [Billion Laughs Attack: XML Entity Expansion DoS and Why Defaults Now Block It](https://techearl.com/billion-laughs-attack): How nested entity expansion bombs work, why libxml's default limit blocks them, and the analogues in JSON / YAML / protobuf. Field notes plus a lab. - [Blind SSRF: Exfiltrating Internal Network Layout Without a Response Body](https://techearl.com/blind-ssrf): Blind SSRF is the variant where the server fetches the URL but the application hides the response. I walk the timing oracles, DNS and HTTP out-of-band exfil patterns, blind port scanning, and the defences that work ev... - [Blind XXE Out-of-Band: What Still Fires on Modern libxml](https://techearl.com/blind-xxe-oob): Direct external entity OOB still fires on libxml 2.9.14. The recursive PE+DTD chain does not. Field notes plus a Dockerised lab. - [Cloud Metadata SSRF: From One Vulnerable URL Fetcher to Full Cloud Compromise](https://techearl.com/cloud-metadata-ssrf): Capital One pattern, IMDSv1 vs v2 token model, GCP and Azure metadata endpoints. Field notes plus a Dockerised lab. - [commix Cheat Sheet: Every Flag I Actually Use for OS Command Injection](https://techearl.com/commix-cheat-sheet): A field-tested commix reference for OS command injection: targeting, request shaping, detection techniques, tamper scripts, enumeration, shell options, file operations, and evasion. Grouped by what you are actually tr... - [commix Tutorial: Exploiting a Vulnerable App End to End](https://techearl.com/commix-tutorial-exploiting-a-vulnerable-app): A complete commix walkthrough against a deliberately vulnerable lab app: identify the sink, capture the request, run the classic, time-based, and file-based techniques, pop an os-shell, catch a reverse TCP, and exploi... - [Cookie SQL Injection: When Session and Preference Cookies Become the Attack Surface](https://techearl.com/sql-injection-cookie): Cookie SQL injection happens when an application reads a cookie value and concatenates it into a query, almost always for preference, theme, A/B-bucket, or hand-rolled session lookups. The vulnerable code patterns, ma... - [Crack ZIP, RAR, and PDF Passwords with John the Ripper](https://techearl.com/crack-zip-rar-pdf-password): Forgot the password on an encrypted ZIP, RAR, PDF, or Office file? John the Ripper extracts a crackable hash from it and recovers the password. I walk the *2john workflow with real output, the hashcat alternative, and... - [Cross-Site Request Forgery (CSRF): The Complete 2026 Practitioner Guide](https://techearl.com/cross-site-request-forgery): CSRF in 2026: how the classic GET/POST/JSON variants still work, what SameSite=Lax actually changed in 2020, and the defences that hold up: anti-CSRF tokens, Origin validation, Fetch Metadata, and custom headers. - [Cross-Site Scripting (XSS): The Complete 2026 Practitioner Guide](https://techearl.com/cross-site-scripting): Cross-site scripting deep dive: three variants (reflected, stored, DOM), the cookie-theft chain end to end, and the modern defences (CSP, Trusted Types, HttpOnly, framework auto-escaping) that actually move the needle. - [CVE-2026-23111: the nf_tables 'off by !' Linux kernel LPE (detect, patch, lab)](https://techearl.com/cve-2026-23111-nftables-lpe): CVE-2026-23111 is a one-character nf_tables use-after-free that escalates any unprivileged Linux user to root through user namespaces, and a public exploit is now out. Here is how I detect it, the user-namespace mitig... - [CVE-2026-31431 'Copy Fail': Detect and Patch the Linux Kernel LPE](https://techearl.com/cve-2026-31431-copy-fail): CVE-2026-31431 (Copy Fail) is a Linux kernel local privilege escalation that turns any unprivileged shell into root on essentially every distribution shipped since 2017. Here is how I check it, patch it, mitigate it p... - [Dalfox Cheat Sheet: Every Flag I Actually Use](https://techearl.com/dalfox-cheat-sheet): A field-tested Dalfox v3 reference: target specification, detection tuning, parameter mining, blind XSS callbacks, evasion, pipeline patterns, and output shaping. Updated for the v3 Rust rewrite that consolidates ever... - [Dalfox Tutorial: Exploiting a Vulnerable App End to End](https://techearl.com/dalfox-tutorial-exploiting-a-vulnerable-app): A complete Dalfox walkthrough against a deliberately vulnerable XSS lab: reflected, stored, and DOM sinks, captured request files, blind callbacks, custom payloads, and a working cookie-theft chain. Updated for the Da... - [Dictionary vs Brute Force vs Mask vs Hybrid: When to Use Each](https://techearl.com/password-attack-types): Picking the attack is the judgement call that separates fast cracks from wasted GPU-weeks. I lay out the five attack types, the keyspace maths that decides between them, and the order I actually run them in, with the... - [DNS Rebinding: The Network-Level Bypass for SSRF Allowlists](https://techearl.com/dns-rebinding-ssrf): Two-record DNS responses, low TTLs, the rebinding race window. How allowlist bypasses still work in 2026 and what actually stops them. - [DOM-Based XSS: The Variant That Never Touches the Server](https://techearl.com/dom-based-xss): DOM XSS sinks (innerHTML, document.write), location.hash sources, Trusted Types defence. Field notes plus a Dockerised lab. - [Elasticsearch Ransomware: How an Open Port Wiped My Database](https://techearl.com/elasticsearch-ransomware): In May 2026 an automated bot wiped a terabyte of Elasticsearch data on a personal project of mine, through a port I left open. Here is exactly how the ransomware works, why it found me, and the boring one-time fixes t... - [eval() Injection: The Sink That Still Ships in 2026](https://techearl.com/eval-injection): eval() injection deep dive: the textbook PHP / Python / JavaScript / Ruby sink, why developers keep reaching for it (calculators, formula fields, dynamic config), and the structural alternatives. - [Exposed .git Directory: How Attackers Reconstruct Your Source Code](https://techearl.com/exposed-git-directory-attack): Web servers that ship their .git/ directory to production hand their entire source history to anyone with curl. I walk the detection, the reconstruction (with four reference dumpers under 200 lines each), the credenti... - [File Upload Double Extension: Apache AddHandler and the shell.php.jpg Trick](https://techearl.com/file-upload-double-extension): Why shell.php.jpg executes when Apache uses AddHandler. The SetHandler + FilesMatch correct pattern. Field notes plus a lab. - [File Upload Extension Bypass: Why Blacklists Always Lose](https://techearl.com/file-upload-extension-bypass): Why extension blacklists always lose. Forgotten extensions, Apache handler quirks. Field notes plus a Dockerised lab. - [File Upload MIME-Type Bypass: Why $_FILES\['file'\]\['type'\] Is a Lie](https://techearl.com/file-upload-mime-bypass): File upload MIME bypass deep dive: the Content-Type header is attacker-controlled, libmagic vs client claim, sniffing turns image stores into XSS sinks. - [File Upload Vulnerabilities: The Complete 2026 Practitioner Guide](https://techearl.com/file-upload-vulnerabilities): How attackers turn an upload form into RCE: extension blacklists, MIME validation, double extensions, polyglots, and the validation patterns that actually work in 2026. - [fuxploider Cheat Sheet: Every Flag I Actually Use](https://techearl.com/fuxploider-cheat-sheet): A field-tested fuxploider reference: target