Where my checks come from
Not from a course. From things that broke in production and cost me hours to find.
A cache layer that silently ignored my own rules, so a correct fix stayed invisible for half a day. A CDN rule that shipped switched on and returned 403 to Googlebot while my robots.txt welcomed everyone. Every pretty URL on a new site returning 404 without writing a single error to any log — and the first explanation I gave for it, which turned out to be wrong.
Every one of those is now a check I run on someone else’s site in two minutes.
How I work
I measure before I conclude, and I show the measurement. The rules I follow when measuring a site I do not own are published in How I measure. Every finding in a report carries the request and the response that produced it, so you can repeat it yourself and disagree with me if I am wrong.
I tell clients when something is not worth their money. The framework I audit against has controls that require APIs and OAuth endpoints a content site will never have — chasing them buys a number, not a visitor, and I say so in the report.
What I actually do
WordPress, and server-level work on Apache, Nginx, LiteSpeed and Cloudflare: cache rules, WAF, DNS, TLS, DNSSEC, structured data, and the newer layer of llms.txt, Content Signals and agent discovery. One write-up walks through a DNS record I published, and the two I rejected because they would have been false.
Based in Chile. I work in English and Spanish.