Join my community / free newsletter — sign up here

form-security

By Greg Nowak , 14 June, 2026

Cloudflare Turnstile on Lead Forms: What the Widget Can’t Do

Cloudflare Turnstile protects lead forms only when server-side validation, token timing, hostname rules, analytics, and secret rotation work together.

Tags

form-security

Review Greg on Google

Written recommendations from Trafik og Veje, Aarhus Municipality (2011) and AgroTech (2010) — read them on LinkedIn.

WordPress 7.1 Forces the Editor Into an iframe—Test Your Custom Blocks

2026-08-15

WordPress 7.1 removes the non-iframe editor fallback. Learn how to audit custom blocks, test real workflows and fix compatibility issues before launch.

GitHub will stop sending jobs to stale self-hosted runners

2026-08-14

GitHub starts enforcing runner versions on August 24, 2026. Audit and upgrade self-hosted runners before builds and deployments start stalling.

Your AI Agent Has Shell Access. What Can It Reach?

2026-08-13

A practical guide to mapping what a shell-enabled AI agent can reach, then containing its access to files, credentials, networks, tools, and high-impact actions.

Cloudflare Changed DoH JSON. What Else Is Parsing DNS as Text?

2026-08-12

Cloudflare’s DoH JSON change exposes brittle DNS parsing. Find affected scripts, test both formats, and choose a safer integration contract.

Your Website Can Answer Questions Now. Should It?

2026-08-11

NLWeb makes conversational website search practical to deploy. The real question is whether your content, users and team are ready to support it.

AI Search Finally Has Reports. Now Connect Visibility to Revenue

2026-08-11

Google and Bing now expose first-party AI search data. The real task is connecting citations and impressions to analytics, CRM outcomes, and revenue.

The Bot Passed Your CAPTCHA. What Did It Do Next?

2026-08-11

Passing a challenge is only one signal. Session analysis, server-side validation and endpoint-specific controls help reduce bot abuse without blocking customers.

WordPress 7.1 Moves Image Work Into the Browser—Test Every Media Hook

2026-08-11

WordPress 7.1 shifts image processing into supported browsers. Here is what to test across hooks, CDNs, formats, security headers, and fallbacks.

Prompt Caches Have Write Costs Now—Audit What Your Workflow Reuses

2026-08-10

GPT-5.6 makes cache writes billable. See how to spot wasted writes, stabilise prompt prefixes, place breakpoints and measure whether caching pays.

The AI Crawler in Your Logs May Be Wearing a Borrowed Name

2026-08-09

A User-Agent is a claim, not proof. See how to verify AI crawler traffic before it shapes reporting, robots.txt decisions, or WAF exceptions.