shaping, true/false response detection, extension fuzzing, cookies and headers, proxying, threading, and what to do once a webshell uploads. Grounded in the real argparse su... - [Hashcat Cheat Sheet: Build the Command, Copy, Crack](https://techearl.com/hashcat-cheat-sheet): Set your hash file, wordlist, hash mode, and mask once at the top, and every command below fills in with your values, ready to copy and run. Then the full flag reference grouped by task, the mask charset table, and th... - [Hashcat Mask Attack (-a 3): Smart Brute Force That Finishes](https://techearl.com/hashcat-mask-attack): A mask attack is brute force with a brain: you tell hashcat the shape of the password and it skips the quadrillions of strings nobody picks. I cover the charsets, custom charsets, increment mode, the keyspace maths, a... - [Hashcat Rules: More Cracks From the Same Wordlist](https://techearl.com/hashcat-rules): Rules are the highest-yield technique in cracking: one wordlist word becomes hundreds of plausible variants. I cover the rule functions, best64 with real generated output, stacking, writing your own, and the big publi... - [Hashcat vs John the Ripper: Which Should You Use?](https://techearl.com/hashcat-vs-john-the-ripper): Hashcat or John the Ripper? They overlap but have different sweet spots. I compare them on speed, hash and file-format coverage, the attack engine, and usability, and give a straight answer for when to reach for each.... - [Host Header SQL Injection: Multi-Tenant Routing Gone Wrong](https://techearl.com/sql-injection-host-header): Host header SQL injection happens in multi-tenant SaaS apps that look up the tenant by hostname. Same pattern applies to X-Forwarded-Host. The vulnerable code, how to test it by hand, the sqlmap one-liner, and the def... - [How Attackers Steal Session Cookies via XSS (and Why HttpOnly Is Not Enough in 2026)](https://techearl.com/xss-stealing-session-cookies): document.cookie exfil, AiTM phishing proxies (Evilginx), and infostealers. How session cookies actually get stolen in 2026, with a working lab. - [How to Crack a bcrypt Hash (and Why It's So Slow)](https://techearl.com/crack-bcrypt-hash): bcrypt is the hash you mostly cannot crack, and that is the point. I cover the hashcat command (-m 3200), why bcrypt is deliberately glacial, how the cost factor multiplies crack time, realistic GPU expectations, and... - [How to Crack a WPA/WPA2 Wi-Fi Password with Hashcat](https://techearl.com/crack-wpa2-password): How to recover your own WPA/WPA2 Wi-Fi password: capture the handshake or PMKID, convert it to the hashcat 22000 format, and crack it with a wordlist. I cover the full toolchain, realistic expectations for this slow h... - [How to Crack an MD5 Hash with Hashcat](https://techearl.com/crack-md5-hash): MD5 is the easy case: fast, unsalted, and broken for passwords, which makes it the perfect place to learn cracking. I cover the hashcat command, salted MD5 variants, why MD5 decrypt sites are not what they claim, and... - [How to Crack NTLM Hashes with Hashcat](https://techearl.com/crack-ntlm-hash): NTLM is the hash behind Windows and Active Directory passwords, and it is fast and unsalted, which is why a password audit cracks weak ones in seconds. I cover the hashcat command, where the hashes come from, realisti... - [How to Identify a Hash Type (and Find the Hashcat Mode)](https://techearl.com/identify-hash-type): Before you can crack a hash you have to know what it is. I cover identifying a hash on sight from its prefix and length, the tools that do it for you, and the part most guides skip: mapping the algorithm to the right... - [How to Use Hashcat: The Complete Guide (with Real Examples)](https://techearl.com/how-to-use-hashcat): Everything you need to go from a fresh hashcat install to recovering a password: the command anatomy, attack modes, hash modes, your first real crack, reading the status screen, and the speed flags that matter. Tested... - [Image Polyglot Webshells: When the JPEG Is Also a PHP File](https://techearl.com/image-polyglot-webshell): Image polyglot webshells, how PHP, PHAR, and ImageMagick MVG hide inside a valid JPEG, the trigger conditions, and a working lab walkthrough. - [Insecure Deserialization: The Complete 2026 Practitioner Guide](https://techearl.com/insecure-deserialization): Insecure deserialization deep dive: how object reconstruction becomes remote code execution across Java, .NET, Python, PHP, Ruby, and Node, with gadget chains, real CVEs, and the defences that actually work. - [John the Ripper Cheat Sheet: Extract, Crack, Show](https://techearl.com/john-the-ripper-cheat-sheet): Set your hash file, wordlist, and format once, and every John the Ripper command below fills in with your values, ready to copy. The *2john extractors, all four cracking modes, the full flag reference, and the format... - [John the Ripper: The Complete Guide (Jumbo, with Real Examples)](https://techearl.com/john-the-ripper): John the Ripper is the cracker that runs anywhere and pulls a hash out of almost any encrypted file. I walk the jumbo install, auto-detection, the *2john extractors that are its killer feature, your first real crack,... - [Learn SQL Injection: A Structured Path from Zero to Defence](https://techearl.com/learn-sql-injection): An ordered learning path for SQL injection, from understanding the bug to finding it, exploiting every variant and vector, automating with sqlmap, getting past WAFs, defending at every layer, and learning from the rea... - [LFI Log Poisoning: Turning a File Read into RCE via the Apache Access Log](https://techearl.com/lfi-log-poisoning): Inject PHP via User-Agent, include the access log, fire RCE. Permission gotchas and the right way to lock this down. Field notes plus a lab. - [LUKS Disk Encryption With cryptsetup](https://techearl.com/luks-encrypt-disk-cryptsetup): Set up LUKS disk encryption with cryptsetup: format a block device, open it, put a filesystem on it, and mount it. The four commands, plus the header backup nobody warns you about. - [Nmap Command Examples: Scan Hosts, Ports, and Services](https://techearl.com/nmap-command-examples): Practical nmap command examples I reach for: host discovery, the default port scan, service and version detection, OS fingerprinting, scoped scans with timing control, and the scripting engine, with notes on when each... - [NVIDIA GeForce GTX 1080 Ti Hashcat Benchmarks (152 Hash Modes)](https://techearl.com/hashcat-benchmarks-nvidia-geforce-gtx-1080-ti): Hashcat benchmark numbers for the NVIDIA GeForce GTX 1080 Ti across 152 hash modes, with a modern context: how the 1080 Ti compares to the RTX 3090, 4090, and 5090, and when it's still worth using in 2026. - [OpenSnitch: An Application Firewall for Linux](https://techearl.com/opensnitch-application-firewall-linux): OpenSnitch is an application firewall for Linux that asks per process before any program talks to the network. Install it, answer the prompts, and write rules that stick. - [OS Command Injection: shell_exec, Metacharacters, and the argv-Array Defence](https://techearl.com/os-command-injection): The classic shell_exec injection, metacharacters, argv-array safe pattern. Field notes plus a Dockerised lab. - [Password Cracking Wordlists: RockYou and Beyond](https://techearl.com/password-cracking-wordlists): A cracker is only as good as the candidates it tries, and the wordlist is the most important