A visual guide to web technology
The web, clearly
explained.
Understand hosting, domains, networks, and the technology behind every website.
A few ideas to start with.
Browse the library- concept
URL structure
Read a web address, one part at a time. Learn what reaches the server—and why the fragment is different.
Explore the idea - comparison
Latency vs bandwidth
Waiting is not the same as transferring. See how round-trip time, body size and goodput shape one simplified response.
Explore the idea - concept
DNS TTL
A DNS answer can outlive a change at its source. Follow one resolver cache—not a global propagation clock.
Explore the idea - concept
Web hosting
See what a hosting environment supplies, trace a static or dynamic request, and separate service capabilities from the responsibilities in your plan.
Explore the idea - concept
Domain name
A domain names a place in DNS. It is neither the complete URL nor the site files or hosting account.
Explore the idea - comparison
Domain vs hosting
Separate registration, DNS, website hosting and mail, then explore what changes—and what stays unchanged—when you renew a domain or prepare a new host.
Explore the idea - comparison
Shared hosting vs VPS
Shared hosting simplifies administration; a VPS offers more system control. Neither guarantees speed or reliability.
Explore the idea - comparison
Managed vs unmanaged hosting
“Managed” describes which jobs a provider performs, not whether the machine is shared, virtual or dedicated.
Explore the idea - comparison
VPS vs dedicated server
Compare shared-host VMs, sole-tenant VMs and bare metal by physical exclusivity, hardware access, resizing and operational responsibility—not a universal score.
Explore the idea - comparison
Static vs dynamic website
Static pages can still be interactive. The key distinction is when and where HTML is produced for a request.
Explore the idea - procedure
Choose hosting for a small website
A practical selection checklist for a small site: requirements, responsibility, verification and an exit plan.
Explore the idea - procedure
Connect a domain to a website
Connect web DNS safely without disrupting existing mail: check delegation, stage the site, change only needed records and verify.
Explore the idea - concept
DNS resolution
Trace cold and cached DNS lookups, distinguish referrals from answers, and see why NXDOMAIN, NODATA and an HTTP response are different outcomes.
Explore the idea - concept
Authoritative nameserver
Learn how authoritative nameservers answer for DNS zones and why registrar delegation must point to the zone you edit.
Explore the idea - concept
Recursive DNS resolver
Understand recursive DNS resolvers, cache hits and misses, negative caching, and why cached data is not a global clock.
Explore the idea - comparison
DNS A and AAAA records
Compare DNS A and AAAA records by address family, check both sets independently and avoid assuming IPv6 always works.
Explore the idea - concept
CNAME record
See how a DNS CNAME aliases a hostname to another name and why ordinary records cannot share that alias owner.
Explore the idea - concept
MX record
Understand MX targets and lower-number mail preference, independent of website A/AAAA records and mail authentication TXT.
Explore the idea - procedure
Change a DNS record safely
Rehearse a single web A-record change, inspect the protected zone data, compare two resolver caches and practice a rollback that does not erase cached answers.
Explore the idea - troubleshooting
A DNS change is not visible
Diagnose an invisible DNS change by separating wrong-zone edits, delegation, cached positive or negative answers, and record type.
Explore the idea - troubleshooting
A website works for some visitors only
Isolate why a site works for some visitors but not others using DNS, IPv4/IPv6, TLS, caches and origin checks.
Explore the idea - concept
HTTP request and response
Read the method, target, headers, optional body, status and returned content in a small HTTP exchange.
Explore the idea - concept
HTTPS and TLS
Understand what HTTPS protects with TLS, how a browser authenticates a service, and which threats remain.
Explore the idea - concept
Reverse proxy
See how a reverse proxy receives public requests and forwards them to one or more upstream applications.
Explore the idea - concept
CDN
Understand how a CDN serves nearby edge responses, when it contacts origin, and why not all content is cached.
Explore the idea - concept
Browser cache
Learn when a browser can reuse a response, revalidate it, or must fetch it again under HTTP caching rules.
Explore the idea - troubleshooting
HTTP 404 troubleshooting
Diagnose an HTTP 404 from request, deployment, routing and cache evidence, then test a narrow correction without turning genuinely missing routes into success pages.
Explore the idea - troubleshooting
HTTP 502 troubleshooting
Investigate a proxy 502 by separating upstream response failures from 404, 503 and 504 without risky restarts.
Explore the idea - procedure
Back up a small website
Plan a recoverable small-site backup that includes deployable source, configuration, changing data and a tested restore.
