Store security16 min read
Add a job to GitHub Actions that lists every plugin, theme and core version in the repository, checks them against Wordfence Intelligence's free vulnerability feed, and fails the build on anything rated CVSS 7 or higher, or not rated at all. The same job compares each wordpress.org plugin with the official checksums for its version, which catches modified or nulled copies, and flags obfuscated code in your own plugin and theme. Run it on every pull request and once a day, and make the deploy depend on it. Wordfence CLI did the vulnerability part, but as of October 2026 it isn't sold to new customers, and the free version reached end-of-life on October 14, 2026. The feed it used is still free with an API key. Keep Wordfence Premium on the live site for what CI can't see: attacks, and vulnerabilities disclosed after your last deploy.
DevOps & monitoring16 min read
Turn off WP-Cron's page-load trigger and run both queues from the system cron every minute, with a time limit on each. At the end of every run, ping an Oh Dear scheduled-task monitor with the exit code. That catches the two failures nothing inside WordPress can report: the cron that stopped running, and the run that crashed. Then add an application health endpoint that Oh Dear polls every minute. It reports how far WP-Cron is behind, how many Action Scheduler jobs are past due, jobs stuck in progress, recent failures, and recurring jobs that no longer have a next run. In our tests on WooCommerce 11.2.1, Action Scheduler stopped rescheduling a recurring job after its 5th failure in a row, and a WP-Cron event that hit a fatal error was gone for good. Only the exit code in the ping showed the second one.
DevOps & monitoring14 min read
Let GitHub Actions copy only your own plugin and theme folders to Kinsta staging over SSH. Validate staging through the Kinsta API and with smoke tests: the pages load, a real add-to-cart works through the Store API, and a build marker matches the commit. Then promote with the API's push endpoint set to files only (push_db false, specific folders), after a tagged backup. Never use the default push on a live store: it copies the database too, which replaces every order placed since staging was made. Kinsta says a push has a couple of seconds of downtime at the end, so this is near-zero, not zero. If the live smoke test fails, roll back by redeploying the previous commit, not by restoring the backup, which would take the orders with it.
DevOps & monitoring15 min read
Run one log shipper, Vector, on the store's server. It tails five files: the Nginx access log (written as JSON), the Nginx error log, the PHP error log, the PHP-FPM log and WooCommerce's wc-logs folder. It joins multi-line entries such as a fatal error's stack trace into one event, drops successful static-file requests, masks emails, card numbers and the last part of IP addresses, and sends the events to Better Stack, to a Loki server you run, or to both. A disk buffer and end-to-end acknowledgements kept every event through an outage and a crash in our test. Better Stack is the faster path: 3 GB a month free, then $0.10 to $0.35 per GB, with alerting and on-call built in. Loki costs a second server and your time, but the data and the alert rules stay with you.
Conversion & analytics13 min read
Store all of an image's or video's hotspots in one JSON post meta row on the media file, with x and y as percentages of its width and height, and render them as positioned HTML details elements. Percentages keep each hotspot on the same point at any screen size; in our test they were within 0.01% of the stored point at 390 px and 1280 px wide. Load every tagged product with one wc_get_products() call: for 12 hotspots that took 14 database queries on a cold cache, against 42 when each hotspot loaded its own product. Products that are deleted, drafted or hidden since they were tagged simply don't appear. On phones, the product card opens as a bottom sheet so it never covers the other hotspots. A SaaS platform such as Taggbox is the better choice when the content is customer photos and social posts rather than your own catalog shots.
Conversion & analytics16 min read
A shoppable video widget hurts Core Web Vitals in two ways. If its box has no height until the widget loads, it pushes the page down (CLS). And if it autoplays a preview, it spends the shopper's bandwidth on video before they've asked for it. In our test on a throttled phone profile, an iframe widget without reserved space scored a CLS of 0.069 on every run and downloaded about 3.3 MB of video in the first seven seconds. Giving the same widget a CSS-sized slot brought CLS to 0, but it still downloaded the video. A small web component that reserves its height in CSS, fetches a JSON feed only when the rail nears the screen, and creates the video element only on tap had a CLS of 0, downloaded no video before a tap, and loaded 284 KB in total. If you use a hosted platform such as Tolstoy for tagging, analytics and UGC collection, give its widget a fixed-height slot and inject its script when that slot approaches the viewport.
Conversion & analytics14 min read
You don't have to choose between them. Prerender every variation as its own static page (app/pdp/[variant]/[handle], with generateStaticParams and revalidate), and let Next.js's proxy (called middleware before Next.js 16) pick the variation per visitor and rewrite /products/mug to /pdp/b/mug. The page stays static, there's no client-side swap and no flicker. Ask VWO's SDK once per visitor and keep the answer in a cookie: getFlag() sends an impression every time it's called, and the proxy can't tell a prefetch from a page view. Create one VWO client per server and reuse it: init() downloads the settings file, which cost 158 ms per request in our test against 0.4 ms for a shared client. Two production traps we hit: the rewritten response still says s-maxage=3600 under the public URL, so a URL-keyed CDN would serve one variant to everyone, and Next.js runs the proxy again for the rewritten path if the matcher covers it. VWO (now part of Wingify) is our pick.
Conversion & analytics15 min read
Client-side testing tools flicker because the cached page arrives first and a script rewrites it afterwards, or hide the page until the script runs. To avoid both, pick the variation before the HTML exists. A Cloudflare Worker running Convert's JavaScript SDK reads the visitor's cookie, buckets them with Convert's deterministic hash, and adds the decision to the origin URL as ?_ab=experience.variation. A small WordPress plugin then renders only that variation's block. Because the decision is in the URL, every cache in between keeps one entry per variation instead of one per visitor. In our test on a real WooCommerce store, 200 new visitors split 110/90 and each variation was rendered by WordPress once; every other request was a cache hit. A cached variation came back in a median 42 to 78 ms across three runs, against 0.6 to 2.4 seconds for an origin render. Conversions are sent from the order-received page, once per order. Convert is our pick; its Full Stack SDK is on the Pro plan.
Shipping & inventory17 min read
WooCommerce's tax rules model your own sales tax or VAT, not the destination's customs: import duty depends on each product's HS code, its country of origin, the destination's thresholds and the courier's DDP fee, and WooCommerce stores none of that. Quote it at checkout instead. Easyship's Rates API (v2024-09) returns DDP rates whose total_charge already includes import duty, import tax and the DDP handling fee when you send incoterms DDP with calculate_tax_and_duties true. Use that endpoint, not the separate Taxes and Duties endpoint, which is limited to 100 calls a day. Only call it once the address is complete and the postcode is valid, cache each quote for 30 minutes, cap the wait at 3 seconds, and stop calling for a minute after a failure. When there's no DDP quote, show a rate that says plainly that duties are due on delivery, never a guessed DDP price. In our tests a cached quote added nothing, an 0.8-second API added about 0.8 seconds once, and an outage cost the first shopper 3 seconds and everyone after them nothing. Easyship is our pick; DDP rates need a paid plan.
Shipping & inventory21 min read
Once ShipBob holds your stock, WooCommerce's stock number is a copy, and every oversell comes from the gap between the copy and the warehouse. ShipBob's 2026-07 API has no inventory webhook, so poll GET /inventory-level and set WooCommerce stock to fulfillable quantity (not sellable, which counts inbound stock) minus paid orders ShipBob hasn't received yet, minus a small buffer. Apply the change with WooCommerce's atomic increase/decrease rather than a plain set: in our race test a plain set left 2 phantom units on sale after an order landed mid-sync, while the delta left the correct number. Right before payment, ask ShipBob again for just the cart's SKUs with a 3-second timeout, because other channels sell from the same stock; WooCommerce's own stock hold already settles two shoppers racing for the last unit. Send paid orders from Action Scheduler with reference_id set to the WooCommerce order ID (ShipBob answers a resend with 422, not a second shipment), and treat webhooks as a doorbell for a reconcile job that reads ShipBob's orders and writes tracking back. ShipBob is our pick for the warehouse side.
