Blog
Notes from those who keep watch.
Technical writing on external observation, security posture and privacy law — what shows up when someone looks at a domain calmly.
20 pieces, newest first
Do patch ao exploit em massa: 24 horas. Sua auditoria mensal não cabe nessa janela.
O wp2shell saiu do patch para exploração em massa em pouco mais de um dia. Se a sua varredura de segurança roda uma vez por mês, ela pode chegar 29 dias depois do atacante. Veja por que a janela encolheu e o que substitui o modelo de "varredura periódica".
Você cuida de 40 sites WordPress. O wp2shell custou quantas horas do seu fim de semana?
Quando um exploit público de WordPress aparece numa sexta-feira à noite, a agência com inventário responde em minutos e a agência sem inventário perde o fim de semana. Veja a conta em horas, o roteiro de triagem e como transformar isso em serviço cobrável.
Melhores ferramentas de monitoramento de site em 2026 (comparativo honesto)
Comparamos as principais ferramentas de monitoramento de site — UptimeRobot, Better Stack, Pingdom e Sentinela — por preço, recursos, idioma e caso de uso. Sem "somos os melhores": qual serve pra cada situação.
Site fora do ar? O que fazer agora (e como não passar por isso de novo)
Seu site caiu? Veja um diagnóstico rápido pra descobrir a causa (hosting, DNS, SSL, ataque ou erro de deploy), como confirmar se é só com você — e o que fazer pra nunca mais descobrir uma queda pelo cliente.
Receita recorrente para agências: como cobrar por monitoramento e segurança
A maior alavanca de uma agência não é vender mais projetos — é criar receita recorrente. Veja como transformar monitoramento e segurança em um serviço mensal white-label, quanto cobrar e qual a margem real.
Site lento? O que são Core Web Vitals e como melhorar de verdade
Site lento derruba conversão e ranqueamento. Entenda os Core Web Vitals (LCP, INP, CLS), como o Google mede a velocidade do seu site e o passo a passo pra melhorar — sem achismo, com PageSpeed e Lighthouse.
How we compute risk in $/year (ALE) — formula, table and worked example
The A–F grade answers "how is my posture?". ALE answers "how much does this cost per year?". We show the formula, the calibrated table and a worked numeric example — with the inputs you need to fill in to switch it on.
ASM (Attack Surface Management): why you should look at your site like an attacker
ASM is the discipline that maps everything your company exposes to the internet — known or forgotten — and measures the risk before an attacker does. What it is, what it isn't, and where to start.
Annual pentest vs continuous auditing: which one protects you more?
A pentest is a snapshot. Continuous auditing is a video feed. Here's when each makes sense, what they cost, and why most companies need both — in different proportions.
Secure WordPress in 2026: a checklist of what an attacker sees
Most "secure WordPress" guides end up recommending the same firewall plugin. This one looks at what an attacker actually sees — before they do.
Subdomain takeover: the forgotten subdomain that becomes a front door
The promo.yourcompany.com you turned off in 2022 still points to Heroku. Today, anyone can grab it back — and run phishing under your domain.
How much does one hour of downtime really cost (with a calculator)
Downtime isn't just "some lost sales". The real bill includes wasted CAC, SEO penalty, reputation, and support load. Here's how to compute it in dollars.
Expired SSL certificate: what happens and how to avoid it
An expired SSL certificate takes your site down without warning. Why it happens, what the user sees, and why you only find out when someone calls to complain.
Why LGPD is not just a privacy page
Most sites treat LGPD as a footer link. Complying with the law involves a consent banner, a legal basis per purpose, the DPO contact and tracking that respects opt-in.
How to tell if your site was hacked (and what to do before Google punishes you)
Most hacked sites only find out when Google flags them as unsafe and traffic collapses. The signs show up earlier — if you know where to look.
SPF, DKIM and DMARC: why your emails land in spam
Three acronyms that decide whether your email reaches the inbox or spam. What each one does, how to configure it, and why most companies still get it wrong.
Is free site monitoring worth it? An honest comparison
UptimeRobot, Better Stack, StatusCake, Pingdom — where the free tier is enough and where it costs you more than it saves.
5 HTTP security headers your site probably doesn't have
Security headers are the cheapest and most underused defense on the web. Five you can turn on today without touching application code.
High uptime is not the same as availability
Your monitoring can report 99.99% and your customer can be furious. The difference is in what you monitor, how often, and what you consider "up".
Nothing in this category yet.
No newsletter
Instead of subscribing to a list, subscribe to the alert.
We do not have a newsletter. What we send is a heads-up about your domain — when it goes down, when the certificate is about to expire, when a header goes missing. One monitor is free, forever.