Security
Knowing what is in your website: dependency scanning and vulnerability monitoring
A modern website is assembled from a great deal of software that nobody on your team wrote. Drupal core, dozens of contributed modules, the PHP libraries they depend on, the JavaScript packages behind...
Who can change what: roles, permissions and audit trails
Every website has an answer to the question "who can change this?" On many sites the answer is "everyone with a login", arrived at not by decision but by accumulation: accounts created for a launch, p...
When something goes wrong: how we respond to and recover from an incident
Most of what we write about is prevention: updates, firewalls, permissions, monitoring, the quiet routines that keep a site out of trouble. This article is about the other side, the plan for the day s...
Passkeys for editors: logging in without a password
Earlier this year we wrote about the password habits we recommend to every client team. This is the companion piece, about the direction that is making many of those habits unnecessary. Passkeys, the ...
The free security wins: TLS, headers and the basics every website should have
Some of the most effective protections a website can have cost nothing and take an afternoon. They are settings rather than software: a handful of response headers, a correctly configured certificate,...
The security questionnaire your customers will send you, and how a well-run site answers it
A growing number of our clients have received the same email this year. A customer, usually a larger one, sends a spreadsheet with forty to two hundred questions about information security and asks fo...
AI crawlers on your site: welcome them, meter them, or block them
The web has never been only humans. For as long as there have been websites, there have been automated visitors: programs that fetch pages for some purpose of their own. The most familiar are search e...
Defense in depth: the seven layers that protect a business website
Ask what keeps a website secure and you will often get a single answer: keep it updated. That is true, and it is the most important habit, but it is one layer of several. A site that stays safe over y...
The security review we run on a website we inherit
Every few months a business comes to us with a website that somebody else built, often years ago, and a simple question: is it in good shape? Sometimes the question is prompted by a story in the news....
Forms that are helpful, accessible, and spam-resistant
For a lot of businesses, the most important thing on the entire website is a form. The contact form, the quote request, the sign-up. It is the point where an anonymous visitor decides to raise their h...
The password habits we recommend to every client team
Passwords are one of those topics where everyone quietly suspects they are doing it wrong, and almost nobody enjoys talking about it. So let us take the judgment out of it right away. The habits most ...
How security patches reach your site
Every so often a client forwards us a news article about a security vulnerability and asks whether their site is affected. It is one of our favorite messages to answer, because the answer is almost al...
How staging stays safe: scrubbed data and no accidental emails
Behind every live website there is a quieter family of copies. A developer runs one on their own machine to build a new feature. A staging environment holds the next release so it can be reviewed befo...
How we verify backups: retention, restore drills, and proof
There is a sentence we repeat internally whenever backups come up: a backup is only real once it has been restored somewhere. Until that moment it is a file you hope is complete, produced by a job you...
A web application firewall your visitors never notice
A web application firewall is a filter that sits in front of a website and inspects every request before the site ever sees it. Requests that look like attack attempts get stopped at the door; everyth...
Keeping automated traffic in its lane
A meaningful share of the traffic reaching any public website is not people. It is software: search engine crawlers building their index, feed readers checking for updates, uptime monitors, link previ...
Have a Drupal question your team is trying to think through?
If you are weighing a rebuild, a migration, a support decision, or a technical direction change, we are happy to talk it through.