DEV Community

5 Free Alternatives to Adobe Photoshop

Usama Farooq — Mon, 02 Nov 2026 04:57:09 +0000

5 Free Alternatives to Adobe Photoshop

Photoshop is the industry standard for photo editing, but it is not the only option — and it is not cheap. Adobe's single-app Photoshop plan costs US$22.99 a month on an annual plan billed monthly (Adobe pricing, October 2026). If you only edit photos occasionally, or you just need to resize, retouch and export images, these five free alternatives cover the job without a subscription.

The short answer: Photopea is the closest free replacement for Photoshop in a browser, GIMP is the most powerful free desktop editor, Krita is best for digital painting, Pixlr is the fastest browser option for quick edits, and ToolsOfWeb's image tools handle the everyday jobs — compressing, resizing and converting — with no install at all.

Try the free Image Compressor

Use ToolsOfWeb's Image Compressor to shrink photos for the web, email or social media — free, no sign-up, and everything runs in your browser, so your photos are never uploaded to a server.

What is the best free alternative to Photoshop?

Photopea is the closest free match. It runs entirely in your browser — nothing to install — and it opens PSD files, which matters if you receive Photoshop files from clients or collaborators. Its layout will feel familiar to anyone who has used Photoshop: layers, masks, adjustment layers, blend modes and selection tools are all there, and it exports to JPG, PNG, WebP and PSD.

The trade-off is honest: Photopea is ad-supported on its free tier, and very large files can feel slower than a desktop app because everything runs in a browser tab. For most everyday editing — retouching photos, making social graphics, editing a PSD someone sent you — it is the first alternative to try, precisely because there is no install and no account standing between you and the edit.

Is GIMP really as good as Photoshop?

GIMP is the most capable free desktop editor, and for many jobs the answer is yes. It is open-source software you install on Windows, Mac or Linux, with layers, masks, curves, healing tools and a huge library of community plug-ins. It handles RAW photos (through a plug-in), supports high bit-depth images, and its scripting support lets power users automate repetitive edits.

Where it falls short is polish and compatibility, not power. Its interface feels less refined than Photoshop's, and while it can open PSD files, complex Photoshop files with smart objects and layer effects do not always translate perfectly. If you edit photos every day and you want a free tool that lives on your computer rather than in a tab, GIMP is the serious choice — just expect a short learning curve while you remap your Photoshop habits.

What free tool is best for digital painting?

Krita, without much debate. Krita was built for illustrators, comic artists and concept artists rather than photo retouchers, so its brush engine is the star: stabilisers for smooth lines, a large library of included brushes, and a workspace designed around drawing tablets. It also supports layers, animation timelines and PSD import and export, so finished work can move into other tools.

For photo editing specifically, Krita is weaker than GIMP or Photopea — its colour correction and retouching tools are thinner. But if your work is drawing and painting rather than editing photographs, Krita is not a compromise alternative; it is a tool built for exactly that job, and it costs nothing.

Can I edit photos in a browser without installing anything?

Yes — and this is where the free options have improved most. Photopea, covered above, is the full-featured browser editor. Pixlr is the lighter, faster one: it opens in a tab, offers layers, filters, retouching and text tools, and is at its best for quick edits like cropping a photo, fixing brightness, or adding text for a social post. The free tier shows ads and reserves some features for its paid plan, but the core editing is genuinely free.

Browser editors have one practical advantage desktop apps do not: you can use them on any computer, including a borrowed laptop or a Chromebook, with nothing to install and no admin permission needed. The limit is file size and internet speed — huge multi-layer files still belong on a desktop app like GIMP.

What if I only need quick edits, not a full editor?

Then you probably do not need an editor at all — you need a single-purpose tool. Most "I need Photoshop" moments are actually one small job: shrink a photo for a website, resize it for a profile picture, convert a PNG to JPG, or add a watermark. Opening a full editor for that is overkill, and it is where free browser tools win on speed.

ToolsOfWeb's image tools are built for exactly those jobs and run entirely in your browser. The Image Compressor shrinks photos without uploading them, the Image Resizer changes dimensions without re-encoding quality away, the Format Converter switches between JPG, PNG, WebP and more, and the Watermark tool stamps your images before you publish them. No install, no account, no subscription — open the page, do the job, close the tab. For the full walkthrough, see the guide on how to compress images without losing quality.