one. I cover rockyou.txt and where to get it, the curated lists worth having, how to optimise and order them, and how to bui... - [Password Cracking: How It Actually Works (Beginner to Advanced)](https://techearl.com/password-cracking): Password cracking is not guessing at a login form. It is an offline maths problem against a stolen hash. I walk the whole workflow, every attack mode and when to use each, the fast-vs-slow hash divide that decides eve... - [Path Traversal and Local File Inclusion (LFI): The Complete 2026 Practitioner Guide](https://techearl.com/path-traversal): Classic traversal, php://filter source disclosure, php://input RCE, log poisoning. Field notes plus a Dockerised lab to reproduce locally. - [php://input LFI-to-RCE: When allow_url_include Turns a File Read into Code Execution](https://techearl.com/php-input-lfi-to-rce): How a single LFI sink reaches full RCE via php://input when allow_url_include is On. Field notes plus a Dockerised lab. - [Referer Header SQL Injection: A Practical Guide](https://techearl.com/sql-injection-referer-header): Referer-header SQL injection lives in click-attribution tables, marketing analytics, and anti-CSRF logging. Same shape as User-Agent injection but distinct enough to need its own treatment. Vulnerable code, curl explo... - [Reflected XSS: How URL-Borne Payloads Land in 2026](https://techearl.com/reflected-xss): Reflected XSS mechanics, delivery via phishing and malvertising, framework auto-escaping, CSP. Field notes plus a Dockerised lab. - [Remote Code Execution (RCE): The Complete 2026 Practitioner Guide](https://techearl.com/remote-code-execution): Remote code execution explained from the sink level up. Command injection, argument injection past escapeshellarg, server-side template injection, and direct eval, with a Dockerised lab that reproduces each one, plus... - [Running sqlmap Through Tor and Proxychains (Without Leaking)](https://techearl.com/sqlmap-with-tor-and-proxychains): How to run sqlmap through Tor or proxychains correctly. The native --tor flag, the proxychains wrapper, DNS leak prevention, rate-limit reality, when not to do it, and how to verify your traffic is actually anonymised... - [Server-Side Request Forgery (SSRF): The Complete 2026 Practitioner Guide](https://techearl.com/server-side-request-forgery): How SSRF actually works, the Capital One breach as the canonical case study, every modern variant (blind, DNS rebinding, cloud metadata, wrapper schemes, tool-call orchestrators), reproducible exploits against a Docke... - [Server-Side Template Injection (SSTI): From {{7*7}} to RCE](https://techearl.com/server-side-template-injection): Jinja2, Twig, FreeMarker, Velocity SSTI mechanics. Sandbox escapes, polyglot detection, defences. Field notes plus a lab. - [Speed Up Hashcat: Workload, Optimized Kernels, and Tuning](https://techearl.com/hashcat-optimization): hashcat slow? Most of the speed is in two things: the workload flags and the order you run attacks. I cover the workload profile, optimized kernels and their length cap, device selection, benchmark-driven tuning, and... - [SQL Injection in HTTP Requests: Every Vector Attackers Use](https://techearl.com/sql-injection-http-request-vectors): A practical map of every place SQL injection can live inside an HTTP request: query string, URL path, request body (form, JSON, XML, multipart filename), and every header from User-Agent to Authorization. Where attack... - [SQL Injection in JSON Request Bodies (REST and GraphQL APIs)](https://techearl.com/sql-injection-json-body): JSON-body SQL injection is the modern face of the bug: REST APIs, GraphQL resolvers, and ORM raw-query escape hatches. How developers paint themselves into the corner with template strings around JSON fields, the manu... - [SQL Injection: Variants, Exploitation, and Defence](https://techearl.com/sql-injection): How SQL injection actually works, what every major variant looks like (union-based, error-based, boolean blind, time blind, out-of-band, second-order, NoSQL), how to exploit each one against a vulnerable app, and how... - [sqlmap Cheat Sheet: Every Flag I Actually Use](https://techearl.com/sqlmap-cheat-sheet): A field-tested sqlmap reference: target specification, request shaping, detection tuning, DBMS fingerprinting, enumeration, dumping, file system access, OS command execution, evasion, and tamper scripts. Grouped by wh... - [sqlmap Evasion and Anti-Detection: WAF Bypass in Practice](https://techearl.com/sqlmap-evasion-and-anti-detection): How to get sqlmap past commercial WAFs. Tamper scripts that still work, request shaping (delays, chunked encoding, HPP), fingerprint reduction, when tamper chains fail and you need to drop to manual Burp Repeater, and... - [sqlmap Tutorial: Exploiting a Vulnerable App End to End](https://techearl.com/sqlmap-tutorial-exploiting-a-vulnerable-app): A complete sqlmap walkthrough against a deliberately vulnerable lab app: target identification, baseline, capture, detection, fingerprinting, enumeration, dumping, file read, and OS shell. Every step reproducible with... - [SSH Keys With a YubiKey (FIDO2 / U2F)](https://techearl.com/ssh-key-yubikey-fido2): Generate a hardware-backed SSH key on a YubiKey with one ssh-keygen command. How FIDO2/U2F SSH keys work, the difference between ed25519-sk and ecdsa-sk, resident keys, and the firmware and OpenSSH versions you need. - [SSRFmap Cheat Sheet: Every Module and Flag I Actually Use](https://techearl.com/ssrfmap-cheat-sheet): A field-tested SSRFmap reference: target capture, the real module list (readfiles, portscan, redis, fastcgi, mysql, smtp, axfr, aws, gce, alibaba, digitalocean, github, zabbix, postgres, docker, socksproxy, smbhash, t... - [SSRFmap Tutorial: Exploiting a Vulnerable App End to End](https://techearl.com/ssrfmap-tutorial-exploiting-a-vulnerable-app): A complete SSRFmap walkthrough against a deliberately vulnerable lab: identify the sink, capture the Burp request, run detection, read local files, scan internal hosts, bypass a broken allowlist, hit the IMDS mock, an... - [Stored XSS: The Variant That Persists and Targets Other Users](https://techearl.com/stored-xss): Stored XSS mechanics, admin-victim chains, CSP and output encoding defences. Field notes plus a Dockerised lab to reproduce. - [SVG XSS: Stored Cross-Site Scripting via SVG Uploads](https://techearl.com/svg-xss): SVG XSS mechanics: SVG is XML that runs scripts. Upload chain, sanitiser bypasses, real CVEs, and the layered defence stack. Field notes plus a lab. - [The 2022 Uber Breach: MFA Fatigue and a Hardcoded Password](https://techearl.com/uber-2022-breach-mfa-fatigue): In September 2022, an attacker spammed an Uber contractor with MFA prompts, then messaged them on WhatsApp pretending to be IT to get one approved. Inside, they found a hardcoded admin password in a script that unlock... - [The Best API Security Tools in 2026](https://techearl.com/best-api-security-tools-2026): The API security tools I actually reach for in 2026: Burp Suite, mitmproxy, OWASP ZAP, kiterunner, Postman, jwt_tool, graphql-cop, and the commercial platforms. Strengths, weaknesses, and how I decide which to use. - [The Best Application-Layer DoS Testing Tools in 2026](https://techearl.com/best-application-layer-dos-tools-2026): The application-layer DoS testing tools I actually use in 2026 for resilience and load testing: