DEV Community: Mecanik Dev

Generative Engine Optimization: Future of SEO in 2026

Mecanik1337 — Sun, 06 Sep 2026 06:00:00 +0000

Generative Engine Optimization is the next evolution of digital search strategy. As users migrate from keyword-based search queries to conversational AI interfaces, business owners must adapt how their platforms present information. AI search engines—such as Perplexity, ChatGPT Search, and Google Gemini—synthesise answers directly from raw web index data rather than displaying a standard list of links. As a result, websites that fail to feed Large Language Models (LLMs) risk losing search traffic. This guide explains how AI crawlers parse content, what variables dictate AI citations, and how to structure your platform to remain visible in 2026.

Research Context: Generative Engine Optimization (GEO) was first formalized in a joint study by researchers at Princeton University, Georgia Tech, the Allen Institute for AI (AI2), and IIT Delhi. Their benchmark, GEO-bench, demonstrated that content optimisations like adding data, citations, and expert opinions boost visibility in AI search results by up to 40%.

Key Takeaways:

Informational Density: AI models look for specific, concise answers that directly address user queries.

Technical Schemas: Format code to expose metadata, schema parameters, and semantic graphs.

Authoritative Citations: Secure high-quality external mentions so search algorithms trust your data.

Conversational Structure: Structure articles with clear markdown headings, concise lists, and technical facts.

Defining Generative Engine Optimization

Traditional Search Engine Optimization (SEO) focuses on keyword density, backlinks, and page speeds. GEO, by contrast, targets how LLMs retrieve, synthesise, and cite content.

When a user submits a conversational query, the AI engine performs an internal search. It retrieves relevant text snippets, synthesises a paragraph answer, and appends citations. As a result, the primary goal of GEO is to ensure the retrieval process selects your content as a reference source.

To achieve this, websites must satisfy retrieval-augmented generation (RAG) pipelines. LLMs do not query the web dynamically using general phrases; instead, they use search APIs to find highly descriptive text segments. Structuring your pages into distinct, fact-rich sections therefore increases the likelihood that a scraper selects your site.

Below is an overview of how RAG pipelines retrieve and ground information before serving it to users:

{{< cta-button url="/services/seo-audit/" text="Book an SEO Audit" >}}

How AI Crawlers Analyse Your Platform

AI search systems employ specialised crawlers to catalogue web pages. Understanding these user-agents is the first step in establishing search visibility.

Rather than letting any bot scrape your assets, you should manage them via your configuration files. For instance, OAI-SearchBot indexes files specifically for ChatGPT Search, whereas PerplexityBot handles conversational queries on Perplexity. Blocking these user-agents completely eliminates your site from conversational indexes. Conversely, allowing access while blocking generic training scrapers ensures your data is used for citations, not just model tuning.

AI crawlers also look for clean HTML structure. Bloated JavaScript code, unformatted tables, and complex navigation structures slow down indexing speed. Building clean, lightweight frontend platforms ensures crawlers can catalogue your articles quickly. If you are planning a rebuild, learn more on our website development services page.

The Core Pillars of GEO Content Strategy

Ranking in conversational search engines requires a shift from keyword repetition to factual authority. Generally, AI algorithms evaluate content based on three primary factors:

To execute this strategy successfully, content creators must collaborate with technical engineering teams. While writers refine factual density, developers must maintain metadata health and server speed. The result is a fast, highly structured repository that conversational search engines prioritise.

Factual Density and Precision

LLMs prefer dense, high-utility text. Instead of writing general introductory paragraphs, begin each section with direct answers. Include specific data, definitions, and technical parameters. Consequently, the search model can extract the exact answer it needs without parsing irrelevant fillers.

Semantic Context and Schema Markup

Traditional search engines read keywords; AI engines interpret context. Additionally, adding custom structured data helps the model understand relationships between entities. To learn how to construct valid data graphs, read our guide on structured data and schema markup.

Citations and Trusted References

AI engines build trust by referencing authoritative external entities. Including links to official documentation, academic papers, or industry organisations signals to the LLM that your content is verified. Google's guidelines on quality content validate this process; you can read them in the official Google Search Quality Evaluator Guidelines.

Step-by-Step GEO Optimisation Workflow

To optimise your existing articles, follow this structured process:

Conduct a Search Intent Audit: Search for your primary keyphrase in ChatGPT Search and Perplexity. Analyse which sites are currently cited.
Reformat Headers: Change vague titles to direct, question-based headings (e.g., replace "CMS Options" with "How to Choose a Headless CMS").
Write Answer Summaries: Directly below each heading, write a 2-3 sentence summary that contains the target keyword.
Insert Structured Data: Add Schema.json script blocks matching your FAQ structure.
Verify Page Load Speeds: Ensure near-instant loading times so crawlers do not timeout during live indexing. When performing this checklist, keep in mind that search bots prioritise edge-cached data. Therefore, placing your final compiled content assets on global content delivery networks (CDNs) drastically reduces retrieval errors.

A GEO-Ready Content Checklist

Before you publish or refresh a page, run it against the checklist below. Each item maps to a signal that retrieval pipelines weigh when they decide which passage to quote. Treat it as a pre-flight review rather than a one-off project.

Checklist item	What good looks like	How to verify
Answer-first paragraphs	The opening one or two sentences under each heading answer that heading directly	Read only the first line of each section; it should stand alone
Self-contained passages	A section makes sense without the paragraph before it	Copy one section into a blank document and check it still reads clearly
Named entities	People, products, and standards are spelled out, not implied by "it" or "this"	Search the draft for vague pronouns that open a sentence
Verifiable facts	Every claim carries a date, a figure, or a named source	Confirm each statistic links to or names its origin
Valid structured data	Article, FAQPage, and Organization schema all validate	Google Rich Results Test and the Schema.org validator
Crawlable HTML	Core content sits in the server-rendered HTML, not in client-side JavaScript	View source (Ctrl+U) and search for your headline text
Bot access	AI search user-agents are permitted in robots.txt	Fetch `/robots.txt` and confirm the agents are not disallowed

Work top to bottom. The first four items decide whether a model can lift a clean quote from your page; the last three decide whether it can reach and parse the page at all.

Concrete Examples: Markup That Earns Citations

Allow the right crawlers

AI search engines use one set of user-agents for live retrieval and another for model training. You usually want the retrieval bots in, and you can decide separately about the training bots. A minimal robots.txt that welcomes search citations looks like this:

# Allow AI search retrieval
User-agent: OAI-SearchBot        # ChatGPT Search
Allow: /
User-agent: PerplexityBot        # Perplexity
Allow: /
User-agent: Google-Extended      # Gemini grounding
Allow: /

# Optional: block a training-only scraper
User-agent: GPTBot
Disallow: /

Check each vendor's published documentation before copying agent names, as they change occasionally. Blocking a retrieval agent removes you from that engine's citations entirely, so edit these lines deliberately.

Publish an llms.txt map

An emerging convention, llms.txt, gives models a plain-Markdown map of your most important URLs. It lives at the site root, next to robots.txt:

# Mecanik
> UK software agency: web development, SEO, and AI integration.

## Core pages
- [Website development](https://mecanik.dev/en/services/website-development/): Frontend and platform builds.
- [SEO audit](https://mecanik.dev/en/services/seo-audit/): Technical and content review.

## Guides
- [Structured data and schema](https://mecanik.dev/en/posts/structured-data-schema-markup-for-seo/): How to build valid graphs.

Expose entities with JSON-LD

Structured data tells a model what your page is about in a format it does not have to infer. A compact Organization block, placed once site-wide, anchors your brand as a recognised entity:

{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "Mecanik",
  "url": "https://mecanik.dev/",
  "sameAs": [
    "https://github.com/Mecanik",
    "https://www.linkedin.com/company/mecanik"
  ],
  "knowsAbout": ["Web development", "Technical SEO", "AI integration"]
}

Rewrite for retrieval

The single highest-return edit is swapping a warm-up introduction for an answer-first sentence. The contrast below shows the same fact written two ways:

Before: There are a lot of factors to weigh when you think about how
often a website should be audited for search performance, and honestly
it depends on your particular situation.

After: Audit a website for search performance at least quarterly.
High-change sites — news, e-commerce, SaaS — benefit from a monthly review.

The second version is quotable on its own, which is exactly what a model looks for when it assembles a cited answer.

How to Measure GEO Visibility

Traditional rank tracking does not tell you whether an AI engine cited you, so measurement needs a different toolkit. Combine manual prompt testing, server-side evidence, and referral analytics.

Prompt testing. Ask the engines the questions your customers ask. Run a fixed list of prompts through ChatGPT Search, Perplexity, and Gemini each week, and record whether your domain appears as a citation and in what position. Because model outputs vary, repeat every prompt two or three times rather than trusting a single response.

Server logs and crawler analytics. Your access logs show exactly which AI user-agents fetched which URLs and how often. If you sit behind Cloudflare, the dashboard reports verified-bot traffic and offers an AI Audit view that separates retrieval crawlers from training scrapers. A page that never appears in these logs cannot be cited, which makes crawler access the first thing to check when visibility stalls.

Referral traffic. When someone clicks through from an AI answer, the visit usually arrives with a referrer such as chatgpt.com, perplexity.ai, or gemini.google.com. Build a segment in Google Analytics 4, or in your privacy-first analytics, that isolates these sources so you can watch the trend over time.

Dedicated visibility trackers. A new category of tools monitors AI answer share the way rank trackers monitor Google. Options include Otterly.AI, Peec AI, and Profound, alongside AI-visibility features now bolted onto established suites such as Ahrefs and Semrush. They automate the prompt testing above and chart your share of voice against competitors.

Measurement layer	Tool examples	What it tells you
Manual prompts	ChatGPT, Perplexity, Gemini	Whether and where you are cited today
Crawler access	Server logs, Cloudflare AI Audit	Which bots reached which pages
Referrals	Google Analytics 4	Visitors arriving from AI answers
Share of voice	Otterly.AI, Peec AI, Profound	Citation share against competitors over time

Track all four layers together. A rise in crawler access with no matching referrals, for example, tells you the bots can read the page but the answers are not persuading users to click.

Common GEO Mistakes to Avoid

Content that only exists after JavaScript runs. If your headline and body text appear only once a client-side framework hydrates, many retrieval crawlers see an empty page. Server-render or pre-render the content that matters.
Blocking the wrong bots. Teams often add a blanket Disallow to stop AI scraping and accidentally remove themselves from ChatGPT and Perplexity citations. Separate retrieval agents from training agents before you block anything.
Burying the answer. A 150-word preamble ahead of the actual point gives a model nothing clean to quote. Lead with the conclusion, then explain it.
Unverifiable claims. "Studies show" with no name or date reads as low-trust to readers and models alike. Attribute every figure you cite.
Schema that contradicts the page. FAQ markup listing questions that are not visible on the page can trigger a manual action and erodes trust. Keep your structured data and visible content in sync.
Chasing volume over authority. Publishing thin pages at scale dilutes the factual density that earns citations. One dense, well-sourced page tends to outperform ten shallow ones.

Key Takeaways

Generative Engine Optimization targets LLM retrieval networks rather than traditional link indexes.
Allow access to verified search crawlers like OAI-SearchBot and PerplexityBot in your configuration.
Structure content with clear markdown headings and dense, fact-based answers to feed RAG systems.
Leverage custom JSON-LD schema blocks to define entity relationships for AI crawlers.
Back up statements with authoritative outbound links to build source credibility.

Frequently Asked Questions

What is generative engine optimisation?
Generative engine optimisation (GEO) represents the practice of optimising web pages so AI-driven search engines select, cite, and reference your brand. Unlike traditional search networks that index static URLs, generative platforms use large language models to synthesise custom text outputs. Therefore, content creators must write high-density, authoritative copy that retrieval-augmented generation (RAG) pipelines can easily extract as inline citations.