Explore the idea - comparison
SSH vs SFTP
Compare SSH remote command sessions with SFTP file transfers carried over SSH, including their security limits.
Explore the idea - concept
DNS TXT record
A DNS TXT record holds textual data at a DNS owner name.
Explore the idea - concept
DNS NS records and delegation
An NS delegation tells a resolver which authoritative servers are responsible for a child DNS zone.
Explore the idea - concept
DNS SOA record
The SOA (Start of Authority) record identifies administrative parameters for a DNS zone.
Explore the idea - concept
DNSSEC
DNSSEC lets a validating DNS resolver authenticate signed DNS RRsets through a chain of trust.
Explore the idea - concept
DNS CAA record
A DNS CAA (Certification Authority Authorization) RRset expresses which certificate authorities may issue specified certificates for a domain.
Explore the idea - concept
SPF email authentication
SPF (Sender Policy Framework) lets a receiving mail system evaluate whether an observed SMTP sending IP is authorized for a specific SMTP identity, commonly MAIL FROM or HELO.
Explore the idea - concept
DKIM email signatures
DKIM (DomainKeys Identified Mail) associates a signing domain with selected canonicalized email headers and message content through a cryptographic signature.
Explore the idea - concept
DMARC alignment and policy
DMARC checks whether either SPF or DKIM passes and aligns with the domain in the visible From header; its published policy requests, but does not guarantee, how failures are handled.
Explore the idea - concept
HTTP status codes
An HTTP status code is a three-digit field in a server's HTTP response.
Explore the idea - concept
HTTP redirects
An HTTP redirect is a response directing a client to another URI, usually through a `Location` header and a 3xx status.
Explore the idea - concept
HTTP cookies
An HTTP cookie is a small name/value state item delivered in `Set-Cookie` and potentially returned in later `Cookie` request headers.
Explore the idea - concept
HTTP Cache-Control
The HTTP Cache-Control response field describes constraints on storage and reuse of a response.
Explore the idea - concept
ETag and conditional requests
An HTTP ETag is an opaque representation validator.
Explore the idea - concept
TLS certificates and trust chains
A TLS certificate chain lets a client build a candidate trust path from the service's leaf certificate through one or more issuing intermediates to a configured trust anchor.
Explore the idea - troubleshooting
TLS certificate hostname mismatch
A TLS hostname mismatch occurs when the requested reference identity does not match a supported name in the certificate presented by the server.
Explore the idea - concept
IP addresses
An IP address is a network-layer identifier used to deliver packets to an interface or endpoint context.
Explore the idea - comparison
TCP vs UDP
TCP provides an ordered, reliable *byte-stream service* under its protocol conditions, using sequence information, acknowledgments and retransmission.
Explore the idea - concept
Network ports
A network port helps identify a transport endpoint within a host's protocol stack.
Explore the idea - concept
CIDR and subnet masks
CIDR combines an IP address and prefix length, such as `192.0.2.0/24`, to describe a range of IP addresses by their leading bits.
Explore the idea - troubleshooting
Connection refused vs timeout
Connection refused and connection timed out describe different observations before an HTTP response is necessarily available.
Explore the idea - concept
Linux paths: absolute vs relative
An absolute Linux pathname starts at the process root. A relative pathname normally starts at the working directory, unless an API supplies another starting directory.
Explore the idea - concept
Linux file and directory permissions
Linux mode bits select owner, group or other permissions for an operation. Directory execute means search; passing a mode-bit check alone does not prove that real access will succeed.
Explore the idea - concept
Linux processes and PIDs
A Linux process has a PID and lifecycle. A child can exit before its parent collects the status; under ordinary retained-status rules, that unreaped child is a zombie.
Explore the idea - concept
systemd services and service states
systemd manages service lifecycles. Automatic restart depends on unit configuration, why the process stopped and applicable limits; a failed service is not guaranteed to restart.
Explore the idea - procedure
Read systemd service logs with journalctl
Use journalctl with a confirmed service unit, boot, time window, and priority threshold to narrow the journal records you read without restarting or reconfiguring the service. Missing output does not prove that an event never happened.
Explore the idea - concept
SSH public-key authentication
SSH public-key authentication proves control of a private key matching a key authorized for the account. That user-authentication proof does not replace separate verification of the server.
Explore the idea - troubleshooting
Disk space vs inode exhaustion
A Linux filesystem can run out of inodes while still reporting free data-block space. Those resources are counted separately, so free bytes alone do not establish that new files can be created.
Explore the idea - concept
Linux signals and graceful process shutdown
SIGTERM can be handled to allow an orderly shutdown. SIGKILL cannot be caught, blocked or ignored; neither signal choice proves that work was saved or termination completed.
