Welcome to the WebPixie Blog, your go-to source for insights, tips, and updates on web development, security, and uptime.https://webpixie.io/blog/en-gbhttps://webpixie.io/blog/post/subdomain-takeover-ops-problemhttps://webpixie.io/blog/post/subdomain-takeover-ops-problemEvery subdomain takeover guide is written for a security team hunting exposure. Most takeovers start as an ops mistake: a CNAME left behind after a vendor migration or a decommissioned SaaS tool, with nobody deleting the record.Sat, 15 Aug 2026 13:51:47 GMTDNSMonitoringMatt Scotthttps://webpixie.io/blog/post/you-dont-need-a-severity-matrixhttps://webpixie.io/blog/post/you-dont-need-a-severity-matrixEvery incident management guide assumes you will build your own severity matrix, even the ones that call it automated. A monitoring tool that assigns severity by what actually happened does not need one at all, at least not for the incidents it already knows about.Thu, 13 Aug 2026 15:33:00 GMTMonitoringIncident ManagementMatt Scotthttps://webpixie.io/blog/post/webhooks-vs-polling-uptime-alertshttps://webpixie.io/blog/post/webhooks-vs-polling-uptime-alertsFor programmatic incident consumption, webhooks deliver in about a second. Polling adds an average of half your poll interval on top, pure waiting, after the incident already exists. Here is the real tradeoff, and the failure mode most guides skip.Mon, 10 Aug 2026 10:34:00 GMTUptime MonitoringMonitoringMatt Scotthttps://webpixie.io/blog/post/rdap-rate-limits-access-tiershttps://webpixie.io/blog/post/rdap-rate-limits-access-tiersRDAP rate limits vary wildly by registry, from 10 requests per 10 seconds to 300 a day, none of it standardized. Real per-registry numbers and what ICANN's RDRS access-tier system actually is in 2026.Fri, 07 Aug 2026 10:37:00 GMTDomainMonitoringMatt Scotthttps://webpixie.io/blog/post/dns-propagation-mythhttps://webpixie.io/blog/post/dns-propagation-mythDNS propagation isn't a transport mechanism, it's cache expiry. Negative caching, not TTL alone, explains why a fresh record can lag. Here's how to actually verify a change, and why that verification never really stops.Wed, 05 Aug 2026 10:37:00 GMTDNSMonitoringMatt Scotthttps://webpixie.io/blog/post/reading-rdap-responsehttps://webpixie.io/blog/post/reading-rdap-responseAn RDAP JSON response reads in four groups: identity, events, entities, and status, plus a few blocks you can skip. Walked through with one real response for example.com, field by field, in the order you actually need them.Mon, 03 Aug 2026 10:37:00 GMTDomainMonitoringMatt Scotthttps://webpixie.io/blog/post/cloudflare-false-downtime-alertshttps://webpixie.io/blog/post/cloudflare-false-downtime-alertsA monitor that says your site is down is not always right. Cloudflare can block your monitoring bot specifically, or have its own outage, and neither one means your server is broken.Sat, 01 Aug 2026 22:38:00 GMTUptime MonitoringMonitoringMatt Scotthttps://webpixie.io/blog/post/cloudflare-5xx-error-codes-explainedhttps://webpixie.io/blog/post/cloudflare-5xx-error-codes-explainedCloudflare’s 521 through 526 errors all mean the same broad thing: Cloudflare reached the internet fine, but something went wrong between Cloudflare and your own server. Here is what each code means, and what actually catches each one.Thu, 30 Jul 2026 22:38:00 GMTUptime MonitoringMonitoringMatt Scotthttps://webpixie.io/blog/post/sitemap-crawl-disagreehttps://webpixie.io/blog/post/sitemap-crawl-disagreeA sitemap is a snapshot of what your site looked like when it was generated. A crawl reflects your site right now. The two drift apart continuously, not just after a big migration.Tue, 28 Jul 2026 20:51:00 GMTMonitoringSEOMatt Scotthttps://webpixie.io/blog/post/broken-link-auditshttps://webpixie.io/blog/post/broken-link-auditsA weekly link crawl catches most broken links before they cost you traffic. When you find them, internal 404s on your highest-traffic pages come first, then redirect chains, then outbound