Security
The security questionnaire your customers will send you, and how a well-run site answers it
A growing number of our clients have received the same email this year. A customer, usually a larger one, sends a spreadsheet with forty to two hundred questions about information security and asks fo...
AI crawlers on your site: welcome them, meter them, or block them
The web has never been only humans. For as long as there have been websites, there have been automated visitors: programs that fetch pages for some purpose of their own. The most familiar are search e...
Defense in depth: the seven layers that protect a business website
Ask what keeps a website secure and you will often get a single answer: keep it updated. That is true, and it is the most important habit, but it is one layer of several. A site that stays safe over y...
The security review we run on a website we inherit
Every few months a business comes to us with a website that somebody else built, often years ago, and a simple question: is it in good shape? Sometimes the question is prompted by a story in the news....
Forms that are helpful, accessible, and spam-resistant
For a lot of businesses, the most important thing on the entire website is a form. The contact form, the quote request, the sign-up. It is the point where an anonymous visitor decides to raise their h...
The password habits we recommend to every client team
Passwords are one of those topics where everyone quietly suspects they are doing it wrong, and almost nobody enjoys talking about it. So let us take the judgment out of it right away. The habits most ...
How security patches reach your site
Every so often a client forwards us a news article about a security vulnerability and asks whether their site is affected. It is one of our favorite messages to answer, because the answer is almost al...
How staging stays safe: scrubbed data and no accidental emails
Behind every live website there is a quieter family of copies. A developer runs one on their own machine to build a new feature. A staging environment holds the next release so it can be reviewed befo...
How we verify backups: retention, restore drills, and proof
There is a sentence we repeat internally whenever backups come up: a backup is only real once it has been restored somewhere. Until that moment it is a file you hope is complete, produced by a job you...
A web application firewall your visitors never notice
A web application firewall is a filter that sits in front of a website and inspects every request before the site ever sees it. Requests that look like attack attempts get stopped at the door; everyth...
Keeping automated traffic in its lane
A meaningful share of the traffic reaching any public website is not people. It is software: search engine crawlers building their index, feed readers checking for updates, uptime monitors, link previ...
Have a Drupal question your team is trying to think through?
If you are weighing a rebuild, a migration, a support decision, or a technical direction change, we are happy to talk it through.