How does GEO differ from traditional SEO?
Traditional SEO focuses on backlinks, keyword density, and search engine results page (SERP) positions. In contrast, however, GEO focuses on content formatting, factual density, and semantic clarity for LLMs. While traditional methods rank entire web pages for keyword queries, generative optimisation targets individual text blocks to feed conversational models during live retrieval.

Will AI search engines replace traditional SEO?
Conversational search is rapidly replacing keyword-based search for research, evaluation, and informational queries. However, traditional search continues to drive transactional and localised user intent. Consequently, businesses should implement a hybrid strategy that combines technical SEO with modern generative optimisations to capture both audiences.

What content changes yield the highest visibility boost in GEO?
Adding authoritative statistics, verified data tables, specific expert citations, and direct definitions yields the highest visibility boost. According to joint research by Princeton and Georgia Tech, incorporating statistical data and references can increase an article's citation score by up to forty percent.

How do LLM scrapers handle copyright and citations?
LLM scrapers crawl public websites and synthesise summaries under fair-use frameworks, but they cite the original URL to attribute sources. Consequently, maintaining clear schema markup and readable content structures ensures that your URL is selected as the primary source when these summaries are constructed.

Claude Fable 5 and Opus 4.8: The Complete 2026 Guide

Mecanik1337 — Sat, 05 Sep 2026 18:00:00 +0000

Claude Fable 5 has quickly become the center of discussion among software engineering teams since its early June 2026 launch. The model is Anthropic's most powerful reasoning engine to date. Anthropic designed the model specifically to handle complex coding and autonomous agentic workflows.

This guide covers everything you need to know about Claude Fable 5, the incremental updates in Claude Opus 4.8, the recent regulatory suspension, and how these models change software development.

TL;DR

Claude Fable 5 represents Anthropic's new Mythos-class architecture, built for autonomous coding and long-horizon tasks.
The model features a massive one million token context window combined with a record-breaking 128k output limit.
Public access to Fable 5 is temporarily suspended across platforms due to a U.S. government export directive.
Claude Opus 4.8 remains available, offering improved judgment, better tool-calling, and four times fewer coding flaws than prior versions.

What is Claude Fable 5?

Anthropic introduced Claude Fable 5 as a frontier intelligence model. It belongs to their new Mythos-class line of architectures. By contrast, unlike previous models that focused on chat, Fable 5 targets agentic execution from the ground up. It excels at writing codebases, debugging microservices, and managing multi-step reasoning plans.

Specifically, the most notable hardware capability is the memory architecture. It features a one million token context window. In addition, Fable 5 supports a 128k output token limit. This allows developers to generate entire application directories in a single request.

However, this raw capability comes with strict safety classifiers. Because of its autonomous execution strength, Anthropic integrated active guardrails to block unauthorized cyber operations. This balance makes Fable 5 highly secure, though it sometimes declines complex edge-case tasks.

The Performance Enhancements in Claude Opus 4.8

Although Fable 5 is a massive architectural leap, Claude Opus 4.8 serves as the new standard for enterprise workloads. Released in late May 2026, Opus 4.8 is a refined version of the earlier Opus 4.7. It focuses on reliability, honesty, and raw coding correctness.

Indeed, the main upgrade is code reliability because the model is four times less likely to suggest code with subtle logical flaws or security vulnerabilities. Developers get cleaner code recommendations, especially when working on complex C++ or Python backends.

Furthermore, Opus 4.8 also introduces new system controls. Developers can adjust the effort level of the model during reasoning tasks. It also fully supports mid-conversation system messages. This feature makes it easier to update system prompts during long-running API sessions.

Why Was Claude Fable 5 Suspended?

Consequently, shortly after its release, regulatory authorities suspended Fable 5 across major platforms. This sudden change surprised many developers, but the reasons are purely regulatory. Specifically, the suspension stems from a U.S. government export control directive.

Since the model has high reasoning capabilities, authorities classified it as a dual-use technology. This means threat actors could theoretically use it for offensive cybersecurity operations. Consequently, Anthropic must restrict its usage until they meet additional compliance standards. Developers can find more details about Anthropic's general research goals and model guidelines on the official Anthropic website.

Anthropic is currently working to restore access for verified enterprise teams. In the meantime, they offer a sister model called Mythos 5. This model lacks the standard safety classifiers and only exists in a secure, private release called Project Glasswing. This private build is accessible only to verified cyberdefenders and infrastructure providers.

Evaluating the Developer Experience: Claude vs. OpenAI

To understand the positioning of these models, we must compare them to other market leaders. For example, OpenAI focuses on providing general-purpose models that handle a wide variety of tasks. Their focus remains on user experience and fast response times for daily tools.

By contrast, Anthropic prioritizes strict safety alignment and depth of reasoning. With Fable 5, they aimed to deliver a system capable of editing software repositories autonomously. This goal requires the model to understand the relationships between different files and classes. For teams that want to set up Claude AI for code review, the reasoning model's capability to understand complex environments is extremely clear.

Consequently, Claude Fable 5 performs much better than ChatGPT on complex programming tasks. It can refactor code across multiple files without losing track of dependencies. However, the regulatory suspension of Claude Fable 5 has temporarily limited its use, forcing developers to look for alternative solutions.

Practical Application: Building with Opus 4.8

For developers who cannot access Fable 5, Claude Opus 4.8 offers the best alternative. Integrating this model into your daily workflow is straightforward, especially when using modern development platforms like GitHub for repository management.

To get the most out of Opus 4.8, you should use the new effort controls. These settings allow you to specify how much time the model should spend reasoning about a prompt. For simple syntax checks, you can lower the effort to save API credits. Conversely, for complex architectural design, you should set the effort to maximum. This helps teams streamline their workflows for AI software development.

In addition, the support for mid-conversation system messages is highly useful. This feature allows you to update the instructions of an agent without restarting the entire conversation session. Consequently, you can build more interactive and dynamic developer agents that adapt to changing contexts.

Key Takeaways

Claude Fable 5 is a Mythos-class reasoning model designed for complex, autonomous programming tasks.
It features a one million token context window and a 128k output limit for large codebase generation.
A U.S. government export directive led to the temporary suspension of public access to Fable 5.
Claude Opus 4.8 remains fully active, providing reliable code and advanced controls.

Frequently Asked Questions

What is Claude Fable 5?
Claude Fable 5 is a high-reasoning AI model from Anthropic launched in June 2026. It is designed for autonomous coding and complex agentic tasks. It features a one million token context window and a 128k output limit.

Why is Claude Fable 5 currently suspended?
The model was suspended due to a U.S. government export control directive. Because of its advanced reasoning capabilities, authorities classified it as a dual-use technology that requires additional compliance checks before global release.

What are the main upgrades in Claude Opus 4.8?
Claude Opus 4.8 offers refined coding accuracy and is four times less likely to introduce flaws. It also adds new effort controls and support for mid-conversation system messages.

What is the difference between Fable 5 and Mythos 5?
Fable 5 is the public version that includes strict safety classifiers. Mythos 5 shares the same reasoning capabilities but has no safety classifiers. It is restricted to cyberdefenders under Project Glasswing.

Build a Cloudflare Workers API: Serverless Guide 2026

Mecanik1337 — Sat, 05 Sep 2026 06:00:00 +0000

Cloudflare Workers let you run backend code at the edge, close to your users, without managing servers. For APIs, that combination of near-zero cold starts, global distribution, and tightly integrated storage makes Workers a compelling platform in 2026. This guide explains how a Cloudflare Workers API is structured and what makes it different from a traditional backend.

TL;DR

Cloudflare Workers run your code on Cloudflare's global network at the edge, so requests are served close to users with near-zero cold starts
A Worker handles incoming requests via a fetch handler; you route on method and path and return standard Response objects
Workers bind directly to storage: D1 (SQLite), KV (key-value), R2 (object storage), Queues, and Durable Objects
Workers suit low-latency, globally distributed APIs; they use a lightweight runtime rather than a full server environment, which shapes how you build

What Makes Workers Different

A traditional API runs on a server (or a container) in one region. Cloudflare Workers instead run on Cloudflare's global network using lightweight V8 isolates rather than containers or virtual machines. The practical consequences:

Near-zero cold starts. Isolates start almost instantly, avoiding the cold-start delays common to some serverless platforms.
Global by default. Your code runs close to each user across Cloudflare's network, cutting latency without you deploying to multiple regions.
No servers to manage. No provisioning, patching, or scaling; the platform handles it.
A focused runtime. Workers provide web-standard APIs (Fetch, Request/Response, Web Crypto, streams) rather than a full server OS, with a Node.js compatibility layer for many Node APIs. You design around web standards.

The Shape of a Cloudflare Workers API

At its core, a Worker exports a handler that receives each request:

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    if (request.method === "GET" && url.pathname === "/api/health") {
      return Response.json({ status: "ok" });
    }
    return new Response("Not found", { status: 404 });
  }
};

From there you build up:

Routing on HTTP method and path (by hand for small APIs, or with a lightweight router for larger ones).
Request parsing using standard Request methods for JSON, form data, and query parameters.
Responses as standard Response objects, including Response.json().
Bindings available on the env argument to reach storage and other resources.

Connecting Storage with Bindings

The real power of a Workers API is how directly it binds to data:

D1 for a serverless SQLite database, ideal for relational data. See Cloudflare D1.
KV for fast, globally distributed key-value data such as configuration or caching.
R2 for object storage (files, images) with no egress fees.
Queues for asynchronous background processing.
Durable Objects for stateful coordination and consistency where you need it.

Bindings are declared in your configuration and appear on env, so your code calls them directly without managing connection strings or credentials in the usual way.

Development and Deployment

Wrangler, Cloudflare's CLI, handles local development, configuration, secrets, and deployment.
You develop against a local runtime that mirrors production, then deploy globally with a single command.
Secrets are managed through Wrangler rather than committed to code.

When Workers Are the Right Choice

Workers are an excellent fit for low-latency, globally distributed APIs, webhooks, edge middleware, and services that benefit from running close to users. They are less suited to workloads needing long-running processes, heavy CPU-bound compute beyond the request model, or a specific language runtime the platform does not target. For a broader compute comparison, see Cloudflare Workers vs AWS Lambda.

A real-world example: the AI Code Review API is built on Cloudflare Workers, running at the edge worldwide with no cold starts to return fast, structured results, exactly the kind of low-latency API Workers excel at.

Key Takeaways

A Cloudflare Workers API runs at the edge with near-zero cold starts and global distribution, with no servers to manage.
A Worker handles requests through a fetch handler; you route on method and path and return standard Response objects.
Bindings connect your API directly to D1, KV, R2, Queues, and Durable Objects.
Workers suit low-latency, globally distributed APIs; their focused web-standard runtime shapes how you build.

Build Your Edge API with Experts

Designing a serverless API that uses the edge well (routing, storage bindings, and the web-standard runtime) benefits from platform experience. Explore Mecanik's products and tools for examples built on Cloudflare, and see how the Cloudflare Pages vs Workers comparison helps you pick the right Cloudflare service for your project.

Frequently Asked Questions (FAQ)

What is a Cloudflare Workers API?
It is a backend API that runs as code on Cloudflare's global edge network rather than on a traditional server. A Worker handles HTTP requests through a fetch handler and can connect directly to storage like D1, KV, and R2, serving requests close to users with near-zero cold starts.

Do Cloudflare Workers have cold starts?
They have near-zero cold starts because they run on lightweight V8 isolates that start almost instantly, rather than spinning up containers or virtual machines. This is one of the main advantages of Workers for latency-sensitive APIs.

Can I use a database with Cloudflare Workers?
Yes. Workers bind directly to D1 (serverless SQLite) for relational data, KV for key-value data, R2 for object storage, plus Queues and Durable Objects. Bindings appear on the env argument so your code accesses them directly.

What language do Cloudflare Workers use?
Primarily JavaScript and TypeScript, and WebAssembly for other languages. Workers provide web-standard APIs (Fetch, Request/Response, Web Crypto) with a Node.js compatibility layer for many Node APIs, so you build around web standards rather than a full server runtime.

