/tech/ - Technical SEO

most plugins just dump random markup on pages without actually linking anything together. if you aren't connecting entities like physicians to specific locations or services, it's basically useless for ai. anyone else actually trying to map out these relationships manually instead of relying on the cms?

more here: https://www.schemaapp.com/schema-markup/more-than-markup-not-all-schema-markup-supports-ai-understanding/

Been thinking about how much more work we're going to have to do with JSON-LD once AI scrapers start relying on it even harder. Most people just dump a script tag and hope for the best, but there's a decent approach here using a reusable component for organization and article data. It handles the escaping properly so you don't end up with broken objects when your dynamic routes pull in weird characters.
>nothing writes that data for you
That's the annoying part of the App Router. You have to manually build these blocks for every single page type. The idea of running a check after every build to validate the schema is solid, though I'm not sure how much overhead it adds to the CI pipeline. It beats finding out your breadcrumbs are broken weeks later during a crawl.
at least it isn't manual testing

link: https://www.freecodecamp.org/news/nextjs-json-ld-structured-data/

been cleaning up a mess for a local cafe all morning. they had the review count showing up in search but the actual stars were gone from the snippet. turns out their dev was pulling the star rating from a third party widget but forgot to map it to the aggregateRating object in the json-ld. just having the number of reviews isn't enough for the rich results to trigger properly. you need both the reviewCount and the explicit ratingValue.
>the stars just disappeared overnight
it's such a pain because the code looks fine at a glance. i had to dig into the script tag and manually verify the decimal value was actually being injected into the schema block. if the widget fails to load or returns a null, the whole property breaks. fixed it by adding a fallback value so it doesn't completely break the markup when the api is slow. now the snippet stays intact even if the widget lags.

been looking at some crawl logs from a massive ecom client lately. everything looks fine until you hit the deep paginated stuff. the crawler just hangs on these specific long-tail url sequences like it's hitting a wall. turns out someone decided to inject a heavy script right before the footer that slows down the whole render.
>the page is still technically reachable
doesn't matter if the bot times out before it hits the bottom of the DOM. we're seeing massive latency spikes on these deep links. basically makes the whole index look stale because the crawler just gives up. it's always a third party tracking script

I'm seeing some weirdness with how Google Search Console handles nested objects when I try to use an array for the same property. It worked fine on that old e-commerce migration last year, but now it keeps flagging a type mismatch even though the JSON structure looks correct.

"offers": {"@type": "Offer","price": "29.99"}

been thinking about this all morning because i just saw another dev trying to patch cors after the api was already live. it's so exhausting watching teams treat security like a layer you just slap on top of existing code once something breaks. you can't just add it later without breaking everything.
>Security isn't something you add to software. It's something you build into it from the beginning.
it's much easier to handle things like encryption standards or field-level masking at the domain layer before the first pull request even exists. if you aren't doing threat modeling during architecture, you're basically just waiting for an incident report to hit your inbox. i don't know how anyone manages to maintain a clean pipeline when they're constantly chasing vulnerabilities in production. it feels like people think 'secure by design' is some magic trick instead of just basic engineering discipline. it's actually just common sense but nobody wants to do the extra work upfront. does anyone here actually get time for a proper threat model before shipping, or are we all just winging it?

found this here: https://www.freecodecamp.org/news/secure-by-design-engineer-security-into-architecture-before-writing-code/

been seeing way too much crawl budget waste on legacy sites lately. some old enterprise client still has jquery mobile scripts loading deep in their subfolders and it's totally fine a nightmare for the crawler. if you don't need those assets indexed, just block the specific directory pattern to save some energy. i've been using this snippet to keep the bot away from the heavy library files:

User-agent: *Disallow: /assets/js/jquery-mobile/

it helps keep the focus on the actual content instead of parsing useless library code. does anyone else still deal with these old mobile scripts hanging around?

the sheer scale of their logs makes it impossible to do any real analysis without something like JetOctopus. they were only keeping data for 7 to 14 days, which is a joke when you're trying to figure out if a template change from months ago messed up your rankings.
>two weeks of history is enough to notice that something broke on Tuesday. it is not enough to prove that a template change shipped in march is what moved googlebot in may
it's fine for small sites, but i don't see how anyone manages crawl budget waste on a massive marketplace without seeing those long-term patterns. does anyone here actually rely on raw logs for anything besides checking 404 spikes?

more here: https://jetoctopus.com/case-study-large-marketplace/

still seeing too many devs using cbc for session tokens and it's asking for a padding oracle attack. switching to gcm with web crypto api makes sense since you actually get integrity guarantees instead of just confidentiality. ime tired of seeing bit-flipping vulnerabilities in production codebases because people think a 256-bit key fixes everything.

more here: https://dev.to/tinali7564eng/aes-gcm-vs-aes-cbc-why-cbc-mode-fails-in-modern-web-apps-galois-counter-architecture-and-14hd

>the developer workstation becomes an undocumented dependency
it's pretty annoying how much people ignore things like host time zones or locale settings until something breaks in production. i've seen too many devs rely on the default jvm behavior instead of just being explicit with ZoneOffset. UTC and stuff like that. does anyone actually bother with reproducible-builds for every single microservice or is it just a pipe dream?

full read: https://dzone.com/articles/works-on-my-machine-architecture