Welcome to the WebPixie Blog, your go-to source for insights, tips, and updates on web development, security, and uptime.
Try WebPixie Free →
AI Crawlers 6 DNS 14 Domain 9 GEO 5 Incident Management 4 Monitoring 48 Security 3 SEO 10 SSL/TLS 12 Uptime Monitoring 10 Web Performance 4 
Domain status codes like clientTransferProhibited, clientHold and pendingDelete are flags on your registration. Only a few take a site offline. Every code, whether the domain still resolves, and which ones are worth an alert.
PHP2Shell is a pair of critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. What they are, how they work, which versions fix them, and how to verify your patch actually landed.
The 2026 new gTLD list includes strings like .login, .verified, .official and .auth. None can host a lookalike domain yet. What the list shows, what .help already looks like, and what a brand owner can do now versus at launch.
Cloudflare’s 1xxx error codes are Cloudflare’s own reason for refusing a request, written in the response body, while the HTTP status your monitor records is a separate number. Here is every code, the status it sends, and who has to fix it.
A status page stays green during an outage when its hosting, its feeding checks, its coverage or its posting path is broken. Real AWS, Cloudflare, GitHub and GitLab incidents, and a self-check for your own page.
A holiday change freeze stops your deploys, not your CA, registrar, CDN or renewal jobs. What keeps changing from November to January, with a dated source, a pre-freeze check and the outside symptom for each.
ACME failover to a second CA only works if your CAA record already authorizes that CA. Here is how the backup issuer gets refused on the day you need it, what changes when every CA must honor accounturi from 15 March 2027, and how to test it now.
CA/B Forum ballot SC104 made the certificate AIA extension optional on 4 October 2026. If a CA drops it and your server omits the intermediate, Chrome, Edge and Safari lose their repair path. Firefox desktop keeps working.
A resolver that trusts only KSK-2017 does not fail at the root KSK rollover on 11 October 2026. It fails when it next fetches the root key set, and a container recreated from a stale image after that date fails on its first query. Tested on Unbound and BIND.
Post-quantum DNSSEC answers signed with ML-DSA-44 do not fit in UDP. The authoritative servers for today's test zones truncate every DNSSEC answer, so TCP/53 is the only working path. The cost lands on recursive resolvers, including ones that cannot validate algorithm 18.
If a 2026 applied-for gTLD matches your internal domain, ICANN can delegate it twice: a 90 to 365 day temporary delegation in a mode it picks, possibly with no 127.0.53.53 warning, then the real one. What to check, and where to move.
Every uptime percentage calculator assumes continuous 24/7 coverage. Real monitoring dashboards don't work that way: paused monitors and unmonitored gaps get excluded, not counted, which is why the two numbers rarely match.
Affiliate links need rel=sponsored, comment links need rel=ugc, and both get missed the moment they're added, not on a schedule. Here is why an outbound link audit needs to be continuous, not a one-off.
An incident postmortem needs more than what a monitoring tool logs automatically. Here's what your incident record already gives you, and the short list you have to write down yourself before you forget it.
A lower TTFB does not guarantee a faster page, and a higher one does not guarantee a slower one. Cloudflare has the data to prove it. Here is what to measure instead.
Orphan pages have no internal links pointing to them, so search engines struggle to find them. Most guides tell you to stitch together a crawler, a sitemap, and Analytics. Here is a faster way, plus a use case most guides skip entirely.
Domain monitoring is not one-size-fits-all. Whether you need it, and how much, depends on how many domains you own and what breaks if one lapses. Here is a scope-based way to decide.
The attacker's certificate for Virtualizor's domains was real, correctly chained, and issued by Let's Encrypt. That's the actual story: certificate validity checks the cert, not the network path serving it.
Chrome 154 turns on HTTPS-by-default warnings for everyone in October 2026. Finding your subdomains is the easy part. Knowing which of them actually need fixing before then is the part nobody's writing about.
During Namecheap's 13 Aug 2026 outage, DNS zone resolution stayed up while DNS management went down. A real, confirmed case for why resolution and management are separate failure domains.