k6, wrk2, slowhttptest, recheck, h2spec/h2load, Burp Turbo Intruder, Locust, and ZAP. Strengths, weaknesses, and how I pick. - [The Best Clickjacking Tools in 2026](https://techearl.com/best-clickjacking-tools-2026): The clickjacking tools I actually reach for in 2026: PoC generators, OWASP ZAP, DNSChkr HTTP Security Headers, Mozilla Observatory, Burp Active Scanner, and the post-Yibelo double-clickjacking PoC repos. Honest framin... - [The Best CSRF Tools in 2026](https://techearl.com/best-csrf-tools-2026): The CSRF tools I actually reach for in 2026: Burp Suite's PoC generator, OWASP ZAP, xsrfprobe, Param Miner for hidden token discovery, plus the manual Origin and SameSite workflow. Honest framing on a defence class th... - [The Best Deserialization Tools in 2026](https://techearl.com/best-deserialization-tools-2026): The insecure deserialization tools I actually use in 2026: ysoserial for Java, ysoserial.net for .NET, marshalsec, PHPGGC, Burp's Java Deserialization Scanner, GadgetInspector, and the honest story on Python pickle. S... - [The Best File Upload Vulnerability Tools in 2026](https://techearl.com/best-file-upload-tools-2026): The file upload vulnerability tools I actually reach for in 2026: fuxploider, Burp Upload Scanner, weevely, exiftool, ffuf, and the webshell repos. Strengths, weaknesses, and how I decide which to use. - [The Best LFI and Path Traversal Tools in 2026](https://techearl.com/best-lfi-tools-2026): The LFI and path traversal tools I actually reach for in 2026: LFISuite, LFImap, dotdotpwn, ffuf with SecLists, Burp Intruder, kadimus, and PayloadsAllTheThings. Honest strengths, weaknesses, and when each one wins. - [The Best RCE Tools in 2026](https://techearl.com/best-rce-tools-2026): The remote code execution tools I actually reach for in 2026: commix for OS command injection, SSTImap for template injection, msfvenom and Metasploit for payloads, Sliver for the C2 layer, and Burp Collaborator for b... - [The Best SQL Injection Tools in 2026](https://techearl.com/best-sql-injection-tools-2026): The SQL injection tools I actually reach for in 2026: sqlmap, ghauri, jSQL Injection, NoSQLMap, Havij (and why I do not use it), plus Burp Suite's role and the manual workflow. Strengths, weaknesses, and how I decide... - [The Best SSRF Tools in 2026](https://techearl.com/best-ssrf-tools-2026): The SSRF tools I actually reach for in 2026: SSRFmap, Gopherus, Burp Collaborator, interactsh, ffuf, and the PayloadsAllTheThings cloud-metadata kit. Strengths, weaknesses, and how I decide which to use. - [The Best XSS Tools in 2026](https://techearl.com/best-xss-tools-2026): The cross-site scripting tools I actually reach for in 2026: XSStrike, Dalfox, kxss/Gxss, Burp Suite with DOM Invader, BeEF, XSS Hunter, OWASP ZAP, and Caido. Strengths, weaknesses, and how I decide which to use. - [The Best XXE Tools in 2026](https://techearl.com/best-xxe-tools-2026): The XXE tools I actually reach for in 2026: XXEinjector, Burp Suite with Collaborator, interactsh, oxml_xxe, docem, PayloadsAllTheThings, and ffuf. Why XXE is a manual-heavy class, what libxml hardening changed, and h... - [The Capital One Breach: SSRF and the Cloud Metadata Service](https://techearl.com/capital-one-breach-ssrf): In 2019, a misconfigured firewall let an attacker use SSRF to reach the AWS metadata service, steal the server's IAM credentials, and exfiltrate the data of over 100 million Capital One applicants. It is the canonical... - [The Colonial Pipeline Attack: One Password, No MFA, a Fuel Crisis](https://techearl.com/colonial-pipeline-breach): In May 2021, ransomware shut down the largest fuel pipeline in the US and sparked panic buying across the East Coast. The way in was a single leaked password for an unused VPN account with no multi-factor authenticati... - [The Day My Password Died](https://techearl.com/the-day-my-password-died): My password showed up in a known breach database at 2 a.m. Here is what happened next, the small casualty I did not see coming, and what to do when yours appears too. - [The Equifax Breach: An Unpatched Bug and a Blind Sensor](https://techearl.com/equifax-breach-apache-struts-rce): In 2017, attackers exploited an unpatched Apache Struts remote code execution flaw to breach Equifax and steal the data of 147 million people. A patch had been available for months, and an expired certificate had blin... - [The Heartland Breach: SQL Injection as the Front Door](https://techearl.com/heartland-breach-sql-injection): The 2008 Heartland Payment Systems breach exposed around 130 million card numbers, the largest of its era. SQL injection was only the entry point: the attackers used it to land on the corporate network, spent months p... - [The Meow Attack: The Bot That Wipes Exposed Databases for No Reason](https://techearl.com/meow-attack): Most database attacks want money. The Meow attack just wipes your data, renames what is left with a -meow suffix, and walks away with no ransom note and no explanation. Here is how the bot works, why it exists, and ho... - [The MGM Breach: A Phone Call to the Help Desk, a $100M Outage](https://techearl.com/mgm-scattered-spider-breach): In September 2023, Scattered Spider breached MGM Resorts with a single phone call to the IT help desk, reset an employee's access, and triggered a ransomware outage that took down slot machines, hotel keys, and reserv... - [The MOVEit Breach: SQL Injection at Supply-Chain Scale](https://techearl.com/moveit-breach-sql-injection): In 2023 the Cl0p gang exploited a SQL injection zero-day in MOVEit Transfer to breach thousands of organisations and tens of millions of people in weeks. It is proof that SQL injection still causes the largest breache... - [The Robinhood Breach: One Phone Call to Support, 7 Million Exposed](https://techearl.com/robinhood-breach-social-engineering): In November 2021, an attacker phoned a Robinhood customer-support employee, social-engineered their way into support systems, and walked out with data on roughly 7 million people. No malware, no exploit, just a convin... - [The TalkTalk Breach: How One SQL Injection Cost £77 Million](https://techearl.com/talktalk-breach-sql-injection): In October 2015 a SQL injection flaw on three forgotten legacy webpages exposed 156,959 TalkTalk customers. The regulator called it preventable: the underlying bug had a fix available for three and a half years. A pra... - [Unlock LUKS Remotely Over SSH With Dropbear](https://techearl.com/luks-remote-unlock-dropbear-ssh): Set up LUKS remote unlock over SSH with Dropbear in the initramfs, so an encrypted root server can finish booting after a reboot without a console or KVM. - [USBGuard: Block Rogue USB Devices on Linux](https://techearl.com/usbguard-block-usb-linux): Use USBGuard to block USB devices on Linux: generate a policy from the hardware you trust, set the daemon to reject everything else, and allow new devices by hand. - [User-Agent SQL Injection: Why It Still Happens and How to Test for It](https://techearl.com/sql-injection-user-agent): User-Agent SQL injection lives in analytics tables, audit logs, and bot-detection lookups. The vulnerable code, why developers think it's safe, the manual curl exploit, the sqlmap one-liner, the detection signals, and... - [Web Application Security Vulnerabilities: The Complete Taxonomy](https://techearl.com/web-application-security-vulnerabilities): A practitioner's map of every major web application