Counter numbers are now checked against both tables
Every counter here has a number. It appears in the embed code, in the statistics address, and on however many pages the owner put it. Numbers are handed out by picking a random one between…
What a password costs on modest hardware
Statistics pages here can be protected with a password. Hashing that password is the one operation in this service that is supposed to be slow — that is what makes a stolen hash expensive…
A backup in the web root is a source leak
Before editing a large file, the natural move is to copy it first. cp index.php index.php.vor-aenderung, then work. If that file sits in the directory the web server publishes, you have…
A language code that looked like Perl
On 19 August 2026 we added a rule to .htaccess blocking a class of file that should never be served directly to a browser: leftover source-code copies sitting in the web root after an edit…
Why the exclusion list is not hashed
If you build a site, you open it twenty times a day. On a counter with forty visitors a month, half the statistics are you. So there is a setting: do not count visits from my own address.…
Your counter on an HTTPS page
Your site is on HTTPS. Your visitors see a padlock. Then you paste in something from another site, and the padlock goes away — or the thing you pasted simply does not appear. That is mixed…