$ ls ./blog

Blog

Walkthroughs, lab notes, and the occasional rant. Mostly about full-stack dev and cybersecurity, the things I'm learning on the way to becoming.

2026-09-124 min read
Your domain name is a business asset. Own it.
Plenty of small businesses do not actually control their own domain name. Here is how to check in five minutes, what real ownership costs, and why your email belongs on it.
- #domains
- #local-business
- #email
- #ownership
2026-09-114 min read
Your booking page is not a website
Booksy, GlossGenius, and Vagaro are great at taking appointments and bad at being your front door. Here is what a thin real site adds without changing how clients book.
- #local-business
- #websites
- #booking
- #seo
2026-09-104 min read
What "website care" actually means for $50 a month
My $50 care plan, line by line: updates, backups, uptime monitoring, and small edits. Plus the honest cases where you should not pay for it.
- #care-plan
- #maintenance
- #local-business
- #small-business
2026-09-093 min read
What to put on your contact page (and what to cut)
Your contact page needs five things: a big phone number, tap-to-call, a map-linked address, real hours, and one short form. Burying the phone number is quietly costing you bookings.
- #local-business
- #contact-page
- #web-design
- #small-business
2026-09-084 min read
What a site audit actually looks for
My free audit is three findings in 24 hours: what is broken, why it costs you customers, and how to fix it whether or not you hire me. Here is exactly what I check.
- #audit
- #local-business
- #web-design
- #small-business
2026-09-074 min read
What a $400 website actually includes
The itemized list of what my $400 starter site covers, why agencies charge $2,500 for a different product, and what my price does not include.
- #local-business
- #pricing
- #web-design
- #small-business
2026-09-063 min read
The website mistakes I see in every small town
I looked up the websites of about 20 local businesses near me. The same five mistakes showed up almost every time, and every one of them costs phone calls.
- #local-business
- #websites
- #small-town
- #audits
2026-09-053 min read
The true cost of a Facebook-only business
A Facebook page is rented space. Here is what renting actually costs a local business: shrinking reach, no Google footprint, and customers who search and find a competitor instead.
- #local-business
- #facebook
- #websites
- #seo
2026-09-044 min read
What actually happens when a small site gets hacked
Small sites get hacked by scripts scanning for outdated software, not by people choosing targets. Here is what actually happens, from spam injection to the Google blocklist to the cleanup.
- #security
- #small-business
- #wordpress
- #websites
2026-09-034 min read
Seasonal businesses need year-round websites
Landscapers and plow companies do the work in season, but customers make the buying decision in the off-season. Your website is the only thing selling for you during that window.
- #local-business
- #seasonal
- #websites
2026-09-024 min read
Two-factor authentication, explained plainly
SMS codes, app codes, and hardware keys, ranked honestly, plus the three accounts to lock down first.
- #security
- #2fa
- #passwords
- #small-business
2026-09-014 min read
Real photos beat stock photos every time
Nail salons and dog groomers are buy-with-your-eyes businesses. Ten honest phone photos of your actual work will sell better than any polished stock image.
- #local-business
- #photos
- #web-design
2026-08-314 min read
What is a YubiKey and should you get one?
A hardware key is the only common form of 2FA that a fake login page cannot beat. Here is what it fixes, what it does not, and why you should buy two or none.
- #security
- #2fa
- #yubikey
- #gear
2026-08-304 min read
Threat, vulnerability, risk: get the vocabulary straight
Threat, vulnerability, and risk are three different words, and exam questions are written to catch people who blur them. A broken door lock sorts them out in about a minute.
- #security-plus
- #sy0-701
- #study-notes
2026-08-294 min read
Updates are a security feature, not an annoyance
Once a security patch is published, attackers scan for everyone who has not installed it. Here is what to auto-update and a 15-minute monthly checklist for the rest.
- #security
- #updates
- #patching
- #small-business
2026-08-283 min read
One page or five? Choosing the right size website
Most local businesses need one solid page, not five thin ones. Here is how I decide when a site actually needs more.
- #local-business
- #web-design
- #small-business
2026-08-274 min read
Security+ study materials worth paying for
Most Security+ prep money gets wasted. Here is the free stack I study with, the one book and practice set actually worth buying, and the buying habit to skip.