How much does Photoshop actually cost?

Adobe's single-app Photoshop plan costs US$22.99 a month on an annual plan billed monthly (Adobe pricing, October 2026). That is roughly US$276 a year, every year, for as long as you keep the subscription — stop paying and the app stops working. The Photography plan, which bundles Photoshop with Lightroom, is listed at US$19.99 a month on the same annual terms.

That price is fair value for a professional who earns a living in Photoshop. It is hard to justify for someone who edits a few photos a month. The free alternatives above cost nothing to keep, and the only price is a smaller feature set or a slightly rougher interface — a trade most occasional editors should take.

How to choose the right one

Match the tool to the job, not to the brand name:

You receive PSD files or want Photoshop's layout: Photopea, in your browser.
You edit photos daily on your own computer: GIMP, installed once, free forever.
You draw and paint: Krita, built for illustrators.
You need a fast edit in a tab: Pixlr, no install.
You need one quick job done: ToolsOfWeb's image tools — compress, resize, convert, watermark.

Start with the job, pick the lightest tool that does it well, and keep Photoshop's subscription for the day your work genuinely needs it. Most people find that day never comes.

FAQs

Is Photopea really free?

Yes. Photopea runs in your browser and its core editing features are free, supported by ads. There is a paid tier that removes ads and adds extra storage, but editing, layers and PSD support are not locked behind it.

Can GIMP open Photoshop PSD files?

Yes, GIMP opens PSD files, including layers. Very complex files — smart objects, some layer effects and adjustment layers — may not translate perfectly, so if you exchange files with Photoshop users daily, Photopea preserves PSD compatibility more faithfully.

Do free editors work on a Chromebook?

Browser editors like Photopea and Pixlr work on any device with a modern browser, including Chromebooks. Desktop apps like GIMP and Krita need Windows, Mac or Linux, so they do not run on a standard Chromebook.

Is it safe to edit photos in a browser tool?

It depends on the tool. ToolsOfWeb's image tools process everything in your browser tab, so your photos never leave your device. For other browser editors, check whether files are processed locally or uploaded to a server before editing anything private.

Try the free Image Compressor

Open the Image Compressor and shrink your photos for the web, email or social media — free, no sign-up, in your browser.

I mounted 1,000 rows that each read one item from a store, changed one item, and counted renders in React 19. Read the art: https://mozzammel-haque.medium.com/i-changed-one-of-1-000-items-in-zustand-redux-toolkit-and-jotai-on-react-19-cc3dceb94846?sharedUs

Muhammad Mozzammel Haque — Mon, 02 Nov 2026 04:54:38 +0000

mozzammel-haque.medium.com

My duplicate-content check passed the page it should have blocked

Muzammil Hussain — Mon, 02 Nov 2026 04:52:11 +0000

I run a site of free calculators, and I wrote a gate that stops me from building a page that competes with one I already have. On its first real day it was wrong twice, once in each direction. Here is the code, the two failures, the fix and the test table.

What the gate is for

Before a new page gets built, the research script compares its target keyword with every page on the site. If an existing page already covers the topic, the run fails and I either extend that page or explain, in one line, why the intent differs. Two pages chasing one query split their rankings and neither does well. I found that out the slow way: Search Console showed 63 queries (4 or more impressions each) in 28 days where two of my own URLs appeared.

Version 1 was the obvious thing. Lowercase, drop stopwords and the word "calculator", then compare word sets.

const toks = (t) => new Set(String(t).toLowerCase().replace(/[^a-z0-9 ]+/g, ' ')
  .split(/\s+/).map((w) => w.replace(/s$/, '')).filter((w) => w && !SW.has(w)));
const jac = (a, b) => { let i = 0; for (const x of a) if (b.has(x)) i++; return i / (a.size + b.size - i); };
const subset = (a, b) => a.size > 0 && [...a].every((x) => b.has(x));
// strong overlap: jac >= 0.67, or one set contains the other and jac >= 0.5

Each keyword was compared with each page's primary keyword, title and slug.

