Blog
Real findings from real audits — security, speed and SEO explained in plain language.
The complete security checklist for AI-built sites (Lovable, Bolt, v0, Cursor)
An AI can ship a working app in an afternoon — and leave a dozen doors unlocked. This is the full checklist I run against AI-built sites, in the order the findings actually bite.
July 19, 2026
One website audit or a dozen browser tabs? All-in-one vs single-purpose scanners
There's a great free tool for each of security headers, SSL, DNS, speed, SEO and cookies. Running all of them, reconciling the results, and knowing what actually matters is the real work. The case for a single scan.
July 19, 2026
How to get found in 2026: SEO, AI visibility and site speed
Getting found used to mean ranking on Google. Now it's three overlapping things — search engines, AI assistants, and the speed that gates both. How the pieces fit, and what to fix first.
July 19, 2026
The 2026 website compliance checklist: GDPR, cookies & the European Accessibility Act
Security isn't the only thing that gets you fined. Here's what actually applies to your website if you sell to EU customers — and what a scan can and can't tell you about it.
July 18, 2026
Cookie banners that actually comply (and the ones that get you fined)
A cookie banner that loads trackers before you click is worse than none — it documents the violation. What a compliant banner does differently, and the common patterns that don't hold up.
July 18, 2026
Supabase RLS: the one setting that decides who reads your data
Row Level Security is the difference between a private database and a public one — and it's the setting AI builders quietly skip. What RLS is, how to tell if yours is off, and how to switch it on without breaking your app.
July 18, 2026
How scrapers find your exposed API key within hours of launch
Put a Stripe or OpenAI key in your frontend and it isn't hidden — it's published. How automated scrapers find bundled keys within hours, why 'it's only the frontend' is a myth, and how to move the key server-side.
July 18, 2026
The scanner said the site was clean. Then I read the code.
A deep audit of one platform turned up 40 issues — four of them critical. Not one of the four would show up on an automated scan. Here's why, and what it means for your site.
July 17, 2026
The security headers your site is probably missing
A handful of HTTP response headers switch off whole classes of attack — and cost nothing but a few lines of config. Here's what each one does, in plain language.
July 16, 2026
Is your site invisible to ChatGPT? Check one file.
More people ask an AI what to buy, and it might never see your site — not because your content is weak, but because one line in robots.txt told its crawler to leave. Here's how to check, and the truth about llms.txt.
July 15, 2026
5 security holes I find on almost every AI-built site
AI tools like Lovable, v0 and Bolt build a site in an afternoon — and just as fast, build in the same mistakes over and over. Here are the five most common.
July 14, 2026
The European Accessibility Act is in force. Your site may be breaking it.
Since 28 June 2025, accessibility is law for most businesses selling to EU consumers — wherever you're based. Who's covered, what it actually requires, and what a scan can and can't tell you.
July 13, 2026
Why an exposed .env is a catastrophe (and how to fix it in a minute)
One file, one request, and an attacker holds the keys to your database and your payment gateway. Why it happens, and how to close it for good.
July 10, 2026
Core Web Vitals: the three numbers Google cares about
LCP, CLS and INP decide how fast your site feels and how it ranks in search. What they mean, and what to aim for.
July 6, 2026