Conversion & analytics12 min read
A JavaScript review widget puts your Google reviews in an iframe, not in your product page: with EmbedSocial's own demo widget, none of the review text was in the server HTML or the page's own document, and the widget added 965 KB over 25 third-party requests (scripts for YouTube and Vimeo, avatars and EmbedSocial's frame). Reading the same content from the EmbedSocial API on the server and printing it as HTML adds 1.6 KB of markup and only lazy-loaded images. Cache it in a WordPress transient, keep a last-good copy in an option, and refresh it in WP-Cron so no shopper ever waits for the API. Show the newest reviews whatever their rating, label them as reviews of the store, and keep them out of structured data: Google Business reviews are about your business, not the product, and Google's rules say not to aggregate ratings from other websites. The product's AggregateRating should come only from WooCommerce's own product reviews. EmbedSocial is our pick (its API is on the Premium plan); Taggbox is a strong alternative for shoppable UGC galleries.
Conversion & analytics15 min read
On a headless Shopify store, skip the Loox script widget on product pages and render reviews on the server from the Loox Storefront API. The API is public (no key; you pass your public store ID), returns published reviews with photo and video URLs, and has a bottomline endpoint with the review count and average rating. Called from a Next.js server component it answered without an Origin header, while a browser on a domain Loox doesn't know got 403. Render the review text into the HTML, resize the 500 KB+ original photos through the image optimizer, show video reviews as a thumbnail until the shopper clicks, and print one Product JSON-LD block whose aggregateRating comes from the same bottomline the page shows. In our lab test the server-rendered page weighed 223 KB, against 1.8 MB with the same media loaded eagerly. The official widget couldn't render on our test domain at all: its review iframe only loads on domains you allow-list, which needs Loox's Convert plan. Loox is our pick for photo and video reviews on Shopify; Yotpo fits enterprise brands that want reviews, loyalty and SMS from one vendor.
Conversion & analytics14 min read
A KPI dashboard that managers trust needs one row of numbers per day, built the same way every day, from WooCommerce orders, Stripe subscriptions and Search Console. A Python script on cron can pull all three APIs, join them on customer email and write the row to a Google Sheet for free. It's the only way to get cross-source metrics such as LTV that includes store purchases, but you own every token, API change and silent failure. Databox connects WooCommerce, Stripe and Search Console natively, syncs hourly on paid plans, and adds goals, alerts and scheduled reports, so day-to-day maintenance drops to near zero. The best setup combines them: Databox's connectors for standard metrics, plus a small nightly script that pushes the custom metrics (MRR, 30-day churn, LTV, subscriber store revenue) into a Databox dataset through its v2 API. Our tested script does both, rewrites the last four days because Search Console data arrives late, and can write the same rows to Google Sheets. Databox is our pick; Metabase and Grafana are the open-source alternatives if you'd rather host it yourself.
Conversion & analytics14 min read
GA4 sets cookies, so in the EU and UK it needs consent before it runs, and its scripts are on the main ad-blocker lists. Fathom Analytics sets no cookies (Fathom says no cookie banner is needed for it) and its script is about 2 KB, against about 150 KB for gtag.js. But a privacy-first tool isn't block-proof: when we ran the EasyPrivacy and uBlock privacy lists through Brave's filter engine, Fathom's script and event beacon were blocked just like GA4's. Fathom also has no API for sending events from a server, so the purchase event still comes from the browser. The reliable setup is therefore two-sided: a small mu-plugin sends one Fathom Purchase event per paid order from the thank-you page, and a WooCommerce order webhook feeds a server-side ledger that no ad blocker can touch. A reconcile command then compares the two through Fathom's API and tells you what share of orders and revenue the browser missed. Fathom is our pick for cookieless traffic and conversion analytics; GA4's Measurement Protocol does take server-side events, but it needs the visitor's GA client ID from a cookie, so consent still applies.
Localization18 min read
Multilingual SEO on a big WooCommerce store comes down to three jobs. First, every language version of a product needs its own crawlable URL with a complete, reciprocal hreflang set and a self-referencing canonical. Second, text that WooCommerce renders in the browser (block cart and checkout, Ajax fragments, React catalogs reading the Store API) must be translated too, or shoppers switch language halfway through checkout. Third, the word budget must fit the catalog. Linguise covers the first two server-side: it translates URLs, prints hreflang, and translates the Store API's cart and checkout JSON. Reading its 2.2.70 source shows that it skips the /wc/store/v1/products route unless you add it with two filters, which our tested mu-plugin does. Its Large plan has no word cap (fair use applies) for $45 a month, which is why it's our pick past 10,000 products; Weglot is the strong alternative, priced by unique words. Translate by hand where words sell: top products, categories and legal pages. Exclude SKUs, prices and account pages, and audit hreflang clusters with the script below.
Localization12 min read
WPML (and Polylang) store every translation as its own WordPress post, so each translated variable product copies the product, all of its variations and their meta. In our measurement on WooCommerce 11.2.1, one variable product with 12 variations took 13 posts, about 270 postmeta rows and 24 attribute-lookup rows, and every extra language added the same again: a 10,000-product catalog in 4 languages grows from about 2.7 million to about 10.8 million postmeta rows. Weglot keeps translations in its cloud: WordPress renders the original page, Weglot's plugin catches the HTML in an output buffer and translates it through cdn-api-weglot.com, so MySQL stays the size of one language. The price is a network call on every uncached translated page view, which makes a full-page cache in front of the translated URLs mandatory, and a word quota: Weglot counts unique words across all languages, so a large catalog can outgrow its 5-million-word top plan. Pick Weglot for performance and a lean database; pick WPML when translations must live on your server, when you need per-language prices or stock rules, or when the word count makes SaaS too expensive. Polylang is the open-source version of WPML's model.
Email, SMS & support16 min read
To show a LiveChat agent who they are talking to before the first message, send two kinds of context. Send the cart from the shopper's browser as LiveChat session variables, which are display-only because the shopper can change them. Send identity as a signed, expiring customer reference that only your store can create. A Details widget in LiveChat's Agent App passes the agent's LiveChat token and the customer ID to a small context service. The service checks that the token belongs to your organization and your app, reads the session variables from LiveChat itself, verifies the signature, and returns the customer's latest WooCommerce orders through a read-only REST key that never reaches a browser. Allow CORS only for your widget's origin. Don't rely on CORS to protect WooCommerce keys: WordPress's REST API reflects any origin. Our tested setup (22 of 22 checks, including the real LiveChat Agent App SDK in a browser) shows purchase history, order status and the live cart in the agent's sidebar. LiveChat starts at $19 per agent per month billed annually.
Email, SMS & support15 min read
"Where is my order?" is usually the biggest single type of e-commerce support request, at roughly 18-30% of tickets in the most cited data, so a bot that answers it from live order data takes a large share of the load off your team. The bot needs three things: an order number, the email used at checkout, and an endpoint that returns the order's status only when both match. Give a wrong pair and a missing order the same answer, rate limit failures per order and per chat, and return status and tracking only, never addresses. On Shopify, Tidio's Lyro has a ready-made order status action. On WooCommerce, point a Lyro Action at a small lookup service like the one in this guide (tested against a real store, 18 of 18 checks passed). A custom Dialogflow CX bot can call the same service, but you then build and maintain the conversation, the hand-over to people and the chat channel yourself. Tidio is our pick for most stores; Gorgias fits stores that want a full helpdesk around the bot.
Payments & fraud15 min read
The hard part of an affiliate program on Stripe is linking the click, which happens on your site, to the payments, which happen in Stripe days or months later. Store the referral code in a first-party cookie, then pass it to Stripe Checkout in three places: client_reference_id, the session metadata and subscription_data.metadata. Stripe copies the subscription metadata onto every invoice, so a webhook endpoint can attribute each customer even when events arrive out of order, then book commissions on invoice.paid and reverse them on charge.refunded. Our tested in-house version does that in about 150 lines of Python with SQLite. What it leaves out is most of the work: affiliate sign-up, a portal, payouts, tax forms and fraud review. FirstPromoter does all of that by connecting to your Stripe account, from $49 a month; build in-house only if your commission rules don't fit a tool.
