DEV Community: Greg Miller

Why email forwarding broke

Greg Miller — Wed, 28 Oct 2026 12:30:00 +0000

“My American Express e-mail used to forward. Now it bounces! Everything they send me gets kicked back. Please research this.”

That was a message from a client this week, and this has been a reoccuring conversation over the past few years, since he became my client. He has forwarded his business email to a personal account for his entire working life, around 30 years. Until the 2020s, it reliably worked. Things have changed. His bank’s messages bounce, and he believes his email provider is responsible for fixing the problem. When I took him on, I definately wanted to move him off of his longtime email provider, Network Solutions , they did not help, but their email service was not the cause of this problem.

A habit that worked for three decades broke, and he refuses to believe that he has to change his behavior. But it’s bad business practice to forward all of your email to a personal account. It’s a security risk, and it’s not good for your brand. The problem isn’t the mail service provider. It’s the forwarding itself. It would happen with any provider, and the proof is a single command you can run in a few seconds.

Open Table of contents

What changed

Email was built on trust. Any server could claim to send mail from any address, and for a long time that mostly worked. Then phishing became a business, and banks became the favorite thing to impersonate.

The industry answered with three layers of checks, added over about fifteen years:

SPF (mid-2000s): the domain publishes a list of servers allowed to send its mail. The receiver checks whether the sending server is on the list.
DKIM (2007): the sender attaches a cryptographic signature to the message. The receiver checks that the message still matches it. Think of a wax seal on a letter: if the contents were changed, the seal won’t match.
DMARC (2012): the domain publishes a policy that says what to do when those checks fail. p=none means “just report it,” p=quarantine means “send it to spam,” and p=reject means “refuse it outright.”

Adoption was slow until providers got serious. In 2014, Yahoo and AOL published p=reject for their own domains, and it famously broke mailing lists overnight. In 2024, Google and Yahoo started requiring authentication from bulk senders. Each step made receivers less forgiving of mail that can’t prove where it came from.

That’s why this “suddenly” broke. Forwarding didn’t change. The rules around it did.

Why forwarding breaks the checks

When you forward a message, you are a middleman. Your server re-sends someone else’s email, and that causes two problems:

SPF fails. The message now comes from your forwarding server, which isn’t on the bank’s approved list.
DKIM sometimes fails. If anything in the message changes along the way (a footer, a subject tag), the seal no longer matches.

If both checks fail and the bank has told the world p=reject, the receiving system is doing exactly what the bank asked: refusing the message. Receivers differ in how strictly they enforce it, and AOL is one of the stricter ones.

There are fixes on the forwarder’s side (SRS rewrites the sender address, and ARC lets a forwarder vouch for what it saw), but they depend on every system in the chain supporting them. You don’t control that, and neither does your bank.

ModernMail stands in for the mailbox. Direct delivery keeps the signature.
The forward to AOL breaks it, and the bounce goes back to the bank.

Swap that mailbox for any other host and the check still fails. The strict receiver is what bounces it.

Prove it with one command

Don’t take my word for it. Your bank publishes its policy in public DNS. On a Mac or Linux terminal:

dig TXT _dmarc.americanexpress.com +short
dig TXT _dmarc.chase.com +short

On Windows:

nslookup -type=TXT _dmarc.americanexpress.com

When I ran these, both returned p=reject:

"v=DMARC1;p=reject;fo=1;rua=mailto:..."
"v=DMARC1; p=reject; pct=100; rua=mailto:..."

The pct=100 on the second one means the policy applies to every message. These policies can change, so run the check yourself.

Don’t go cold turkey

The cleanest fix is to stop forwarding. But telling someone to abandon a 30-year habit overnight is a good way to lose their trust. Here is a staged approach that worked for this client.

Deliver mail directly to a real mailbox. Mail for the business address lands in a proper hosted mailbox first, with no forwarding step. The bank’s messages arrive intact. Any decent provider works; the point is that the bank’s message goes straight to the place you read it.
Keep forwarding for the mail he actually wants elsewhere. Instead of forwarding everything except the bank, flip it: forward only a short list of trusted senders (clients, family). Anything a rule misses stays in the new inbox instead of silently bouncing.
Give financial accounts a private alias. An address like finance@yourdomain.com that goes to the same inbox but isn’t published anywhere. Point your banks to it, and write one rule that catches everything sent to that alias. It’s also harder for scammers to guess or spoof.
Set a review date. After 30 days, check whether the old inbox still has anything important. Most people find they’ve stopped opening it.

One caution: “forward everything except the bank” looks easier, but it’s fragile. Banks send from several addresses, and other organizations (payment processors, insurers, government agencies) use the same strict policies. A bounce goes to the sender, so you never see what you missed.

As a bonus, once mail is sent from the proper address, the “I may be replying from a personal device” line in a signature isn’t needed anymore. What people mail to is what they get replies from. ModernMail makes a great mobile app. Users may find it a better fit for their needs than a traditional, You’ve got mail! inbox.

Why forwarding is a security risk

A business owner owes that standard to the clients who trust the company with their money, and to the people inside the organization who have to live with the setup. Forwarding business mail into a personal inbox is a security problem. Bank alerts, invoices, and client threads land in an account the business does not control. The checks that prove a message is real get stripped on the way, and a bounce goes back to the sender, so a fraud notice can vanish without anyone at the company seeing it. Replying from a personal address also trains customers to trust mail that did not come from the company domain. That is the habit phishers count on.

