// writing
Notes on systems done right.
Field notes and opinions on AWS, networks, firewalls, and running infrastructure that small businesses can actually rely on. Written by the person doing the work, not a marketing team.
Why your site shouldn't be a pile of plugins
Nobody chooses to run thirty-four plugins — they accumulate one reasonable decision at a time. Here's what that costs in security and update deadlock, the debugging problem that's worse than both, and the cases where a plugin is genuinely the right call.
Read →Password managers for a small team
The thing you're replacing is the shared spreadsheet, and the reason it's dangerous isn't that it's a spreadsheet. What a shared vault actually buys you, how to structure it, and why most of what you'd put in it shouldn't be shared at all.
Read →The router your ISP gave you
A walkthrough of the five jobs the ISP's box is doing for you, the six it isn't, and why the right move is usually bridge mode rather than throwing it away.
Read →Shared-hosting mail vs real mail infrastructure
The mailboxes bundled with your web hosting are a mail server shared with hundreds of strangers on one IP address. Here's what that costs you in deliverability, what it does to your SPF record, and where the line is between "good enough" and "move it."
Read →Better Wi-Fi is channel planning, not more access points
Adding access points to a badly planned network makes it slower, because Wi-Fi is a shared medium and every AP on the same channel is another competitor for it. Here's the channel and power planning that has to happen first.
Read →Matter and Thread: what actually changed
Matter is an application-layer standard; Thread is a low-power mesh network. They sit at different layers and solve different problems, and the "Works with Matter" logo promises less than most buyers assume. Here's what each one is, and where the reality still trails the pitch.
Read →What a real incident actually looks like
Not the tidy version. The ambiguous first ten minutes, the suspect that turns out to be innocent, the choice between restoring service and understanding it, and why the running notes matter more than the speed.
Read →Page speed: the three things that actually matter
Most page-speed advice is a checklist of thirty items, twenty-eight of which will not move your site. Three things decide whether a page feels fast — server response time, what blocks the first paint, and how much JavaScript the phone has to execute — and all three are decided when the site is built.
Read →What a WCAG audit report actually contains
Three quotes for an accessibility audit can range from a few hundred dollars to five figures for what sounds like the same thing. Here are the six sections a real report has, what a single finding must contain, and the two questions that tell you which one you're buying.
Read →The call data you should be keeping
Most small businesses can't say how many people called last month and hung up without leaving a message. Here are the six fields worth recording for every call, what the pattern in them tells you, and why the missed calls are the valuable ones.
Read →What a 'managed network' actually buys
An itemized account of what sits inside a monthly managed-network fee, what it explicitly does not cover, and the one question that separates a real managed service from a dashboard somebody glances at.
Read →Own your domain registration
If a former web designer or agency holds your domain, they control your website, your email, and every password reset you'll ever need. Here's how to find out who really holds it, how to get it back, and the transfer lock that catches people in exactly the wrong order.
Read →Automations worth having, and the gimmicks
After the novelty wears off, the automations people keep are dull ones — water shutoff, freeze alerts, a garage door that closes itself. Here's the list that earns its keep, the list that doesn't, and the single rule that separates them.
Read →Website backups: what 'restore' actually means
A website is three things that must come back together — a database, an uploads folder, and configuration — and a file-level copy of a running database is usually worthless. Here's what a real website restore involves, and why the restore you'll actually be asked for is a partial one.
Read →Why accessibility overlays fail an audit
The demo is impressive and the automated error count really does drop. Here are the five specific mechanisms by which an overlay widget still fails a WCAG audit — and why the number it improves is the one nobody is judged on.
Read →What a retainer actually buys you
A monthly plan isn't a block of hours, and it doesn't cover everything. Here's what a retainer genuinely includes, what still gets quoted separately, and why "call us when it breaks" tends to cost more over a year.
Read →DNS filtering: categories beat blocklists
A blocklist is a snapshot of last week's bad domains. A category is a policy that still applies to a domain registered tomorrow. Here's how category filtering works, what it genuinely cannot do, and the browser feature that quietly routes around all of it.
Read →What really happens when you change MX records
Moving your email to a new provider is one DNS record, and that's exactly why it goes wrong. What TTLs actually control, why mail keeps arriving at the old server for days, and the one step you have to take before the day of the cutover.
Read →What actually needs patching urgently
A scanner report with 300 findings is not a plan. A triage rule that puts internet-facing, authentication-adjacent systems first — and what you have to do after the patch that the advisory never mentions.
Read →Test your own site with a keyboard in five minutes
Put the mouse down and press Tab. This is a minute-by-minute walkthrough of the keyboard-only test an auditor runs first, what a failure looks like at each step, and which success criterion each one breaks.
Read →Smart-home segmentation, and why it isn't optional
Smart-home gear is the least-patched equipment on your network and it talks to the internet constantly. Walling it off is straightforward. Keeping casting, printing and speaker discovery working afterward is the part that goes wrong, and it isn't a firewall problem.
Read →What an AI receptionist can't do
An honest account of the limits — what it doesn't know, what it should never promise on your behalf, and the calls that have to reach a person immediately. Including the failure mode that costs more than a wrong answer.