Payments & fraud15 min read
Treat a payment gateway's callback as a hint, not as proof of payment. CoinGate's callbacks carry no signature header, so verify them in two steps: give each order its own secret token (an HMAC of the order ID, so nothing needs storing) and reject any callback without it, then read the order back from CoinGate's API and act only on what the API says. Ship only when the API reports the status paid; confirming means the transaction is still waiting for network confirmations. For wrong amounts, let CoinGate's underpaid cover absorb small shortfalls (1-2% covers most wallet fees), put bigger shortfalls on hold for a person instead of cancelling them, and note overpayments so support can point the customer to CoinGate's refund form. Settle in EUR or USDC if you don't want to hold price risk. Our tested WooCommerce gateway does all of this; CoinGate charges 1% per payment with no monthly fee, and NOWPayments is a good alternative with HMAC-signed callbacks.
Email, SMS & support22 min read
WooCommerce core has no abandoned-cart feature, and most recovery plugins store every cart in the WordPress database and send reminders from WP-Cron. A lighter design keeps WordPress to one job: when a shopper who ticked a consent box enters an email or phone number at checkout, send a signed cart snapshot to a small external service, and tell it when the order is paid. The service keeps the carts in SQLite, sends one email after an hour and one SMS after a day through Brevo's API, retries network errors, rate limits and server errors with backoff, texts only during daytime hours in the shopper's time zones and honors one-click unsubscribes. Our tested mu-plugin and Python relay do this with no extra packages. Brevo covers email and SMS in one API with a free email plan; Textmagic is an SMS-first alternative and MailerLite a cheaper marketing tool.
Email, SMS & support16 min read
A staging copy of a WooCommerce store holds real customer addresses and sends mail through the server's PHP mail() unless something stops it, so order emails, password resets and scheduled follow-ups can reach real customers from a test site. Route mail by environment: send everything from staging to an email sandbox such as Mailtrap's, block mail when no sandbox is set up, and send real mail only when the site is the live host name. In production, send receipts and resets through a transactional stream kept apart from marketing mail, and publish SPF, DKIM and DMARC records for the sending domain. Our tested mu-plugin does the routing and our Python script checks the DNS records. Mailtrap covers both testing and sending (sending is free up to 4,000 emails a month); Postmark is a strong developer-focused alternative for sending.
Payments & fraud16 min read
A fraudulent order costs the goods, the shipping, the refund and a dispute fee when the real cardholder files a chargeback, and too many chargebacks put your payment account at risk. Score every paid order before it ships: read the AVS and CVC checks and risk level your payment processor already returns, compare the buyer's IP location with the billing and shipping address, and count repeat orders from one email or IP. Our tested Node.js webhook service does this with no dependencies, puts risky orders on hold with a note listing every reason, and can add FraudLabs Pro's score, which brings proxy detection, email and phone checks and a shared blacklist that hand-written rules can't match. FraudLabs Pro's free plan covers 500 orders a month; Stripe Radar only sees Stripe payments.
Store security17 min read
A Magecart skimmer is JavaScript injected into your checkout that copies card details as customers type them and sends them to the attacker. On WooCommerce it gets in through a core or plugin file, a theme, a must-use plugin, or a database option, and it often hides from logged-in admins. Catch it in three layers: compare every file with WordPress.org's official checksums and a baseline of everything else, query the database for injected scripts, and send a Content-Security-Policy header so the browser refuses to send card data to hosts you didn't list. Our tested Python script found all 10 planted changes on a real WordPress 7.1.3 and WooCommerce 11.2.1 install with no false positives, and in headless Edge an enforced CSP blocked all 5 exfiltration channels we tried. MalCare does the scanning on its own servers, covers files and database, adds a firewall and cleans up on paid plans: the better choice if nobody will read a nightly report.
Store security13 min read
Every customer or order export from Shopify or WooCommerce is a spreadsheet of names, emails, addresses and phone numbers, and by default it lands in the Downloads folder, often in a cloud-synced Desktop or Documents folder, and then in an email to the accountant. Treat exports as short-lived: export only when needed, move the file into an end-to-end encrypted locker straight away, share it through an encrypted link instead of an attachment, and delete the plain copies. Full-disk encryption protects a laptop that is switched off; it doesn't protect files that sync to the cloud, get attached to email or are read by malware on a running machine. Under the GDPR, data that is encrypted and unreadable to whoever got it can spare you from notifying every affected customer after a breach. NordLocker is the simplest end-to-end encrypted option for non-technical staff; Cryptomator and GPG are free open-source alternatives. Our tested Python scanner finds exports left in plain text without printing their contents.
DevOps & monitoring16 min read
Back up a WooCommerce store with restic: dump the database with mysqldump through restic's --stdin-from-command, so a failed dump never becomes a snapshot, back up wp-content/uploads, keep 14 daily, 8 weekly and 12 monthly snapshots, read back a different 1/30 of the repository every night, and run a monthly restore drill that loads the dump into a scratch database and compares it with the live store. restic encrypts on your server, so the bucket only ever holds ciphertext. For the bucket, egress decides the bill: IDrive e2 is $6 per TB a month with free downloads up to 3 times the stored volume and no API fees, while AWS S3 Standard is $0.023 per GB plus $0.09 per GB downloaded after the first 100 GB. Below roughly 200 GB, S3 is cheaper; at 500 GB with a monthly full verification read, e2 is $6 against about $47.50.
DevOps & monitoring13 min read
Monitor four things for an online store: certificate expiry on every hostname (and every server behind it), the response time of the cart and checkout pages, the APIs the storefront depends on, and the monitor itself. A cron script in Python can cover the first three from one server, and our tested version alerts Slack only when something changes. What a script on one server can't do is see your store from several regions or confirm a failure from a second location before paging you, and it can't tell you when its own server dies. StatusCake does both: SSL monitors with expiry reminders, uptime checks with confirmation servers, page speed monitors, and a push (heartbeat) test that can watch your cron script. The free plan covers one SSL monitor and 10 uptime checks at 5-minute intervals; Superior is $20.41 a month billed yearly for 50 SSL monitors and 1-minute checks.
DevOps & monitoring16 min read
Run the webhook receiver as a small always-on service that verifies the signature, writes the event to disk and answers 200 in milliseconds, with a worker forwarding it in the background. Our tested relay used about 31 MB of RAM and 6 ms of CPU per webhook, so on Railway, which bills measured usage per second, it costs well under the $5 that the Hobby plan already includes: $5 a month, deployed from Git. A $5 Vultr or $6 DigitalOcean VPS costs the same and needs you to run Docker, TLS and updates. Railway gets expensive for workers that keep a full vCPU or several GB busy around the clock: a 1 vCPU / 1 GB worker running 24/7 is about $30 a month on Railway against $10 to $12 for a 2 GB VPS. Don't enable Railway's Serverless sleep on a webhook receiver.
Hosting & performance14 min read
Don't rebuild a headless Shopify storefront when a price or a paragraph changes. Tag each cached fetch (product:handle for Shopify, story:slug for Storyblok), point Shopify's products/update webhook and Storyblok's publish webhook at two small Next.js route handlers, verify their signatures, and call revalidateTag. Only the pages using that tag re-render, on their next visit. In our test with Next.js 16.4, a full build of 5,000 product pages took 62.6 seconds against a zero-latency mock API, while a webhook plus the next page view showed the new price in about 0.1 seconds. Use { expire: 0 } for prices so nobody sees the old one, and 'max' for editorial content.
Conversion & analytics15 min read
Shopify records every online store search with a search_results_were_returned flag, and since Admin API 2025-10 you can query it with ShopifyQL (FROM searches, read_reports scope). Pull the zero-result queries monthly, compare their words against your catalog's own vocabulary, and sort them: typos and missing synonyms go into the Search & Discovery app, combinations need merchandising, true gaps are a stocking or redirect decision. The script in this guide does the sorting and publishes reviewed redirects to a shop metafield your theme reads. If you'd rather not maintain that loop, Searchanise handles synonyms, typo suggestions, search redirects and no-result analytics as one app, from $16 a month billed yearly for up to 1,500 products.