The address on the door is part of the brand. When a message arrives, gets answered, and comes back from the same domain, the business looks like it is paying attention. Missed mail, bounced bank notices, and a signature that apologizes for a personal device do the opposite: they make a careful company look careless. Cleaner email protects the clients and the staff, and it makes the business easier to trust with the next invoice.

Need help with this?

If you have a client, a family member, or your own business email forwarding through Gmail , AOL , or Yahoo and you’re seeing bounces, spam folder surprises, or “I never got that” moments, this is a fixable problem. I help small businesses build their brand, establish stronger email security, improve their email deliverability, and more. I help clients move to reliable email, set up the DNS records (SPF, DKIM, DMARC) behind it, and make the transition gentle enough that people actually stick with it. If you want to learn more about ModernMail, I’m happy to share what we’re using to help our clients.

Shrinkray Interactive can take that handoff: the mailbox, the DNS, and a plan the person will still be using a month later.

Facts in this post were checked against public sources on October 27, 2026. DMARC policies change, so verify with dig before telling a client.

Turn Your Idle Terminal into a Retro Screensaver with Native Zsh and Homebrew

Greg Miller — Thu, 15 Oct 2026 19:00:00 +0000

Terminal customization usually focuses on status prompts, completions, and syntax highlighting. Adding animations when you step away from your keyboard brings back classic desktop nostalgia without bloating your dotfiles.

Many developers search for Oh My Zsh screensaver plugins, only to hit broken clone URLs, abandoned repositories, or unmaintained dependencies. Zsh already contains the primitives needed to detect idle state and launch commands.

This guide demonstrates how to configure automatic, randomized terminal screensavers using native Zsh parameters and Homebrew.

Open Table of contents

The problem with shellsaver plugins

Searching for terminal screensaver plugins often leads to dead ends:

fatal: repository 'https://github.com/luisico/shellsaver.git/' not found
[oh-my-zsh] plugin 'shellsaver' not found

Framework plugins frequently go unmaintained because external wrappers add unnecessary complexity. Zsh ships with a built-in idle detection mechanism: TMOUT and TRAPALRM. Bypassing third-party plugin managers yields three distinct benefits:

Zero framework lock-in: The logic runs on vanilla Zsh, Oh My Zsh, Prezto, or custom dotfiles.
Instant process recovery: Pure shell traps trigger reliably without background daemon memory leaks.
Pluggable CLI ecosystem: Any program that prints to stdout functions as a screensaver.

Step 1: Install terminal animation packages

Homebrew provides several polished, low-overhead animation utilities. Install a foundational collection:

brew install cmatrix pipes-sh asciiquarium cbonsai

The animation suite

cmatrix: The classic green cascading code rain from The Matrix.
pipes.sh: The nostalgic animated pipe maze from Windows 95 screensavers.
asciiquarium: An animated marine ecosystem with fish, ducks, sharks, and seaweed.
cbonsai: An ASCII bonsai tree generator featuring procedural branch growth.

Test each tool manually in your shell before configuring the automation:

cmatrix -s
pipes.sh -R
asciiquarium
cbonsai -S

Press q or Ctrl + C to exit any active animation (or tap any key if running cmatrix -s or cbonsai -S).

Step 2: Configure the native Zsh trap

Zsh tracks idle time via the special shell integer variable TMOUT. When the terminal remains inactive at an empty prompt for the number of seconds defined by TMOUT, Zsh triggers an internal ALRM signal. The shell function TRAPALRM() intercepts this signal and executes custom commands.

Good to know: TMOUT only counts down while the shell is idle at an interactive prompt. It will never interrupt running builds, test suites, or active foreground processes.

Shell-local parameter: Always set TMOUT=120 without export. Exporting TMOUT into your environment causes child processes (such as bash scripts or subshells) to inherit the timeout without your TRAPALRM handler, causing them to terminate after 120 seconds of inactivity.

Before configuring the trap, check if your shell already defines an existing TRAPALRM handler:

typeset -f TRAPALRM

If your terminal prints an existing function body (such as an auto-logout policy or a prompt redraw timer), you can chain it so both behaviors run without conflict.

Open your Zsh configuration file:

nano ~/.zshrc

Append this block to the bottom of the file:

# ==========================================
# Terminal Screensaver on Idle
# ==========================================

# Idle duration in seconds before trigger (120 = 2 minutes)
# Keep TMOUT shell-local so child subshells do not inherit it
TMOUT=120

# Screensaver core routine
_zsh_screensaver() {
    # Ensure execution only occurs inside interactive shell prompts
    if [[-o interactive]]; then
        # Define candidate animation commands
        local savers=(
            "cmatrix -abs"
            "pipes.sh -p 4 -R"
            "asciiquarium"
            "cbonsai -S"
        )

        # Select a random item from the array (1-indexed in Zsh)
        local pick=${savers[$(( RANDOM % ${#savers[@]} + 1 ))]}

        # Clear screen, execute selected screensaver, then clear again
        clear
        eval "$pick"
        clear
    fi
}

# Preserve any external TRAPALRM handler (refreshes if an external handler was edited)
if typeset -f TRAPALRM >/dev/null 2>&1; then
    case "$functions[TRAPALRM]" in
        *_zsh_screensaver*) ;;
        *) functions -c TRAPALRM _previous_trapalrm ;;
    esac
fi

TRAPALRM() {
    # Execute existing handler first; guard with || true to prevent aborts under ERR_RETURN / ERR_EXIT
    if typeset -f _previous_trapalrm >/dev/null 2>&1; then
        _previous_trapalrm || true
    fi

    _zsh_screensaver
}

Save changes (Ctrl + O, Enter) and exit nano (Ctrl + X).