When should I use Cloudflare Workers for an API?
Use Workers for low-latency, globally distributed APIs, webhooks, and edge middleware that benefit from running close to users with instant scaling. They are less suited to long-running processes or heavy CPU-bound work outside the request model.

Drupal Web Development - A 2026 Guide

Mecanik1337 — Fri, 04 Sep 2026 18:00:00 +0000

Drupal web development occupies a particular place in the content management landscape: less talked about than WordPress, but trusted by governments, universities, and large organisations for sites where structure, security, and scale matter. Search interest in Drupal web development has climbed, and for good reason, since the platform suits a class of project that simpler tools struggle with. This 2026 guide explains what Drupal is genuinely good at, how it compares to WordPress, when it is the right choice, and what UK organisations should know before committing to it.

TL;DR

Drupal is a powerful, open-source CMS built for structured content, complex permissions, and large-scale sites
It is favoured by government, education, and enterprise where security and content modelling are priorities
Compared to WordPress, Drupal offers more power and flexibility but a steeper learning curve
Drupal 11 is modern, secure, and built on contemporary PHP and Symfony foundations
Choose Drupal for complex, structured, security-sensitive sites; choose simpler tools for straightforward ones

What Drupal Is

Drupal is a free, open-source content management system used to build websites and web applications. Where some platforms aim for simplicity above all, Drupal is built for capability. It excels at managing structured content, handling complex relationships between different types of information, and supporting sophisticated user roles and permissions. This is why it powers many of the largest and most demanding sites on the web.

Drupal has been in continuous development for over two decades and is maintained by a large, active community. The current generation, Drupal 11, is built on modern PHP and the Symfony framework, giving it a contemporary, maintainable foundation. It is a serious platform for serious projects, not a quick-site builder, and understanding that distinction is the key to deciding whether it fits your needs.

What Drupal Is Genuinely Good At

Drupal's strengths cluster around complexity and scale. If your project has these characteristics, Drupal is worth serious consideration.

Structured content modelling. Drupal lets you define custom content types and the relationships between them with precision. For a site with many interrelated kinds of content, this structural power is a major advantage.

Granular permissions. Drupal's user role and permission system is exceptionally fine-grained, which matters for large organisations where different people need different levels of access.

Security. Drupal has a strong security reputation and a dedicated security team, which is one reason governments and institutions choose it for sensitive sites.

Scalability. Drupal handles large volumes of content and traffic well, making it suitable for sites that need to grow without being rebuilt.

Multilingual capability. Strong built-in support for multiple languages makes it a natural fit for international and public-sector sites.

Drupal vs WordPress

The most common question is how Drupal compares to WordPress, by far the more popular platform. They serve overlapping but distinct needs.

Aspect	Drupal	WordPress
Ease of use	Steeper learning curve	Beginner-friendly
Content structure	Excellent for complex, structured content	Good for simpler content
Permissions	Highly granular	Simpler roles
Security	Strong, enterprise-grade reputation	Strong, but plugin quality varies
Ecosystem	Smaller, more technical	Vast plugin and theme ecosystem
Best for	Complex, large, security-sensitive sites	Blogs, business sites, most SMEs

WordPress is the right choice for most small and medium businesses, which is why we cover it in our WordPress versus custom web development guide. Drupal earns its place when requirements outgrow what WordPress handles cleanly: complex content structures, strict permissions, or the security demands of a public institution.

When to Choose Drupal

Drupal is the right choice in specific circumstances. Consider it when you have a large site with complex, structured content and relationships between content types. Consider it when you need granular control over who can see and edit what, as large organisations and editorial teams often do. Consider it when security is a primary concern, such as for government, healthcare, or financial sites. And consider it when you expect significant scale or complex multilingual requirements.

In each of these cases, Drupal's power justifies its steeper learning curve. The platform was built for exactly this kind of demanding project, and trying to force a simpler tool to do the same job often costs more in the long run.

When Not to Choose Drupal

Equally important is knowing when Drupal is the wrong tool. For a small business brochure site, a simple blog, or a straightforward online store, Drupal is overkill. Its power comes with complexity, and for simple needs that complexity is a cost without a corresponding benefit. You would spend more time and money than the project warrants, and ongoing maintenance would be heavier than necessary.

For most small and medium businesses, WordPress or a focused custom build is the more sensible path, as our guide on website development cost reflects. Matching the tool to the job is the whole point; Drupal is excellent for the right project and excessive for the wrong one.

What UK Organisations Should Know

For UK organisations weighing Drupal, a few practical points matter. Drupal expertise is more specialised than WordPress expertise, so the pool of developers is smaller and rates can be higher; budget accordingly and choose an experienced partner. The platform's strong security record makes it a sound choice for public-sector and regulated work, and it has a long track record in UK government and higher education. Like any platform, it must be kept updated, and following sound web development best practices around performance and security applies just as much to Drupal as to any other system. Done well, a Drupal site is a robust, long-lived asset for an organisation with the complexity to justify it.

Key Takeaways

Drupal is a powerful open-source CMS built for structured content, granular permissions, security, and scale
It is trusted by government, education, and enterprise for demanding, security-sensitive sites
Compared to WordPress, Drupal offers more power and flexibility at the cost of a steeper learning curve
Choose Drupal for large, complex, structured, or security-sensitive sites; choose simpler tools for straightforward ones
Drupal 11 is modern and well-maintained, built on contemporary PHP and Symfony foundations
Drupal expertise is more specialised, so budget for experienced developers and ongoing maintenance

Frequently Asked Questions

What is Drupal used for?
Drupal is used to build websites and web applications, particularly large or complex ones with structured content, sophisticated user permissions, and high security requirements. It is popular with governments, universities, and large organisations for sites that demand more than simpler platforms provide.

Is Drupal better than WordPress?
Neither is universally better; they suit different needs. WordPress is easier and ideal for blogs, business sites, and most small and medium businesses. Drupal is more powerful and flexible, making it better for complex, structured, large-scale, or security-sensitive sites, but it has a steeper learning curve.

Is Drupal still relevant in 2026?
Yes. Drupal remains actively developed, with Drupal 11 built on modern PHP and Symfony foundations. It continues to power many large government, education, and enterprise sites where its strengths in structure, security, and scale are valued.

Is Drupal hard to learn?
Drupal has a steeper learning curve than beginner-friendly platforms like WordPress, because its power comes with more concepts and configuration. For developers it is very capable once learned, but it is not designed for non-technical users to build complex sites without help.

When should I not use Drupal?
Avoid Drupal for simple projects like a small business brochure site, a basic blog, or a straightforward online store. Its power becomes unnecessary complexity for simple needs, costing more time and money than the project warrants. WordPress or a focused custom build is usually better for those cases.

Is Drupal secure?
Drupal has a strong security reputation, backed by a dedicated security team and a long track record with government and institutional sites. As with any platform, security also depends on keeping it updated and following good development and hosting practices.

COBOL to C# Migration - A UK Enterprise Guide 2026

Mecanik1337 — Fri, 04 Sep 2026 06:00:00 +0000

COBOL still underpins a vast amount of the software running in UK banks, insurers, public sector bodies, and large retailers. Much of it processes money, and much of it has been running since long before the developers maintaining it today joined the organisation. As COBOL expertise retires out of the workforce, the pressure to modernise grows every year, and a COBOL to C# migration is one of the routes UK organisations most often consider.

For organisations already invested in the Microsoft stack, C# on .NET is one of the strongest migration targets available. It is a modern, statically typed, object-oriented language, it runs cross-platform on .NET 8 and later, and it has one feature that makes it particularly well suited to COBOL: a native decimal type built for exact financial arithmetic.

This guide explains what a COBOL to C# migration actually involves, the approaches available to UK enterprises, what it costs, and how to manage the risk.

TL;DR

C# is the best-fit COBOL migration target for organisations already on .NET or Azure, and its native 128-bit decimal type maps directly to COBOL packed-decimal fields without third-party libraries
The three main approaches (automated conversion, parallel rewrite, and incremental "strangler fig" migration) carry different risk and cost profiles; most UK enterprises use a hybrid
A mid-size migration typically costs £200,000 to £800,000 and takes one to two years; underestimating scope is the most common failure mode
Automated conversion tools produce structurally correct C# but not a finished system; the data access layer, testing, and business validation remain manual work regardless of tooling

Why C# Is a Strong Target for COBOL Migration

C# is not the only sensible destination for COBOL. Python, Java, Go, C++, and Rust are all valid depending on context. C# stands out for specific reasons:

Native decimal precision. This is the single strongest technical argument for C#. COBOL financial fields use packed decimal (COMP-3) and PIC 9 numeric clauses that represent exact base-10 values. C#'s built-in decimal type is a 128-bit fixed-precision, base-10 type designed specifically for financial and monetary calculations. COBOL decimal fields map directly onto it, preserving exact arithmetic with no rounding surprises and no external library. Java can achieve the same correctness with BigDecimal, but only through a more verbose object API; languages that lean on binary floating point (double in Java, float64 in Go, f64 in Rust) are a poor fit for money without extra work.

The .NET ecosystem. Many UK enterprises already run Windows Server, SQL Server, Active Directory, and Azure. For these organisations, migrating COBOL to C# keeps the modernised system inside a stack their teams already operate, monitor, and secure. Data access maps cleanly to ADO.NET, Entity Framework Core, or Dapper.

Cross-platform, modern runtime. Modern .NET is not Windows-only. C# 12 code compiles and runs on .NET 8 or later (a Long Term Support release) across Windows, Linux, and macOS, and deploys naturally as a container on Azure, AWS, or GCP. Migrating to C# no longer locks you into a single operating system.

Static typing and tooling. C#'s strong static typing catches whole categories of error at compile time, which matters when translating decades-old business logic. Visual Studio, Rider, and the .NET CLI provide mature debugging, profiling, and refactoring support.

Developer availability. C# is consistently among the most widely used enterprise languages in the UK, so the long-term hiring and maintenance pool is deep.

Understanding What You Are Migrating From

COBOL systems in the UK enterprise context usually fall into a few categories, and the character of the migration changes with each:

Batch processing systems. The classic COBOL workload: large volumes of records read from files, processed sequentially, and written back out. These are typically the most straightforward to migrate and map well to C# background services and streaming I/O.

Transaction processing systems. Online transaction processing, often driven by CICS or IMS on IBM mainframes. These carry the most risk because transaction boundaries, rollback behaviour, and connection management all need careful mapping onto .NET equivalents.

Report generation systems. COBOL reporting is commonly migrated to C# pipelines that output modern formats: PDF, Excel, or web dashboards.

Interface and middleware layers. COBOL programs sitting between older systems and databases often become C# services in the modernised architecture.

The COBOL Constructs That Need Real Translation

A safe migration depends on translating COBOL semantics, not doing line-by-line text substitution. The constructs that need genuine mapping include:

PERFORM ranges become C# method calls, with paragraphs and sections decomposed into methods.
EVALUATE / WHEN maps to C# switch statements or pattern matching.
88-level condition names become boolean properties or helper methods.
MOVE CORRESPONDING, REDEFINES, and OCCURS require careful mapping to typed fields, unions of intent, and arrays or collections.
PIC clauses map to the appropriate C# type: string for alphanumeric, short / int / long for sized integers, and decimal for packed-decimal fields with preserved precision.
COPY and REPLACE directives (copybooks) must be resolved before or during parsing, including nested copybooks.
EXEC SQL (DB2), EXEC CICS, and VSAM file access have no drop-in C# equivalent and are the parts most likely to need deliberate redesign onto ADO.NET / Entity Framework Core and modern service patterns.
EBCDIC encoding and fixed-width record layouts need explicit conversion to Unicode and typed models.

Migration Approaches

There are three main approaches, each with a different risk and cost profile.

1. Automated Conversion

Tooling parses COBOL and generates equivalent C#. Done well, the output is structurally correct C# 12 with namespaces, classes, and correct decimal mapping. Done naively, it produces a single class stuffed with static methods that is harder to maintain than the original COBOL.