Store security14 min read
Stop card testing in layers, as early as possible: a WAF in front of the store (Sucuri as a managed service, or Cloudflare if someone on your team owns the rules), rate limits on the payment endpoints at the origin, WooCommerce's own checkout rate limit, and velocity rules at the payment gateway. Rate limit by IP alone fails against testers that rotate through many addresses, so also watch whole networks and attempts from visitors who never browsed a product. Sucuri suits stores without a security person: one price per site, its team handles the WAF rules and virtual patching, malware cleanup is included, and Protected Pages can put a CAPTCHA on the add payment method page. Cloudflare gives more control and a free tier, but rate limiting on Free is one rule with a 10-second window, and Bot Fight Mode can't be skipped for payment gateway callbacks.
Email, SMS & support16 min read
Use Shopify Flow when the automation acts inside Shopify (tags, metafields, notes) or when one HTTP call per event is enough; its Send HTTP request action needs the Grow plan or higher, waits 30 seconds for a reply and can retry for 24 hours. Move to ActiveCampaign's API through a small relay when you need signals Flow can't see (category browsing from a custom pixel), values you define yourself (net lifetime value after refunds), or control over retries and rate limits: ActiveCampaign allows 5 API requests per second per account and answers 429 with Retry-After. The relay in this guide verifies Shopify's HMAC, de-duplicates deliveries, keeps an outbox in SQLite and sends absolute values, so a retry can never double-count.
Shipping & inventory16 min read
For a full catalog export, Shopify's GraphQL bulk operations are the better tool: one query, no rate limit, a JSONL file you rebuild with __parentId. Paged GraphQL queries are a poor fit at this size because nested variants make each query expensive and Shopify caps pagination at 25,000 objects. BigCommerce's REST catalog is simpler to reason about: 250 products per page with variants included, and a request quota per 30 seconds (150 on Core and Growth, 450 on Scale) that parallel workers can share using the rate limit headers. For frequent writes and B2B pricing, BigCommerce is ahead on lower plans: batch variant updates of 50, price lists with bulk upserts of 1,000 records, and customer groups from Growth up, while Shopify's points budget grows tenfold only on Plus.
Hosting & performance17 min read
Never cache the cart, checkout, My Account, the Store API or any response that sets a cookie. Cache anonymous product and category pages for a few minutes, bypass the page cache for every shopper who has a cart or a login, and put a Redis object cache under the uncached requests. Treat a cached Set-Cookie header as the serious bug: it hands one shopper's session, cart and checkout details to the next. Self-managed Varnish works if someone owns its rules; WP Engine (EverCache for WooCommerce, from $150 a month) and Cloudways (Varnish rules preset for WooCommerce apps, Redis included, from $11 a month) make those rules the host's job. Whichever you choose, run a cart isolation test after every cache change.
Hosting & performance14 min read
Contabo sells RAM for an eighth to a tenth of what DigitalOcean and Vultr charge: €25 a month (€20 for the first 24 months) buys 48 GB and 12 vCPUs, while 32 GB costs $160 to $168 a month on the other two. But Playwright rendering usually runs out of CPU before RAM, so extra memory only pays off when pages spend most of their time waiting, for example on per-domain rate limits or long sessions. Use Contabo for steady, waiting-bound workloads; Vultr Optimized Cloud or DigitalOcean CPU-Optimized for CPU-heavy rendering that needs dedicated vCPUs; and either one with hourly or per-second billing for jobs that run only a few hours a day. Measure memory per page and CPU steal on a one-month plan before you commit to a long term.
DevOps & monitoring17 min read
Use an external service such as UptimeRobot for anything a shopper would notice: storefront uptime, a keyword monitor that alerts when the Add to cart button disappears, an API monitor that checks the product JSON has a price above zero, and status monitors for payment providers. Use your own scripts for what only you can judge: whether a scraper's output is complete and plausible, and whether the checkout flow works end to end. Connect the two with heartbeat monitors: each script pings UptimeRobot only when it succeeds, so a crashed script, a dead server or a run that produced bad data all raise the same alert. Heartbeat, API and SSL monitors need a paid UptimeRobot plan; Solo starts at $9 a month billed yearly.
Proxies & scraping11 min read
Firecrawl takes a URL and a JSON schema, renders the page, and returns the product as structured JSON in one API call, for 5 credits a page (1 for the scrape plus 4 for the JSON format). 10,000 product pages a month is 50,000 credits, which fits the Standard plan at $83 a month billed yearly. A DIY pipeline with Playwright and Beautiful Soup costs little to run, but you still need an LLM call to turn the cleaned text into JSON, proxies for protected stores and a few hours a month of upkeep: by our estimate about $180 to $490 a month for the same 10,000 pages. DIY wins when you scrape a few sites with good schema.org data, or at very high volume.
Localization12 min read
To see the price a shopper in another country sees, send the request from a residential IP in that country, keep the same IP for the whole redirect chain with a sticky session, keep the cookies the store sets on the way, and send a matching Accept-Language header. Then read the price and currency from the page's schema.org Product data, convert it with a daily reference rate such as the ECB's, and strip VAT before you compare, because EU and UK prices include VAT and US prices don't include sales tax. Most failed geo checks are redirect loops caused by a rotating IP, a missing cookie jar or a language header that contradicts the IP.
Proxies & scraping10 min read
Replace chromium.launch() with chromium.connect_over_cdp('wss://production-sfo.browserless.io?token=...') and your existing Playwright code drives a Chrome running on Browserless instead of your own server. Browserless bills units of up to 30 seconds of browser time per connection, so how you connect decides the bill: opening one session per page costs at least a unit a page, while reusing each session for many pages costs only the seconds you use. For 100,000 six-second pages a month, that's about $35 with reused sessions or $200 with a session per page, against about $124 for a 4 GB VPS plus an estimated two hours of upkeep. Keep workers at or below your plan's concurrent browsers, reconnect before the session time cap, and always close the browser.
Proxies & scraping9 min read
ZenRows renders the page in its own headless browser, routes it through rotating residential IPs and handles anti-bot challenges, then returns the finished HTML from a single GET request. With JavaScript rendering and premium proxies a page costs 25 credits, which works out to about $6.90 per 1,000 pages on the $69 Launch plan and about $2.75 per 1,000 on the $549 Scale plan. Running Playwright yourself makes the browser almost free, but on a protected store you still pay for residential proxy bandwidth and for the hours spent keeping stealth patches working: by our estimate about $190 to $460 a month for 10,000 protected pages, against $69 on ZenRows. Self-hosting wins on high-volume sites that don't block you.
Email, SMS & support11 min read
Trigger an n8n workflow on Shopify's checkouts/create webhook, pause it for two hours with a Wait node, then ask Shopify's Admin GraphQL API whether an order exists with that checkout's token. If there's no order, an IF node sends a recovery email with the checkout's abandoned_checkout_url, or an SMS through Twilio when the buyer gave a phone number and opted in to SMS marketing. The whole workflow is eight nodes and one n8n execution per checkout. The import-ready JSON is below.
Proxies & scraping11 min read
Zyte API's automatic extraction takes a product URL and returns name, price, currency, availability and SKU as JSON, without any selectors, so a store redesign doesn't break your scraper. On pay-as-you-go it costs about $0.40 to $2.35 per 1,000 product pages fetched over HTTP, and about $1.30 to $17 per 1,000 when the page has to be rendered in a browser. Hand-written Playwright selectors cost almost nothing per page but need developer time every time a store changes its HTML. At an estimated half hour of maintenance per store per month, Zyte is cheaper until a single store passes roughly 16,500 to 35,000 HTTP pages a month on a moderate (tier 3) site.
Email, SMS & support11 min read
Make bills a credit for almost every module a scenario runs, so 10,000 credits ($9 a month on Core, billed annually) cover roughly 2,500 four-step abandoned-cart alerts but only 19 runs of a 500-SKU catalog sync. n8n Cloud bills one execution per workflow run, however many steps it has, and self-hosted n8n has no usage fee at all: you pay about $12 to $15 a month for a 2 GB VPS plus your maintenance time. If you count that time at $50 an hour, self-hosting pays off once you need more than about 80,000 Make credits a month.
