Notes on production infrastructure, incidents, and things I learned the hard way.
A shared-hosting WordPress took a paid campaign burst on the wall. Two Cloudflare layers, a silently challenged preloader, and a language subpath that was cold every time it mattered. The diagnosis before the rebuild.
A webhook-based deploy pipeline that proves what commit landed, not just that curl returned 200. Uses HTTP 423 for stale-lock detection and a version.txt for SHA verification.
Three Firebase projects, custom claims for offline RBAC, and a three-tier backup strategy for a multi-tenant PWA.
Database bloat, unrestrained images, plugin overload, missing caching, wrong-sized hosting. What each costs you, and what fixing them buys back.
How I recovered a compromised WordPress site during a critical campaign launch with only 4 hours to spare.