- #security-plus
- #certifications
- #study-materials
2026-08-263 min read
One question a day beats a weekend cram
Cramming feels productive and fades in a week. One exam question a day, protected by a streak, is how I keep Security+ and eJPT material warm between real study sessions.
- #security-plus
- #ejpt
- #study-habits
- #streaks
2026-08-253 min read
What a security audit looks like for a small site
The exact five things I check on every small business site: headers, forms, admin panels, old software, and leaked keys. Plus what a finding looks like in plain words.
- #security
- #audit
- #small-business
- #web
2026-08-244 min read
How to ask for Google reviews without being weird
A plain system for getting more Google reviews: the one-tap link, when to ask, why replies matter, and the shortcuts that can get your profile suspended.
- #google-reviews
- #local-business
- #marketing
2026-08-234 min read
Laptop stands, monitors, and your neck
A laptop flat on a table puts the screen a foot too low, and your neck pays for it. The cheap fix is a folding stand, a basic external keyboard, and a used office monitor.
- #gear
- #ergonomics
- #budget
- #remote-work
2026-08-223 min read
UUIDs vs auto-increment IDs
Sequential IDs let strangers guess your URLs and chart your growth. Here is when UUIDs earn their ugliness and when a plain serial column is honestly fine.
- #databases
- #postgres
- #uuid
- #security
2026-08-214 min read
A test-day checklist for your first cert exam
What goes in a first-timer's test-day checklist: online proctor vs test center, the ID and room rules, flag-and-move pacing, and the energy dip at question 40.
- #security-plus
- #ejpt
- #certifications
- #study-tips
2026-08-204 min read
Public wifi: what I actually worry about
HTTPS killed most of the old public wifi attacks. Here is what still worries me: evil twin networks, fake captive portals, and the person sitting behind you.
- #security
- #wifi
- #vpn
- #threat-model
2026-08-194 min read
How local search decides who shows up
Google's local pack runs on three things: relevance, distance, and prominence. Here is what each one means in plain language and what a small shop can actually fix this week.
- #local-seo
- #google-business-profile
- #small-business
2026-08-184 min read
The only keyboard and mouse advice you need
Wrist position matters more than switch color. The budget keyboard, vertical mouse, and wrist rest advice I actually follow, plus the one purchase to skip.
- #gear
- #ergonomics
- #keyboards
- #mice
2026-08-174 min read
The Pomodoro setup that finally stuck for me
The 25/5 timer failed me three times before two boring changes made it stick: a task pre-list and the phone in another room. Here is my setup and where it still falls short.
- #pomodoro
- #focus
- #productivity
- #study
2026-08-163 min read
Subnetting without tears
Subnetting on exams comes down to one mental model and two question types. Here is the finger-counting method I use while studying for Security+ and eJPT.
- #subnetting
- #security-plus
- #ejpt
- #networking
2026-08-154 min read
Phishing tests you can run on yourself
Four free drills you can run on your own inbox: hover the link, read the sender domain out loud, spot the urgency tell, and verify invoices by phone. The goal is a two-second pause.
- #phishing
- #security
- #email
- #small-business
2026-08-144 min read
How I built a nail salon website in a day
I shipped a bilingual nail salon site in about a day. The code was the easy part; the photos, prices, and translations were the real work.
- #local-business
- #web-design
- #case-study
2026-08-134 min read
A home office for a broke developer
The gear that fixed my back and focus for around 200 dollars total: what to buy used, what to buy new, and the one popular chair to skip.
- #gear
- #home-office
- #budget
- #remote-work
2026-08-124 min read
The five regex patterns I actually use
Anchors, classes, quantifiers, groups, and one lookahead trick cover almost everything I do with regex. One real example each, from log grepping and form validation.
- #regex
- #dev-tools
- #logs
- #validation
2026-08-114 min read
A Security+ study plan that fits around a job
My real SY0-701 routine around client work: a daily question, flashcards in dead time, weekend labs, and the exam objectives PDF as the only syllabus.
- #security-plus
- #sy0-701
- #study-plan
- #certifications
2026-08-104 min read
A password manager is the best hour you will spend on security
Reused passwords are how small businesses actually lose accounts, not exotic hacks. One hour with a password manager closes the biggest hole, if you set up the recovery plan too.
- #security
- #passwords
- #password-manager
- #small-business
2026-08-094 min read
How fast should a small business site load?
