Notes
Notes
Practical notes on website security, performance and search visibility, written for people who need their site looked after without being technical themselves.
- RansomwareSecurity incident
Hit by Ransomware? Do Not Pay or Reinstall
The two most expensive decisions are paying and rushing to reinstall. What to check first, and what can still be recovered.
- Account SecuritySmall Business
Passwords in a Shared Spreadsheet: How to Fix It
Passwords in a spreadsheet or chat leave no trail. Which accounts must be individual, how to handle the shared ones, and what to do on someone's last day.
- HostingOperationsWordPress
Moving a Website to a New Host Cleanly
Same URLs, different machine. Safer than a redesign, but as much gets left behind. What to inventory, how to cut over without downtime, what to verify.
- WordPressSEO
All Green in Yoast, Still Not Found. Why?
The traffic lights are the plugin's own rules, not Google's. What an SEO plugin reaches, what it cannot, and four checks worth running after install.
- SEOOutsourcing
SEO: An Agency, a Consultant, or an Engineer?
Agencies, consultants and engineers all sell SEO, and all three sell something different. What each is best at, and how hiring the wrong one wastes the budget.
- DomainsOperations
Moving a Domain to Another Registrar
You think about this when the domain is in someone else's name or the registrar has gone quiet. Locks, the 60-day rules, cost, and whether the site goes down.
- SSLOperations
Certificate Lifetimes Are Shrinking Fast
Maximum certificate validity keeps dropping, so renewing by hand once a year no longer works. The schedule, who gets hurt first, and how to automate it.
- Security incidentBusiness security
A Company PC Was Hacked: Three Questions
How long were they in, what did they take, are they still there. All three answers live in the machine's state before anyone touches it. What to preserve.
- WordPressPerformanceMaintenance
Why Is My WordPress Site Slow? Six Causes
The weight is usually plugins, unprocessed images and a heavy theme, not the server. Six causes ranked by impact, each with a check you can run yourself.
- WordPressPlatform choice
WordPress, Wix, Shopify or Webflow: How to Choose
Three questions rule out most options: are you selling, who updates the site afterwards, and how much lock-in you can live with. Plus what WordPress costs.
- WordPressIncident responseMaintenance
WordPress White Screen and 500 Errors: Fix Order
When the site will not open, changing settings at random makes it worse. A fixed order for breakage after updates, failed installs and database errors.
- MalwareWindows reinstall
Does Reinstalling Windows Remove Malware?
A clean reinstall does deal with most ordinary infections. But six situations survive it, the most common being restoring an old backup. Find yours first.
- Data BreachIncident ResponseCompliance
The First 72 Hours After a Data Breach
The clock starts when you know, not when the investigation ends. Order of work, who decides, what to record, what to say. Taiwan rules. Not legal advice.
- Terms of ServiceWebsitesCompliance
Does a Small Website Need Terms of Service?
Terms are an agreement, a privacy policy is a notice. What a brochure site really needs, what a shop needs, and the clauses people skip. Not legal advice.
- MalwareSecurity basics
Computer Virus Symptoms: Is Your PC Infected?
A slow computer is usually not a virus. A program you never installed is. Symptoms mapped to real causes, and four checks Windows runs without installs.
- PDPACompliance
Taiwan's PDPA Amendment: 72-Hour Reporting
A single regulator, and breach reporting written into the law. What changed, what the draft rules require, and what a small company can prepare now.
- NASBackup
A Copy on the NAS Is Not a Backup
The NAS is where a small business piles its data, and where ransomware aims. Exposure, default accounts, snapshots, and what offline backup means.
- Small BusinessRemote Access
Remote Desktop Open to the Internet: The Risk
Exposing Remote Desktop to the internet means constant automated login attempts. How that differs from VPN first, and what to fix today without rebuilding.
- VPNRemote access
Does a Small Business Need a VPN?
The consumer product and the company kind share a name and little else. What a business VPN actually buys, when to skip it, and the upkeep it adds.
- Account SecuritySecurity Basics
Which Accounts Need 2FA First? Start With Email
Turning it on everywhere is too much work, so it never happens. A priority order that works, what SMS, an app and a hardware key each cost, and backup codes.
- Cloud storageAccess control
Cloud Drive Sharing: Which Setting Is Public?
Anyone with the link means anyone on the internet. What each sharing level really grants, what to revoke when someone leaves, and how to audit access.
- Website securitySecurity headersSecurity testing
HTTP Security Headers: A Free Five-Minute Check
What six common security headers block, how to test your site for free, how to add each one, and which two will break the site if you get them wrong.
- SEOGEOPerformance
My Own Site, SEO Score 69 to 100: Before and After
The same page in PageSpeed Insights before and after: SEO 69 to 100, mobile 66 to 87, first text 5.3s to 2.3s. And what a score still does not buy you.
