Field Notes.
What actually happens.
From the trenches
Real problems. Real solutions. No theory, no fluff. These are tactical notes from actual client work and implementation projects – the stuff that breaks, the approaches that work, and the conventional wisdom that needs challenging. If you want thought leadership, look elsewhere. If you want solutions that actually ship, you're in the right place.
Blocking /wp-admin/ With a WAF Rule Is Not a Security Strategy
Blocking /wp-admin/ with a WAF rule also blocks admin-ajax.php, which plugins use for legitimate front-end requests. It leaves wp-login.php — the actual attack target — fully exposed. WAF rules are for traffic filtering. Zero Trust is for identity-based access control. They’re complementary tools, not alternatives. Using one to do the other’s job breaks both layers.
Read field noteAuthentik Forward Auth on Standalone NGINX Is a Minefield Nobody Maps
What if the Authentik docs for NGINX forward auth are fundamentally incomplete for real-world deployments?
Read field noteYour Page Builder’s CSS Shortcut Is a Vendor Lock-In Trap
What if adopting your builder’s recommended CSS approach is the thing that makes your components worthless outside of it?
Read field noteYou Replaced Your Security Gate With a Different Gate and Called It Progress
What if switching from Cloudflare Access to Tailscale for WordPress login protection just moves the perimeter instead of improving it?
Read field noteYour Page Builder Is Getting You Banned From Your Own API
What if the tool you trust to build your site is also the one triggering your security stack to lock you out?
Read field noteAll-in-One Security Plugins Are a Single Point of Failure
Question: Does your WordPress security plugin actually weaken your security posture?
Read field noteMarketing Automation Isn’t CRM (No Matter What the Sales Page Says)
Marketing automation isn’t CRM, no matter what FluentCRM, SureContact, or ActiveCampaign call themselves. The mislabeling leads businesses to choose tools based on vendor positioning rather than actual requirements. Here’s how to map what you genuinely need before evaluating what’s convenient to implement.
Read field noteYour llms.txt File is Theater: Why Security Blocks the Bots You’re Inviting
What if implementing llms.txt without monitoring means you’re signaling to an empty room?
Read field noteWhen Your Email Security Works Too Well: A DMARC Investigation
A DMARC report arrives showing emails from your domain being sent through an unfamiliar IP address—but with valid authentication signatures. Is it a security breach or normal email behavior? This field note documents a real investigation from alarm to resolution, explaining why email authentication matters and what happens when forwarding, bounces, and cryptographic signatures collide in the wild.
Read field noteHow to Spot a Cryptocurrency Phishing Scam (Anatomy of a Ledger Impersonation)
A sophisticated phishing email targeting crypto wallet users landed in my inbox today. Here's how to dissect these scams before they dissect your wallet—with a real-world example that checks almost every box on the fraud checklist.
Read field note