Blog · all articles
The articles that apply to the websites these organizations run, in one place, with a feed of their own. The market page is here.
Every website has four plain-text files no visitor ever sees: robots.txt, sitemap.xml, security.txt, and llms.txt. Search engines, security scanners, and AI agents read them on every visit.
What each one is, who actually reads it, what to put in it, and the one rule that keeps all of them safe. We went through this list on our own site this week and found gaps, so the free audit now checks for them.
The media library is not a private folder, in WordPress or anywhere else. What that means for the drafts and packets that get uploaded to grab a link, why switching the API off is the wrong fix, and how to mark a file private without breaking anything.
Color contrast, image headers, link behavior, and the small interface choices that determine whether a page works for everyone.
Ask a WordPress site for its list of users and, by default, it answers. Every author's login name, in a machine-readable list, at a fixed address. Attackers do not have to guess who the accounts are. They only have to guess the passwords.
Where the list comes from, how the free audit reports it, and the four changes that close it without locking anyone out.
Everything in this article is public. It is what a curious visitor, a vendor sizing you up, a journalist, or a scanner run by someone less friendly can read about your website in about a minute.
The free audit is that minute, run on your behalf. This is what it looks at, in the order a stranger would.
Password resets, spam folders, domain trust, and why important website emails should never look suspicious to inbox providers.
Fingertips are not cursors. Target sizes, tappable labels, and the field settings that decide which keyboard appears: the mobile details that quietly determine whether your form gets finished.
A form's error messages are the only conversation it ever has. What a useful error says, where it belongs on the page, when it should speak up, and who has to be able to perceive it.
Once a month: one number from our census of sites like yours, one fix, and what we published. No sequence, no sales calls.
One confirmation email first. Nothing sends until you click it. Or follow by RSS.
Check your inbox. A confirmation is on its way.