Best for: Large codebases where the priority is eliminating COBOL dependency quickly, followed by incremental refactoring.

Risk: No tool produces a finished, production-ready system. Embedded SQL, CICS interactions, and dynamic calls still need human decisions.

The Mecanik COBOL to C# migration tool illustrates what good automated conversion looks like. It runs a full compiler pipeline (lexer, parser, semantic analyser, code generator) rather than text substitution, decomposes COBOL sections and paragraphs into C# methods, maps COMP-3 fields to native decimal, resolves COPY / REPLACE directives including nested copybooks, and produces a Migration Report that flags every EXEC SQL, EXEC CICS, and dynamic CALL that needs manual attention. It also handles the practical details, such as prefixing identifiers that collide with C# reserved words and converting ACCOUNT-RECORD style names to PascalCase.

2. Parallel Rewrite

The C# system is built alongside the existing COBOL system. Both run against the same inputs, and outputs are validated against each other until the C# system passes, at which point COBOL is decommissioned.

Best for: Mission-critical systems where continuity cannot be risked, such as payments, payroll, and benefits.

Risk: Running two systems in parallel doubles operational cost during the migration and demands disciplined reconciliation.

3. Incremental Migration (Strangler Fig)

Individual COBOL programs are replaced with C# equivalents one at a time. The system becomes a hybrid and then, eventually, pure C#.

Best for: Large monolithic COBOL systems where a full rewrite is impractical. It lets the team learn and iterate while keeping the business running.

Risk: The hybrid state can persist longer than planned, and it demands careful interface design between the COBOL and C# components.

For most UK enterprise migrations, the strangler fig approach combined with selective automated conversion for boilerplate-heavy sections gives the best balance of risk and velocity.

COBOL to C# Migration Costs in the UK

Cost depends heavily on codebase size, complexity, and approach. Indicative ranges for UK enterprise projects:

System Size	Approach	Estimated Cost
Small (< 50,000 lines)	Parallel rewrite	£80,000 to £200,000
Medium (50,000 to 500,000 lines)	Strangler fig	£200,000 to £800,000
Large (500,000+ lines)	Automated + incremental refactor	£500,000 to £2,000,000+
Legacy mainframe decommission	Full programme	£1,000,000 to £10,000,000+

These figures cover analysis, migration, testing, and go-live support. They exclude ongoing operational costs, training, and downstream integration work that often surfaces mid-project.

The Mecanik COBOL to C# migration service specialises in UK enterprise migrations, covering assessment, conversion, Entity Framework data access layer implementation, and output parity testing. For organisations weighing multiple target languages, the COBOL migration overview sets out the full range of options including Python, Java, Go, C++, and Rust, and the COBOL to Python migration guide covers the most popular alternative target in the same depth as this one.

For migrations where the COBOL is running on IBM z/OS or similar infrastructure, the Mecanik legacy mainframe migration service covers the infrastructure decommission alongside the code migration.

Key Risks and How to Manage Them

COBOL to C# migrations overrun or fail for predictable reasons:

Undocumented business logic. COBOL systems often carry 30 to 40 years of business rules embedded in the code with no external documentation. Discovering and documenting that logic is the most time-consuming and risk-intensive part of any migration.

Data format dependencies. Packed decimal (COMP-3), EBCDIC encoding, and fixed-width layouts have no automatic C# equivalent. C#'s decimal type solves the arithmetic side cleanly, but every field still needs to be mapped and tested with real data before cutover.

The data access layer. Converting COBOL logic is often easier than replacing its data access. EXEC SQL against DB2 and VSAM file handling must be redesigned onto ADO.NET, Entity Framework Core, or Dapper, and this is frequently the largest single work item.

Performance expectations. A COBOL batch job that clears 10 million records overnight sets a bar a naive C# rewrite may not meet. Profiling, optimisation, and sometimes architectural change are required.

Regression testing coverage. The only reliable way to prove the C# output matches the COBOL is comprehensive regression testing with real (anonymised where required) data. Building that test suite before migration begins is not optional.

Cut-over risk. Switching to C# in production is the highest-risk moment. A detailed cut-over plan with rollback procedures and reconciliation checks is mandatory.

Key Takeaways

C# is the strongest COBOL migration target for organisations on the .NET or Azure stack, largely because its native 128-bit decimal type maps directly to COBOL packed-decimal fields with exact precision and no external library.
The three main approaches are automated conversion, parallel rewrite, and incremental migration; most UK enterprise projects use the strangler fig approach with selective automation.
Costs range from around £80,000 for small systems to multi-million-pound programmes for full mainframe decommissions.
The biggest risks are undocumented business logic, data format dependencies, and the data access layer redesign. Addressing all three before migration begins is essential.

Frequently Asked Questions (FAQ)

Why migrate from COBOL to C# rather than Java or Python?
Choose C# when your organisation runs on the .NET ecosystem or Windows and Azure infrastructure. Its native decimal type is a particularly strong fit for COBOL's financial fields. Java is the natural choice for teams on the JVM, and Python suits organisations prioritising readability and AI integration.

What makes C#'s decimal type better for COBOL migration?
C# decimal is a 128-bit, base-10, fixed-precision type built for financial calculations, so COBOL COMP-3 and PIC 9 decimal fields map directly onto it with exact arithmetic and no third-party library. Languages that use binary floating point for numbers need extra work to match COBOL's decimal behaviour.

Does migrated C# code run on Linux, or only Windows?
It runs on both. C# 12 targets .NET 8 or later, which is cross-platform across Windows, Linux, and macOS, and deploys as a standard application or container on Azure, AWS, or GCP.

Can COBOL logic be automatically converted to C#?
Yes, with tooling. A good converter produces structurally correct C# with proper class structure and decimal mapping, but it flags embedded SQL, CICS interactions, and dynamic calls for manual work rather than guessing. The data access layer and business validation remain human tasks.

What happens to COBOL data formats like COMP-3 and EBCDIC?
COMP-3 fields map cleanly to C# decimal. EBCDIC text and fixed-width layouts require explicit conversion to Unicode and typed models, and every structure should be tested against real data before production use.

How long does a COBOL to C# migration take?
Small, well-documented systems take three to nine months. Medium enterprise systems run twelve to twenty-four months. Large mainframe programmes can take three to five years for a full decommission.

Claude AI for Code Review - A Developer's Guide for 2026

Mecanik1337 — Thu, 03 Sep 2026 18:00:00 +0000

Claude AI has become one of the fastest-growing AI tools in the UK, with search interest up 120% in the past three months alone. Developers are no longer just experimenting with it; they are relying on it daily, and code review is one of the highest-value use cases.

In this guide, you will learn exactly how Claude AI fits into a modern code review workflow, what it catches that humans miss, how it compares to other AI tools, and how to plug it into your team's process today.

TL;DR

Claude reviews complete PR diffs in seconds, applying consistent standards regardless of file size or reviewer fatigue
Its strongest capabilities are security vulnerabilities, logic errors, and multi-file reasoning; it is weakest on novel business logic and architectural concerns
The most effective integration hooks Claude into CI/CD to post findings as inline comments before any human sees the PR
Claude Sonnet is the recommended model for code review tasks in 2026; long context windows let it reason across multiple interdependent files simultaneously

What is Claude AI?

Claude AI is a large language model developed by Anthropic, built with a strong focus on safety, accuracy, and reasoning. Unlike general-purpose chatbots, Claude is specifically well-suited to technical tasks: it understands complex codebases, follows nuanced instructions, and produces consistent, well-structured output.

In 2026, Claude runs on the Sonnet and Opus model families, both of which support long context windows. That means you can feed Claude an entire file, a full pull request diff, or even multiple interdependent files in one go, and it will reason across all of them coherently.

For developers, this changes what AI-assisted code review can actually do.

Why Developers Use Claude AI for Code Review

Traditional code review has two bottlenecks: time and consistency. Senior engineers are expensive and busy. Junior engineers miss subtle issues. Style guides drift. Security issues slip through.

Claude AI addresses all three:

Speed - Claude reviews a pull request in seconds, not days.
Consistency - It applies the same standards every time, regardless of file size or reviewer fatigue.
Depth - It reasons about logic, not just syntax. It can spot race conditions, null pointer risks, and off-by-one errors that linters cannot catch.
Contextual feedback - It explains what is wrong and why, which makes it genuinely useful for junior developers learning on the job.

UK development teams in particular are using Claude AI to reduce review bottlenecks without increasing headcount.

What Claude AI Catches in Code Review

Here is a breakdown of the categories where Claude AI consistently delivers value during code review:

Logic Errors

Claude reads control flow and identifies cases where the logic does not match the intent. Examples include incorrect loop termination conditions, missing edge cases in conditional branches, and faulty error propagation.

Security Vulnerabilities

Claude flags common security issues including SQL injection risks, improper input validation, hardcoded credentials, insecure use of cryptographic functions, and missing authentication checks. For UK businesses subject to UK GDPR and Cyber Essentials requirements, this layer of automated review is increasingly important.

Performance Issues

Claude identifies patterns that are likely to cause performance problems: N+1 database queries, unnecessary object creation inside loops, blocking calls in async contexts, and inefficient data structure choices.

Code Style and Standards

When given a style guide or told to follow a specific convention, Claude applies it consistently. It flags variable naming violations, unnecessary complexity, and code that works but would confuse a future reader.

Dead Code and Unused Dependencies

Claude spots functions that are never called, variables that are declared but never used, and imported packages that serve no purpose in the file.

Claude AI vs Other AI Tools for Code Review

Not all AI tools perform equally on code review tasks. Here is how Claude compares to the main alternatives in 2026:

Feature	Claude Sonnet	ChatGPT-4o	Gemini 2.5 Pro	GitHub Copilot
Long context (full file review)	Excellent	Good	Good	Limited
Security issue detection	Excellent	Good	Moderate	Limited
Logic error reasoning	Excellent	Excellent	Good	Moderate
Inline PR comment output	Via API	Via API	Via API	Native
Explainability of findings	Excellent	Good	Good	Minimal
UK GDPR-relevant flagging	Good	Moderate	Moderate	Limited
API availability	Yes	Yes	Yes	No (IDE only)

Claude's strongest advantage is reasoning depth. It does not just flag issues; it explains the risk and often suggests a concrete fix. For teams that want reviewers to learn from the process, not just receive a pass/fail result, that distinction matters.

How to Use Claude AI for Code Review

There are three practical ways to bring Claude AI into your code review workflow:

1. Direct Prompt Review

Paste a code snippet or diff into the Claude interface and ask it to review for bugs, security issues, and style violations. This works well for quick, one-off checks. It requires no setup, but it does not scale.

2. API Integration

Connect Claude to your CI/CD pipeline using the Anthropic API. When a pull request is opened, a webhook triggers a Claude review. The output is posted back to the PR as a comment. This approach scales to any team size and removes the manual step entirely.

If you want this running in production without building it from scratch, the Mecanik AI Code Review API provides a ready-to-use service that integrates directly into your workflow.

3. IDE Extension

Several IDE extensions now route code review requests through Claude via the API. Developers get inline feedback while they write, before the code ever reaches a PR. This catches issues earlier and costs less than post-merge fixes.

Setting Up Claude AI Code Review via API: A Quick Example

The core pattern for calling the Anthropic API for code review looks like this:

import anthropic

client = anthropic.Anthropic(api_key="YOUR_API_KEY")

diff = """
- def process_payment(amount):
-     query = "SELECT * FROM users WHERE id = " + user_id
+ def process_payment(amount, user_id):
+     query = "SELECT * FROM users WHERE id = %s"
"""

message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=1024,
    messages=[
        {
            "role": "user",
            "content": f"Review this code diff for security issues, logic errors, and style problems. Be specific.\n\n{diff}"
        }
    ]
)

print(message.content[0].text)

Claude will return a structured analysis pointing out the SQL injection risk in the original code and confirming the parameterised fix is correct.