Reload your shell environment:

source ~/.zshrc

Step away from your keyboard. After two minutes of inactivity, Zsh triggers an animation at random.

Step 3: Exit keys and terminal state recovery

Stopping an active screensaver

Exit keys vary slightly depending on how each binary handles raw input:

Any keypress: Exits cmatrix -abs and cbonsai -S instantly, restoring your prompt the moment you resume typing.
Press q: Safest exit for pipes.sh and asciiquarium. This key triggers clean curses teardown routines.
Press Ctrl + C (SIGINT): Sends a termination signal if standard keys fail to respond.

Fixing invisible cursors (stty sane)

Interactive CLI programs modify terminal driver flags, hiding the cursor or turning off echo mode. An abrupt exit via Ctrl + C occasionally interrupts terminal teardown, leaving your prompt invisible or garbled.

When your prompt ceases to display typed input or hides the cursor, run:

stty sane

Or run the deeper terminal initialization command:

reset

stty sane instantly restores canonical terminal settings:

Flag	State restored
`echo`	Renders typed keys on screen
`icanon`	Restores standard line editing
`cursor`	Restores visibility indicator

Step 4: Verification checklist

Validate your implementation:

Syntax check: Run typeset -f TRAPALRM in your shell. The terminal must print the function body defined in your .zshrc.
Idle execution: Set TMOUT=5 temporarily in your active terminal. Wait five seconds. Confirm execution of a randomized animation.
Cursor persistence: Terminate the animation. Verify that your command prompt returns cleanly with a visible cursor.
Clean profile: Reset TMOUT=120 for routine daily use.

Pro-tip: Temporarily disabling the screensaver

If you are giving a live demo, screen sharing, or recording a tutorial, you might not want animations interrupting your pauses:

# Temporarily disable idle triggers in the current shell session
unset TMOUT

# Re-enable when finished
TMOUT=120

Summary

Custom terminal screensavers require neither heavy dependencies nor unmaintained plugins. By pairing Zsh’s native TMOUT and TRAPALRM with Homebrew CLI tools, you gain a dependable, modular idle screensaver that protects your workflow while adding personality to your desk setup.

Taming WordPress Multisite Bottlenecks: Bot Mitigation & Cron Health with a Custom Plugin

Greg Miller — Tue, 28 Jul 2026 12:50:00 +0000

Managing high-traffic WordPress Multisite networks often reveals unique performance challenges. In large setups, standard off-the-shelf security or optimization plugins can introduce their own bloat, compounding the very issues they are meant to solve.

At the end of June 2026, we deployed a custom-engineered solution— UXPA Network Performance & Guard Suite —to address two persistent bottlenecks identified in server log audits: aggressive, automated bot harvesting and recurring database option table serialization locks.

The Root Performance Bottlenecks

1. Automated Credential Harvesting via Username Enumeration

Bots continuously probe WordPress sites searching for valid administrative and author usernames. They typically target default query endpoints:

Query strings targeting author archives: /?author=N
Core REST API user endpoints: /wp-json/wp/v2/users or /wp-json/wp/v2/users/me

While standard security utilities can block these requests, letting every malicious scan boot up the full WordPress core, query the database, and execute complex plugin chains causes significant CPU and memory spikes. On a multisite network, this traffic degrades performance for genuine users across every sub-site.

2. Cron Array Serialization Failures

WordPress stores scheduled tasks inside a single serialized database option (cron). When background libraries like Action Scheduler accumulate tens of thousands of historic, failed, or duplicate events, this option row balloons in size.

Eventually, writing updates to this database row hits MySQL packet limits or thread locks, resulting in repeated system errors:Cron reschedule event error for hook: action_scheduler_run_queue... Error code: could_not_set

When action_scheduler_run_queue fails to save its state, background processing stalls, creating a cascading backlog.

The Solution: UXPA Network Performance & Guard Suite

To solve these issues without adding third-party plugin overhead, we engineered a dedicated, lightweight network suite.

Key Architectural Capabilities

Early-Exit Firewall: Intercepts username enumeration attempts during the early init hook execution phase. It drops connection requests immediately before WordPress initializes heavy database queries or theme resources.
Cron Database Health & Pruning: Keeps the scheduler array lean by automatically stripping duplicate task hooks and offering a single-click queue purge.
Action Scheduler Retention: Limits completed action log retention to 7 days (down from the 30-day default), keeping table sizes under control.
Threat Intelligence Integration: Outbound links within the dashboard allow administrators to audit offending IP addresses directly on AbuseIPDB.

Investigating Threats with AbuseIPDB

When an IP triggers our early-exit firewall, the dashboard provides direct lookup links to verify its threat profile before applying permanent edge or host-level blocks.

