Business email compromise in plain terms: a real-looking email from a supplier with new payment details, why the email itself proves nothing, and what to do in the first hour.
Offboarding for a small shop: the shared Wi-Fi key, the email forward nobody removed, the Facebook admin seat, the door code. A one-page checklist to run the day someone leaves.
A Facebook Page lives on someone else's platform, with reach you do not control and content search engines cannot index. Where a Page fits, and what belongs on a site you own.
A check that pings an IP or a static page will report green while your database is down and customers cannot log in. What a monitor should actually exercise.
If your developer, agency, or ex-employee registered your domain, you may not control it. How to check the registrant, what expiry looks like, and how to move it.
A third of the people typing the domain got a timeout, for about a year, because of one leftover A record. How it happened, what it cost, and the five-minute check that finds it.
An expired TLS certificate costs you traffic and trust. Why certificates now expire every 90 days, what that costs a small shop, and how managed hosting makes it invisible.
Moving a site is the easy half. Here is what SPF, DKIM, DMARC and TTLs forget to bring along when you change hosts, and the five things I do on every move.
Most of what makes a website project cheap or expensive is already sitting in the site you have. The seven things I check before I give anyone a number, and what each one tells me.
Nobody chooses to run thirty-four plugins. They accumulate one reasonable decision at a time. Here's what that costs in security and update deadlock, the debugging problem that's worse than both, and the cases where a plugin is genuinely the right call.
The thing you're replacing is the shared spreadsheet, and the reason it's dangerous isn't that it's a spreadsheet. What a shared vault actually buys you, how to structure it, and why most of what you'd put in it shouldn't be shared at all.
A walkthrough of the five jobs the ISP's box is doing for you, the six it isn't, and why the right move is usually bridge mode rather than throwing it away.
The mailboxes bundled with your web hosting are a mail server shared with hundreds of strangers on one IP address. Here's what that costs you in deliverability, what it does to your SPF record, and where the line is between "good enough" and "move it."
Adding access points to a badly planned network makes it slower, because Wi-Fi is a shared medium and every AP on the same channel is another competitor for it. Here's the channel and power planning that has to happen first.
Matter is an application-layer standard; Thread is a low-power mesh network. They sit at different layers and solve different problems, and the "Works with Matter" logo promises less than most buyers assume. Here's what each one is, and where the reality still trails the pitch.
Not the tidy version. The ambiguous first ten minutes, the suspect that turns out to be innocent, the choice between restoring service and understanding it, and why the running notes matter more than the speed.
Most page-speed advice is a checklist of thirty items, twenty-eight of which will not move your site. Three things decide whether a page feels fast (server response time, what blocks the first paint, and how much JavaScript the phone has to execute) and all three are decided when the site is built.
Three quotes for an accessibility audit can range from a few hundred dollars to five figures for what sounds like the same thing. Here are the six sections a real report has, what a single finding must contain, and the two questions that tell you which one you're buying.
Most small businesses can't say how many people called last month and hung up without leaving a message. Here are the six fields worth recording for every call, what the pattern in them tells you, and why the missed calls are the valuable ones.
An itemized account of what sits inside a monthly managed-network fee, what it explicitly does not cover, and the one question that separates a real managed service from a dashboard somebody glances at.
If a former web designer or agency holds your domain, they control your website, your email, and every password reset you'll ever need. Here's how to find out who really holds it, how to get it back, and the transfer lock that catches people in exactly the wrong order.
After the novelty wears off, the automations people keep are dull ones: water shutoff, freeze alerts, a garage door that closes itself. Here's the list that earns its keep, the list that doesn't, and the single rule that separates them.
A website is three things that must come back together (a database, an uploads folder, and configuration) and a file-level copy of a running database is usually worthless. Here's what a real website restore involves, and why the restore you'll actually be asked for is a partial one.
The demo is impressive and the automated error count really does drop. Here are the five specific mechanisms by which an overlay widget still fails a WCAG audit, and why the number it improves is the one nobody is judged on.
A monthly plan isn't a block of hours, and it doesn't cover everything. Here's what a retainer genuinely includes, what still gets quoted separately, and why "call us when it breaks" tends to cost more over a year.
A blocklist is a snapshot of last week's bad domains. A category is a policy that still applies to a domain registered tomorrow. Here's how category filtering works, what it genuinely cannot do, and the browser feature that quietly routes around all of it.
Moving your email to a new provider is one DNS record, and that's exactly why it goes wrong. What TTLs actually control, why mail keeps arriving at the old server for days, and the one step you have to take before the day of the cutover.
A scanner report with 300 findings is not a plan. A triage rule that puts internet-facing, authentication-adjacent systems first, and what you have to do after the patch that the advisory never mentions.
