Journal

Notes from
the work.

Practical thoughts on building better websites, solving the awkward problems, and keeping things running.

Rows of physical servers with metal ventilation grilles, status lights and Ethernet cables in a working server room.

PHP2SHELL: what happened and how to secure your WordPress site

PHP2SHELL exposed a risk below WordPress itself. Understand the October 2026 incident, the PHP patches and follow-up advisory, and the security checks every site owner should make.

A laptop and connected portable backup drive on a naturally lit wooden work desk.

How to update WordPress without breaking your live site

A practical workflow for WordPress updates: prepare a recoverable backup, test a staging copy, check the journeys that matter, and plan a safe release.

A hand holding a smartphone displaying a website, with a laptop softly blurred on the desk behind it.

Why your website feels slow: a guide to Core Web Vitals

Loading, responsiveness and layout stability are different problems. Learn how LCP, INP and CLS help you find the right performance fix.

A developer reviewing code on a monitor at a lived-in desk, photographed from behind with their face out of view.

AI-generated code still needs a review. Here is what to check.

A working demo is only the start. Review AI-written code for real requirements, access control, data handling, failure states and a safe release.

A laptop displaying a WPForms contact-form confirmation with the generated eight-digit request ID 88045722.

Update field value before submission in WPForms

Use the wpforms_process_filter hook to update a hidden field before a form submission is processed.

Follow via RSS