For example, looking up an offending IP (102.220.160.79) shows a 100% Abuse Confidence Score with 427 recent reports of failed WordPress logins and web application attacks. This confirms that the early-exit firewall is catching legitimate malicious actors.

Managing Security & Blocking Strategies

The plugin dashboard aggregates threat statistics and offers quick export options for off-site auditing.

When an IP demonstrates persistent malicious behavior, we employ a multi-layered blocking strategy:

1. Edge-Level Blocking (Cloudflare)

Offloading blocked IPs to Cloudflare WAF drops malicious traffic at the CDN edge, preventing requests from reaching our web server entirely.

2. Host-Level Rules (WP Engine)

For persistent subnet probes, we configure access rules directly within the WP Engine control panel.

Adding IP deny rules at the host level stops the traffic at the web server layer (Nginx/Apache), protecting PHP execution limits.

Restoring Scheduler Health

The Cron Health tab provides immediate visibility into the underlying state of the WordPress scheduler array.

Performance Diagnostics Delivered:

Cron Option Size Tracking: Keeps the serialized byte count visible (currently stabilized at a clean 8.12 KB).
Scheduled Event Auditing: Monitors the total number of active queue items (49 total events).
Duplicate Event Cap: Enforces strict limits on repetitive hook registrations to prevent option row bloat.
Manual Queue Purge: Provides a one-click mechanism to purge historic Action Scheduler logs instantly.

Opportunities for Future Improvement

While the suite has successfully stabilized background queue processing and short-circuited bot traffic, there are several areas targeted for future enhancement:

Dedicated Custom Database Table (dbDelta Migration):

Current State: Telemetry data uses bounded update_site_option() writes. In WordPress Multisite, sitemeta options preload across the entire network on every page request.
Enhancement: Transition log storage to a dedicated custom table (wp_uxpa_security_logs). This will remove telemetry writes from the preloaded network memory path entirely, allow longer log retention windows, and enable fast indexed per-IP querying.

Automated Cloudflare API Integration:

Current State: High-volume offending IPs are reviewed manually before copying them into Cloudflare or host firewall lists.
Enhancement: Add an optional Cloudflare API endpoint integration to allow one-click IP banning directly from the plugin dashboard into Cloudflare WAF rulesets.

Automated Cron Array Auto-Recovery:

Enhancement: Implement an automated health check that detects if the core cron option string becomes corrupted or un-serializable, automatically executing an array repair routine to prevent execution stalls entirely.

Let me build a custom plugin for your community or multisite website

Need a custom WordPress plugin tailored to your community, business, or multisite website? Shrinkray Interactive is here to help. We research your specific needs and design, evaluate, implement, and continuously improve your white-labeled plugin.

Ready to lock down your network? Reach out to Greg to get your own custom plugin developed today!

Reasons to set up a Cloudflare Tunnel

Greg Miller — Sat, 20 Jun 2026 10:00:00 +0000

Let’s say you are running a service on your home network—maybe a smart home dashboard (like Home Assistant), a private website you’re coding, or a home file server. You want to be able to access it when you are away from home, or you want a friend to look at it.

To let the outside internet in, the old-school method is called port forwarding. This is the digital equivalent of unlocking a specific window in your house, publishing your home address to the world, and hoping no burglars notice the open window.

Cloudflare Tunnel changes the game. Instead of unlocking any windows, your home computer reaches out to Cloudflare’s secure servers in the cloud and establishes a private, encrypted hallway between them. When someone wants to visit your site, they talk to Cloudflare, and Cloudflare passes the message back to your computer through this private hallway. No windows are unlocked, and your home address remains hidden.

Do I need this?

If you are running a self-hosted app, home server, or development site and need it safely accessible from the internet, a Cloudflare Tunnel is the gold standard. If you’d rather not deal with the configuration, DNS routing, or firewall settings yourself, Shrinkray Interactive can handle the entire setup for you.

To learn how tunnels work and why they are so secure, see below.

Ready to secure your network? Reach out to Greg to get your own custom tunnel configured today!

Open Table of contents

You stop opening doors on your router

Ports are like doors on your internet router. By default, your router blocks all incoming traffic to keep you safe. Port forwarding means you carved a small pet door into your firewall and pointed it directly at your device (like a home storage drive or computer).

The problem is that automated bots crawl the internet 24/7, shaking every door handle they can find. If you leave a port open, those bots will find it and try to exploit outdated software or guess your passwords.

With a tunnel, you don’t open any doors. The tunnel software (a tiny program running on your computer) makes an outbound connection. It’s like your computer calling out to Cloudflare and keeping the phone line open. Traffic comes in through that phone line, meaning your router’s doors remain locked tight.

For homelabs, side projects, and small business gear sitting on a consumer connection, that is a meaningful security upgrade without buying enterprise hardware.

If they can’t find your door, they can’t knock on it

Attackers can’t hack what they can’t see. When you use port forwarding, your public IP address is exposed, meaning anyone can scan your connection. If there is a bug (a security vulnerability) in your home software, they can exploit it.

With a tunnel, your home setup is invisible to the public internet. Visitors only see Cloudflare’s massive network. Think of Cloudflare as a highly trained security guard standing at the entrance of a gated community. If a bot or hacker tries to spam your site or send malicious traffic, the guard blocks them at the gate before they ever get near your actual home network.

