Skip to content

Blog

Notes from the build.

What I use on real projects: Next.js, technical SEO, AI search and web performance, written down so you can use it too.

  1. · 6 min read

    Core Web Vitals in 2026: fixing LCP, INP and CLS in Next.js

    The three metrics Google measures, what counts as good, and the fixes that move them on a real Next.js site: images, fonts, JavaScript, long tasks and layout shift. With a 30-minute audit routine.
  2. · 7 min read

    How to get your website cited by ChatGPT, Perplexity and Google AI Mode

    What decides whether AI assistants mention and link your site in 2026, and six steps that work for small businesses and freelancers: crawler access, Bing, quotable pages, one clear identity and mentions.
  3. · 6 min read

    Next.js as a backend: Server Actions, Route Handlers or a separate Node.js API?

    Do you need Express or NestJS next to your Next.js app? What each Next.js server feature is for, when a separate Node.js API is worth it, and a decision checklist for startups and full-stack teams.
  4. · 8 min read

    Next.js SEO checklist for 2026: 12 fixes for the App Router

    The checklist I run on every Next.js App Router site: metadata, canonicals, sitemap, robots, JSON-LD, headings, server-rendered content, speed and Search Console. With code you can copy.
  5. · 8 min read

    PHP2Shell (CVE-2026-109618 and CVE-2026-109619): is your website affected, and how to fix it

    Two critical PHP flaws let attackers run code on a web server without logging in. Which sites are affected, the fixed PHP versions, how to check yours on shared hosting, WordPress, VPS or Docker, and why the popular workaround isn't enough.
  6. · 8 min read

    Securing Next.js Server Actions: a 10-point checklist for 2026

    Every exported Server Action is a public POST endpoint. Here's what Next.js protects for you, what it doesn't, and the ten checks I put on every action: auth, ownership, validation, cookies, rate limits and more.