For production use, you would add error handling, log the output, and post the result back to your PR via your version control API. The Mecanik AI Integration Services team can handle the full implementation if you need it done quickly.

Key Takeaways

Claude AI search interest in the UK is up 120% in 2026, and code review is one of its primary developer use cases.
Claude outperforms most alternatives on reasoning depth, long-context review, and explainability of findings.
It catches logic errors, security vulnerabilities, performance issues, and style violations consistently.
You can use it via direct prompt, API integration, or IDE extension depending on your team's scale.
A managed AI code review API removes the integration work and gets you running in hours.

Frequently Asked Questions (FAQ)

What is Claude AI best used for in software development?
Claude AI excels at code review, debugging, refactoring suggestions, and documentation generation. Its long context window makes it particularly useful for reviewing full files or multi-file pull requests in one pass.

Is Claude AI better than GitHub Copilot for code review?
They serve different purposes. Copilot is primarily a code completion tool. Claude AI is a reasoning model that can analyse existing code, explain what is wrong, and suggest specific fixes. For code review specifically, Claude provides much deeper analysis.

How much does it cost to use Claude AI for code review?
Anthropic charges per token via the API. A typical pull request review costs a fraction of a penny. At scale, the cost is negligible compared to engineer time saved. Using a managed service like the Mecanik AI Code Review API bundles this into a predictable pricing model.

Can Claude AI review code for security vulnerabilities?
Yes. Claude flags SQL injection, insecure credential handling, improper input validation, missing authentication, and other OWASP Top 10 issues. It is not a replacement for a formal penetration test, but it catches a significant proportion of common vulnerabilities before they reach production.

Is Claude AI safe to use with proprietary code?
Anthropic's API does not use your data to train models by default when using the API. For teams with strict data handling requirements, review Anthropic's data usage policies and consider on-premise or private deployment options.

How do I integrate Claude AI into my CI/CD pipeline?
The standard approach uses webhooks to trigger a Claude API call when a PR is opened, then posts the review result as a comment. The Mecanik AI Code Review API provides this as a managed service with minimal configuration required.

WordPress Security Hardening Checklist for 2026

Mecanik1337 — Thu, 03 Sep 2026 06:00:00 +0000

WordPress powers a huge share of the web, which makes it a constant target. The good news is that the overwhelming majority of WordPress compromises exploit a small, predictable set of weaknesses, and almost all of them are preventable. This WordPress security hardening checklist walks through the steps that actually move the needle in 2026, roughly in priority order.

TL;DR

Vulnerable and outdated plugins and themes are the single biggest WordPress attack vector; disciplined updates and removing unused code matter more than anything else
Strong authentication (unique admin usernames, strong passwords, two-factor, login rate limiting) closes the second most common door
Harden wp-config.php, file permissions, and the REST API / XML-RPC surface, and put a WAF in front of the site
Back up regularly and test restores; a good backup is what turns a breach into an inconvenience rather than a disaster

1. Keep Core, Plugins and Themes Updated

Outdated plugins and themes are the number one way WordPress sites get hacked. Every plugin is third-party code running with access to your site.

Enable automatic updates for WordPress core (minor releases at minimum).
Update plugins and themes promptly, ideally on a schedule with a staging test.
Remove plugins and themes you do not use. Deactivated is not enough; deleted is safe.
Only install plugins from reputable sources with an active maintenance history.
Watch for abandoned plugins; unmaintained code is a liability even if it still works.

2. Lock Down Authentication

Brute-force and credential attacks against wp-login.php are relentless.

Never use admin as a username. Use a unique administrator name.
Enforce strong, unique passwords for every account.
Enable two-factor authentication (2FA) for all admin and editor accounts.
Limit login attempts and add rate limiting to block brute-force attempts.
Consider changing or protecting the login URL and adding a CAPTCHA challenge.

3. Apply Least-Privilege User Roles

Give each user the lowest role that lets them do their job. Not everyone needs to be an administrator.
Audit user accounts regularly and remove ex-staff and unused logins.
Review roles after installing plugins that add custom capabilities.

4. Harden wp-config.php

wp-config.php holds your database credentials and secret keys, so it deserves special attention.

Set unique authentication keys and salts.
Disable the built-in file editor: define('DISALLOW_FILE_EDIT', true); so an attacker who gains admin access cannot edit theme and plugin code from the dashboard.
Move wp-config.php one level above the web root where the hosting setup allows it, and restrict its file permissions.
Keep WP_DEBUG disabled in production so errors do not leak information.

5. Set Correct File and Directory Permissions

Directories 755, files 644 as a standard baseline; never use 777.
Ensure the web server user owns the files but cannot write where it does not need to.
Protect sensitive files and disable directory browsing.

6. Reduce the Attack Surface: XML-RPC and REST API

Disable XML-RPC if you do not use it; it is a common brute-force and DDoS amplification vector.
Restrict or authenticate the REST API where it exposes data you do not want public.
Remove the WordPress version number and other unnecessary information disclosure from page output.

7. Put a WAF and HTTPS in Front

Serve the entire site over HTTPS and redirect all HTTP traffic.
Add security headers (HSTS, X-Content-Type-Options, X-Frame-Options or a frame-ancestors Content-Security-Policy, and a CSP where practical).
Use a Web Application Firewall. A CDN-level WAF such as Cloudflare filters malicious traffic before it reaches WordPress and absorbs bot and DDoS pressure.

8. Database and Hosting Hardening

Use a non-default database table prefix on new installs.
Use a dedicated database user with only the privileges WordPress needs.
Keep PHP on a supported, current version; end-of-life PHP is a silent risk.
Choose hosting that isolates sites and patches the server stack.

9. Monitoring, Backups and Recovery

Run malware and file-integrity scanning so unexpected changes are detected quickly.
Enable security logging so you can see login attempts and changes.
Take regular, automated backups stored off the server, and test restoring them. An untested backup is a hope, not a plan.

Key Takeaways

The biggest wins are unglamorous: update everything, remove unused plugins and themes, and enforce strong authentication with 2FA.
Harden wp-config.php, file permissions, and the XML-RPC / REST API surface to shrink the attack surface.
Put HTTPS, security headers, and a WAF in front of the site.
Back up regularly and test restores so a breach is recoverable.

Professional WordPress Security Hardening

A checklist gets you most of the way, but WordPress security hardening still benefits from expert eyes. A WordPress security audit reviews every plugin and theme, tests authentication and access, and checks wp-config.php, the database, and the REST API and XML-RPC surface, producing a prioritised hardening plan. For the wider picture across your whole site and stack, see the website security audit guide for UK businesses. If your site needs ongoing development and maintenance alongside hardening, a WordPress developer for hire can keep it secure over time.

Frequently Asked Questions (FAQ)

What is the most common way WordPress sites get hacked?
Vulnerable and outdated plugins and themes. Third-party plugin code is the single biggest attack vector, which is why prompt updates and removing unused plugins matter more than almost anything else.

Do I really need a security plugin?
A reputable security plugin helps with malware scanning, login limiting, and monitoring, but it is not a substitute for the fundamentals: updates, strong authentication, least-privilege roles, and a WAF. Layer it on top of good hygiene, not instead of it.

Should I disable XML-RPC?
If you do not use it (for example for the mobile app or certain integrations), yes. XML-RPC is frequently abused for brute-force and DDoS amplification, so disabling it removes a common attack surface.

How often should I back up my WordPress site?
Frequently enough that you could not lose meaningful data, typically daily for active sites, stored off the server. Crucially, test your restores; a backup you have never restored is unproven.

Is Cloudflare enough to secure WordPress?
A CDN-level WAF like Cloudflare filters a lot of malicious traffic and absorbs bot and DDoS pressure, but it does not fix vulnerable plugins, weak passwords, or misconfiguration. Use it as one layer alongside on-site hardening.

Optimizing Cloudflare CDN Caching Strategy for Speed

Mecanik1337 — Wed, 02 Sep 2026 18:00:00 +0000

Configuring a robust Cloudflare CDN caching policy is one of the highest-impact engineering tasks for speed-optimising an enterprise website in 2026. Many web platforms suffer from high latency because every user request must travel to the origin database server to render pages. That origin dependence delays the First Contentful Paint (FCP) and Largest Contentful Paint (LCP) speed metrics, whereas storing static page layouts and asset components at edge locations worldwide delivers fast, low-latency responses from the nearest edge location. This guide breaks down the caching mechanics, Edge Cache TTL rules, and dynamic cookie bypass configurations.

Caching Optimization Tip: Avoid caching HTML pages that contain logged-in user details. Always configure your Cache Rules to bypass edge caching when specific session cookies (such as WordPress cookies or custom auth tokens) are detected in request headers.

Key Takeaways:

Cloudflare CDN caching reduces backend server database queries, cutting down hosting costs.

Cache Rules allow developers to set custom TTL values based on content types and directories.

Deploying Cache Everything rules requires configuring session cookie bypasses to prevent user data leaks.

Serving static pages directly from edge locations helps websites pass Core Web Vitals on mobile devices.

Caching Configurations: Page Rules vs. Cache Rules

To get the best out of your delivery pipelines, you must choose the appropriate dashboard control model. According to caching guidelines from Cloudflare Developer Docs, legacy Page Rules are being replaced by modular Cache Rules. Therefore, developers should implement these configurations:

By default, CDN networks cache only media formats, stylesheets, and scripts. Consequently, you must configure three core asset options:

HTML Caching: To achieve instant page loads, you must instruct the CDN to cache the HTML document structure. Therefore, this stops database queries.
Cache-Control Headers: Configure your Symfony or PHP backend server to send custom s-maxage directives to instruct edge servers how long to store the pages. Additionally, this allows custom TTL rules.
Browser Cache TTL: Set shorter browser cache lifetimes (e.g. 4 hours) to ensure users receive updates when you modify site layouts. Consequently, this prevents layout mismatch issues.

For interactive web portals, you cannot cache all pages universally. Therefore, you must establish two dynamic bypass rules:

Session Bypasses: Build rules that instruct the CDN to bypass caching when a request carries authentication or session cookies, so logged-in users always receive personalised responses while anonymous visitors are still served from the edge cache.
Query String Sorting: Configure the edge database cache to ignore minor analytics variables (like UTM tags) when evaluating cache keys. Consequently, this prevents cache fragmentation.

To deploy an enterprise edge caching strategy safely, work through this technical validation sequence. Adopt these four optimisation steps:

Audit HTTP Headers: Verify that your origin server sends clean Cache-Control and Vary headers without auth blocks.
Draft Modular Cache Rules: Configure target Cache Rules to store static category directories for up to 30 days.
Build Authentication Exceptions: Create rules to bypass the edge cache when login cookies are detected.
Deploy Purge API Webhooks: Configure database save actions to trigger automated Purge API requests when you update pages.

Performance Comparison: Edge Caching vs. Origin Fetch

To illustrate the speed benefits, the following table details actual loading metrics:

Performance Metric	Origin Server Fetch (No CDN Cache)	Edge Cache Hit (CDN Active)	Expected Speed Improvement
Time to First Byte (TTFB)	450 - 800 Milliseconds	15 - 35 Milliseconds	Up to 95% faster initial server response
Mobile LCP (Largest Image)	3.8 Seconds (Poor)	1.4 Seconds (Good)	Pass Core Web Vitals metrics cleanly
Origin CPU Load	High (Every page queries database)	Minimal (Edge handles 90% of hits)	Reduced hosting costs and higher stability

Prerequisites

Before you touch the dashboard, make sure you have the following in place:

A domain already proxied through Cloudflare (the orange-cloud DNS setting, not grey/DNS-only).
Access to your origin configuration — Nginx, Apache, or the application layer — so you can set response headers.
An API token scoped to Zone → Cache Purge if you intend to automate purges. Create it under My Profile → API Tokens.
A way to inspect raw HTTP headers: curl on the command line, or the Network tab in Chrome DevTools.
A staging URL or a low-traffic path you can experiment on before rolling anything out site-wide.