Changing home addresses stops being a headache

Every home internet connection has an IP address—think of it as your house’s mailing address. However, home internet providers constantly change this address every few days or weeks (this is called a “dynamic IP”). If you are hosting a website, this means your site’s address is constantly changing, making it impossible for people to reliably connect to it.

Normally, you have to buy a costly “static IP” or set up complicated updater tools (Dynamic DNS) that break when you least expect it.

Because a Cloudflare Tunnel keeps a constant connection open from your computer out to Cloudflare, it doesn’t matter if your home’s mailing address changes. Cloudflare always knows where your computer is because the computer is the one keeping the connection alive. Your website name (like myproject.com) stays online without you needing to lift a finger.

Free security padlocks without the headaches

When you visit a website, you expect to see the secure padlock icon in your browser address bar. This is powered by HTTPS and an SSL/TLS certificate—a digital security badge proving your site is secure.

Setting up these certificates on your own home computer is notoriously frustrating. You have to install renewal tools, make sure they run every few months, and configure complex server software. If something breaks, visitors get a scary “This site is not secure” warning.

When you use a tunnel, Cloudflare automatically provides and manages the SSL certificate for you. Visitors get a secure, encrypted connection to Cloudflare, and Cloudflare encrypts the rest of the journey to your home computer. You get the padlock icon instantly without configuring any certificate tools at home.

Your small project gets enterprise-grade shields

Your home computer or a cheap virtual server was never designed to handle thousands of visits at once. If your site gets popular, or if a malicious group tries to overwhelm it with fake traffic (a DDoS attack ), your home internet will crash.

By routing your traffic through Cloudflare’s tunnel, you get to borrow their massive global network. If a flood of traffic hits your site, Cloudflare absorbs it and only sends the legitimate visits down the tunnel to your home computer. It’s like having a giant buffer that prevents your home internet from being knocked offline.

Add a bouncer to your site in two clicks

Just because your project is online doesn’t mean you want the public to see it. Maybe it’s a private family photo album or a dashboard for your home smart devices.

Normally, keeping these secure means setting up a complex VPN (Virtual Private Network) or managing logins inside your app.

With Cloudflare, you can turn on a feature called Cloudflare Access. This acts like a bouncer at the door. Before anyone is even allowed to see your website, they have to log in using an approved method—like their Google account, GitHub, or a one-time email code. If they aren’t on the list, Cloudflare turns them away before they ever reach your computer.

Easy integrations for developers (Webhooks)

If you are building apps, you often need external services to send messages to your local computer. For example, when someone pays you on Stripe or pushes code to GitHub , those services need to send a notification (a “webhook”) to your project.

Getting these notifications to reach a computer in your living room is incredibly hard because home networks block outside requests by default.

A tunnel gives you a simple, public link that connects directly to the app running on your computer. You can test payment systems, chat bots, and other tools on your own computer without having to pay for online servers or mess with insecure router settings.

It works even when your internet provider blocks you

Many modern internet providers use a technology called CGNAT (Carrier-Grade NAT). Essentially, they share a single public IP address among hundreds of different homes in your neighborhood. Because of this, traditional port forwarding is physically impossible—you don’t have your own “front door” to unlock.

Similarly, if you are at an office, a university, or a coffee shop, their firewalls will block any incoming connections.

But because a Cloudflare Tunnel is an outbound connection (your computer initiating the call to Cloudflare), CGNAT and strict network firewalls don’t block it. If your computer can browse the web, it can host a tunnel.

The free plan is actually free and powerful

Usually, security tools like this are expensive or have severely limited free plans. Fortunately, Cloudflare’s tunnel feature is completely free for personal use, side projects, and small teams. You can run multiple tunnels, connect different projects, and secure them with login screens without paying a cent.

When is a tunnel not the right tool?

Tunnels are amazing for making a specific app or website reachable. But they aren’t a cure-all:

If you need access to your entire home network: If you want to connect to your home printer, your smart TV, and all your computers at once while away, a VPN (like WireGuard or Tailscale) is a better choice.
If you have strict data privacy needs: Since all traffic goes through Cloudflare’s servers to be inspected for security, companies with strict government compliance rules may not want their data passing through a third party.

Time to lock the doors

Setting up a tunnel usually takes under ten minutes. You install a small helper program, log in to your Cloudflare account, name your website, and point it at the app running on your computer.

Once you do, you can log into your home router and lock every single inbound port. You stop thinking about your home’s public IP address as your front door. Cloudflare becomes your front door, your bouncer, and your security system—giving you peace of mind that your home network is completely secure.

Let me build your own Custom Tunnel

If you want to secure your self-hosted websites, home servers, or private projects but don't want to wrestle with command line tools, DNS setups, or firewall settings, Shrinkray Interactive is here to help. We can design and implement secure outbound tunnel architectures, configure authentication bouncers, and audit your remote access setups to make sure your home or business network stays completely protected.

Ready to lock down your network? Reach out to Greg to get your own custom tunnel configured today!

Hunting Dictionary Bots: Inside a Sophisticated WordPress Membership Attack

Greg Miller — Wed, 27 May 2026 12:00:00 +0000

Automated registration spam is shifting away from traditional brute-force tactics. Standard security layers often fail against modern bot scripts that pass visual challenges and bypass baseline web application firewalls. These advanced campaigns mimic legitimate human patterns to compromise open registration endpoints.