Read →Reading a bandwidth graph: what normal looks like
Your router already draws a traffic graph for every interface. Here's how to tell a backup window from a saturated uplink from a broadcast storm by shape alone — and why the graph can look perfectly healthy while the network feels awful.
Read →Image weight, the silent conversion killer
A photo straight off a phone is 12 megapixels and several megabytes, displayed in an 800-pixel box. Here's what that costs on a real phone on real cell service, how to serve the right size instead, and the mobile trick that doesn't work.
Read →Accessible PDFs: the hardest part of Title II
A PDF stores glyphs at coordinates, not structure — which is why remediating one is slow manual work no scanner can do for you. Here's what a tagged PDF needs, the export setting that destroys it, and why the rule's exceptions probably point at your forms, not your archive.
Read →How you'd know your domain is being spoofed
Nobody sends you a notification when someone starts forging mail from your domain. Here are the three ways businesses actually find out, what DMARC can and can't stop, and the null-record posture that protects every domain you own but never send from.
Read →MFA that survives a lost phone
Turning on multi-factor authentication is easy. Getting back into your own accounts after the phone holding all the codes disappears is the part nobody plans for. How to set it up so a lost phone is an errand, not an emergency.
Read →WireGuard vs the VPN you already have
What WireGuard does differently from IPsec and OpenVPN, where it is genuinely better, the authentication it deliberately refuses to do, and the MTU problem that makes a working tunnel feel broken.
Read →Certificates always expire on a Sunday
Automated certificate renewal fails quietly, and the browser only tells you weeks later — with a full-page security warning in front of your customers. Here's why renewals break, the failure mode where the cert renews and the site goes down anyway, and how to monitor expiry so you find out first.
Read →Why blocking robocall numbers never works
Blocking a robocaller's number accomplishes nothing, because the number was forged and will be a different one in an hour. Here's how neighbor spoofing works, what STIR/SHAKEN does and doesn't fix, and the one change that actually cuts the interruptions.
Read →Color contrast is math, not vibes
WCAG contrast is a formula with fixed constants, not a judgment call — and it weights green nine times heavier than blue. Here's the actual arithmetic, the two thresholds that matter, and the four places an automated checker can't decide for you.
Read →Local control vs the cloud, for when the vendor dies
A cloud-connected smart device is a subscription to someone else's company continuing to exist. Here's what "works locally" actually means, the two-step test that tells you which kind you bought, and how to spec a house so an outage doesn't cost you a light switch.
Read →Your guest Wi-Fi probably isn't isolated
A separate SSID and a "client isolation" checkbox do less than most people assume. Here's the difference between AP-level isolation and real separation, plus the two RouterOS settings that let a guest reach the router itself even when every other rule is right.
Read →Monitoring is not alerting
A dashboard only helps when somebody is looking at it. The difference between monitoring and alerting, why a check that can't detect its own death isn't a check, and why the only test that counts runs from outside your network.
Read →How to read a DMARC report
DMARC reports arrive as XML attachments from Google, Microsoft, and mail providers you've never heard of. Here's what each field means, and how to tell a broken forwarder apart from someone genuinely forging your domain.
Read →What hosting actually costs, itemized
One company quotes $4.99 a month, another quotes $50, and nobody shows their work. Here is every line item behind hosting a small business site — domain, DNS, certificate, compute, storage, bandwidth, email, backups, monitoring — with real numbers, and the one line that actually sets the price.
Read →Alt text: what a screen reader actually says
Four images, four alt attributes, four completely different sentences read aloud to a resident. Here's what a screen reader announces for a missing alt, an empty one, a lazy one, and a good one — and why the linked ones matter most.
Read →Dual-WAN failover that actually fails over
A second internet circuit only helps if your router notices the first one is dead. Here's why link state and gateway pings miss most real outages, how recursive route checks catch them, and why "traffic is moving again" is the wrong thing to measure.
Read →The federal deadline every small-town website now has — and what it actually requires
The DOJ's ADA Title II rule gives city, county, and special-district websites until April 2027–2028 to meet WCAG 2.1 AA. Here's what the rule really says, what enforcement looks like, why overlay widgets don't work, and what a sensible path to compliance costs.
Read →Storage that scales, and backups that actually restore
Two truths most businesses learn the hard way — storage always grows faster than you plan for, and "we have backups" is not the same sentence as "we have backups that restore." Here's how to get both right.
Read →Why your email keeps going to spam — and the three DNS records that fix it
If your business email lands in customers' spam folders, it's almost never the content. It's three DNS records — SPF, DKIM, and DMARC — that tell the world your mail is really yours.
Read →Own your telemetry — self-hosted observability, not rented
SaaS monitoring works until the bill grows and you notice you're shipping all your operational data to someone else's cloud. Here's what a self-hosted observability stack looks like, and when it's worth building.
Read →VLANs are the cheapest security you can buy
A flat network means one compromised smart plug can see your accounting PC. Segmentation fixes that for the price of some config time. Here's how I think about it.
Read →Why one engineer beats four vendors
Most small businesses stitch together a web designer, a host, a network installer, and a payments consultant — none of whom talk to each other. Here's why that's the real problem.
Read →