Web posts
Everything in the journal filed under web.
2026
An eleven kilobyte home page: the case for static sites
What pre rendering buys you, what it costs, and the build pipeline, page weight budget and caching rules that keep a static site small and boring.
Two accessibility mistakes almost every site makes
Heading levels chosen to match the layout, and an aria-label that hides the visible text. Both break keyboard and voice users, and both are cheap to fix.
2025
Self hosted fonts, privacy law and one request less
A hosted font stylesheet hands every visitor IP address to another company before your page renders. Self hosting removes the transfer and a round trip.
What the responsive images audit is really telling you
The audit compares the file you sent with the pixels the device needs, which is layout width times pixel ratio. Here is how to read it and what to change.
A streamed response that never closes hangs for a hundred seconds
Tokens arrive, the answer is complete, and the request stays open until a proxy kills it. How to close a stream and test it through the real domain.
How a misconfigured root exposes your .env to the internet
When the web root points at the project directory and the server falls back to any file that exists, your .env and .git are one plain request away.
A strict content security policy with an inline first paint
Inlining critical CSS and a small script is good for first paint and illegal under a strict CSP. Hashes fix it, if you compute them at the right moment.
Your entrance animation is delaying your largest paint
An element that starts at opacity zero is never painted, so a fade in pushes Largest Contentful Paint out by the delay plus part of the animation.
When PNG beats AVIF: images made of hard dots
Lossy codecs are built for photographs. On a halftone screen an indexed PNG beat AVIF at every width, and the only way to know is to measure both.
Subset the fonts, match the fallback metrics, stop the layout shift
A page that renders 127 characters should not download 889 glyphs. Subset at build time, metric match the fallback, and the font swap stops moving things.
The Turkish uppercase trap: i, I and the dotted İ in code
In Turkish, i uppercases to İ and I lowercases to ı. Case folding, CSS text-transform and database collations all get this wrong by default.
2024
Justified Turkish text without a hyphenation dictionary
Chrome ships no Turkish hyphenation dictionary, so justified Turkish opens rivers of white space. Insert soft hyphens at build time instead.
When your control panel and your nginx file disagree
Hosting panels re-render the vhost file from their own template, so hand edits vanish at the next certificate renewal. Where to put the change instead.
The nginx rule that quietly drops your security headers
In nginx, add_header is only inherited when the child level defines none of its own. One cache header in a location removes HSTS and nosniff from it.
Why redirecting every missing page to the home page costs you in search
A blanket redirect from missing pages to the home page creates soft 404s, wastes crawl budget and hides broken links. Serve a real 404 instead.
A cached 301 can break your site after a redesign
Browsers keep permanent redirects for good. If a new site reverses an old 301, returning visitors land in a redirect loop. Here is how to find it and fix it.