Put the mouse down and press Tab. This is a minute-by-minute walkthrough of the keyboard-only test an auditor runs first, what a failure looks like at each step, and which success criterion each one breaks.
Smart-home gear is the least-patched equipment on your network and it talks to the internet constantly. Walling it off is straightforward. Keeping casting, printing and speaker discovery working afterward is the part that goes wrong, and it isn't a firewall problem.
An honest account of the limits: what it doesn't know, what it should never promise on your behalf, and the calls that have to reach a person immediately. Including the failure mode that costs more than a wrong answer.
Your router already draws a traffic graph for every interface. Here's how to tell a backup window from a saturated uplink from a broadcast storm by shape alone, and why the graph can look perfectly healthy while the network feels awful.
A photo straight off a phone is 12 megapixels and several megabytes, displayed in an 800-pixel box. Here's what that costs on a real phone on real cell service, how to serve the right size instead, and the mobile trick that doesn't work.
A PDF stores glyphs at coordinates, not structure, which is why remediating one is slow manual work no scanner can do for you. Here's what a tagged PDF needs, the export setting that destroys it, and why the rule's exceptions probably point at your forms, not your archive.
Nobody sends you a notification when someone starts forging mail from your domain. Here are the three ways businesses actually find out, what DMARC can and can't stop, and the null-record posture that protects every domain you own but never send from.
Turning on multi-factor authentication is easy. Getting back into your own accounts after the phone holding all the codes disappears is the part nobody plans for. How to set it up so a lost phone is an errand, not an emergency.
What WireGuard does differently from IPsec and OpenVPN, where it is genuinely better, the authentication it deliberately refuses to do, and the MTU problem that makes a working tunnel feel broken.
Automated certificate renewal fails quietly, and the browser only tells you weeks later, with a full-page security warning in front of your customers. Here's why renewals break, the failure mode where the cert renews and the site goes down anyway, and how to monitor expiry so you find out first.
Blocking a robocaller's number accomplishes nothing, because the number was forged and will be a different one in an hour. Here's how neighbor spoofing works, what STIR/SHAKEN does and doesn't fix, and the one change that actually cuts the interruptions.
WCAG contrast is a formula with fixed constants, not a judgment call, and it weights green nine times heavier than blue. Here's the actual arithmetic, the two thresholds that matter, and the four places an automated checker can't decide for you.
A cloud-connected smart device is a subscription to someone else's company continuing to exist. Here's what "works locally" actually means, the two-step test that tells you which kind you bought, and how to spec a house so an outage doesn't cost you a light switch.
A separate SSID and a "client isolation" checkbox do less than most people assume. Here's the difference between AP-level isolation and real separation, plus the two RouterOS settings that let a guest reach the router itself even when every other rule is right.
A dashboard only helps when somebody is looking at it. The difference between monitoring and alerting, why a check that can't detect its own death isn't a check, and why the only test that counts runs from outside your network.
DMARC reports arrive as XML attachments from Google, Microsoft, and mail providers you've never heard of. Here's what each field means, and how to tell a broken forwarder apart from someone genuinely forging your domain.
One company quotes a few dollars a month, another quotes ten times that, and nobody shows their work. Here is every line item behind hosting a small business site (domain, DNS, certificate, compute, storage, bandwidth, email, backups, monitoring) with real numbers, and the one line that actually sets the price.
Four images, four alt attributes, four completely different sentences read aloud to a resident. Here's what a screen reader announces for a missing alt, an empty one, a lazy one, and a good one, and why the linked ones matter most.
A second internet circuit only helps if your router notices the first one is dead. Here's why link state and gateway pings miss most real outages, how recursive route checks catch them, and why "traffic is moving again" is the wrong thing to measure.
The DOJ's ADA Title II rule gives city, county, and special-district websites until April 2027 or April 2028 to meet WCAG 2.1 AA. Here's what the rule really says, what enforcement looks like, why overlay widgets don't work, and what a sensible path to compliance looks like.
Two truths most businesses learn the hard way. Storage always grows faster than you plan for, and "we have backups" is not the same sentence as "we have backups that restore." Here's how to get both right.
If your business email lands in customers' spam folders, it's almost never the content. It's three DNS records (SPF, DKIM, and DMARC) that tell the world your mail is really yours.
SaaS monitoring works until the bill grows and you notice you're shipping all your operational data to someone else's cloud. Here's what a self-hosted observability stack looks like, and when it's worth building.
A flat network means one compromised smart plug can see your accounting PC. Segmentation fixes that for the price of some config time. Here's how I think about it.
Most small businesses stitch together a web designer, a host, a network installer, and a payments consultant, none of whom talk to each other. Here's why that's the real problem.