Insights
Things we learned the hard way
Write-ups of problems we actually hit building and running our own systems, with the real numbers. No listicles, and nothing we have not measured.
- 4 minute read
Your CSP probably breaks Google Analytics, and only sometimes
We shipped a hash-based CSP, tested every route, and found gtag firing image requests on 2 of 29 pages. A missing img-src entry would have lost analytics intermittently and silently.
- Security
- Analytics
- CSP
- 3 minute read
nginx add_header silently drops every inherited header
The nginx directive inheritance rule that removes your security headers from exactly the paths you were least likely to check, and the snippet pattern that avoids it.
- nginx
- Security
- Operations
- 4 minute read
Google ignores your sitemap lastmod, and that is your fault
Why a generated lastmod is usually worse than no lastmod, and how to derive an honest one from the commit that last touched each page.
- SEO
- Build tooling
- 5 minute read
What a prerendered React site actually costs in bytes
React 19 and React Router are about 116 kB gzipped before your first component. Here is what that buys, what it costs, and when it stops mattering.
- React
- Performance
- SEO
Got a problem worth writing up?
Most of these started as something going wrong on a client system. If something on yours is not behaving, that is the conversation we enjoy most.
A reply from a developer. Not a sales pipeline. The person who reads your message is the person who would do the work.
An honest answer on fit. If an off-the-shelf product solves your problem better than a custom build, we will tell you which one.
No obligation. A first conversation costs nothing and commits you to nothing. Discovery output is yours either way.