vulnerability class: SQL injection, XSS, CSRF, SSRF, RCE, file upload, path traversal, authentication and session attacks, deserialization, clickjacking, XXE, supply... - [WPScan Usage Guide and Man Page (2026)](https://techearl.com/wpscan-usage-man-page): WPScan v3.8+ usage reference for WordPress security audits: install on Linux/macOS, API token setup, the command patterns that matter (enumerate users, vulnerable plugins, brute force), JSON output, and how WPScan com... - [X-Forwarded-For SQL Injection: The Proxy Header Bug](https://techearl.com/sql-injection-x-forwarded-for): X-Forwarded-For SQL injection lives in geolocation tables, audit logs, IP-based ban lists, and rate-limit lookups. Same family includes X-Real-IP, X-Client-IP, True-Client-IP. The vulnerable code, manual exploit with... - [XInclude Attacks: The XXE-Adjacent Variant Audits Routinely Miss](https://techearl.com/xinclude-attacks): xi:include is a separate primitive from external entities. How to block it across libxml, Java, .NET, Python. Field notes plus a Dockerised lab. - [XML External Entity (XXE): The Complete 2026 Practitioner Guide](https://techearl.com/xml-external-entity): XXE deep dive: in-band file reads, out-of-band exfiltration via external entities, XInclude, billion-laughs DoS, and what libxml 2.9.x's hardening actually changed in 2026. ### WordPress - [WordPress (topic hub)](https://techearl.com/wordpress): Building, hardening, and unbreaking WordPress without losing weekends to plugin updates. - [A Cleaner Way to Render ACF Flexible Content Layouts Using Template Parts](https://techearl.com/acf-flexible-content-template-part-example): The template-parts pattern for ACF Flexible Content: one PHP partial per layout, one dispatcher loop, zero switch statements. The directory structure, the loop, the data-passing, and the agency-scale benefits. - [A WordPress Hosting Decision Tree for Agencies](https://techearl.com/wordpress-hosting-decision-tree-for-agencies): Hosting choices for WordPress agency clients are operational decisions, not pricing decisions. The decision tree by traffic tier and workload type: shared, managed WordPress, managed VPS, self-managed VPS. Plus the ag... - [ACF Field Naming Conventions That Actually Scale](https://techearl.com/acf-field-group-naming-conventions): A few naming conventions for ACF field groups, field names, and field keys keep a multi-year codebase navigable: snake_case names, hierarchy-encoded keys, post-type prefixes, sub-field consistency. The cost is zero; t... - [ACF Fields vs Native Post Meta in WordPress](https://techearl.com/wordpress-custom-fields-acf-vs-native-meta): ACF and native post meta both write to the same wp_postmeta table. Here is what register_post_meta gives you, what ACF adds on top, and the read/write rules so a bulk script and a content editor never fight over the s... - [ACF Flexible Content Loop Not Working? Here's the Fix](https://techearl.com/acf-flexible-content-loop-not-working): ACF Flexible Content loops fail silently in five predictable ways: missing have_rows, wrong context, missing the_row inside the loop, post ID confusion, and nested loops. Here's the fix for each. - [ACF Image Field Returning an Array Instead of a URL?](https://techearl.com/acf-image-field-url-vs-array): ACF Image fields can return an array, a URL string, or just the attachment ID. The return format is a per-field setting. Here's what each option returns, when to pick which, and the cleanest pattern for responsive ima... - [ACF Options Page Not Showing Up? Check These Things](https://techearl.com/acf-options-page-not-loading): An ACF Options Page that does not appear in wp-admin almost always traces to one of four things: missing acf_add_options_page() call, ACF Pro vs free version, location rules, or current_user_can capability mismatch. - [Add a Custom REST API Endpoint in WordPress (register_rest_route)](https://techearl.com/wordpress-custom-rest-api-endpoint): How to add a custom WordPress REST API endpoint with register_rest_route: the namespace convention, methods, the required permission_callback, args validation and sanitization, and returning WP_REST_Response or WP_Error. - [Add a Custom Sitemap to Yoast SEO (wpseo_sitemap_index)](https://techearl.com/wordpress-add-custom-sitemap-yoast): How to add a custom sitemap to Yoast SEO so rewrite-driven pages with no WordPress post still get indexed: append a to the index with wpseo_sitemap_index, register a named sitemap, and generate its ent... - [admin-ajax.php High Traffic: Attack or Normal?](https://techearl.com/admin-ajax-php-high-traffic): Thousands of hits to wp-admin/admin-ajax.php are almost always your own site: WordPress Heartbeat and plugins, not a DDoS. How to read the action parameter, when it is a real attack, and why blocking the file breaks y... - [Bluehost for WordPress: Honest Take for Small Sites](https://techearl.com/bluehost-honest-take-for-small-sites): Bluehost has the WordPress.org recommendation and the lowest entry-tier price in mainstream hosting. The honest take on where Bluehost legitimately fits in 2026, the real operational ceiling, and the migration path fo... - [Build a Custom Product URL Structure in WordPress (Remove /product/ and /shop/)](https://techearl.com/wordpress-custom-product-url-structure): How to build a custom product URL structure in WooCommerce: change or remove the /product/ and /shop/ bases from Settings > Permalinks, do it in code with a permalink filter plus add_rewrite_rule, and avoid the 404 co... - [Build Make / Model / Year URLs in WordPress (Catalog and Directory Sites)](https://techearl.com/wordpress-make-model-year-urls): How to build three-level /make/model/year/ URLs in WordPress with add_rewrite_rule, custom query vars, and a vehicle CPT, plus the static-prefix collision that breaks the naive rule. Works the same on a catalog of bra... - [Build Service-Area Landing Page URLs in WordPress (/service/city/)](https://techearl.com/wordpress-service-area-landing-page-urls): How to build /service/city/ landing page URLs in WordPress with add_rewrite_rule and a custom template, plus the honest E-E-A-T warning about when this crosses into doorway pages Google penalizes. - [Bulk Schedule WooCommerce Sale Prices From a Google Sheet](https://techearl.com/woocommerce-bulk-update-prices-and-sales): Run a site-wide or category sale from a sheet of sku, sale_price, start and end dates. A WP-CLI command reads the sheet, sets scheduled sale dates through the WooCommerce CRUD, and lets WooCommerce flip and unflip the... - [Bulk-Create WooCommerce Products From a CSV or Google Sheet With a Script](https://techearl.com/woocommerce-bulk-create-products-from-csv): When the built-in CSV importer is not enough, a WP-CLI command reads a sheet or CSV and creates WooCommerce products through the CRUD. Idempotent by SKU, dry-run by default, so re-running the same file never duplicates. - [Bulk-Edit WordPress SEO Titles and Meta Descriptions From a Google Sheet](https://techearl.com/wordpress-bulk-edit-seo-meta-google-sheet): Maintain SEO titles and meta descriptions in a Google Sheet and have a WP-CLI command write them into Yoast or Rank Math. Pull model, change-only, dry-run by default. No opening each post in the editor. - [Bulk-Update WooCommerce Products (Prices, Stock) From a Google Sheet](https://techearl.com/woocommerce-bulk-update-products-google-sheet): Pull a