This post examines the mechanics of Dictionary Attack Bots , details the concrete risks they pose to membership platform integrity, and provides implementation code to secure your user tables.

The Membership Threat: Impact by the Numbers

Allowing automated registrations to pool in your database creates immediate operational hazards:

42% Database Inflation: Automated accounts distort core engagement metrics. They skew active user KPIs, churn rates, retention tracking, and email marketing segmentation analytics.
Origin Server Overhead: Bulk account creation triggers repetitive INSERT queries, invalidates user cache clusters, and drives high CPU utilization.
8.3x Email Delivery Risk: Automated sign-ups generate high bounce rates and trigger spam complaints during onboarding automation. This degrades your transactional email domain authority and lands critical system emails in user spam folders.
Downstream Vulnerabilities: Attackers weaponize these dormant accounts later for credential stuffing, automated API scraping, or content/comment injection.

Anatomy of the Exploit: Dictionary Word Pairing

Traditional registration scripts rely on randomized character strings (e.g., xj947_ktr). Modern security filters identify and block these strings easily. To circumvent detection, this script uses coordinated dictionary pairings.

The bot engine generates identifiers by combining two distinct English dictionary terms, appended with a single or double digit: [Noun/Adj] + [Noun] + [Digit]. This structure targets validation suites that assume standard dictionary terms indicate human input.

Data from an active database trace reveals clear structural patterns across separate registration batches:

User ID	Registered Username	Target Domain Name	Structural Formula
4372	`basketoption7`	`koiot.de`	`[Noun] + [Noun] + [Digit]`
3537	`basketperch1`	`koiot.de`	`[Noun] + [Noun] + [Digit]`
4341	`basketriver9`	`koiot.de`	`[Noun] + [Noun] + [Digit]`
4481	`basketwomen0`	`koiot.de`	`[Noun] + [Noun] + [Digit]`
4528	`actman4`	`koiot.de`	`[Noun] + [Noun] + [Digit]`
N/A	`adultmiddle4`	`calculator.city`	`[Adj] + [Noun] + [Digit]`
N/A	`actormuseum8`	`bitingmites.org`	`[Noun] + [Noun] + [Digit]`

The script rotates target domains across separate waves, altering infrastructure footprints while maintaining the underlying username generation logic. The email handles often use standard human name formats (e.g., johne@calculator.city) to blend in with valid registrations.

Defensive Engineering: Programmatic Remediation

Because these registration payloads exist entirely within the body of incoming POST requests, standard proxy layers cannot always parse or drop them based on payload content alone. Remediating this threat requires a defense-in-depth approach across your technical stack.

1. Application Layer Domain Restrictions

The fastest method for stopping active registration waves involves validating the registration array directly inside WordPress. Hooking into the registration_errors filter intercepts the registration process before the application executes a database transaction.

/**
 * Restrict known malicious domains from creating WordPress user accounts.
 * Drops the registration request before hitting the database.
 */
add_filter('registration_errors', 'devcharms_restrict_spam_domains', 10, 3);
function devcharms_restrict_spam_domains($errors, $sanitized_user_login, $user_email) {
    $banned_domains = [
        '24faw.com',
        'igtikrenai.com',
        'koiot.de',
        'temz.net',
        'emailmin.com',
        'calculator.city'
    ];

    $email_parts = explode('@', $user_email);
    $domain = end($email_parts);

    if (in_array(strtolower($domain), $banned_domains)) {
        $errors->add(
            'banned_domain_error',
            __('<strong>ERROR</strong>: Registration parameters rejected.')
        );
    }

    return $errors;
}

2. Remediate Existing Users (Purge the Spam Already Inside)

Once these accounts exist, blocking new registrations won’t fix the damage already done to your tables and analytics. The simplest remediation path is to go to Admin → Users , search by the offending domain (for example @koiot.de), and bulk-delete the matching accounts.

This approach (Admin UI bulk delete or WP-CLI) is almost always safer than “just deleting rows” in the database. User emails and IDs can be duplicated across core and plugin tables, and a manual DB purge can leave orphaned metadata, broken relationships, or stale activity records—especially on community sites running BuddyPress, bbPress, membership plugins, or LMS/ecommerce add-ons.

Common places these users can persist include:

Core WordPress : wp_users, wp_usermeta
BuddyPress : wp_bp_activity, wp_bp_activity_meta, wp_bp_friends, wp_bp_groups*, wp_bp_notifications, wp_bp_messages*, wp_bp_xprofile*
bbPress : forum/topic/reply content in wp_posts plus related post meta in wp_postmeta
Other plugins : their own custom tables and user meta keys (memberships, LMS, ecommerce, forms, etc.)

If you have WP-CLI access, you can do the same cleanup much faster from the command line by deleting users whose email matches a domain pattern:

wp user delete $(wp user list --search="*@koiot.de" --field=ID)

Ditch the post-it notes: protect your business secrets with a password vault

Greg Miller — Mon, 11 May 2026 20:00:00 +0000

A password on a post-it note stuck to a monitor is not a security strategy. Neither is a shared spreadsheet, a notebook in a desk drawer, or a Slack message that says “hey, what’s the AWS login again?” Yet these habits persist in companies of every size, from startups to publicly traded firms.