Explore the idea - concept
Linux load average explained
Linux load average describes an averaged count of runnable tasks and tasks in some uninterruptible waits. It is not a CPU-utilization percentage, and it cannot by itself distinguish CPU demand from waiting elsewhere.
Explore the idea - procedure
Linux packages, dependencies and safe updates
Package dependencies can broaden a proposed update. Review the whole transaction against authorized scope and a recovery plan; a newer package version alone does not make the update safe.
Explore the idea - comparison
CPU cores vs threads for web workloads
SMT lets hardware threads share a physical core. More logical processors therefore do not guarantee the same workload capacity as the same number of independent physical cores.
Explore the idea - concept
RAM, paging and swap pressure
Memory pressure can trigger reclaim, eligible swap activity or an out-of-memory condition. Swap provides backing for some pages but does not replace RAM performance or guarantee allocation success.
Explore the idea - comparison
Storage IOPS, throughput and latency
IOPS counts operations, throughput counts transferred bytes and latency measures delay. Operation size connects the two rates, but neither rate alone establishes request latency.
Explore the idea - comparison
RAID redundancy vs backups
RAID redundancy can preserve access during some disk failures, but it does not replace an independently retained backup for recovering an earlier state.
Explore the idea - comparison
Virtual machines vs containers
A virtual machine can run its own guest kernel; an ordinary Linux container shares the host kernel. This boundary alone does not establish which environment is safer or faster.
Explore the idea - troubleshooting
Find a server resource bottleneck
Distinguish CPU, memory, storage and network bottlenecks by matching resource-wait evidence to the slow requests, workload scope and time window. A busy resource is a candidate to investigate, not proof that it delayed the affected work.
Explore the idea - comparison
NVMe vs SATA storage interfaces
NVMe and SATA describe storage communication, not flash media. Device capabilities, interface and workload are separate factors; an interface name alone does not establish application performance.
Explore the idea - concept
SQL primary keys and unique constraints
A primary key requires unique, non-null key values. A unique constraint follows its declared duplicate rule; PostgreSQL 18 default UNIQUE constraints allow multiple NULLs.
Explore the idea - concept
Database indexes and query plans
An index can let a query locate candidate rows without scanning every table row. That can reduce retrieval work, but a planner may still choose a sequential scan when its estimated cost is lower.
Explore the idea - concept
SQL joins explained
INNER JOIN returns one row for every matching left–right pair. LEFT JOIN returns those same pairs and also preserves each unmatched left row with NULLs in the right-side fields. Later filters can still remove rows from that joined result.
Explore the idea - concept
Database transactions and ACID
A transaction groups transactional changes into commit or rollback. ACID names distinct guarantees whose behavior depends on the database, isolation level and persistence configuration.
Explore the idea - comparison
Object, block and file storage
Object storage addresses named objects by key through an API; block storage exposes addressable logical blocks; file storage presents files and directories through paths and filesystem operations.
Explore the idea - comparison
Database backups, snapshots and consistency
A snapshot can be part of a backup, but its existence proves neither consistency nor recovery. The base copy must meet engine requirements, and required change logs must cover the recovery target.
Explore the idea - concept
Database connection pooling
A database connection pool reuses connections and caps how many callers can borrow them at once. When all usable connections are borrowed, additional callers must wait or fail according to the pool's policy.
Explore the idea - concept
The browser DOM explained
The DOM is a tree of nodes representing a document. A browser builds it as it parses HTML, and scripts can update that tree after the initial parse.
Explore the idea - concept
Critical rendering path
The critical rendering path links resources and browser work needed for visible content. Required HTML/CSS, script execution, layout and painting can delay rendering; download time is only one part.
Explore the idea - concept
CORS and the same-origin policy
CORS permits browser scripts to read qualifying cross-origin responses. With credentials mode include, an explicit matching origin and credentials permission are required; a wildcard origin is insufficient.
Explore the idea - procedure
Responsive images with srcset and sizes
srcset supplies candidate resources; sizes describes the intended display size for width candidates. Browser selection also considers pixel density and is not a command to fetch one exact file.
Explore the idea - concept
HTML forms and validation boundaries
Browser form validation can catch declared input errors before submission, but it is not a trust boundary. The server must independently validate requests and enforce application and authorization rules.
Explore the idea - comparison
Semantic HTML and ARIA roles
Prefer native HTML when it supplies the interaction you need. Adding role=button to a div can expose semantics, but it does not create native focusability or keyboard activation.
