Web development
HTML, CSS, JavaScript, performance, accessibility and web application security.
Accessible and secure HTML forms: validation and good practice
How to build HTML forms everyone can use: labels, input types, autocomplete, error messages, validation in the browser and on the server, and spam defence.
CMS or static site: how to choose for your project
Traditional CMS, headless or static generator: a practical comparison of editing, maintenance, security and cost to choose the right site architecture.
Content Security Policy: set it up without breaking your site
How Content Security Policy works: key directives, why to avoid unsafe-inline, nonces, hashes and Report-Only mode to roll it out step by step.
Core Web Vitals explained: LCP, INP and CLS without jargon
What LCP, INP and CLS measure, the recommended thresholds, how to read lab and field data and which changes genuinely improve each of the three metrics.
CORS explained: why the browser is blocking your request
Same-origin policy, simple and preflight requests, Access-Control headers and credentials: how CORS works and how to configure it securely on the server.
CSS container queries: truly responsive components
Container queries adapt a component to its container's space rather than the window: syntax, cqi units and when to prefer them over media queries.
CSS variables (custom properties): a practical guide
How CSS variables work: declaration, inheritance, fallback values, light and dark themes and updating them from JavaScript, with ready-to-use examples.
CSS Grid or Flexbox: when to use each one
Practical differences between CSS Grid and Flexbox: one- and two-dimensional layouts, code examples and simple criteria for picking the right tool.
HTTP caching: Cache-Control, ETag and asset versioning
How HTTP caching works: Cache-Control, validation with ETag, hashed file names and a safe caching strategy for HTML, CSS, JavaScript and APIs.
HTTP security headers every website should have
HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and clickjacking protection: what each security header does and how to set it.
ES modules in JavaScript: import, export and browser use
How ES modules work: named and default exports, dynamic import, script type module, import maps and the differences from CommonJS, with examples.
Fetch and async/await in JavaScript: errors, timeouts, retries
Using fetch with async/await properly: check response.ok, handle network errors and timeouts with AbortController, run requests in parallel, retry.
Images for the web: formats, sizes and lazy loading
How to choose between JPEG, PNG, WebP, AVIF and SVG, serve the right size with srcset and sizes, and lazy load images without slowing the page.
Preventing cross-site scripting (XSS): a developer's guide
What cross-site scripting is, why it comes from untrusted data in the wrong context, and which encoding and sanitisation practices really prevent it.
Designing a clear REST API: resources, methods and status codes
How to design an understandable REST API: resource-based URLs, HTTP methods, status codes, consistent errors, pagination, versioning and security.
Loading JavaScript and CSS: defer, async and blocking resources
Why scripts and CSS can block a page and how to use defer, async, preload and preconnect so visitors see your content sooner on every page load.
Secure cookies: Secure, HttpOnly and SameSite explained
The attributes that protect session cookies: Secure, HttpOnly, SameSite, Domain, Path, expiry and the __Host- prefix, with a ready configuration.
Semantic HTML: why it matters and how to use it well
What semantic HTML is, which elements to use instead of generic divs, and why it improves accessibility, SEO and code maintenance, with practical examples.
Static hosting and CDNs: what a developer needs to know
Atomic deploys, previews, redirects and rewrites, 404 pages, environment variables and edge functions: how to work well with static hosting and CDNs.
Static sites: advantages, limits and when to choose them
What a build-time static site is, why it is fast and secure, what its real limits are and how to handle forms, search and content that keeps changing.
Structured data with Schema.org and JSON-LD: a practical guide
What structured data is, why JSON-LD is the handiest format, examples for articles, organisations and breadcrumbs, and how to validate it properly.
Technical SEO for developers: what to check in your code
Robots.txt, noindex, canonical, sitemaps, status codes, redirects, hreflang and JavaScript rendering: the technical SEO checks that fall to developers.
Web accessibility: the basics every developer should know
WCAG principles in practice: contrast, keyboard navigation, visible focus, alternative text, zoom and reduced motion, plus checks to run on your site.
Web fonts without slowing your site: WOFF2, font-display, subsets
How to load web fonts efficiently: WOFF2, font-display, preload, subsetting with unicode-range, variable fonts and fallbacks tuned to cut layout shift.
ARIA: when it really helps and when it makes things worse
ARIA roles, states and properties with examples: the first rule of ARIA, aria-label, aria-expanded, live regions and mistakes that break accessibility.