The reasoning usually sounds practical: “We only have five people,” or “I’ll remember it,” or “We’ve never had a problem.” That last one is survivorship bias wearing a name badge. The problem has not happened yet.

Open Table of contents

The real cost of “just remembering it”

When credentials live in someone’s head—or worse, on a scrap of paper—three things quietly go wrong.

People reuse passwords. If the company WiFi password is also someone’s email password, one breach unzips everything. Verizon’s 2024 Data Breach Investigations Report found that stolen or weak credentials were involved in nearly half of all breaches. That statistic has barely moved in a decade.

Onboarding and offboarding become dangerous. A new hire asks around for the staging server password. Someone texts it. When that person leaves six months later, nobody rotates the credential. The door stays open and everyone forgets it exists.

There is no audit trail. If something goes wrong, you cannot answer the most basic question: who had access to what, and when?

AI has changed the math on password guessing

Brute-forcing a short, predictable password has always been feasible. What has changed is that large language models and purpose-built cracking tools can now make educated guesses at scale.

Researchers at Home Security Heroes demonstrated in 2023 that an AI-powered tool called PassGAN could crack over half of common passwords in under a minute and 71 percent of them in less than a day. It works by learning the patterns humans fall into—capitalizing the first letter, appending a year, substituting @ for a—and generating candidates that feel random to us but are statistically predictable to a model.

If your company’s convention is CompanyName2025! or Summer2026#, an attacker armed with a fine-tuned model, a list of leaked hashes, and commodity GPUs does not need luck. They need patience measured in hours, not years.

A password vault solves this at the source. It generates long, truly random strings—x7$qL!9mWv@kR2pZ—that no human would choose and no model can predict from patterns, because there are no patterns to learn.

What a vault like 1Password actually gives you

A password vault is not just a digital notebook with a lock. It is an infrastructure layer. Here is what it provides that you would never build or sustain on your own.

Secure sharing without exposure

Need to give a contractor access to a staging API key? In 1Password, you share a vault or a single item. The contractor sees the credential inside the app but never copies it into a text file. When the engagement ends, you revoke access in one click. Compare that to the alternative: sending a password over email, hoping they delete it, and wondering six months later if they did.

Watchtower: breach detection you would never do manually

1Password’s Watchtower feature cross-references your stored credentials against known breach databases (like Have I Been Pwned) and flags weak, reused, or compromised passwords automatically. No human is going to check 200 service accounts against a breach list every morning. Watchtower does it continuously and silently, surfacing only the items that need attention.

Secrets automation for development teams

For engineering teams, 1Password offers a Secrets Automation platform and a CLI that inject credentials into builds, CI/CD pipelines, and server environments without ever writing them to disk or committing them to a repository. A .env file checked into Git is an open invitation. A reference to a 1Password secret that is resolved at runtime is not.

Travel Mode

Crossing an international border where devices may be inspected? 1Password’s Travel Mode lets you temporarily remove sensitive vaults from a device. Only vaults marked “safe for travel” remain visible. Once you arrive, you toggle Travel Mode off and everything reappears. Try replicating that with a notebook.

Passkey and MFA management

Passwords are already giving way to passkeys in many services. 1Password stores and autofills passkeys alongside traditional credentials, so the transition does not mean juggling yet another tool. It also serves as an authenticator for TOTP two-factor codes, consolidating what would otherwise be a mess of separate apps and backup codes.

“We’re too small for this”

You are not. A freelancer with a handful of client logins is exactly the profile that suffers most from a single breach—because there is no security team to contain the damage and no PR department to manage the fallout.

1Password’s pricing starts at a few dollars per user per month. The time you save not resetting forgotten passwords, not onboarding people through DMs, and not lying awake wondering if the intern still has the production database password will pay for itself before the first quarterly review.

The habit shift

Moving to a vault is less a technology decision than a habit change. The hardest part is the first week: importing existing passwords, agreeing on a vault structure, and convincing the person who “has a system” that their system is a liability.

After that, the daily experience is easier than what it replaces. You stop typing passwords. You stop resetting passwords. You stop wondering if that Google Doc full of credentials is shared with the right people.

Post-it notes are great for reminding yourself to buy milk. They are not where your business secrets belong.

How CSS cascade layers let you win with lower specificity

Greg Miller — Mon, 30 Mar 2026 12:00:00 +0000

Specificity is a useful tool until it becomes a scoreboard. You add a class, then a parent selector, then another class, and soon “winning” the cascade means out-gunning yesterday’s selectors instead of expressing intent. Cascade layers (@layer) change the game: they add a new step in the cascade— layer order —that is evaluated before specificity. That lets you keep selectors shallow and predictable while still controlling what wins.

Open Table of contents

What @layer actually does
The main benefit: order beats specificity across layers
Fewer reasons to use !important
Clear mental model for teams
How this pairs with modern CSS stacks
Practical cautions

What `@layer` actually does

The @layer at-rule groups styles into named layers. You declare an order once—often from low-level to high-level:

@layer reset, tokens, components, utilities;

Rules in utilities are considered after rules in components in the cascade, regardless of selector specificity (for normal declarations in author stylesheets). Only after layers are compared does the engine fall back to specificity, then source order.

So layers are not a replacement for specificity inside a layer; they are a way to structure conflict between kinds of styles (foundation vs. components vs. overrides) without turning every file into a specificity arms race.