Shipping & inventory16 min read
To sync your own Amazon prices and stock, register as a private developer in Seller Central, give your app the Pricing and Amazon Fulfillment roles, and self-authorize it to get a refresh token. Your script swaps that refresh token for a one-hour access token at Login with Amazon (LWA), then calls the SP-API with it in the x-amz-access-token header. AWS IAM and request signing have not been required since October 2023. Stay inside each operation's usage plan: getInventorySummaries allows 2 requests per second and getPricing 0.5 per second for up to 20 SKUs.
Marketplaces & research14 min read
Most Shopify stores publish their catalog at /products.json: every product and variant with its price, compare-at price and stock status, 250 products per page. A small Python script can page through it, save a snapshot, and compare each run with the last one to alert you on price drops, price rises, stock changes, new products and removed products. Check robots.txt, keep a few seconds between requests, back off on HTTP 429, and run it a few times a day, not every minute.
Proxies & scraping15 min read
Send the same set of real target URLs through every proxy you pay for, record each request's status, timing and bytes in SQLite, and compare providers on three numbers: success rate (a 200 response that contains the content you expect), p50 and p95 latency of successful requests, and cost per 1,000 successful requests. The script in this guide does that as a cron-friendly CLI with no dependencies beyond Python's standard library.
Proxies & scraping15 min read
Run Redis and several Playwright worker containers with Docker Compose on one VPS. Workers pull jobs from a Redis stream, render pages in a shared Chromium with a few pages open at once, retry temporary failures with exponential backoff, and move jobs that keep failing to a dead-letter stream. On a 4 GB, 2 vCPU server, start with 2 browsers and 3 pages each, then tune from measured memory and CPU.
Proxies & scraping9 min read
Bot management scores every request on IP reputation, client signals, behaviour and the site owner's rules, then allows, challenges or blocks it. A challenge or a run of 403s means the owner doesn't want that traffic on those terms, so a well-built crawler detects it and stops the host instead of retrying or trying to solve it. Cloudflare marks challenge responses with the cf-mitigated: challenge header. Treat 429 as slow down, with additive increase and multiplicative decrease of the interval. Then get the data legitimately: an official API or feed, allow-listing by the owner, an identified and signed crawler, or licensed datasets. The tested script in this guide reads a crawl log and decides continue, slow down or stop per host.
Payments & fraud10 min read
If you run several businesses as separate LLCs, each one needs its own EIN, its own bank account, its own payment-processor payouts into that account, domains registered to it, and its own books. Money moves between them only through written agreements (a management fee, a loan, a license), recorded on both sides. Commingling, such as one bank account for two LLCs or a processor paying out to the parent, weakens the liability protection that was the reason for separate LLCs and makes taxes and a future sale harder. Keep an entity register and check it monthly; the tested script here flags shared accounts, payouts landing in another entity, domains registered to the wrong owner, missing agreements and upcoming filing deadlines.
Account safety & teams8 min read
In the first 15 minutes: don't open a replacement account, screenshot the exact notice and cited policy, secure every login with new passwords and 2FA, and freeze changes to devices, payment methods and team access. Then find the root cause, build an evidence pack with a checksummed manifest, check that every business document is current and matches your legal name, and submit one complete appeal through the platform's official channel.
Account safety & teams8 min read
A working SOP for store teams has five stages. Before access, write down the role and the exact areas it needs. On day one, invite the person with their own login through the platform's user roles, require 2-step verification on their own device, and record the grant in an access register. Keep each client or store in its own browser profile and each shared secret in a password manager vault. Every week, review the activity log against the role, flagging actions outside the role, outside agreed hours, or in unusual bulk. On the last day, revoke, rotate and record. The review script in this guide does the weekly check from a CSV log and a JSON policy.
Proxies & scraping5 min read
Pick Apify for ready-made scrapers (Actors) for Amazon, Google Maps and social platforms, plus scheduling and storage. Pick ScrapingBee if you write code and want one API call that handles proxies and JavaScript rendering. Pick Browse AI for point-and-click monitoring of a few competitor pages, synced to Google Sheets, without code.
AI & cloud GPUs7 min read
RunPod is usually cheaper per GPU hour, bills per second and has the widest range of consumer and data center GPUs, which makes it the better fit for experiments, batch jobs and inference on open models. Vultr costs more per hour for comparable cards but gives you full cloud VMs, private networking and 30+ global locations, which suits production services that need a conventional cloud setup.
Marketplaces & research9 min read
AutoDS is a fulfilment automation layer: it imports products from many suppliers, monitors their price and stock, places orders and syncs tracking numbers to your store. Spocket is a supplier catalog weighted towards US and EU suppliers, so delivery is faster but unit cost is higher. Choose AutoDS when order volume and stock sync are the bottleneck, Spocket when delivery time matters more than margin. Either way, measure how often your suppliers change stock and price: the tested script in this guide replays your orders at several sync intervals and counts oversold orders and margin breaches, so you can pick a plan by the interval you need.
Marketplaces & research8 min read
Dropship.io estimates what public Shopify stores sell, so it answers whether a product is selling. Minea indexes ads and influencer posts on Facebook, TikTok and other platforms, so it answers how a product is being marketed. Both work from public signals and produce estimates, not ground truth. Use Minea to find angles, Dropship.io to check that sales hold across weeks, and five years of Google Trends to tell broad, steady demand from a spike that is already fading. The tested script in this guide labels each term's demand shape from a Trends CSV export.
SEO & content7 min read
Mangools is the cheapest and simplest, built for bloggers and small sites that mainly need keyword research. SE Ranking is the value pick for small teams and agencies that need daily rank tracking, audits and client reporting. Semrush costs the most but has the deepest competitor, keyword and advertising data, which matters most in competitive niches and for larger agencies.
Account safety & teams6 min read
AdsPower gives the best value for teams that need automation: a small free plan, no-code RPA and a window synchronizer. GoLogin is the easiest to learn and can launch profiles from the web or Android. Multilogin costs more but bundles proxy traffic and has the longest track record. Test any of them on a cheap trial first.
Hosting & performance8 min read
Cloudways is the cheapest way to get a managed cloud server you can fill with many sites, with prices from $11 a month and a 3-day free trial. ScalaHosting gives you a managed VPS with its own SPanel control panel, a dedicated IP and backups included, but watch the renewal price. Kinsta costs the most per site and does the most for you: Google Cloud infrastructure, edge caching and expert WordPress support.
Proxies & scraping7 min read
Webshare is the cheapest place to start, with 10 free datacenter proxies and low-cost static plans. IPRoyal suits irregular workloads because its residential traffic doesn't expire. Decodo is the balanced mid-market pick with simple dashboards and scraping APIs. Bright Data costs the most but has the deepest network and unblocking tools.
Marketplaces & research9 min read
Build the stack by job, not by tool: storefront and checkout, payments, email and SMS, support, automation, supplier and fulfilment, inventory across channels, research, analytics and reviews, with one owner tool per job. When you sell on several marketplaces, keep one system as the source of truth for stock and sync every channel from it. Then measure the stack the way you measure products: monthly cost at today's order volume and the next two, cost per order, jobs paid for twice, jobs nobody covers, and channel fees per order. The tested script in this guide computes all of that from a short JSON file of your subscriptions and channels.
AI & cloud GPUs8 min read
A private model service is managed infrastructure with obligations, not a product you set up once. Check every license first: the model's (Llama's community license and acceptable-use policy, Apache 2.0 for many Qwen and Mistral models) and the tools' (n8n's Sustainable Use License doesn't allow selling hosted n8n). Isolate clients with separate API keys, separate logs and, for sensitive data, separate instances; per-client LoRA adapters on one base model are cheaper but share the GPU. Log tokens and latency per key, split each month's GPU bill by usage, and compare every client's revenue and p95 latency with its plan. Price from that measured cost plus your operating time, not from what the market seems to bear.
AI & cloud GPUs8 min read
On 23 October 2026 an L40S (48 GB) cost $0.79 to $1.09 an hour on RunPod, $1.57 on DigitalOcean, $1.671 on Vultr and $1.861 on demand on AWS (g6e.xlarge); an H100 SXM cost $2.69 to $3.99 on RunPod, $2.99 per GPU in Vultr's 8-GPU server, $3.99 to $4.29 on Lambda and $6.88 per GPU on demand on AWS (p5.48xlarge). The hourly rate is only half the comparison: billing granularity, storage while stopped, minimum terms and above all the tokens per second you actually get decide the price per job. Rent the candidate GPU for an hour, run the benchmark script in this guide at your real concurrency, and divide.