A broken IPv6 path does not take a dual-stack site down. It adds real, measurable delay for a share of visitors while an IPv4-only uptime check keeps reporting "up" the entire time.
Let's Encrypt shut down OCSP entirely in August 2025. Chrome and Firefox both moved revocation checking off the live connection years ago. Most OCSP stapling tutorials still teach it as the default, without saying any of that.
Most guides say removal "takes months." The real number, from the official removal page, is 6 to 12 weeks to reach most Chrome users, and Firefox and Safari run their own separate clocks entirely.
503 means a server is deliberately not serving right now. 504 means something upstream never answered in time. The trigger conditions for each are different in nginx, AWS ALB, and Cloudflare, and none of them share the same defaults.
Let's Encrypt's shift to 45-day certificates will double daily renewal requests. Here is which rate limit you actually hit, why, how long until it resets, and the one mechanism most automated setups already have that sidesteps the problem entirely.
A real CNAME can never sit at a zone apex, so every provider invented its own workaround: ALIAS, ANAME, CNAME flattening. Three names for roughly the same trick, with real differences in TTL handling and DNSSEC behavior, plus a newer standards-based alternative most guides skip.
Five directives, one table, and four ways getting one of them wrong actually breaks a site: a personal page cached on a shared CDN, a logged-out user seeing a previous session on the back button, and two more.
A check run from one location can fail for reasons that have nothing to do with your site, including, in one real 2025 incident, a problem with the monitoring vendor's own infrastructure in that region. Here is what actually causes this, and what confirming from elsewhere buys you.
DNSSEC fails closed: a broken chain of trust returns SERVFAIL, not a wrong answer. Two real incidents, Slack in 2021 and a TLD-wide DENIC outage in 2026, show the two root causes that actually happen, and the fast path to telling them apart.
Six headers cover most of the real risk, and the free scanner every checklist points you to recently lost its API. Here is what actually matters, what to skip, and how to verify it without depending on a one-off manual scan.
Most SSL monitoring dashboards show a green check for two things: the TLS handshake succeeded and the certificate has not expired. Neither one confirms the chain is complete, and an incomplete chain fails silently for exactly the clients your monitor never tests.
Most SEO monitoring advice means stitching together five separate tools and a dashboard yourself. The signals that actually predict a traffic drop, robots.txt, canonical, hreflang, noindex, sitemap coverage, and link health, are more useful correlated in one place than tracked apart.
Every subdomain takeover guide is written for a security team hunting exposure. Most takeovers start as an ops mistake: a CNAME left behind after a vendor migration or a decommissioned SaaS tool, with nobody deleting the record.
Every incident management guide assumes you will build your own severity matrix, even the ones that call it automated. A monitoring tool that assigns severity by what actually happened does not need one at all, at least not for the incidents it already knows about.
For programmatic incident consumption, webhooks deliver in about a second. Polling adds an average of half your poll interval on top, pure waiting, after the incident already exists. Here is the real tradeoff, and the failure mode most guides skip.
RDAP rate limits vary wildly by registry, from 10 requests per 10 seconds to 300 a day, none of it standardized. Real per-registry numbers and what ICANN's RDRS access-tier system actually is in 2026.
DNS propagation isn't a transport mechanism, it's cache expiry. Negative caching, not TTL alone, explains why a fresh record can lag. Here's how to actually verify a change, and why that verification never really stops.
An RDAP JSON response reads in four groups: identity, events, entities, and status, plus a few blocks you can skip. Walked through with one real response for example.com, field by field, in the order you actually need them.
A monitor that says your site is down is not always right. Cloudflare can block your monitoring bot specifically, or have its own outage, and neither one means your server is broken.
Cloudflare’s 520 through 526 errors all mean the same broad thing: Cloudflare reached the internet fine, but something went wrong between Cloudflare and your own server. Here is what each code means, and what actually catches each one.
A sitemap is a snapshot of what your site looked like when it was generated. A crawl reflects your site right now. The two drift apart continuously, not just after a big migration.