The main benefit: order beats specificity across layers

Classic pain: a third-party or legacy block uses .sidebar .nav li a.active and you need a one-off tweak. Without layers, you either match or beat that specificity, reach for !important, or duplicate structure in your selector.

With layers, you might put that legacy chunk in @layer legacy and your app overrides in @layer app. A single class in app can override a long chain in legacy because the layer wins first. You are not “reducing specificity” in the mathematical sense for rules in the same layer—you are making specificity less often the deciding factor between layers you own.

That is the practical payoff: simpler selectors for the code you write every day, because where it lives in the stack is explicit.

Fewer reasons to use `!important`

!important often appears when specificity and source order leave no clean escape hatch. Layers give you a structured escalation path: add a higher layer (for example utilities or overrides) instead of marking every declaration important.

You still should not create dozens of micro-layers without reason— broad, stable layers (reset → base → components → utilities) are easier to reason about than a layer per file.

Clear mental model for teams

Layers encode intent in the stylesheet architecture:

reset / normalize — browser quirks, low precedence.
base — element defaults and typography.
components — BEM-style blocks, cards, nav patterns.
utilities — small, single-purpose helpers (spacing, visibility).

New contributors can read @layer declarations like a table of contents for the cascade. That reduces “why did this style lose?” debugging sessions that end in a 0–4–2 specificity lecture.

How this pairs with modern CSS stacks

Frameworks and build tools increasingly respect layers (for example, importing Tailwind with layered preflight and utilities). Whether you author layers by hand or adopt a layered preset, the underlying idea is the same: separate concerns by layer , keep selectors inside each concern as simple as the design allows, and let layer order carry cross-cutting priority.

Practical cautions

Unlayered author styles still sit above layered styles in the cascade for normal rules—so stray global CSS outside @layer can still surprise you. Prefer moving everything into layers once you adopt them, or be deliberate about what stays unlayered.
Same-layer conflicts still use specificity and source order; layers do not remove the need for sensible selectors inside a layer.
Scoped styles (for example in Shadow DOM) follow their own encapsulation rules; layers apply within the same origin and tree as usual, but component boundaries still matter for what actually applies.

Cascade layers are not magic—they are structure. If your project fights the cascade with ever-longer selectors, @layer gives you a way to lower the temperature : define a small number of layers, put resets and utilities in the right slots, and let order do what you used to do with specificity gymnastics.

DEV Community: Greg Miller

Why email forwarding broke

Table of contents

Open Table of contents

What changed

Why forwarding breaks the checks

Prove it with one command

Don’t go cold turkey

Why forwarding is a security risk

Need help with this?

Turn Your Idle Terminal into a Retro Screensaver with Native Zsh and Homebrew

Table of contents

Open Table of contents

The problem with shellsaver plugins

Step 1: Install terminal animation packages

The animation suite

Step 2: Configure the native Zsh trap

Step 3: Exit keys and terminal state recovery

Stopping an active screensaver

Fixing invisible cursors (stty sane)

Step 4: Verification checklist

Pro-tip: Temporarily disabling the screensaver

Summary

Taming WordPress Multisite Bottlenecks: Bot Mitigation & Cron Health with a Custom Plugin

The Root Performance Bottlenecks

1. Automated Credential Harvesting via Username Enumeration

2. Cron Array Serialization Failures

The Solution: UXPA Network Performance & Guard Suite

Key Architectural Capabilities

Investigating Threats with AbuseIPDB

Managing Security & Blocking Strategies

1. Edge-Level Blocking (Cloudflare)

2. Host-Level Rules (WP Engine)

Restoring Scheduler Health

Performance Diagnostics Delivered:

Opportunities for Future Improvement

Let me build a custom plugin for your community or multisite website

Reasons to set up a Cloudflare Tunnel

Do I need this?

Table of contents

Open Table of contents

You stop opening doors on your router

If they can’t find your door, they can’t knock on it

Changing home addresses stops being a headache

Free security padlocks without the headaches

Your small project gets enterprise-grade shields

Add a bouncer to your site in two clicks

Easy integrations for developers (Webhooks)

It works even when your internet provider blocks you

The free plan is actually free and powerful

When is a tunnel not the right tool?

Time to lock the doors

Let me build your own Custom Tunnel

Hunting Dictionary Bots: Inside a Sophisticated WordPress Membership Attack

The Membership Threat: Impact by the Numbers

Anatomy of the Exploit: Dictionary Word Pairing

Defensive Engineering: Programmatic Remediation

1. Application Layer Domain Restrictions

2. Remediate Existing Users (Purge the Spam Already Inside)

Ditch the post-it notes: protect your business secrets with a password vault

Table of contents

Open Table of contents

The real cost of “just remembering it”

AI has changed the math on password guessing

What a vault like 1Password actually gives you

Secure sharing without exposure

Watchtower: breach detection you would never do manually

Secrets automation for development teams

Travel Mode

Passkey and MFA management

“We’re too small for this”

The habit shift

How CSS cascade layers let you win with lower specificity

Table of contents

Open Table of contents

What @layer actually does

The main benefit: order beats specificity across layers

Fewer reasons to use !important

Clear mental model for teams

How this pairs with modern CSS stacks

What `@layer` actually does

Fewer reasons to use `!important`