supplier sheet of SKU, price, and stock into WooCommerce and apply each row through the product CRUD. A WP-CLI command with a service account, change-only writes, and a dry run, plus why writing _price directly... - [Bulk-Update WordPress Custom Fields From a Google Sheet](https://techearl.com/wordpress-bulk-update-custom-fields-google-sheet): The pull model: have WordPress read a Google Sheet itself with a service account and apply each row to a custom field. A WP-CLI command, no Apps Script, no button, dry-run and change-only built in. - [Catch and Route Your Own 404s in WordPress](https://techearl.com/wordpress-catch-404-custom-routing): Intercept requests that would 404 in WordPress on template_redirect, then resolve them to real content with status_header(200), 301 to the right URL with wp_safe_redirect(), or let them fall through. A fallback router... - [Clean Up wp_head in WordPress: Remove the Header Bloat](https://techearl.com/clean-up-wordpress-wp-head): What WordPress prints in wp_head by default, which tags and scripts are safe to remove, and one must-use plugin that strips the emoji, shortlink, feed, oEmbed, and version bloat in one place. - [Common ACF Performance Problems on Large WordPress Sites](https://techearl.com/acf-performance-issues): ACF performance problems at scale almost always trace to one of six things: missing object cache, oversized Repeaters, deeply nested Flexible Content, meta_query usage on ACF fields, too many fields per post type, or... - [Disable Dashicons on the WordPress Front End](https://techearl.com/disable-dashicons-wordpress): How to disable Dashicons on the WordPress front end: dequeue the dashicons stylesheet for logged-out visitors only, so the admin icon font stops loading on pages that never use it. - [Disable WordPress Emojis to Speed Up Your Site](https://techearl.com/disable-wordpress-emojis-speed): How to disable WordPress emojis: a small functions.php snippet that strips the wp-emoji-release.min.js script, the inline detection JS, and the emoji styles from every page. - [Disable WordPress oEmbed (Discovery Links, wp-embed.js, and /embed/)](https://techearl.com/disable-wordpress-oembed): How to disable WordPress oEmbed: stop the discovery links, the wp-embed.js script, the oEmbed REST route, and the /embed/ URLs, while keeping the YouTube-style embeds you paste in posts working. - [Discovered vs Crawled - Currently Not Indexed in Search Console](https://techearl.com/discovered-vs-crawled-currently-not-indexed): What 'Discovered - currently not indexed' and 'Crawled - currently not indexed' actually mean in Google Search Console, why they are usually normal, and why spamming Request Indexing does nothing. - [Elasticsearch vs OpenSearch for ElasticPress: Which to Run](https://techearl.com/elasticsearch-vs-opensearch-for-elasticpress): ElasticPress officially supports Elasticsearch, not OpenSearch. OpenSearch can be coaxed into basic functionality, but 10up does not recommend it for production. Here is the real status and what to run. - [Embed a Lazy-Loaded, Privacy-Friendly Google Map in WordPress](https://techearl.com/wordpress-lazy-load-google-maps-embed): Embed a Google map in WordPress without tanking your load time: the free Maps Embed API iframe with loading="lazy", a te_map shortcode that escapes its output, an HTTP-referrer-locked API key, and a click-to-load cons... - [Fix 'Call to undefined function get_option()' in WordPress](https://techearl.com/wordpress-fatal-error-call-to-undefined-function-get_option): How to fix the 'Call to undefined function get_option()' fatal error in WordPress. Covers premature WP function calls, the wp-load.php bootstrap, the modern WP-CLI alternative, and the plugin-developer checklist. - [Generate a Static XML Sitemap for Large WordPress Sites (WP-CLI)](https://techearl.com/wordpress-static-xml-sitemap-wp-cli): On a WordPress site with hundreds of thousands of URLs, building the sitemap on every request is expensive. Generate static sitemap files with a WP-CLI command instead: chunked to 50,000 URLs, written to disk, and reg... - [get_field() Returning Nothing? Here's What Usually Causes It](https://techearl.com/acf-get-field-not-working): ACF's get_field() returning empty or false has eight common causes. The diagnostic order: field name typo, post context, location rules, field group not assigned, sub-field confusion, get vs the, caching, permissions. - [How to Add a Custom Rewrite Rule in WordPress (add_rewrite_rule)](https://techearl.com/wordpress-add-rewrite-rule): How to add a custom rewrite rule in WordPress with add_rewrite_rule: the regex, the index.php query target, registering the query var so it actually populates, loading a template, and flushing once without flushing on... - [How to Change a WordPress Password](https://techearl.com/change-wordpress-password): Four reliable ways to change a WordPress password: admin dashboard, WP-CLI, directly in the database with the correct phpass or bcrypt hash, and the lost-password email reset. - [How to Count Rows in an ACF Repeater Field](https://techearl.com/acf-repeater-row-count): Counting ACF Repeater rows is three short patterns: count() on the raw field, get_field_count() inside a loop, and a faster meta-only count that skips loading the rows. Each has its right use case. - [How to Find the Original Entry Point in a WordPress Compromise (Access-Log Forensics)](https://techearl.com/wordpress-entry-point-log-forensics): A cleanup that doesn't identify the entry point is temporary. The methodical access-log analysis that finds exactly which plugin CVE, credential vector, or upload path got the attacker in, with the grep one-liners, th... - [How to Get ALT Text from an ACF Image Field](https://techearl.com/acf-image-alt-text): Getting alt text from an ACF Image field depends on the field's Return Format. Image Array gives you the alt directly. ID and URL formats need a wp_get_attachment helper. Plus the cleanest pattern for always-correct a... - [How to Get the Current ACF Flexible Content Layout Name](https://techearl.com/acf-get-flexible-content-layout-name): get_row_layout() returns the current layout's name inside an ACF Flexible Content loop. Plus the canonical dispatch pattern using template parts, the switch-based pattern, and what to do when get_row_layout returns no... - [How to Optimize WooCommerce: Why It's Slow and How to Fix It](https://techearl.com/how-to-optimize-woocommerce): A WooCommerce store slows down for specific, structural reasons. Here is the layered fix: hosting, page caching, object caching, the database, search, and the front end, and why one layer alone is never enough. - [How to Remove WordPress Malware: The Practitioner's Playbook](https://techearl.com/wordpress-malware-removal): A step-by-step methodology for finding and removing malware from a compromised WordPress site, written by a Security+ certified engineer who's been cleaning sites since the early WordPress 2.x era. Covers every attack... - [How to Set Default Values in ACF Select Fields](https://techearl.com/acf-select-field-default-value): ACF Select fields have a Default Value setting in the field group editor that handles the simple case. For dynamic defaults (computed from another field, role-based, or per-post-type), the acf/load_value filter is the... - [How to Start a WordPress Agency in 2026 Without Burning Yourself