links last.Sat, 25 Jul 2026 20:50:00 GMTMonitoringSEOMatt Scotthttps://webpixie.io/blog/post/whois-vs-rdaphttps://webpixie.io/blog/post/whois-vs-rdapWHOIS and RDAP look up the same domain registration record, but only one of them is still the protocol ICANN actually requires. Here is the real difference and the verified 2019 to 2025 timeline that made RDAP the default.Wed, 22 Jul 2026 20:50:00 GMTDomainMonitoringMatt Scotthttps://webpixie.io/blog/post/acme-renewal-informationhttps://webpixie.io/blog/post/acme-renewal-informationACME Renewal Information (RFC 9773) lets a CA tell your client to renew earlier than the raw expiry date suggests. Every guide treats it as an ACME-client feature. None treats it as a second signal an external monitor could watch.Mon, 20 Jul 2026 20:50:00 GMTSSL/TLSMatt Scotthttps://webpixie.io/blog/post/certificate-inventory-ct-logshttps://webpixie.io/blog/post/certificate-inventory-ct-logsBuilding a certificate inventory from scratch is unnecessary work. Certificate Transparency logs already record every certificate issued for your domain, in public, for free. Here is how to read that record yourself.Sun, 19 Jul 2026 17:02:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/lets-encrypt-expiration-emailshttps://webpixie.io/blog/post/lets-encrypt-expiration-emailsLet's Encrypt ended its certificate expiration emails in June 2025. Here is why its own recommended fix does not solve the real problem, and what actually catches a renewal that fails silently.Fri, 17 Jul 2026 17:02:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/is-your-website-agent-readyhttps://webpixie.io/blog/post/is-your-website-agent-readyAI agents now crawl, read, and act on websites the way search engines used to. Here is a practical, standards-graded checklist for making your site agent-ready, and what to skip for now.Wed, 15 Jul 2026 10:09:00 GMTAI CrawlersGEOSEOMatt Scotthttps://webpixie.io/blog/post/web-bot-auth-explainedhttps://webpixie.io/blog/post/web-bot-auth-explainedWeb Bot Auth lets a crawler cryptographically sign its requests instead of relying on a spoofable User-Agent string. Here is how the RFC 9421 mechanics actually work, who really signs requests today, and what the spec still leaves unresolved.Fri, 10 Jul 2026 10:08:00 GMTAI CrawlersMatt Scotthttps://webpixie.io/blog/post/dns-aid-explainedhttps://webpixie.io/blog/post/dns-aid-explainedDNS-AID proposes publishing AI agents through DNS records instead of well-known URIs. Here is what the draft actually specifies, what the Linux Foundation launch means, and why the record shape is still inconsistent across every implementation we checked.Thu, 02 Jul 2026 10:08:00 GMTDNSAI CrawlersMatt Scotthttps://webpixie.io/blog/post/domain-vs-dns-monitoringhttps://webpixie.io/blog/post/domain-vs-dns-monitoringDomain monitoring and DNS monitoring watch two different layers of the same name: registration versus resolution. Here is what each one catches, where they overlap at the nameserver, and which layer catches which outage, so you know why you need both.Sun, 28 Jun 2026 12:46:31 GMTDomainDNSMonitoringMatt Scotthttps://webpixie.io/blog/post/detect-domain-hijackinghttps://webpixie.io/blog/post/detect-domain-hijackingDomain hijacking shows up in the registration record before you lose the name: a transfer lock removed, a pendingTransfer flag, a nameserver or registrant rewrite. Here is how to detect domain hijacking early by watching WHOIS and RDAP, with the perl.com case as the lesson.Sat, 27 Jun 2026 12:33:00 GMTDomainMonitoringMatt Scotthttps://webpixie.io/blog/post/domain-expiry-monitoringhttps://webpixie.io/blog/post/domain-expiry-monitoringDomain expiry monitoring reads your domain's WHOIS or RDAP record on a schedule and warns you weeks ahead, so a missed renewal never takes your site, email, and certificates offline at the same time. Here is the expiry lifecycle, how to check it, and how to alert in time.Fri, 26 Jun 2026 12:16:00 GMTDomainMonitoringMatt Scott