Explore the idea - concept
REST APIs and HTTP methods
HTTP methods express intended request semantics. Safe and idempotent are different properties; neither promises success, and method names alone do not certify a correct or RESTful implementation.
Explore the idea - comparison
Authentication vs authorization
Authentication establishes an identity; authorization decides whether it may perform a particular action on a resource. Being signed in does not supply a missing permission.
Explore the idea - comparison
Sessions vs JWT authentication state
A server session uses a lookup for state; a signed JWT can carry locally checked claims. A local-only verifier cannot learn an uncommunicated revocation, so invalidation is a key design tradeoff.
Explore the idea - concept
API rate limiting and HTTP 429
HTTP 429 indicates that the server has rate-limited the request. Use the provider’s limit and retry guidance to decide whether and when to retry; waiting alone does not establish that another attempt is safe or will succeed.
Explore the idea - procedure
Webhooks, retries and idempotency
Repeated webhook delivery must not duplicate business effects. An idempotent operation or correctly committed deduplication can help; reconcile an uncertain prior outcome before another non-idempotent change.
Explore the idea - comparison
Background job queues vs synchronous requests
A queue separates accepting work from completing it. Use it when results can arrive later with tracked outcomes; keep required immediate results synchronous. A queue does not add worker capacity.
Explore the idea - comparison
Recovery point objective vs recovery time objective
RPO limits tolerated data loss as a time interval. RTO targets the duration of disruption before agreed service capability returns. The two goals measure different recovery outcomes.
Explore the idea - procedure
What a restore test actually proves
A restore test establishes only the recovery checks and conditions it actually exercises. A completed backup job alone does not prove usable data, dependencies or application behavior can be restored.
Explore the idea - concept
Principle of least privilege
Least privilege means granting only the permissions required for a defined task, scope, and period.
Explore the idea - concept
Content Security Policy basics
Content Security Policy restricts certain browser resource loads and script execution. It is a defense-in-depth control, not a replacement for preventing injection in application code.
Explore the idea - comparison
MFA and phishing-resistant authentication
MFA does not automatically stop phishing: a typed OTP can be relayed. An origin-bound passkey resists that path when relying-party and origin checks are correct; MFA qualification is a separate question.
Explore the idea - procedure
Secrets management for web applications
Keep credentials out of repositories and public client output. After exposure, deleting a visible copy is not enough: authorized revocation or rotation and verification are separate tasks.
Explore the idea - concept
Git commits, branches and merging
Git histories diverge when neither tip is an ancestor of the other. Merging may fast-forward or combine divergent histories; divergence alone does not prove a file conflict.
Explore the idea - procedure
Deploy a static website safely
Switch a static release only after its complete output matches the accepted source/build, staged checks pass and exact publication is authorized. Verify the expected current release and rollback path too.
Explore the idea - comparison
Blue-green vs rolling deployments
Rolling deployment mixes versions while replacing instances. Blue-green switches traffic to a separately prepared pool. Neither name guarantees zero downtime: readiness, compatibility and recovery still matter.
Explore the idea - concept
Website uptime monitoring and false alarms
Uptime probes sample a defined check at selected times and locations. Successful probes do not prove universal availability; one failed probe does not prove a global outage.
Explore the idea - troubleshooting
Troubleshoot a slow website using evidence
Locate the delayed stage of a page load, then gather evidence that distinguishes its causes. Use browser timings and authorized matching server observations before changing infrastructure.
Explore the idea - comparison
HTTP compression: gzip and Brotli
gzip and Brotli are lossless HTTP content codings. Content-Encoding names the applied coding, but neither format guarantees a smaller body or faster response for every payload and implementation.
Explore the idea - concept
Core Web Vitals: LCP, INP and CLS
Core Web Vitals measure loading, responsiveness and visual stability through LCP, INP and CLS. Field assessment uses eligible observations and the 75th percentile, not one favorable test.
Explore the idea - concept
CDN cache keys and response variants
A cache key must preserve request distinctions needed to select suitable content. HTTP cache selection considers method and target URI; Vary can require matching nominated request headers.
Explore the idea
Follow your curiosity.
- Frontend & browsers8 article
- Networks6 article
- Domains & DNS19 article
- Operations & procedures6 article
- Hosting6 article
- Backend & software7 article
- HTTP, TLS & web servers9 article
- Delivery & performance7 article
- Security & reliability7 article
- Servers & hardware7 article
- Data & storage7 article
- Linux & administration11 article
A clear definition. A small example to explore. A closer look at why it works.