Out](https://techearl.com/how-to-start-a-wordpress-agency): What I'd actually do if I were starting a WordPress agency today: client acquisition, recurring revenue, hosting, maintenance, outsourcing, AI workflows, and the operational mistakes that kill small shops. - [How to Update ACF Fields Programmatically](https://techearl.com/acf-update-field-programmatically): update_field() is the canonical way to write ACF data programmatically: the function signature, how to write to Repeater and Flexible Content fields, when to use field keys instead of names, options pages and user met... - [How to Use ElasticPress with WP_Query](https://techearl.com/how-to-use-elasticpress-with-wp-query): Wire ElasticPress to WP_Query so WordPress queries hit Elasticsearch instead of MySQL. Covers installation, indexable post types, ep_integrate, the wp-cli index command, faceted search with aggregations, and when ES a... - [Kinsta for WordPress Agencies: Honest Review](https://techearl.com/kinsta-honest-review-for-agencies): Kinsta is the premium managed WordPress host most agencies eventually consider. The honest take: where the value justifies the price, where it does not, the agency partner program math, and the alternatives at each tier. - [Large ACF Repeater Fields Slowing Down WordPress? Here is Why](https://techearl.com/acf-repeater-performance-issues): Large ACF Repeaters (100+ rows) slow down WordPress because each sub-field is a separate wp_postmeta row. The fixes: persistent object cache, fewer reads, direct-meta count, or moving the data out of Repeater into a c... - [Manage Multiple WordPress Sites From One Google Sheet](https://techearl.com/manage-multiple-wordpress-sites-google-sheet): Run a fleet of WordPress installs from a single Google Sheet: a website column per row, a small controller that groups the rows by site and pushes each batch to that site's endpoint, and partial-failure handling so on... - [Managed WordPress Hosting vs VPS for Agencies](https://techearl.com/managed-wordpress-hosting-vs-vps-for-agencies): Managed WordPress hosting buys you operational simplicity at a per-site price premium. VPS buys you flexibility and lower per-resource cost at the price of in-house sysadmin time. The honest comparison and the agency-... - [Override Rank Math's Title and Meta Description Programmatically](https://techearl.com/wordpress-override-rank-math-title-meta): How to override Rank Math's SEO title and meta description in PHP using the rank_math/frontend/title and rank_math/frontend/description filters, plus the canonical and Open Graph filters, with conditional per-context... - [Override Yoast SEO's Title and Meta Description Programmatically](https://techearl.com/wordpress-override-yoast-title-meta): Override Yoast SEO's title, meta description, canonical, and Open Graph/Twitter tags in PHP using the wpseo_title and wpseo_metadesc filters, with per-context conditionals for dynamic and rewrite-driven pages Yoast ca... - [Override Your SEO Plugin's Title and Meta Description (Yoast, Rank Math, or Core)](https://techearl.com/wordpress-override-seo-title-meta-description): Hooking pre_get_document_title does nothing once Yoast or Rank Math is active: the plugin owns the title and meta description tags. Here is which filter to hook for Yoast, Rank Math, and core, plus a portable helper t... - [Populate a WordPress Events Calendar From a Google Sheet](https://techearl.com/wordpress-events-calendar-google-sheet): Keep events (title, dates, venue, sold-out flag, ticket URL) in a Google Sheet and have WordPress pull them into an event CPT on a cron. Dates stored as sortable Y-m-d H:i:s, change-only, dry-run by default, so the ca... - [Proper Responsive Images with ACF Image Fields](https://techearl.com/acf-responsive-images-example): The cleanest pattern for responsive images from an ACF Image field: ID return format plus wp_get_attachment_image, which produces a complete srcset and sizes attribute from registered image sizes. Plus the manual srcs... - [Pull GA4 Data Into WordPress With a Service Account](https://techearl.com/wordpress-pull-ga4-data-service-account): Read your own GA4 metrics server-side from WordPress: a Google Cloud service account, the google/analytics-data PHP client, a te_ga4_run_report() wrapper around runReport, plus caching and credential hygiene. - [Rank Math vs Yoast SEO: Which WordPress SEO Plugin to Use in 2026](https://techearl.com/rank-math-vs-yoast): Rank Math's free tier covers roughly what Yoast Premium does, schema support is broader, and the plugin is lighter on resources. Yoast still has brand recognition and a more guided editor flow. The honest agency compa... - [Remove the WordPress Shortlink (rel=shortlink) from the Head](https://techearl.com/remove-wordpress-shortlink): How to remove the WordPress rel=shortlink: a small remove_action snippet that strips the from the head and the matching Link: HTTP header. - [Remove the wp-block-library CSS in WordPress (Carefully)](https://techearl.com/remove-wp-block-library-css): How to dequeue the wp-block-library CSS in WordPress, and the one big caveat: do it only on a site whose front end uses no block markup, or you break your layout. - [Remove WordPress Feed Links (and the /feed/ URLs)](https://techearl.com/remove-wordpress-feed-links): How to remove WordPress feed links from the head with remove_action, plus the deeper step most guides skip: killing the /feed/ rewrite rules and redirecting the URLs so they stop getting crawled. - [replytocom URLs in Google Search Console: Why They Are Harmless](https://techearl.com/replytocom-urls-google-search-console): Thousands of ?replytocom= URLs in Search Console come from WordPress comment reply links. Why they are already nofollow and canonicalized, and why blocking them in robots.txt is the one fix that backfires. - [Run Bulk Scripts in WordPress With WP-CLI (eval-file)](https://techearl.com/wordpress-run-bulk-scripts-wp-cli): The right way to run a one-off bulk operation across thousands of WordPress posts: a wp eval-file script with caches suspended, queries batched, and the object cache flushed in the loop so memory doesn't blow up. - [Safely Bulk-Update Custom Fields in WordPress](https://techearl.com/wordpress-safe-batch-update-custom-fields): A bulk custom-field update with no undo is one typo away from wrecking thousands of posts. Here is a safe pattern (and a downloadable WP-CLI command) with a dry run, a backup gate, a change-only changelog, and idempot... - [Securing a WordPress REST API Write Endpoint](https://techearl.com/wordpress-secure-rest-api-write-endpoint): A custom write endpoint accepts changes from the open internet. Harden it step by step: header secret, constant-time compare, HMAC signatures, replay protection, rate limiting, secret out of the repo, and a hidden route. - [Send WordPress Email Through SendGrid](https://techearl.com/wordpress-send-email-sendgrid): Route WordPress email through SendGrid's SMTP relay with the phpmailer_init hook, keep the API key in wp-config.php, and stop transactional mail landing in spam. - [The Exact Stack I'd Use to Run a Small WordPress Agency Today](https://techearl.com/my-wordpress-agency-stack): If I were starting a small WordPress agency today: the page builders, plugins, hosting, forms, SEO, backups, image optimization, and AI tooling I'd actually choose, with the reasoning behind each pick. - [The Fake Cloudflare Verification Attack on