Blog |

Can a CMS Feed Expose Draft Metadata Even When Draft Pages Are Private?

Feeds, APIs, and sitemaps each decide separately whether your drafts stay hidden — here's where they've failed and how to test yours.

Serve cheap 410s outside the CMS, block only clients that ignore them, and purge your own stale references to dead attachment URLs.

Which parts of a WordPress site live in the XML export, which in the database, and which on disk — and what a restore misses.

A step-by-step way to prove your Google Drive WordPress backups can actually be restored, before you need them to be.

Find out fast whether your form entries survived a mail outage — plugin by plugin, including the CF7 settings that silently delete them.

Verify a spare WordPress admin login from a private window or second browser profile — capabilities, reset email, and 2FA included.

Learn why uncacheable search URLs force full database queries on every bot hit, how to confirm it in your logs, and which fixes hold under load.

Cut scripted signups with honeypots, timing checks, rate limits and approval queues — without turning registration off for real users.

Map Google OAuth error codes to two message types — "we're fixing it" versus "check your browser or account" — and cut sign-in support tickets.

Read Google's SMTP rejection code first — it separates a suspended account from a revoked app password, a throttle, or a blocked port.