Home / Blog

Blog

Your blog category

Multi-region deployment is overkill for 90% of products

I rolled back multi-region deployment on two projects where I'd introduced it too early. When it's truly required, when it just piles…

Blog 4 min

Sprint planning that actually earns its place: negotiation, not ritual

Sprint planning is a ritual on most teams. Two hours long, output fuzzy. Turning it into a practice that actually earns its…

Blog 6 min

CLS culprits: from font loading to ad slots, and how to fix each one

Cumulative Layout Shift (CLS) is Google's visual stability metric. Where layout shifts come from, and how to fix them.

Blog 6 min

Custom WP REST API endpoints: authentication and capability checks that hold up

You're writing a custom WordPress REST API endpoint. The security discipline: authentication, authorization, rate limiting.

Blog 6 min

API key rotation: four scenarios and how to handle each one

What happens when an API key leaks? Without rotation, years of exposure. Four real scenarios and the practical rotation for each.

Blog 6 min

Dark Mode done right: the discipline from design to code

Dark Mode has been around since iOS 13. Badly implemented apps are still everywhere. The right approach, from design to code.

Blog 6 min

Disaster recovery: the mistakes I made before a real incident exposed them

Most companies have a DR plan on paper that nobody tests. Here are the failures a real drill will expose.

Blog 6 min

Story points are not hours: the estimation mistake most teams make

A story point is not hours. But most teams estimate with that assumption. What does good estimation actually look like?

Blog 5 min

The 10-point LCP checklist I run on every site

Largest Contentful Paint is Google's most important performance metric. A practical checklist to get it under 2.5s.

Blog 5 min

WooCommerce B2B pricing: plugin or custom code?

In B2B e-commerce, the price changes per customer. Bulk discounts, category discounts, membership tiers. Plugin or custom code?

Blog 6 min

OAuth 2.0 flows in practice: authorization code, PKCE, client credentials

OAuth 2.0 is the most widely used authorization protocol. Four flows, each for a different scenario. A practical usage guide.

Blog 6 min

A dynamic icon strategy built on SF Symbols

SF Symbols is Apple's free icon library. 5000+ symbols, dynamic color, weight. It made custom icons obsolete for me.

Blog 5 min