A Free or Pro plan is enough to follow every step below. Cache Rules are available on all plans, though a few cache-key options and Tiered Cache sit behind higher tiers.

Step 1: Send Correct Cache-Control Headers from the Origin

Cloudflare only treats a response as cacheable if your origin does not actively forbid it. The single most common reason HTML never caches is an origin returning a Set-Cookie header or a restrictive Cache-Control on every request.

Set explicit directives at the origin. In Nginx:

location ~* \.(css|js|woff2|jpg|png|webp|svg)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
}

location / {
    # HTML: short browser life, long shared (edge) life
    add_header Cache-Control "public, max-age=0, s-maxage=86400";
}

The s-maxage directive targets shared caches such as the Cloudflare edge, while max-age=0 keeps the visitor's browser revalidating so they never see stale HTML after a deploy. The immutable token on fingerprinted assets tells browsers never to revalidate them at all.

For an application-driven response (PHP or Symfony), express the same intent in code:

$response->setPublic();
$response->setMaxAge(0);            // browser
$response->setSharedMaxAge(86400);  // edge / s-maxage

Authenticated or personalised responses must opt out explicitly, otherwise a broad rule could serve one user's page to another:

Cache-Control: private, no-store

Step 2: Make HTML Eligible for Cache with a Cache Rule

By default Cloudflare marks HTML as DYNAMIC and never stores it. To change that, create a rule under Caching → Cache Rules → Create rule.

Write an expression that matches the pages you want cached while excluding anything dynamic:

(http.host eq "example.com"
  and not starts_with(http.request.uri.path, "/wp-admin")
  and not starts_with(http.request.uri.path, "/cart")
  and not starts_with(http.request.uri.path, "/checkout")
  and not starts_with(http.request.uri.path, "/my-account"))

Then set the rule actions:

Cache eligibility: Eligible for cache — the modern equivalent of the old "Cache Everything" behaviour.
Edge TTL: Use cache-control header if present, so the s-maxage you set in Step 1 wins; fall back to a fixed value such as 1 day if the header is absent.
Browser TTL: Respect origin.

Step 3: Add a Cookie Bypass So Logged-in Users Are Never Cached

This is the step most guides skip, and the one that leaks data when they do. Add a second rule, placed above the eligibility rule, that forces a bypass whenever a genuine session cookie is present. Cloudflare evaluates Cache Rules top-down, so an earlier bypass rule always wins for authenticated visitors.

http.cookie contains "wordpress_logged_in_"
or http.cookie contains "wp-postpass_"
or http.cookie contains "woocommerce_items_in_cart"
or http.cookie contains "comment_author_"

Set the action to Bypass cache. For non-WordPress stacks, swap the cookie names for your framework's session identifier — PHPSESSID, laravel_session, connect.sid, and so on. Scope this tightly: matching a broad analytics cookie such as _ga here would accidentally bypass the cache for every anonymous visitor too.

Step 4: Normalise the Cache Key

Two URLs that differ only by a tracking parameter should share one cached object. Inside the eligibility rule, open Cache Key → Query String, choose Ignore specific query string parameters, and list the analytics keys:

utm_source, utm_medium, utm_campaign, utm_term, utm_content, fbclid, gclid

This collapses /pricing?utm_source=newsletter and /pricing?gclid=123 onto a single cached entry, lifting your hit ratio instead of fragmenting it across thousands of near-duplicate keys.

How to Verify a Cache HIT or MISS

Never assume a rule works — measure it. Every response Cloudflare serves carries a cf-cache-status header. Request the same URL twice and watch it change:

curl -sI https://example.com/ | grep -i cf-cache-status
# First request:  cf-cache-status: MISS
# Second request: cf-cache-status: HIT

The values you will encounter and what each one means:

`cf-cache-status`	Meaning	What to do
HIT	Served straight from the edge	Working as intended
MISS	Not cached yet; fetched from origin and now stored	Re-request to confirm it becomes a HIT
DYNAMIC	Cloudflare judged it uncacheable	Rule not matching, or origin forbids caching
BYPASS	A rule or cookie bypass skipped the cache	Expected on logged-in requests
EXPIRED	TTL elapsed, revalidated with origin	Normal; raise Edge TTL if it happens too often
REVALIDATED	Stale, confirmed still fresh via ETag	Normal

If you only ever see DYNAMIC, the eligibility rule is not firing. Confirm the hostname in the expression, then check the origin is not sending Cache-Control: private or a Set-Cookie on the HTML document.

Common Pitfalls and Troubleshooting

A Set-Cookie on every response. Cloudflare will not cache a response that sets a cookie. Analytics plugins, CSRF tokens, and A/B testing tools frequently attach one to the HTML document. Move that logic to an asynchronous request, or strip the header on cacheable paths.
BYPASS on anonymous visitors. Almost always a cookie-bypass rule that is too broad — a generic cookie such as _ga matching your expression. Restrict the bypass to real session cookies only.
Stale pages after a deploy. Edge TTL is doing its job; you simply forgot to purge. Trigger a targeted purge on publish rather than shortening the TTL to a few seconds.
Vary headers being ignored. Cloudflare only varies its cache on Accept-Encoding; it will not keep separate copies for an arbitrary Vary: User-Agent or Vary: Cookie. Serve device-specific markup through responsive CSS or a Worker instead of relying on Vary.
Development Mode left switched on. It bypasses the cache for three hours and silently makes every response look uncacheable. Confirm it is off before you test.

Production Considerations and Automated Purging

Once a single path behaves correctly, widen the rule to the full site during a low-traffic window and watch Caching → Overview for your hit ratio — a healthy static site sits comfortably above 90%.

Wire your CMS to purge only what changed rather than the whole zone. A targeted purge by URL keeps neighbouring pages warm in the cache:

curl -X POST \
  "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/purge_cache" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{"files":["https://example.com/pricing"]}'

Call this from your publish hook so an editor's update goes live within seconds while everything else stays cached. For large catalogues, group related URLs behind a Cache Tag (Enterprise) or purge by prefix, and enable Tiered Cache to lift the global hit ratio by routing misses through a regional parent before they ever reach your origin.

Partner with a Vetted UK Cloudflare Consultancy

Getting these caching decisions right protects your origin servers and speeds up page delivery for every visitor. Mecanik provides professional technical SEO audit services and infrastructure scaling through our website development page. We specialise in Symfony edge integrations, custom Cloudflare Cache Rules, and edge-native deployments. Contact us today to schedule your technical scoping workshop.

Frequently Asked Questions

What is cloudflare cdn caching?
Cloudflare cdn caching is the process of storing static copies of your website's pages, images, and script files on edge servers located around the world. This configuration allows user requests to be served from the nearest physical server, reducing website load times.

How do I cache HTML pages without leaking user data?
To cache HTML safely, configure a Cache Rule with a "Bypass Cache" action that triggers when session or admin cookies are present in request headers. This setup ensures logged-in portal users always fetch dynamic content from the origin database.

What is the difference between Edge TTL and Browser TTL?
Edge TTL (Time-To-Live) dictates how long the Cloudflare CDN servers store your content before requesting a fresh copy from your origin server. Conversely, Browser TTL determines how long the visitor's local browser cache keeps the files.

Why does query string caching affect website performance?
If query strings (like UTM tracking tags) are not normalised, the CDN treats each variant as a unique URL, generating duplicate requests to your origin server. Configuring cache key normalisation prevents this crawl duplication.

Can edge caching improve my Core Web Vitals scores?
Yes, serving your HTML and media assets directly from edge servers minimises Time-to-First-Byte (TTFB) and Largest Contentful Paint (LCP) times. Consequently, this caching strategy directly improves your mobile page speed ranking.

Legacy PHP Modernisation: A 2026 Guide

Mecanik1337 — Wed, 02 Sep 2026 06:00:00 +0000

A legacy PHP application is often the software equivalent of a building that has been extended a dozen times: it works, the business depends on it, and nobody wants to touch it. Old PHP versions, no tests, mixed concerns, and years of accumulated shortcuts make every change risky. The good news is that legacy PHP modernisation does not require a big-bang rewrite, which is usually the riskiest option of all. This guide lays out a safer, incremental path.

TL;DR

A full rewrite is the most tempting and most dangerous option; incremental modernisation is safer and delivers value sooner
Start by assessing the code, upgrading to a supported PHP version, and adding a safety net of tests around critical behaviour
Introduce Composer, autoloading, and modern structure, then refactor toward clean separation of concerns
Adopt a framework like Symfony gradually using the strangler fig pattern, replacing the old system piece by piece

Why Not Just Rewrite It?

Rewriting from scratch is appealing: a clean slate, modern everything. It is also where most legacy modernisation efforts fail. A rewrite means re-implementing years of undocumented business rules, freezing improvements to the live system while you build, and betting the business on a single cut-over. Incremental modernisation avoids that by improving the running system in controlled steps, delivering value along the way. It is the same logic that makes the strangler fig approach the default for mainframe modernisation: preserve what works, replace deliberately.

Step 1: Assess Before You Touch Anything

Inventory the PHP version, dependencies, and their support status.
Identify the critical paths (the features the business cannot lose) and the riskiest, most-changed areas.
Map the obvious problems: SQL scattered through templates, no separation of concerns, global state, dead code.
Understand the database and how tightly the code is coupled to it.

You cannot modernise safely what you do not understand.

Step 2: Get onto a Supported PHP Version

Running an end-of-life PHP version is a security and performance liability, and it blocks modern tooling.

Upgrade incrementally through versions rather than jumping several at once.
Fix deprecations and breaking changes at each step.
Modern PHP is dramatically faster and safer than older versions, so this step often pays for itself in performance alone.

Step 3: Build a Safety Net of Tests

The single most valuable investment in any legacy project is tests around existing behaviour.

Add characterisation tests that capture what the system currently does, especially on critical paths, before you change anything.
Even coarse, high-level tests give you the confidence to refactor without breaking things silently.
This test suite is what makes every later step safe.

Step 4: Introduce Modern Foundations

Adopt Composer for dependency management and PSR-4 autoloading to replace manual includes.
Introduce namespaces and a sane directory structure.
Add static analysis and coding standards tooling to stop new debt accumulating.

Step 5: Refactor Toward Clean Separation

Separate business logic from presentation and data access; get SQL out of templates.
Extract reusable services and introduce dependency injection where it reduces coupling.
Refactor in small, tested steps, not sweeping rewrites of whole areas at once.

Step 6: Adopt a Framework Incrementally (Strangler Fig)

Rather than rewriting into a framework wholesale, grow the new system around the old one.

Stand up a modern framework such as Symfony alongside the legacy app.
Route new features and gradually migrated ones through the framework, while the legacy code keeps serving the rest.
Replace old functionality piece by piece until the legacy code is "strangled" and can be retired.

This keeps the business running throughout and avoids the all-or-nothing risk of a rewrite. (For a comparison of framework options, see Symfony vs Laravel in 2026.)

Managing the Technical Debt

Modernisation is, at its core, paying down technical debt deliberately. Prioritise the debt that actually costs you (the code you change often, the parts that break, the security risks) rather than trying to fix everything. For a fuller treatment, see the guide to technical debt for engineering teams.

Key Takeaways

Legacy PHP modernisation should avoid the big-bang rewrite; modernise incrementally to reduce risk and deliver value sooner.
Assess first, then upgrade to a supported PHP version and add tests around existing behaviour.
Introduce Composer, autoloading, and clean separation of concerns step by step.
Adopt a framework like Symfony using the strangler fig pattern, retiring legacy code piece by piece.

Legacy PHP Modernisation with Experts

Legacy modernisation is as much about risk management as coding. To hire a Symfony developer for the job, Mecanik brings legacy PHP codebases up to modern, maintainable, well-tested standards using clean architecture and an incremental approach, with CI/CD so quality holds over time.

Frequently Asked Questions (FAQ)

Should I rewrite or refactor a legacy PHP application?
Refactor incrementally in almost all cases. A full rewrite means re-implementing years of undocumented business rules and betting the business on a single cut-over, which is where most efforts fail. Incremental modernisation improves the running system in controlled, valuable steps.