AI & cloud GPUs8 min read
Run n8n with Docker Compose on a Linux VPS (2 GB RAM for light use), backed by Postgres and served over HTTPS through Caddy. Back up the database and the encryption key, turn on 2FA, keep port 5678 closed, and pin the image version. Then watch it: a daily report from n8n's public API that flags workflows with a high error rate, slow runs, executions stuck in running and active workflows that didn't run at all catches the silent failures that cost orders. The license allows internal business use, not reselling n8n itself as a hosted service.
AI & cloud GPUs10 min read
Fine-tune for tone, format and recurring answers; keep facts that change (prices, policies, stock) in retrieval. Export resolved tickets, mask emails, phones, card and order numbers, drop duplicates and one-line replies, and split train and eval by ticket. LoRA on all seven projections of Llama 3.1 8B at rank 16 trains 41.9 million parameters; with QLoRA the 8B base sits in 4-bit, so a 24 GB GPU is usually enough at 2k-token examples, while 70B needs an 80 GB card. Checkpoint every few minutes so a reclaimed spot instance resumes, compute only the loss on the assistant's tokens, and compare eval loss and blind-graded answers before and after.
AI & cloud GPUs8 min read
Treat an unattended agent as a program that spends money and can write to your systems. Give every run hard limits on steps, tokens, dollars and wall-clock time, stop it when it calls the same tool with the same arguments over and over, and make every tool that changes something (prices, listings, emails, refunds) wait for a person to approve that exact call. Record approved actions so a restarted run can't repeat them, log every model and tool call to a file, and run the agent from a systemd timer with a dedicated user, memory and CPU limits, secrets in a root-only file and a heartbeat to an external monitor.
AI & cloud GPUs9 min read
Run ComfyUI on a rented 24 to 48 GB GPU, bound to localhost and reached through an SSH tunnel, because it has no login of its own. Generate only the background: cut the product out with a transparent background, let the model repaint the transparent area, then paste the original product pixels back on top so the item buyers receive is exactly the item they saw. Check the model license first (FLUX.1 [schnell] is Apache 2.0, FLUX.1 [dev] weights are under a non-commercial license), install as few custom nodes as possible, and drive batches through ComfyUI's API with a script that records the source photo, prompt, seed and workflow hash for every image.
AI & cloud GPUs10 min read
Size the GPU from the model's config.json, not from its name: weights take parameters times bytes per parameter (about 15 GiB for Llama 3.1 8B in BF16, about 35 GiB for a 70B model in 4-bit AWQ), and every concurrent sequence adds KV cache (128 KiB per token for Llama 3.1 8B, so 1 GiB per 8k-token conversation). Use Ollama for one user and quick tests, and vLLM for concurrent or batch traffic through an OpenAI-compatible API. Bind the server to 127.0.0.1, reach it through an SSH tunnel or an authenticated proxy, and stop the GPU when the queue is empty.
AI & cloud GPUs8 min read
Price every option per useful GPU-hour at your real monthly usage. An owned RTX 4090 workstation mostly costs depreciation, so it's expensive at 40 hours a month and cheap at 400. On-demand cloud scales linearly with use; spot is cheaper per hour but loses about half a checkpoint interval of work plus the restart time at every interruption; reserved capacity costs the same whether you use it or not, so it only pays at high, steady utilization. With the October 2026 prices and the example assumptions in this guide, the workstation beat RunPod's Secure Cloud RTX 4090 from about 76 hours a month but needed 234 hours a month to beat its Community Cloud price. Run the model with your own numbers before buying anything.
Marketplaces & research9 min read
Slow overseas delivery costs more than it looks: refunds, disputes, 'where is my order' tickets and a delivery promise that lowers conversion. US and EU suppliers (from catalogs such as Spocket, private suppliers in AutoDS, platforms such as Zendrop, or your own stock in a 3PL) usually cost more per unit, so decide per product with your own data. Score each supplier from your order history: handling and transit time at the median and 90th percentile, on-time rate against the promise on your product page with a confidence bound, issue and refund rates, and open orders already past the promise. The tested script in this guide produces that scorecard from an order export.
SEO & content8 min read
Retargeting organic readers can work, but last-click reports overstate it, because people who were going to buy anyway are the ones most likely to click an ad on the way back. Measure articles first: readers, return visits, 30-day conversion and days to buy, per landing article. Build audiences only from readers who consented to advertising cookies, and keep a random holdout (10 to 20% of the audience never sees the ads). The difference in conversion between exposed and holdout readers is what retargeting adds. The tested script here computes both, and on synthetic data with a known effect it shows last-click crediting retargeting with about a third more buyers than the ads actually added.
SEO & content10 min read
Export the organic keywords for your site and two or three real search competitors (the sites that rank for your queries, not your business rivals), plus their referring domains. A keyword is a gap when a competitor ranks in the top 10 and you don't rank in the top 20. Group gaps into topics, score them by volume, expected click-through at the competitor's position and difficulty, and look at the competitor's ranking page before deciding what to build. For links, list sites that link to two or more competitors but not to you: they've shown interest in your topic. Treat every volume and traffic number as a tool estimate. The tested script in this guide does the matching across exports from different tools.
Email, SMS & support9 min read
Split the work by what each tool owns: AutoDS places supplier orders, watches supplier price and stock, and syncs tracking back to the store; Gorgias holds every customer conversation with the order beside it and answers routine questions; Make connects the gaps with webhooks. The part most setups miss is the exception path: orders that are paid but not shipped after a few days, shipped without tracking, or stuck in transit. A small hourly script (tested in this guide) finds those in Shopify and posts each one once to a Make webhook, which opens a Gorgias ticket before the customer has to ask. Automate the routine, route every exception to a person, and log what each automation did.
SEO & content9 min read
Collection pages are the right page type for most commercial shopping queries, because the results for those queries are mostly category pages. Create a collection for each query group with real demand and enough products (not one per tag), write a short intro above the grid and the helpful detail below it, and keep sort and multi-filter URLs out of the index. Shopify's default robots.txt already blocks sort_by, tag combinations and two-filter URLs, and standard themes canonicalize filtered pages to the collection and products to /products/. The audit script in this guide checks a live store for empty, thin and duplicate collections and for themes that break those canonicals.
Hosting & performance14 min read
Hosting mostly shows up in one number: time to first byte (TTFB), which delays Largest Contentful Paint because the browser can't render before the HTML arrives. Core Web Vitals are a confirmed but modest ranking signal, judged on real-user field data at the 75th percentile (LCP 2.5 s, INP 200 ms, CLS 0.1). Before paying for a faster host, measure TTFB per page, check whether HTML is served from a cache, and check compression and cache headers on assets. In the tested nginx example below, an edge cache cut TTFB from about 350 ms to 2 ms for the same page. The script in this guide makes those checks per URL and says what to fix.
SEO & content9 min read
Programmatic pages work when each page carries data a searcher wants and can't easily get elsewhere (specs, measurements, prices, availability), and fail when a template is filled with a name and some generated text. Build from a structured dataset, compute something per row that's actually useful (a comparison against the category median, for example), and put three gates in front of publishing: required fields present, enough facts per page, and no page that's a near-copy of another. Publish only what passes, as drafts a person reviews, and list only those pages in the sitemap. The tested script here does all of that and publishes to WordPress through the REST API with an application password.
SEO & content12 min read
Semrush is a research suite: keywords, competitors, backlinks, site audits and rank tracking. Surfer is an on-page editor: it compares your draft with the pages ranking for a query and suggests terms, headings and length. They overlap little, and neither decides whether Google or an AI assistant cites a page. Google says AI Overviews and AI Mode need no special markup or files: pages need to be indexable, answer the query clearly and early, and keep structured data consistent with what's visible. The tested script in this guide checks those things on any URL: title vs H1 vs query, answer-first intro, heading outline, and JSON-LD that parses and matches the page.
