Blog
Practical guides on website monitoring, GDPR/EAA compliance, security headers, SEO and Core Web Vitals — from real work with XICTRAQ.
Frozen user agents: what device reports can still prove
Android 10, macOS 10.15.7, Windows NT 10.0: browsers report fixed values. Which device report details still hold and which are only constants.
Fake CAPTCHAs: When Your Own Website Delivers Malware
ClickFix on hijacked websites: how fake CAPTCHA overlays get into a page, which traces remain in the source and how operators can detect them early.
Withdrawal button in peak season: keep checking that it works
Since 19 June 2026, Section 356a BGB has required a withdrawal function in German online shops. How to monitor the two-stage procedure as a browser flow without triggering real withdrawals, and how dated captures document permanent availability.
Root KSK Rollover on 11 October: Prevent DNS Failures
From 11 October 2026 only KSK-2024 signs the root zone. Why servers with their own resolver then resolve nothing, how to check Key Tag 38696 and how to recognise an outage.
Deploy as Outage Cause: Roll Back in Minutes
Roughly 70 percent of outages are due to changes in a live system. How a fixed change window, an automated post-deploy check and a practised rollback cut outage duration from hours to minutes.
Maintenance Windows: 503 and Retry-After Done Right
When the maintenance window should run, what a 503 actually promises and how to set Retry-After - all three measurable before the date.
iPhone Users Invisible: Field Data Knows One Browser
Public Core Web Vitals field data comes from Chrome only: iPhones, Safari, Firefox and in-app browsers are missing entirely. What that means for the assessment, how large the invisible share in Germany is, and how first-party field measurement closes the gap.
Back Button: The Visits Your Analytics Misses
The back/forward cache serves pages without a new build. Why most measurement scripts lose these visits and how pageshow closes the gap.
Agency Switch: Handover Protocol for Client Sites
Which positions belong in a handover record, which deadlines run during a domain transfer, why the auth code is not a bargaining chip, what Article 28 GDPR requires on deletion and return, and how every promised position can be measured instead of asserted.