The 3-second phone test, the two things that slow most small business sites down, and how to check yours for free.
- #site-speed
- #local-business
- #performance
2026-08-084 min read
Gear for shooting your own business photos
Salon, groomer, and restaurant owners: your phone is already the camera. Here is the cheap gear that actually fixes bad photos, and the expensive purchase to skip.
- #photography
- #local-business
- #gear
2026-08-074 min read
I write everything in Markdown. Here is why.
I lost notes to three different apps before I switched to plain Markdown files. Here is the ten-minute syntax, how I use it for everything, and where it still falls short.
- #markdown
- #plain-text
- #notes
- #workflow
2026-08-064 min read
The ports and protocols actually worth memorizing
About twenty ports cover almost every Security+ and eJPT question. Here is the short list, the memory hooks that made them stick for me, and why understanding beats rote for the rest.
- #security-plus
- #ejpt
- #networking
- #studying
2026-08-054 min read
The OWASP Top Ten in plain English
All ten OWASP categories in one honest sentence each, with examples that could happen to a real shop on Main Street. No jargon walls.
- #owasp
- #security
- #small-business
- #web-basics
2026-08-044 min read
Set up your Google Business Profile in one afternoon
A Google Business Profile puts your shop on the map faster than any website can. Here is the full setup, categories, hours, photos, and the verification wait, in one afternoon.
- #local-seo
- #google-business-profile
- #small-business
2026-08-034 min read
Coding on your phone: the gear that makes it work
The folding keyboard, phone stand, and power bank that turn Termux on a phone into a workable dev setup. Plus the honest limits of coding on 6 inches of glass.
- #termux
- #gear
- #mobile-coding
2026-08-024 min read
JWTs explained by decoding one
I take a real JWT apart piece by piece: header, payload, signature. What the signature actually proves, and why the payload is readable by anyone with no key at all.
- #jwt
- #security
- #web-dev
- #tutorial
2026-08-014 min read
Lab time vs book time for eJPT
eJPT rewards hands-on enumeration reps, not reading. Here is my Kali VM setup, what one lab session looks like, and the note format that actually survives the exam.
- #ejpt
- #study
- #kali
- #notes
2026-07-314 min read
The padlock proves less than you think
The padlock only proves the connection is encrypted, not that the site is honest. Phishing sites have it too, and your site still needs it anyway.
- #https
- #tls
- #phishing
- #security
2026-07-304 min read
Five signs your business is invisible on Google
A five-minute self-check to find out whether customers can actually find your business on Google. No tools needed, just your phone and an incognito window.
- #local-seo
- #google
- #small-business
2026-07-294 min read
A budget homelab starter kit
A working homelab for around $200: one used mini PC, a cheap managed switch, and the two upgrades that actually matter. Plus the truth about powerline adapters.
- #homelab
- #hardware
- #networking
- #budget
2026-07-284 min read
Hashing vs encryption: the difference that matters
Encryption is reversible and hashing is not, and that one difference decides how passwords should be stored. It also explains why a site that can email you your old password is a problem.
- #security
- #hashing
- #encryption
- #passwords
2026-07-274 min read
How I take notes for technical certs
My Security+ and eJPT note system: plain Markdown files, own-words summaries, an explain-it-to-a-client test, and a weekly pass that turns notes into flashcards.
- #security-plus
- #ejpt
- #study-habits
- #notes
2026-07-264 min read
How I handle client credentials without losing sleep
Client passwords should not live in a text thread. Here is my four-rule system: one vault, no secrets over email or SMS, least access, and a real offboarding step when the project ends.
- #security
- #passwords
- #credentials
- #small-business
2026-07-254 min read
DIY website builders: when they work and when they hurt
Wix, Squarespace, and GoDaddy are the right call for some small businesses and a slow leak for others. Here is how to tell which one you are.
- #website-builders
- #small-business
- #diy
- #local-seo
2026-07-244 min read
Books that actually taught me web development
Five books that actually helped me go from tutorials to paid client work. Two of them are free online, and one whole category is not worth buying.
- #books
- #learning
- #web-development
2026-07-233 min read
Color contrast: the accessibility fix nobody skips twice
Gray text on white fails more visitors than any other design choice. Here is what the WCAG ratios mean in plain terms, and the free tools that catch failures in five minutes.
- #accessibility
- #contrast
- #css
