Field notes on monitoring
Honest writing about uptime, on-call, and running reliable systems for other people.
Status-by-colour-alone is failing your on-call
A red dot tells you something is wrong. It doesn’t tell you what, since when, or whether you can trust it. Here’s how we designed Vigil so severity is never carried by colour alone — and why your dashboard probably gets this wrong.
Read articleWordPress user enumeration: why /?author=1 hands attackers half a login
If your site redirects /?author=1 to /author/<name>/, it's publishing valid usernames. Here's why that matters and how to shut it down.
Your WordPress debug.log is public — here’s what it’s handing out
A reachable /wp-content/debug.log is a running confession of everything going wrong on the box: paths, plugins, queries, sometimes secrets.
xmlrpc.php: the WordPress endpoint you can almost certainly turn off
A reachable xmlrpc.php is a brute-force amplifier and a DDoS reflector. Most modern sites don’t use it at all.
WordPress version disclosure: a small leak that makes you a precise target
Publishing your exact WordPress version lets attackers match your site to a CVE list in seconds. Hide it — but don’t mistake that for the real fix.
Monitoring WordPress without installing a plugin
Core version drift, exposed xmlrpc, leaked debug logs — all catchable from the outside.
Runbooks, not dashboards
Why we model monitoring as named, scheduled runbooks instead of a wall of graphs.
Keeping secrets write-only (and why you should)
A monitoring tool holding readable credentials is a breach waiting to happen. Ours can’t.
The security headers every site should send — and how to set them
HSTS, CSP, nosniff, framing, Referrer-Policy, Permissions-Policy. What each one stops, and the exact lines to add for nginx, Apache and Node.
Cookie flags that matter: Secure, HttpOnly, SameSite (and scope)
A session cookie without the right flags is a session waiting to be stolen. What Secure, HttpOnly and SameSite do — and how to set them on any stack.