SEO & content10 min read
For your own site, the Search Console API is the most accurate rank source there is: real impressions, clicks and impression-weighted average positions per query and page, free, with no scraping. Use it to find rank drops, queries in positions 8 to 20, and queries where two of your pages split the impressions (cannibalization). Use a rank tracker or SERP API only for what Search Console can't give you: competitors' positions, a specific city or ZIP code, and SERP features. Scraping Google yourself breaks Google's terms, gets blocked quickly and returns results personalized to the proxy's location, so don't build on it.
SEO & content12 min read
A new domain can't compete for broad head terms, so start where authority matters least: specific queries whose intent you can satisfy better than the current results (exact fit, sizing, compatibility, comparisons with real data). Map one intent to one URL, group pages into hubs that link down to every child and across to siblings, keep every indexable page within three clicks of the home page, and give none of them zero contextual links. The crawler in this guide finds orphan and deep pages and suggests which existing page should link to each one. Expect months, not weeks; Search Console is the scoreboard.
Account safety & teams9 min read
Use each platform's delegation tools first: Meta Business Manager partner access, Google Ads manager accounts, Shopify collaborator accounts and Amazon user permissions. Give every staff member their own login with least-privilege roles, keep the client as owner of every asset, isolate each client's sessions in a separate browser profile and vault folder, and offboard the same day someone leaves. The audit script in this guide compares every grant with who is assigned to each client.
AI & cloud GPUs7 min read
Serve an 8B-class model with vLLM on one rented GPU, send it many requests in parallel (vLLM batches them on the GPU), ask for JSON with fixed keys, and write each result to a JSONL file the moment it's done so a stopped or reclaimed instance resumes where it left off. Validate every answer and retry bad JSON once. Your cost per 1,000 rows is the hourly price divided by rows per hour, so measure rows per hour on 200 real rows first and compare it with an API's per-token price at your volume before committing.
Marketplaces & research11 min read
Work out break-even ACoS from your margin before ads, then review the Sponsored Products search term report weekly. Negate a term only after enough clicks that zero orders is unlikely to be chance at your conversion rate (about 22 clicks at 10% conversion), negate ASIN search terms as product targets, move terms with two or more orders at or under your target ACoS into exact match and negate them where they came from, and bid terms that convert above break-even down to the bid that hits target. The tested script in this guide produces that review list from the report.
Proxies & scraping8 min read
Residential proxies bill per GB in both directions, so the budget is bytes per page times pages times runs. Measure bytes per page from a HAR file of a real page load instead of guessing, then compare four ways of collecting the same data: a full browser load, a browser with images, media, fonts and analytics blocked, the HTML alone with a plain client, and the HTML only for pages that changed (conditional requests answered 304 for the rest). In the tested example below, the gap between the first and the last is about 60 times. The tested script in this guide reads a HAR and prints that comparison with your page count, schedule and price per GB.
Proxies & scraping9 min read
A Squid proxy on a small VPS gives your team and your scripts one fixed datacenter IP with bandwidth included in the server price. It fits allow-listing (suppliers, APIs, admin panels that accept only known IPs), a stable egress for webhooks and monitors, and outbound filtering. It doesn't fit jobs that need many IPs or consumer locations; that's what commercial residential and ISP pools are for. Run it with authentication, a firewall rule limiting the port to your own IPs, CONNECT only to port 443, no forwarding headers and no caching, then read the access log weekly. The tested script in this guide reports usage per user and destination, refusals, probing from unknown IPs and egress against your plan.
Account safety & teams7 min read
Photos from phones and cameras carry EXIF metadata: GPS coordinates, camera make, model and often a serial number, and the time taken. Before publishing, upload copies with EXIF removed (rotation applied first, color profile kept), and keep the untouched originals in an encrypted archive as proof of authorship. Marketplaces and search engines also compare images by perceptual hashes, which survive resizing and recompression. You can use the same technique to find other sellers using your photos and report them through the platform's intellectual property form. Altering photos so two shops don't look related is evasion, not privacy, and this guide doesn't cover it.
Payments & fraud13 min read
A processor holds or reserves funds when its exposure to your future disputes grows faster than your track record: a sudden volume spike, slow delivery, rising disputes or early fraud warnings, or a business that no longer matches its account profile. The numbers behind it are public. Stripe treats dispute activity above 0.75% as excessive, Visa's VAMP program counts disputes plus fraud reports against same-month Visa payments (non-compliant at 0.5%, excessive at 1.5% with 1,500+ reports), and Mastercard counts this month's chargebacks against last month's payments (1.5% with 100+). Track those ratios weekly from the API, warn the processor before spikes, upload tracking fast, refund early fraud warnings, and keep enough cash to run for 30 days without payouts.
Account safety & teams8 min read
Before staff log in to seller, store or ad accounts, check four things. The connection leaves from the team's known address (office or a VPN dedicated IP) that's on your allow-list. Nothing bypasses the VPN over IPv6, DNS or WebRTC. The browser profile for that client contains only approved extensions. And the session is clean: password manager autofill on the real domain, 2-step verification on, no stale sessions on shared machines. The script in this guide checks the egress IP, IPv6 and every Chrome profile's extensions in one run.
Email, SMS & support10 min read
Send checkout abandoners a three-message flow: a plain reminder with the restored cart after 30 to 60 minutes, an objection-handling email around 24 hours, and an optional small, single-use, expiring incentive at 48 to 72 hours. Add one SMS only for shoppers who ticked a separate, unticked marketing consent box. Exit the flow the moment an order exists, on any device. Then hold out about 10% of abandoners at random and compare profit per abandoned checkout, after discounts and sending costs, between the two groups: most dashboards credit the flow with orders that would have come back anyway. The tested script in this guide does that comparison with a significance test.
Hosting & performance9 min read
A small Linux VPS with 1 to 2 GB of RAM runs several Python monitors in Docker for a few dollars a month. What makes them reliable isn't the server size but four habits: keep state on a volume so a restart doesn't re-alert or forget, write a heartbeat after every pass and let a Docker HEALTHCHECK read it, stop cleanly on SIGTERM within the grace period, and cap log size because Docker's default json-file log never rotates. Docker restarts a container that exits, but not one that's merely unhealthy, so also have an outside check that alerts when the heartbeat stops. The tested runner in this guide does all of this with the standard library.
Proxies & scraping7 min read
Most product pages don't need a browser: the data is in the raw HTML, in a JSON-LD block, in framework state such as __NEXT_DATA__, or in a JSON endpoint the page calls. Check that first with a plain request, and render only the pages where the values appear after JavaScript runs. When you do render, block images, media and fonts, use one browser context per task, cap concurrency by memory, and capture the JSON responses the page fetches. The tested script in this guide makes that decision per URL and reports the JSON endpoint when one exists.
Account safety & teams9 min read
Circumventing systems is one of Google Ads' most serious policies: accounts can be suspended without warning for cloaking, redirects that hide the real landing page, evading earlier enforcement, or running ads from a compromised account. Don't open a new account. Find the cause (often a hacked site that redirects only some visitors, a redirect in your tracking setup or a link to a previously suspended account), fix it, document it and appeal through the official form. The script in this guide fetches every final URL as a browser, as a visitor from Google and as AdsBot-Google, and flags redirects and content that differ between them.
Conversion & analytics18 min read
Browser pixels lose conversions to ad blockers, Safari's cookie limits and checkouts that leave your domain. Server-side tracking sends the purchase from your server instead: Meta's Conversions API, GA4's Measurement Protocol, or a server-side Google Tag Manager container that forwards to both. It only helps if the payload is right. Normalize and SHA-256 hash email, phone and name fields before they leave your server, using each platform's own rules: Meta and Google normalize Gmail addresses and phone numbers differently, so the same customer gives different hashes. Never hash IP, user agent, fbp or fbc. Send the same event_id from the pixel and the server so Meta counts the sale once, keep event_time within 7 days and in seconds, and send nothing to ad platforms when the visitor declined marketing cookies. The tested Python script in this guide builds and checks both payloads and reads the APIs' replies.