- #web-design
2026-07-224 min read
Flashcards vs practice exams: what actually sticks
Flashcards build recall, practice exams build stamina and judgment. Here is how I split them while studying for Security+ and eJPT, and the streak habit that keeps me consistent.
- #security-plus
- #ejpt
- #flashcards
- #study
2026-07-214 min read
Your business email should be on your own domain
A free gmail address costs a local business trust, invites spoofing, and walks out the door when staff leave. Here is the case for email on your own domain, and what it honestly costs.
- #email
- #security
- #dmarc
- #local-business
2026-07-204 min read
Bilingual websites are an unfair advantage in Utah
Roughly one in five Heber City residents is Latino, and almost no local business website has a real Spanish version. Here is what a one-tap bilingual site actually looks like, with my first client as the example.
- #local-business
- #bilingual
- #heber-city
- #web-design
2026-07-193 min read
Backup gear for a small business that fits in a drawer
The whole backup kit for a one-laptop business: an SSD for the daily copy, two rotating hard drives, a go-bag flash drive, and cloud as the third leg. It all fits in a drawer.
- #backups
- #gear
- #small-business
- #security
2026-07-184 min read
Base64 is not encryption
Base64 reverses in one line with no key. Here is what encoding is actually for, how to decode it on sight, and the ways people get burned treating it as protection.
- #base64
- #encoding
- #security
- #web-dev
2026-07-174 min read
eJPT vs Security+: which one first?
I am studying Security+ SY0-701 and eJPT at the same time. Here is what each one actually proves, what they cost, and how to pick if you can only afford one.
- #security-plus
- #ejpt
- #certifications
- #study
2026-07-164 min read
Backups: the boring thing that saves you
The 3-2-1 backup rule scaled down for a one-location business. What to save, what to skip, and why automation beats memory.
- #backups
- #security
- #small-business
2026-07-154 min read
Before you pay for ads, fix your foundation
Ads multiply whatever they point at, and most local sites are not ready for the clicks. Here is the order I would follow instead: listing, site, reviews, then ads if ever.
- #local-business
- #ads
- #google-business-profile
- #websites
2026-07-042 min read
Infrastructure Scaling Paradigms: How Modern Applications Handle Growth
2026-06-074 min read
Why I sell a $19 ebook instead of running an agency
Every small business gets quoted four thousand dollars for a website they will never edit. Every junior dev buys a course they never finish. The space between those two prices is where I work.
- #indie
- #business
- #writing
2026-05-195 min read
eJPT prep, my enumeration checklist
A practical first pass for any box: what I check before I touch a single exploit. Notes from eJPT prep.
- #writeup
- #ejpt
- #security
- #enumeration
- #lab
2026-05-125 min read
From Coding Temple to my first deployed site
A year of practice, three days of wrestling with Vercel, one live URL.
- #personal
- #career
- #building-in-public
2026-05-105 min read
Notes from "The Complete Developer" (Martin Krause)
Three ideas from the book that changed how I write Next.js apps.
- #books
- #nextjs
- #fullstack
2026-05-083 min read
Why I paid for a bootcamp instead of teaching myself
I almost taught myself to code for free. Here is why I paid for structure instead, and what it actually bought me that the tutorials could not.
- #career
- #personal
- #coding-temple
- #learning
2026-05-065 min read
Building a contact form that doesn't get spammed
Three layers of defense, each cheap, each measurable.
- #web-security
- #building-in-public
- #forms
2026-05-045 min read
The CIA triad, explained simply
Confidentiality, Integrity, Availability. Three letters that decide your security strategy.
- #secplus
- #cybersecurity
- #fundamentals
2026-05-025 min read
Why I'm learning Burp Suite (and you should too)
A web proxy is to a web pentester what a debugger is to a developer.
- #burp
- #cybersecurity
- #tools
- #ejpt
2026-04-305 min read
SQL injection in 3 minutes
The vulnerability that won't die. What it is, why it works, how to stop it.
- #cybersecurity
- #web-security
- #sql
- #owasp
2026-04-285 min read
The nmap commands I keep forgetting
Five flags I've had to look up more than once. Saving them here so I stop.
- #nmap
- #ejpt
- #cybersecurity
- #cheatsheet
2026-04-265 min read
eJPT Day 1: Kali in a VM
Setting up the lab. UTM on Mac, virt-manager on Linux, VirtualBox if you must.
- #ejpt
- #kali
- #cybersecurity
2026-04-252 min read
Why I'm building aldowebsitellc.xyz
A personal site is a forcing function. Here's the plan.
- #meta
- #personal
2026-04-251 min read
Hello, world
First post. Why I'm building this site, and what to expect here.
- #meta