WordPress (ClickFix): What It Is and How to Remove It](https://techearl.com/wordpress-fake-cloudflare-verification-clickfix): Visitors to your WordPress site see a fake 'Cloudflare verification' page telling them to paste a command into Windows Run or Terminal. That's ClickFix, the social-engineering campaign that first appeared in early 202... - [Update a WordPress Business Directory From a Google Sheet](https://techearl.com/wordpress-business-directory-update-google-sheet): Keep a directory of thousands of listings in sync with a Google Sheet a non-dev maintains: a WP-CLI pull command that reconciles each listing change-only, parses structured hours, and flips permanently-closed places t... - [Use a .env File for WordPress Config and Secrets](https://techearl.com/wordpress-env-file-config): Keep API keys, database credentials, and SMTP secrets out of wp-config.php and out of git by loading them from a .env file with vlucas/phpdotenv, fed into define() where WordPress expects constants. - [Useful Things You Can Do with acf/save_post](https://techearl.com/acf-save-post-hook-example): acf/save_post is the hook that fires after ACF saves a post's custom fields. Useful patterns: derived field computation, taxonomy sync, search-index refresh, ACF-to-meta mirroring, validation, audit logging. Plus the... - [Using ACF Like a Lightweight Component System](https://techearl.com/acf-component-based-development): ACF Flexible Content plus template parts plus a shared component library is effectively a lightweight component system for WordPress. The patterns: one component per layout, props via sub-fields, composition over inhe... - [Using ACF with Elementor Dynamic Fields](https://techearl.com/using-acf-with-elementor): Elementor Pro's Dynamic Tags integration with ACF is the mature reference for binding custom field values to widget properties. Coverage for every field type, including Repeater via the Loop widget, and the Theme Buil... - [Why ACF Relationship Fields Lose Their Selected Order](https://techearl.com/acf-relationship-field-order): ACF Relationship fields preserve order in the editor and in the stored array, but lose it when you pass the IDs to WP_Query. The fix: post__in plus orderby=post__in, every time. Plus when ACF returns objects vs IDs. - [Why ACF True/False Fields Sometimes Behave Unexpectedly](https://techearl.com/acf-true-false-not-working): ACF True/False fields store 1 or 0 in the database but appear as booleans in PHP. Loose-comparison bugs, empty-row defaults, conditional logic visibility, and meta_query gotchas are the four causes of unexpected behav... - [Why I Wouldn't Build Fully Custom WordPress Themes for Most Clients in 2026](https://techearl.com/custom-wordpress-themes-vs-page-builders): I am a custom-development-first engineer. But for most agency client work in 2026, fully custom themes are the wrong economic choice. The honest case for picking reusable systems over from-scratch builds. - [Why Many Agencies Still Prefer ACF Over Gutenberg](https://techearl.com/acf-vs-gutenberg-for-agencies): ACF and Gutenberg are not competing for the same job. The honest agency take: where Gutenberg wins, where ACF Flexible Content still wins, and how to decide for a fresh project in 2026. - [Why WordPress Malware Keeps Coming Back: A Field Guide to Persistence Mechanisms](https://techearl.com/wordpress-malware-persistence-mechanisms): WordPress malware that survives cleanups isn't stronger malware; it's malware with persistence. A complete catalog of where attackers hide the re-infection logic, wp_options autoload, WP-Cron, server crontab, .htacces... - [Why Your ACF Checkbox Field Returns an Array](https://techearl.com/acf-checkbox-return-value): ACF Checkbox fields return arrays because they support multiple selections. The shape varies by Return Format. Here's what each option returns, the patterns for rendering and querying, and when to switch to a Select o... - [Why Your First ACF Repeater Row Appears Empty](https://techearl.com/acf-repeater-empty-first-row): An ACF Repeater where the first row's data looks blank is almost always one of three things: missing the_row(), incorrect sub-field name, or accidental data overwrite via update_field with the wrong field reference. - [wordfence_lh URLs in Google Search Console: The Right Fix](https://techearl.com/wordfence_lh-urls-google-search-console): Thousands of ?wordfence_lh=1&hid= URLs in Google Search Console come from Wordfence's Live Traffic feature. The setting that stops them, the check to run first, and why robots.txt is the wrong fix. - [WordPress AMP: Enable Automattic's AMP Plugin for Custom Post Types (CPT)](https://techearl.com/wordpress-amp-automattic-plugin-enable-custom-post-typescpt): How to add AMP support to WordPress custom post types using the official Automattic AMP plugin, with a 2026 reality check on whether AMP is still worth the engineering investment. - [WordPress File Integrity Monitoring That Can't Be Disabled from Inside the Server](https://techearl.com/wordpress-file-integrity-monitoring-server-side): Wordfence, Sucuri, and every in-WordPress security plugin can be disabled by malware running with the same privileges. The fix is monitoring at a layer the attacker can't touch: AIDE, maldet, or a custom cron-driven s... - [WordPress Rewrite Rules Not Working? The Checklist](https://techearl.com/wordpress-rewrite-rules-not-working): A diagnostic checklist for WordPress rewrite rules that won't fire: forgetting to flush, an unregistered query var, rule order, regex anchors, and how to inspect reality with wp rewrite list and parse_request. - [WordPress wp-config.php Malware (gsyndication / googlesyndication): Remove It and Stop the Reinfection](https://techearl.com/gsyndication-malware-repeatadly-infecting-wordpress-wp-config-php): Remove the gsyndication malware (sync.gsyndication.com and async.gsyndication.com) that injects a script into wp-config.php, find the hidden process, cron, and database entries that keep reinfecting it, and clean it f... - [WordPress: Moderate Comments Using Regular Expressions](https://techearl.com/wordpress-moderate-comments-using-regular-expressions): Use the built-in WordPress comment-moderation regex fields and the pre_comment_approved filter to approve, hold, spam, or trash comments based on PCRE patterns. - [WordPress: Sending HTML Formatted Emails Using the wp_mail() Function](https://techearl.com/wordpress-sending-html-formatted-emails-using-the-wp_mail-function): How to send HTML emails from WordPress with wp_mail and the wp_mail_content_type filter. Covers SMTP setup, deliverability with SPF, DKIM, and DMARC, and modern transactional providers like SendGrid, Postmark, and Res... - [WP Engine for WordPress Agencies: Honest Review](https://techearl.com/wp-engine-honest-review-for-agencies): WP Engine is the most-recognized managed WordPress host and the default pick for many agencies. The honest take on performance, support, the agency partner program, the recent ACF acquisition implications, and where W... - [wp_insert_post Consuming Large Amounts of Memory: How I Actually Fix It](https://techearl.com/wp_insert_post-consuming-large-amounts-of-memory): Fix wp_insert_post OOMs during bulk imports: chunk in batches, flush the object cache, defer term/comment counting, suspend cache invalidation, disable revisions, and (where appropriate) bypass the WordPress API with...