Account safety & teams8 min read
TikTok Shop allows sellers to run more than one shop in some cases, for example separate brands or regions, but forbids duplicate shops and shops opened to get around a penalty. Give each shop a real, verified business identity, add staff through Business Center with Seller Center roles such as Customer Service Agent or Finance Specialist instead of shared logins, secure every account with 2-step verification, and review access every quarter. The review script in this guide compares shop users with your team roster and role policy and flags leavers, wrong roles, missing 2-step verification and stale logins.
SEO & content10 min read
Let a language model write variants, but never let it be the source of facts. Keep one facts file per product (specs, sizes, price, warranty, returns, the claims you can prove), generate copy as structured JSON per placement, and run every variant through automated checks before a person reviews it: platform length limits (Google responsive search ad headlines 30 characters, descriptions 90; Merchant Center titles 150), numbers that aren't in the facts, claims that need evidence (environmental, health, 'best', guarantees), Google Ads editorial rules, unfilled placeholders and near-duplicates. The tested checker in this guide does that. Then test fewer variants for longer: small creative tests need tens of thousands of impressions per variant to show a real difference.
Payments & fraud10 min read
Give every vendor, ad account and subscription its own virtual card with a monthly limit just above expected spend, lock it to that merchant where your bank allows it, and name it after the vendor and the business that owns the account. A leaked or abused card then costs one budget line and can be frozen without touching anything else. Platforms also use payment details, issuer program, billing name and payout account to connect accounts, so every card must belong to the legal entity that owns the account it pays for. Audit monthly: off-vendor charges, cards near or without limits, idle cards and unknown cards, which the tested script in this guide checks from a CSV export.
Proxies & scraping10 min read
Pick the proxy type by what the job needs (datacenter for volume on unprotected sources, ISP for stable sessions, residential or mobile only where the answer depends on a consumer location), then build rotation around three rules. A 429 or 503 from the site means slow down that host, not switch IP: hold the host for Retry-After or an exponential backoff with jitter. A timeout, connection error or 403 counts against the proxy: after a few in a row, open its circuit breaker for a cooldown that doubles each time. A 407 is a credentials problem, so stop. Keep a session key on one proxy for multi-step tasks, and send one identified User-Agent. The tested standard-library module in this guide does all of this.
Proxies & scraping9 min read
For Amazon, read prices and offers through the Selling Partner API (getPricing, getCompetitivePricing, getItemOffersBatch) and stay inside each operation's published rate and burst. For Walmart, use the Marketplace APIs for your own items and the affiliate API for catalog data. Crawl public pages only where the site's terms and robots.txt allow it, at a fixed interval per host with one identified User-Agent, and stop when a host challenges or blocks you. Before scheduling anything, count the calls each refresh needs against each source's limit: the tested script in this guide does that and flags any tier that can't be met.
Account safety & teams7 min read
Give each VA their own login through the platform's built-in user roles: Shopify staff accounts, Amazon Seller Central User Permissions, eBay Team access, Etsy shared shop access, Meta business portfolio roles and TikTok Seller Center roles. Grant only the areas their job needs, require 2-step verification on their own device, and keep a register of every grant. For tools without user roles, share the login from a password manager vault and treat anything a VA could see as something to rotate when they leave. The offboarding script in this guide turns the register into a revoke-and-rotate checklist.
Account safety & teams8 min read
Browser fingerprinting identifies a device from attributes it exposes to every website: user agent, screen, timezone, fonts, canvas and WebGL rendering, audio processing and network signals. Incognito mode clears cookies but changes none of these, and a VPN changes only the IP address. Fraud systems use the result to link accounts to devices and to spot spoofed or inconsistent browsers. For teams, the practical answer is one login per person on their own device, separate browser profiles per client to keep sessions apart, and no shared or disguised devices.
Hosting & performance11 min read
At most revenue levels the largest cost on either platform is card processing, not the plan or the server. Shopify's plan and app fees are fixed; WooCommerce swaps them for a server, premium plugins and the hours someone spends maintaining it. With list card rates on both sides, the tested model in this guide finds Shopify cheaper at every level from $10,000 to $250,000 a month, because the maintenance time costs more than Shopify's plan. WooCommerce comes out ahead only once you negotiate a lower card rate than Shopify Payments gives your plan (above about $52,000 a month in the example), or when you need control Shopify doesn't give. The script computes the table and break-even points from your own numbers and sizes PHP workers and RAM for the self-hosted side.
Marketplaces & research10 min read
Helium 10 and Jungle Scout cover the same jobs (product discovery, keyword research, listing optimization, PPC and profit analytics) and both estimate a product's sales from its Best Sellers Rank with their own models, so their numbers differ and neither is Amazon's data. Choose Helium 10 if keyword depth and PPC automation matter most, Jungle Scout if you want simpler product and supplier research. Calibrate either one against a product you already sell, check search volume in Amazon's own Product Opportunity Explorer, and run every candidate through a fee model with the current FBA rate card before ordering stock. The tested script here compares FBA and FBM profit per unit and per month from a rate card file.
Marketplaces & research10 min read
Treat a product as validated only when three checks pass: demand that is broad and not fading (Google Trends over five years, several unrelated sellers, ads that keep running for weeks), a contribution margin per order that leaves room for the cost of acquiring a customer, and a supplier whose real delivery times match the promise on your product page. Then run a paid test sized in advance (roughly 60 orders' worth of traffic tells you the conversion rate within about 25%) with a stop rule written down before you start. The tested script in this guide works out contribution per order, break-even CPA and ROAS, and the traffic a test needs.
Account safety & teams8 min read
eBay allows several accounts, for example for different product lines, as long as each meets the same standards and none is used to dodge restrictions or duplicate listings. Etsy allows more than one shop but forbids opening one to get around a suspension. Make each shop a distinct brand with its own catalog, give staff access through eBay Team access and Etsy's shared shop access instead of the owner's password, secure every login with 2-step verification, and check exports regularly for listings that appear in more than one shop.
Hosting & performance12 min read
Pick a Windows Server image with at least 4 GB of RAM in the region closest to the sites or people it works with, and put a cloud firewall in front of it before the first login. Remote Desktop's protection is the network scope, not the port number: allow TCP and UDP 3389 only from your own addresses or a VPN, keep Network Level Authentication on, and keep account lockout on. Schedule updates and reboots for a quiet hour instead of disabling them, then snapshot the configured server. The tested read-only Python audit in this guide checks RDP, NLA, firewall scope, lockout, pending reboots and failed logons, and exits 1 when something needs fixing.
Hosting & performance8 min read
Run interactive work on your own machine unless there's a reason not to: it has no network delay, no hourly bill and no remote-access surface to secure. A Windows VPS earns its place for jobs that must run when your computer is off (scheduled imports, monitors, desktop-only tools), for a shared desktop several people use, or when the work should happen near a server or market far from you. For people working over Remote Desktop, round-trip time decides the experience: Microsoft's guidance is under 100 ms for ideal interaction, up to 150 ms fine for office work, and above 200 ms noticeably worse. Measure it from where your team sits before choosing a region; the tested script in this guide does that.
Proxies & scraping5 min read
Datacenter proxies are the cheapest and fastest choice for unprotected public data. Rotating residential proxies handle bot-protected retail sites. Static ISP proxies give a fixed, ISP-registered IP for long-lived account logins. Mobile proxies route through carrier networks for mobile-first social and ad platforms. Choose by use case, not price.
Account safety & teams8 min read
Meta and TikTok lock or disable access when a login looks like a takeover: a new device and country at once, a shared VPN exit used by strangers, or one profile used by several people. The fix is structural. Every person uses their own profile with two-factor authentication, gets a role in the Meta business portfolio or TikTok Business Center, and is assigned only the ad accounts and tasks their job needs. Agencies join as partners, not as extra logins. A read-only Graph API script in this guide compares actual access with your written policy.
Account safety & teams9 min read
Amazon allows one Seller Central account per region unless you have a legitimate business need, such as separate brands run as separate businesses, and every account is in good standing. Accounts Amazon considers related can be deactivated together, so record the business reason for each extra account, give each one its own entity and payout bank, run staff through User Permissions with an authenticator app, and review Account Health weekly. The register and check script in this guide flag the gaps that most often turn one account's problem into a group problem.
No guides match that search. Try a tool name, or switch the topic back to All.