Your domain name is a business asset. Own it.

Your booking page is not a website

What "website care" actually means for $50 a month

What to put on your contact page (and what to cut)

What a site audit actually looks for

What a $400 website actually includes

The website mistakes I see in every small town

The true cost of a Facebook-only business

What actually happens when a small site gets hacked

Seasonal businesses need year-round websites

Two-factor authentication, explained plainly

Real photos beat stock photos every time

What is a YubiKey and should you get one?

Threat, vulnerability, risk: get the vocabulary straight

Updates are a security feature, not an annoyance

One page or five? Choosing the right size website

Security+ study materials worth paying for

One question a day beats a weekend cram

What a security audit looks like for a small site

How to ask for Google reviews without being weird

Laptop stands, monitors, and your neck

UUIDs vs auto-increment IDs

A test-day checklist for your first cert exam

Public wifi: what I actually worry about

How local search decides who shows up

The only keyboard and mouse advice you need

The Pomodoro setup that finally stuck for me

Subnetting without tears

Phishing tests you can run on yourself

How I built a nail salon website in a day

A home office for a broke developer

The five regex patterns I actually use

A Security+ study plan that fits around a job

A password manager is the best hour you will spend on security

How fast should a small business site load?

Gear for shooting your own business photos

I write everything in Markdown. Here is why.

The ports and protocols actually worth memorizing

The OWASP Top Ten in plain English

Set up your Google Business Profile in one afternoon

Coding on your phone: the gear that makes it work

JWTs explained by decoding one

Lab time vs book time for eJPT

The padlock proves less than you think

Five signs your business is invisible on Google

A budget homelab starter kit

Hashing vs encryption: the difference that matters

How I take notes for technical certs

How I handle client credentials without losing sleep

DIY website builders: when they work and when they hurt

Books that actually taught me web development

Color contrast: the accessibility fix nobody skips twice

Flashcards vs practice exams: what actually sticks

Your business email should be on your own domain

Bilingual websites are an unfair advantage in Utah

Backup gear for a small business that fits in a drawer

Base64 is not encryption

eJPT vs Security+: which one first?

Backups: the boring thing that saves you

Before you pay for ads, fix your foundation

Infrastructure Scaling Paradigms: How Modern Applications Handle Growth

Why I sell a $19 ebook instead of running an agency

eJPT prep, my enumeration checklist

From Coding Temple to my first deployed site

Notes from "The Complete Developer" (Martin Krause)

Why I paid for a bootcamp instead of teaching myself

Building a contact form that doesn't get spammed

The CIA triad, explained simply

Why I'm learning Burp Suite (and you should too)

SQL injection in 3 minutes

The nmap commands I keep forgetting

eJPT Day 1: Kali in a VM

Why I'm building aldowebsitellc.xyz

Hello, world