What is the first step to modernising legacy PHP?
Assess the code, dependencies, and PHP version, then upgrade to a supported PHP version and add tests around critical existing behaviour. That safety net of tests is what makes every later refactoring step safe.

How do I move legacy PHP to a framework without a rewrite?
Use the strangler fig pattern: stand up a modern framework such as Symfony alongside the legacy app, route new and migrated features through it, and replace old functionality piece by piece until the legacy code can be retired. The business keeps running throughout.

Why is upgrading the PHP version important?
Running an end-of-life PHP version is a security and performance risk and blocks modern tooling. Newer PHP is significantly faster and safer, so upgrading often improves performance immediately and unlocks the libraries and tools modernisation depends on.

How do I deal with a legacy app that has no tests?
Add characterisation tests that capture the system's current behaviour on critical paths before changing anything. Even high-level tests give you enough confidence to refactor safely. Building this coverage first is the highest-value step in any legacy project.

OWASP Top 10 Explained for Business Owners

Mecanik1337 — Tue, 01 Sep 2026 18:00:00 +0000

The OWASP Top 10 is the most widely referenced list of web application security risks, published by the Open Worldwide Application Security Project (OWASP), a respected non-profit. It is written for security professionals, but the risks it describes have direct business consequences: data breaches, downtime, fines, and lost trust. This guide explains each category in plain English so you can ask the right questions about your own applications.

OWASP revises the list every few years as attack patterns evolve. The categories below reflect the well-established 2021 revision, which remains the standard reference for most teams; the underlying risks are stable even as their ranking shifts.

TL;DR

The OWASP Top 10 is the industry-standard list of the most critical web application security risks
The biggest categories are about access control, weak cryptography, injection flaws, and insecure design decisions made early
Most of these risks come down to a few root causes: missing checks, misconfiguration, outdated components, and inadequate monitoring
You do not need to be technical to hold your team or supplier accountable for addressing each one

1. Broken Access Control

What it means: Users can do or see things they should not, for example viewing another customer's data by changing an ID in the URL, or reaching an admin function without being an admin.

Why it matters: This is consistently one of the most common and damaging risks. It leads directly to data exposure and unauthorised actions.

Ask your team: Are permissions enforced on the server for every request, not just hidden in the interface?

2. Cryptographic Failures

What it means: Sensitive data (passwords, payment details, personal information) is not properly protected, for example not encrypted in transit or at rest, or protected with weak or outdated algorithms.

Why it matters: Exposed sensitive data triggers breaches and, under UK GDPR, potential fines and mandatory disclosure.

Ask your team: Is all traffic over HTTPS, and is sensitive data encrypted at rest with modern algorithms?

3. Injection

What it means: Untrusted input is treated as a command, letting an attacker manipulate a database (SQL injection) or run unintended operations. Cross-site scripting (XSS) is included here.

Why it matters: Injection can expose or destroy entire databases and hijack user sessions.

Ask your team: Do we use parameterised queries and validate and encode all user input?

4. Insecure Design

What it means: The security weakness is in the design itself, not just the code, for example a password-reset flow that can be abused, or a checkout that trusts a price sent by the browser.

Why it matters: Design flaws cannot be patched away later; they require rethinking the feature. Security has to be considered up front.

Ask your team: Do we threat-model important features before building them?

5. Security Misconfiguration

What it means: Insecure default settings, unnecessary features left enabled, verbose error messages, or missing security headers.

Why it matters: Misconfiguration is extremely common and often trivial for attackers to find and exploit.

Ask your team: Are default accounts removed, unused features disabled, and security headers in place?

6. Vulnerable and Outdated Components

What it means: The application relies on third-party libraries, frameworks, or plugins with known vulnerabilities that have not been updated.

Why it matters: Attackers scan for known vulnerable components at scale. Many major breaches trace back to an unpatched dependency.

Ask your team: Do we track our dependencies and update them promptly when vulnerabilities are disclosed?

7. Identification and Authentication Failures

What it means: Weak login systems: poor password policies, no protection against brute force, weak session handling, or missing multi-factor authentication.

Why it matters: Compromised accounts are a direct route to data and functionality.

Ask your team: Do we offer multi-factor authentication and protect against credential stuffing and brute force?

8. Software and Data Integrity Failures

What it means: Trusting code, updates, or data from sources that are not verified, for example an insecure software update mechanism or a compromised build pipeline (a supply-chain risk).

Why it matters: Supply-chain attacks are growing and can compromise many victims at once through a single trusted channel.

Ask your team: Do we verify the integrity of updates and dependencies and secure our build and deployment pipeline?

9. Security Logging and Monitoring Failures

What it means: Not recording security-relevant events, or not watching them, so attacks go unnoticed for long periods.

Why it matters: You cannot respond to what you cannot see. Poor monitoring is why breaches often go undetected for months.

Ask your team: Do we log security events and alert on suspicious activity?

10. Server-Side Request Forgery (SSRF)

What it means: An attacker tricks the server into making requests to systems it should not, potentially reaching internal services that are not meant to be public.

Why it matters: SSRF can expose internal infrastructure and cloud metadata, and has featured in significant breaches.

Ask your team: Do we validate and restrict the destinations our server is allowed to call?

Key Takeaways

The OWASP Top 10 is the standard reference for web application security risk; most items reduce to missing checks, misconfiguration, outdated components, and weak monitoring.
Access control, cryptography, injection, and insecure design are the highest-impact categories.
You do not need to be technical to hold your team or supplier accountable for each risk; the questions above are a good start.
The most reliable way to know where you stand is an independent test.

Test Your Site Against the OWASP Top 10

The questions above start the conversation; a professional test gives you the answer. Application security testing combines static code analysis, dynamic runtime testing, dependency and supply-chain auditing, and authentication and cryptography review to find these risks in your actual application, with risk-rated findings and remediation guidance. For a broader look at securing a live site, see the website security audit guide for UK businesses.

Frequently Asked Questions (FAQ)

What is the OWASP Top 10?
It is a regularly updated list of the ten most critical web application security risks, published by the Open Worldwide Application Security Project (OWASP). It is the industry-standard reference for prioritising application security work.

Is the OWASP Top 10 a complete security standard?
No. It is an awareness and prioritisation document covering the most critical risks, not an exhaustive checklist. Use it as a starting point alongside deeper testing and secure-development practices.

How often is the OWASP Top 10 updated?
OWASP revises it every few years as data and attack patterns change. The categories evolve and re-rank, but the underlying risks remain broadly stable, so the concepts stay relevant between revisions.

Which OWASP risk is the most dangerous?
It varies by application, but broken access control and injection have historically been among the most common and damaging. The right priority for you depends on how your specific application is built and exposed.

How do I know if my application is affected?
The only reliable way is testing: static analysis, dynamic testing, and a dependency audit against your actual codebase and running application. A professional application security test maps your risks to these categories with prioritised fixes.

How AI Search Engines Read Schema Markup and Structured Data

Mecanik1337 — Tue, 01 Sep 2026 06:00:00 +0000

Implementing schema markup for LLMs is the most reliable way to feed structured data directly to conversational search engines. As Large Language Models (LLMs) take over standard web search queries, traditional keyword indexing is no longer enough to maintain digital visibility. AI search crawlers—such as ChatGPT's indexers and Perplexity's retrieval bots—rely on explicit semantic maps to parse and verify information. Websites that expose clean, standardised metadata graphs rank higher and secure more inline citations. This guide details how AI retrieval networks read structured data, which schema types are most critical for LLMs, and how to construct files that machines parse easily in 2026.

Developer Insight: Always nest your schema files rather than serving disconnected metadata cards. For example, rather than declaring an Organization and a Person independently, embed the Person under the organisation's founder property. This teaches AI parsers the exact relationship graph between entities.

Key Takeaways:

Feed Semantic Graphs: JSON-LD graphs help AI search crawlers connect organisations, services, and locations.

Prioritise Specific Schemas: Map core facts using Product, Organization, Service, and FAQPage structures.

Nesting Architecture: Nest entity cards to declare clear founder, vendor, and location connections.

Wikidata Anchoring: Use sameAs links to anchor your brand to globally recognised database records.

Why LLMs Rely on Structured Metadata

Traditional crawlers use simple textual patterns to index pages. In contrast, conversational retrieval bots use structured metadata to map entities, verify claims, and build direct answers.

LLMs are highly proficient at parsing natural language. However, parsing unstructured, messy web templates remains compute-intensive and prone to error. Exposing your core facts via JSON-LD schemas allows the crawler to bypass layout styling and ingest data directly. This makes structured data a primary pillar of Generative Engine Optimization (GEO).

Furthermore, structured metadata helps AI engines prevent hallucinations. By referencing verified entity parameters in your schema, you provide a clear source of truth for the model's output. To learn more about optimising your site's codebase, read our guide on structured data and schema markup.

Critical Schema Types for AI Crawlers

Not all structured data carries equal weight for LLMs. Focus your optimisation efforts on these specific templates.

Organization & Service Schema

These structures identify who you are, what services you build, and where you operate. Connecting your organisation schema to Wikidata or Crunchbase profiles confirms your business's legitimacy to search algorithms, preventing identity confusion.

Product and Pricing Schema

AI engines excel at product research. For instance, when a user asks for "best custom software agencies in the UK," crawlers scan pricing, ratings, and features. Specifically, providing nested product entities ensures the crawler extracts exact variables without parsing irrelevant page fluff.

FAQPage Schema

FAQ blocks are highly valuable. Crawlers use them to resolve direct questions in search results. To verify how schemas are parsed, refer to the Schema.org Official Specification.

{{< cta-button url="/services/seo-audit/" text="Book an SEO Audit" >}}

Structured data is one signal AI search engines read; see our Generative Engine Optimization (GEO) guide for how it fits the wider citation strategy.

Optimising Schema Markup for LLMs

To make your schema files highly readable for AI models, implement nested architectures and entity references. By nesting entities—such as describing a founder within the Organization schema rather than declaring them as separate, disconnected blocks—you help the model trace semantic relationships, allowing the parser to build an accurate relationship graph of your brand assets.

First, use sameAs parameters. When declaring your organisation, include sameAs arrays that link directly to your official Wikidata profile, Crunchbase page, and LinkedIn handle. This merges your website page with existing global knowledge bases.

Second, resolve parsing errors. Broken nested arrays or trailing commas trigger index exceptions, forcing bots to ignore your data card completely. Therefore, you must establish an automated validation step in your deployment pipelines. If you are building custom database integration paths for your metadata files, read about our website development services.

Handling Dynamic Schema Generation

For enterprise sites, manually updating JSON-LD script blocks across thousands of pages is inefficient. Developers should instead implement dynamic schema generators that query the database and compile structured data on-demand. When using this serverless approach, caching the output is crucial. If the schema generation process triggers database queries on every crawler request, high scraper volume can overload your edge functions. To avoid this, cache the generated JSON-LD strings at the edge (using KV or Redis) to ensure instant responses for crawler agents.

Step-by-Step Implementation Protocol

Follow this structured protocol to optimise your data schema files:

Map Core Entities: Define your primary business services, founders, locations, and parent categories.
Generate JSON-LD Blocks: Write clean script blocks using nested key-value parameters.
Insert sameAs Anchors: Anchor your organisation description to verified external database directories.
Validate File Syntax: Use online JSON validators to confirm syntax correctness before deployment.
Cross-Link Local Files: Ensure related articles point to the same global Organization schema file to maintain consistency. To learn about link structural strategies, check our comparison of WordPress vs custom web development.

A Practical Schema Checklist

Before you write a single line of JSON-LD, work through the entities a retrieval bot actually needs to understand your page. The checklist below is the sequence we follow when auditing a client site for AI visibility.