A weekly link crawl catches most broken links before they cost you traffic. When you find them, internal 404s on your highest-traffic pages come first, then redirect chains, then outbound links last.
WHOIS and RDAP look up the same domain registration record, but only one of them is still the protocol ICANN actually requires. Here is the real difference and the verified 2019 to 2025 timeline that made RDAP the default.
ACME Renewal Information (RFC 9773) lets a CA tell your client to renew earlier than the raw expiry date suggests. Every guide treats it as an ACME-client feature. None treats it as a second signal an external monitor could watch.
Building a certificate inventory from scratch is unnecessary work. Certificate Transparency logs already record every certificate issued for your domain, in public, for free. Here is how to read that record yourself.
Let's Encrypt ended its certificate expiration emails in June 2025. Here is why its own recommended fix does not solve the real problem, and what actually catches a renewal that fails silently.
AI agents now crawl, read, and act on websites the way search engines used to. Here is a practical, standards-graded checklist for making your site agent-ready, and what to skip for now.
Web Bot Auth lets a crawler cryptographically sign its requests instead of relying on a spoofable User-Agent string. Here is how the RFC 9421 mechanics actually work, who really signs requests today, and what the spec still leaves unresolved.
DNS-AID proposes publishing AI agents through DNS records instead of well-known URIs. Here is what the draft actually specifies, what the Linux Foundation launch means, and why the record shape is still inconsistent across every implementation we checked.
Domain monitoring and DNS monitoring watch two different layers of the same name: registration versus resolution. Here is what each one catches, where they overlap at the nameserver, and which layer catches which outage, so you know why you need both.
Domain hijacking shows up in the registration record before you lose the name: a transfer lock removed, a pendingTransfer flag, a nameserver or registrant rewrite. Here is how to detect domain hijacking early by watching WHOIS and RDAP, with the perl.com case as the lesson.
Domain expiry monitoring reads your domain's WHOIS or RDAP record on a schedule and warns you weeks ahead, so a missed renewal never takes your site, email, and certificates offline at the same time. Here is the expiry lifecycle, how to check it, and how to alert in time.
Detecting DNS record changes is a snapshot-and-diff loop on top of dig and the SOA serial. The hard part is not the detection, it is filtering the false positives from GeoDNS, round-robin, and CDN IP rotation so you only alert on changes that matter.
DNS monitoring catches the silent failures an uptime check never shows: records pointing at the wrong server, nameservers out of sync, expired DNSSEC signatures, broken email records. Here is exactly what it catches, what it cannot, and how to start with dig.
Checking an SSL certificate's expiration takes ten seconds with a browser or openssl. The real problem: certificate lifespans have already dropped to 200 days and reach 47 by 2029, so a once-a-year manual check no longer protects you. Here is how to check, and how to automate it.
llms.txt still does almost nothing for AI search citations, and a 137,000-site study found 97% of files never get fetched. But in 2026 Google moved it into a new agentic browsing standard alongside WebMCP. Here is what changed, and when llms.txt is still worth adding.
GEO is SEO with one extra job: getting cited inside AI assistant responses. The 2023 paper that coined the term tested 9 content interventions. Four worked strongly, three gave moderate gains, and two flatlined or backfired, including classic keyword stuffing.
Most sites should allow AI training crawlers in 2026: invisibility in AI assistant answers now costs more than uncrawled-for-training saves. Here is the per-provider breakdown (GPTBot, ClaudeBot, Google-Extended) and the robots.txt for each realistic decision.
The famous downtime cost numbers (Gartner's $5,600/min, IDC's $1M/hour) come from enterprise IT surveys that rarely apply to most sites. Here is where each one comes from, why it overstates the cost for most businesses, and a calculation framework that does apply.
Picking an uptime check interval is not a question of "as fast as your plan allows." It is a question of which failure mode you are catching and how fast the world needs to know it is broken. Here is how to pick by impact, plus the alert latency math vendors rarely show.
Three small files with three different jobs. robots.txt controls who crawls, sitemap.xml maps what to crawl, and llms.txt curates what AI assistants read first. Get the mental model right with minimum-viable examples and the mistakes that confuse them.