Blog
Forms, deliverability, accessibility, operations: plain English, useful before you know what to ask for.
New articles by email
One confirmation email first. Nothing sends until you click it. Or subscribe via RSS.
Check your inbox. A confirmation is on its way. Nothing else sends until you click it.
Nothing matches. Clear the search or pick another topic.
Every selling page on this site ends with the same dark band: a heading, a sentence, two buttons. We found it built by hand on sixty pages, with the button spacing declared in fifty-five separate places. One page had lost it.
Why that matters to a reader who never sees the code, what it costs in speed and in trust, and how to tell whether your own site has the same problem.
Every website has four plain-text files no visitor ever sees: robots.txt, sitemap.xml, security.txt, and llms.txt. Search engines, security scanners, and AI agents read them on every visit.
What each one is, who actually reads it, what to put in it, and the one rule that keeps all of them safe. We went through this list on our own site this week and found gaps, so the free audit now checks for them.
For weeks the hero on three of our own pages vanished for a second and a half on iPhones, on a cold load only. Nothing reproduced it in a lab.
A fifty-line field trace found it in three page loads: an ad blocker was hiding any element whose class started with ad-.
What layout shift is and why it registers as brokenness, the four causes behind nearly every case (images without dimensions, embeds without reserved space, fonts swapping, banners injected late), and the exact fixes, including where WordPress already knows every image's width and height.
Why a 2.6 MB hero reaches a phone that needs 33 KB, how srcset and sizes let the browser choose, when you actually need the picture element, what WebP buys you, and where WordPress themes quietly undo the work it already does for you.
The media library is not a private folder, in WordPress or anywhere else. What that means for the drafts and packets that get uploaded to grab a link, why switching the API off is the wrong fix, and how to mark a file private without breaking anything.
The series finale: where a submission actually goes. The record before the notification, the email path that rots silently, the confirmation with substance, and the monitoring that notices the week your form goes quiet.
CAPTCHAs tax the humans and barely slow the professionals. The quiet alternative: a honeypot, a clock, a rate limit, and a content check that flags instead of blocking, all on the server where the visitor never sees any of it.
If it keeps coming up for your team, it's probably worth writing about. New pieces go out by email (one confirmation first, one-click unsubscribe on every send) or over RSS if you'd rather use your own reader. Either way, nothing in your inbox we didn't earn.
Got it, thank you. If it's a problem we can write about usefully, it'll turn up here.