Declare one canonical Organization for the whole site, with a stable @id, then reference it everywhere else instead of redefining it on every page.
Add sameAs anchors to your Wikidata, LinkedIn, and Crunchbase records so parsers can reconcile your brand with existing knowledge graphs.
Mark up every article with Article (or BlogPosting), including author, datePublished, and dateModified.
Expose an FAQPage wherever you answer genuine questions, and keep the visible text identical to the schema text.
Use specific types — SoftwareApplication, Service, Product — rather than the generic Thing.
Connect entities with @id references so the crawler reads a single graph, not a pile of disconnected cards.
Render schema server-side so bots that do not execute JavaScript still receive it.
Validate every template in your build pipeline before it ships.

The table below maps the schema types that carry the most weight for conversational engines to what each one signals and how urgently you should implement it.

Schema type	What the crawler extracts	Priority
`Organization`	Brand identity, location, founders, trust links	Essential
`Article` / `BlogPosting`	Topic, author, freshness, canonical URL	Essential
`FAQPage`	Direct question-and-answer pairs	High
`Service` / `SoftwareApplication`	What you sell and to whom	High
`Product` / `Offer`	Price, availability, ratings	High for e-commerce
`BreadcrumbList`	Site hierarchy and page context	Medium

JSON-LD Examples You Can Adapt

The blocks below are production patterns rather than fragments. Each one belongs inside a `

Optimize Your Website for ChatGPT Search and Perplexity

Mecanik1337 — Mon, 31 Aug 2026 18:00:00 +0000

OpenAI and Perplexity are changing how users discover business platforms, and ChatGPT Search SEO is fast becoming as important as ranking on Google. These conversational engines do not display a traditional list of indexed links. Instead, they synthesise a single unified response and link to source material via in-text citations. To stay visible, websites must be built for AI retrieval architectures rather than blue-link rankings. This guide outlines how to configure your indexation setup, format your data to win AI references, and optimise for both ChatGPT Search and Perplexity.

Developer Insight: ChatGPT Search uses a user-agent named OAI-SearchBot for live citations, which differs from GPTBot (used for model training). You can allow OAI-SearchBot to index your site for real-time citations while blocking GPTBot if you want to restrict model training on your proprietary code.

Key Takeaways:

Win Citations: Format content with direct definitions and clean tables to feed AI scrapers.

Crawl Paths: Configure robots.txt to permit OAI-SearchBot and PerplexityBot access.

Structured Schemas: Expose JSON-LD schema markup to describe entity relationships.

Trust Profiles: Build backlinks and secure entity citations on major review hubs.

The Shift to Conversational Search

Traditional SEO relies on keyword matching to rank static pages. Conversational search works differently: it feeds retrieval engines that construct answers dynamically. When configuring your backend for these systems, developers must establish clean API responses and structured data schemas, allowing conversational spiders to parse text segments without overhead.

When a user submits a query to ChatGPT or Perplexity, the system queries its web index. It collects raw text snippets, analyses the query context, and constructs a logical response. It then selects the most authoritative sites to link as inline citations. Understanding how these retrieval pipelines score sources is therefore essential, because you need high-density, factual content to ensure your site is the one that gets selected.

Because these models use live index databases, keeping your site fast is crucial. Slow platforms or complex scripts cause crawler timeouts, preventing indexing.

{{< cta-button url="/services/seo-audit/" text="Book an SEO Audit" >}}

This guide zooms in on ChatGPT Search and Perplexity; for the wider strategy across every AI engine, start with our Generative Engine Optimization (GEO) guide.

Technical Indexing for AI Bots

To optimise for ChatGPT Search and Perplexity, you must manage crawler access. Both entities deploy specific index bots that you must accommodate in robots.txt.

User-agent: OAI-SearchBot
Allow: /

User-agent: PerplexityBot
Allow: /

Verify, too, that your server does not block requests from these bots. Some firewalls automatically flag AI user-agents as suspicious scraping traffic, blocking their connection.

Furthermore, ensure your frontend structures are easily readable. Bloated JavaScript elements and unformatted tables hinder text extraction. If you want to optimise your backend architecture for indexing speed, read about our website development services.

Optimising for Perplexity SEO Citations

Perplexity operates as a real-time retrieval machine. It prioritises factual density, external references, and semantic structure. Rather than writing long narratives, focus on presenting information in high-utility blocks.

LLMs prefer to extract exact figures, years, and specific percentages. Therefore, writing direct definitions at the top of your paragraphs is highly recommended. Linking to high-domain entities indicates that your text is researched. This practice is supported by official guides; you can read about web indexes in the OpenAI Bot Documentation.

Furthermore, Perplexity often outputs comparisons as tables. Formatting your product statistics using clean HTML or markdown tables helps the crawler scrape and render it cleanly.

Designing Content for ChatGPT Search

OpenAI's search model relies on user intent mapping. It groups similar queries and looks for synthesis pages that solve user problems.

To design for this architecture, you must write conversational content. Focus on long-tail search questions that users type directly into chatbots. For instance, rather than optimising for "CMS comparison," write a paragraph answering "Which headless CMS is best for an enterprise database?" Direct query mapping is the strongest driver of visibility here, so your paragraphs should address these complex technical questions head-on.

Additionally, cross-link your articles. Creating a strong logical mesh helps ChatGPT trace related information. To learn about structural internal linking, check out our guide on WordPress vs custom web development.

AI Crawler User-Agents at a Glance

Different bots do different jobs, and confusing them is the most common configuration mistake. Blocking GPTBot, which gathers training data, does not affect whether ChatGPT Search can cite you: that job belongs to OAI-SearchBot. The table below maps each agent to its purpose so you can decide what to allow.

User-agent	Operator	Purpose	Typical decision
`OAI-SearchBot`	OpenAI	Indexes pages for ChatGPT Search citations	Allow
`ChatGPT-User`	OpenAI	Fetches a page when a user asks ChatGPT to browse it	Allow
`GPTBot`	OpenAI	Collects training data for future models	Optional (block to opt out)
`PerplexityBot`	Perplexity	Indexes pages for Perplexity answers and citations	Allow
`Perplexity-User`	Perplexity	Visits a page on a live user request	Allow
`Google-Extended`	Google	Controls use of content for Gemini training	Optional

A frequent goal is to appear in AI answers without handing your content to model training. This configuration permits the retrieval crawlers while opting out of the training ones:

# Allow AI search and citation crawlers
User-agent: OAI-SearchBot
Allow: /

User-agent: ChatGPT-User
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: Perplexity-User
Allow: /

# Opt out of model training
User-agent: GPTBot
Disallow: /

User-agent: Google-Extended
Disallow: /

Remember that robots.txt rules are directives honoured by compliant operators, not a security control. Keep genuinely private data behind authentication rather than a Disallow line.

Structured Data That AI Retrievers Read

Retrieval systems reward pages whose meaning is machine-explicit. A short JSON-LD block that names the entity, its author, and its subject gives a model clean facts to quote rather than prose it has to infer. A minimal Article schema looks like this:

{
  "@context": "https://schema.org",
  "@type": "Article",
  "headline": "How Headless CMS Platforms Handle Enterprise Databases",
  "author": { "@type": "Organization", "name": "Your Company" },
  "datePublished": "2026-07-20",
  "about": "Headless content management",
  "mainEntityOfPage": "https://example.com/headless-cms-guide/"
}

Phrasing matters as much as markup. Retrievers extract self-contained sentences, so lead with the answer and keep the subject explicit. Compare two openings for the same paragraph:

Before: "It depends on your stack, but there are a few things to weigh up first."
After: "A headless CMS suits enterprise teams that need to serve one content source to a website, a mobile app, and an internal dashboard at once."

The second version can be lifted verbatim into a generated answer with a citation attached; the first cannot stand on its own.

Step-by-Step GEO Implementation Checklist

To format your pages for AI visibility, perform this workflow:

Format for Direct Answers: Place a concise 2-sentence summary below every ## heading.
Add Domain Schema: Ensure your JSON-LD schema describes your business, local services, and articles correctly.
Secure Web Citations: Earn reviews on platforms like Trustpilot or Clutch. AI crawlers scrape these hubs to build entity trust graphs.
Audit Web Performance: Ensure your pages load in under 1 second so AI spiders index them without delay.
Monitor Search Crawl Logs: Track how often ChatGPT Search and Perplexity crawl your platform. Look for 403 or 429 response codes in your logs, which indicate blockages, and clearing these is an essential technical step for AI visibility.

How to Measure AI-Referral Traffic

You cannot improve what you cannot see, and AI referrals do not appear in the standard Google Search Console performance report. Track them through three channels instead.

Analytics referrals. In Google Analytics 4, segment session source for hostnames such as chatgpt.com, perplexity.ai, and gemini.google.com. These arrive as ordinary referral traffic and show which pages are earning clicks from AI answers.
Server and edge logs. Filter your access logs, or Cloudflare's, for the user-agents listed above. How often OAI-SearchBot and PerplexityBot visit tells you whether your content is being re-indexed, and a rise in 403 or 429 responses flags accidental blocking.
Citation-tracking tools. Platforms such as Ahrefs Brand Radar and Semrush, along with dedicated monitors like Profound, now report when your domain is cited in AI answers. Without one, run your priority queries manually in ChatGPT and Perplexity once a month and record which sources they cite.

Watch two signals together: how often the search bots crawl you, which is the supply side, and how much referral traffic those citations return, which is the demand side. A page that is crawled often but never cited usually needs clearer, more extractable answers rather than more crawl access.

Common Mistakes That Cost You Citations

Blocking the wrong bot. Aggressive firewalls and broad robots.txt rules often ban OAI-SearchBot alongside genuine scrapers, quietly removing you from citations.
Burying the answer. Long preambles before the point give retrievers nothing clean to extract. State the direct answer in the first sentence under each heading.
Client-side-only rendering. If key content appears only after JavaScript runs, expect partial or missed indexing. Serve a static HTML representation of the important text.
Thin or unverifiable claims. Figures without sources read as low-trust. Cite reputable references and keep dates and numbers current.
Inconsistent entity data. A business name, address, and description that differ across your own site and third-party profiles weaken the trust graph these models rely on to verify you.

Key Takeaways

Conversational search engines display synthesised answers backed by inline citations.
Allow OAI-SearchBot and PerplexityBot crawlers access in your robots.txt.
Format text with direct answer summaries and clean tables to support data scraping.
Design content to answer long-tail conversational queries rather than short keywords.
Secure citations on third-party review platforms to strengthen your trust profile.

Frequently Asked Questions

How do I optimise my site for chatgpt search seo?
To rank on ChatGPT Search, you must ensure your robots.txt allows OAI-SearchBot access, write direct answers to long-tail conversational queries, and build authoritative backlinks. Because ChatGPT Search maps user queries to synthesised blocks in real-time, your pages must load near-instantly and contain structured schemas so the retriever can easily parse and verify your data.

What is Perplexity SEO?
Perplexity SEO represents the practice of optimising content so Perplexity AI references and links to your website in its conversational search results. This optimisation relies heavily on factual density, semantic entity mapping, and outbound citations. Consequently, using clean Markdown tables, lists, and direct answers increases the likelihood that Perplexity's retrieval pipeline extracts your content.

Do traditional backlinks still matter for AI search?
Yes, traditional backlinks remain critical because AI search engines use them to evaluate the trust and authority of your domain before citation. Conversational models prioritise domains with strong backlink profiles to reduce the risk of serving hallucinated or unverified data to users.

Which crawler agents index sites for ChatGPT Search and Perplexity?
ChatGPT Search utilises the OAI-SearchBot agent to index web content in real-time, whereas Perplexity relies on PerplexityBot and third-party API crawls. Developers should permit these specific user-agents in their site configuration, ensuring that rate limits or server blockages do not prevent their indexing pipelines from scanning pages.

Do conversational search engines index javascript-heavy frontend sites?
Yes, modern conversational search crawlers can parse JavaScript-heavy client-side pages, but they strongly prefer static HTML representations to minimise rendering cost. Consequently, developers should configure server-side rendering (SSR) or pre-render pages into clean static scripts to guarantee index accuracy.