- Web designPricing
Web Design Pricing: How to Read a Quote
Why quotes for the same brief differ tenfold, which line items get left off, and which cheap options move the cost somewhere you cannot see. Figures in NT$.
- Website costsBookkeeping
How to Account for Website Costs
Domain, hosting, build and monthly upkeep are not one line in the books. Which parts are an expense, which get capitalised, and what paperwork to ask for.
- GEOSEOAI visibility
What Is GEO? Getting AI Engines to Cite You
How GEO differs from SEO, why the way your pages are produced decides whether a machine sees anything, and three checks you can run without buying a tool.
- Social engineeringSecurity testingStaff training
Phishing Simulations: What a Drill Involves
Written authorisation, scenario design, the metrics worth tracking, turning the report into training, and the lines a drill must not cross.
- Government procurementSecurity testing
Buying Security Testing in Taiwan's Public Sector
What Taiwan's common-supply contract system is, who can order through it, how security line items are priced, and the options when the amount is small.
- WordPressSite buildMaintenance
How to Build a WordPress Site, Start to Launch
Domain, hosting, installation, theme work and pre-launch checks, in sequence. Self-hosting against one-click platforms, and where the money actually goes.
- MaintenanceManaged hostingSmall business
No IT Staff: Who Looks After Your Website?
What maintenance actually covers, how doing it in-house compares with calling the developer or paying a retainer, and which accounts to keep in your name.
- PerformanceWeb fontsFrontend
Chinese Web Fonts Are Why Your Site Loads Slowly
A CJK font file runs to several megabytes, often more than the rest of the page combined. How to confirm it, four places to fix it, and what each costs.
- SEOIndexingSearch Console
Website Not Showing Up on Google?
A site nobody can find is usually not indexed at all rather than ranking badly. How to tell which, the six usual causes, and what speeds indexing up.
- SEOStructured dataGEO
Structured Data: Does a Small Site Need It?
What it actually does, the five types worth doing first, how to add it on WordPress or a custom build, and why it is not a ranking factor.
- WordPressWebsite security
WordPress Security Checklist for Small Sites
Updates, login hardening, user roles, file permissions, certificates, headers and restore tests. Settings you can go and apply, with no promises attached.
- SEOSearch ConsoleTools
The Four Search Console Reports You Actually Use
Performance, Page Indexing, URL Inspection and Sitemaps. What to look at in each, which numbers mean trouble, and what to do about them.
- Server securityHealth checkOperations
Server Security Health Check: What It Looks At
Full load for weeks, an admin account nobody made, antivirus switched off. What a health check inventories, what access it needs, and what it will not find.
- SEOIndexingSite setup
robots.txt and Sitemaps: The Minimum Setup
What each file does, what a minimum working setup looks like, the three mistakes that keep coming up, and how to check your own without guessing.
- Privacy PolicyPDPACompliance
What Actually Goes in a Privacy Policy
Most policies come from a generator and describe a generic site rather than yours. How to check one against what your site really does. Not legal advice.
- EmailSite setupOperations
Company Emails Landing in Spam? Check DNS First
Quotes and password resets going to junk is usually missing sender authentication. What SPF, DKIM and DMARC each prove, and how to check yours.
- PDPACompliancePrivacy
Collecting Customer Data Under Taiwan's PDPA
Member accounts, orders or a contact form make you a collector under Taiwan's PDPA. The duties that brings, and a checklist. Not legal advice.
- RedesignSEOOperations
Redesign Without Losing Your Search Traffic
Old addresses turning into 404s take years of rankings with them. The URL map to build first, how redirects should work, and what to check after launch.
- HostingVPSInfrastructure
VPS, Shared Hosting or a Managed Platform?
What separates them is control, who maintains it, and how hard it is to leave. Who each suits, the hidden costs, and where security responsibility divides.
- Website securitySecurity basics
Website Security After Launch: Five Things First
Five habits needing almost no technical knowledge that block most automated attacks: force HTTPS, patch, lock down admin, protect data, scan regularly.
- Security testingReading reportsSecurity basics
How to Read a Vulnerability Scan Report
The problem is not understanding the report, it is knowing which line to start on. What the CVSS bands mean, and why the top score is rarely the first fix.
- Incident responseWordPressWebsite security
My Website Has Been Hacked: What to Do First
Deleting files destroys the evidence and leaves the backdoor, so it happens again. A calm order of work: confirm, contain, clean, restore, find the cause.
- Vulnerability scanPenetration test
Vulnerability Scan vs Penetration Test
They differ in breadth, depth and cost by roughly ten times. What each one answers, what the report contains, and why most small firms start with a scan.