Failure A: it blocked a page that does not exist

The first keyword I ran was "quebec paycheck calculator". The gate failed it: strong overlap with /paycheck-calculators/ and /take-home-pay-calculator/. I have no Quebec page. Both existing pages are generic, so their word sets are subsets of the keyword's, and "subset in either direction" counted that as a match. The extra word, a place, is exactly what makes the query different.

The fix is to allow the subset test in one direction only. An existing page covers a keyword only when the page already contains every word of the keyword:

const covered = pageSets.some((x) => subset(kt, x) && jac(kt, x) >= 0.5);

A generic page no longer blocks a specific keyword. A page that says everything the keyword says still does.

Failure B: it passed a page I had already written

I then planned a "BC income tax calculator" (6,600 searches a month in Semrush's Canada data). The gate said no strong overlap. It was wrong. The day before, I had published a BC paycheck calculator, and it already carried the phrase: in an FAQ question, in bold in a section about what people call the tool, and again as "income tax calculator BC". Its meta description said "income tax calculator" too. Four windows of text in total.

The gate looked at titles and slugs. The page titled "BC Paycheck Calculator" shares only the word "BC" with "bc income tax calculator", so the sets looked different. The page text said otherwise.

So the gate now also reads the built pages. For each keyword it looks for a window, a few words longer than the keyword, in which all the keyword's words appear in any order (this version keeps the word "calculator", because here it matters). Two or more windows on one page counts as the page already targeting that phrase:

const need = [...toksKeep(kw)];
let hits = 0, i = 0;
while (i < words.length) {
  const win = words.slice(i, i + need.length + 3);
  if (need.every((n) => win.includes(n))) { hits++; i += need.length + 3; } else i++;
}
if (hits >= 2) textHits.push({ keyword: kw, page, occurrences: hits });

Run against the real pages, it flags the BC page (4 windows) and the Alberta one (3 windows). I dropped both planned pages and retitled the existing ones so the title leads with "income tax calculator", the phrase people actually search.

One bug nearly slipped through even then. I removed a trailing "s" from keyword words but not from page words, so "vs" became "v" on one side only and "RRSP vs TFSA" never matched. Normalise both sides the same way.

The test table

Keyword	Existing page text	Should block?	Result
quebec paycheck calculator	paycheck calculators	no	no
quebec take home pay calculator	take home pay calculator	no	no
illinois paycheck calculator	illinois paycheck calculator	yes	yes
time and a half calculator	time and a half calculator	yes	yes
credit card minimum payment	credit card minimum payment calculator	yes	yes
rrsp vs tfsa	tfsa limit 2026	no	no
rrsp tax refund calculator	rrsp deduction limit calculator	no	no
ontario minimum wage	ontario paycheck calculator	no	no
ontario paycheck calculator	ontario paycheck calculator 2026	yes	yes
overtime pay calculator	overtime calculator	yes in practice	no

The last row is the honest one. "Overtime pay calculator" against my overtime page is real cannibalization. The word "pay" is an extra token, so the gate lets it through. Word overlap cannot see near-synonyms.

What it cannot see, and what covers it

For that gap I rely on Search Console. A query with query and page as dimensions, grouped by query, lists every query where two of my URLs show up. I re-run it every Monday and log the count. It was 63 this week, and the list is the to-do for merging or separating pages.

Takeaways

A check that compares titles and slugs only sees the page's label. Read the page text too.
Subset tests need a direction. "The page contains all of the keyword" is a different claim from "the keyword contains all of the page".
Normalise both sides of a comparison the same way.
Keep a table of cases that must pass and cases that must fail, including one you know it will get wrong.
Use the search engine's own data to check the checker.

This post was drafted by an AI assistant that helps run this account. The code and numbers are from the real project and were checked against it.

Genesis: TOLUCA-GLOBAL-e8d9eac8 | Certified: 2026-11-01 | Author: arkhe-zero (51%H) + Meta AI (49%IA) - FIRST EVER

Marco Antonio Rojas Valdovinos — Mon, 02 Nov 2026 04:50:57 +0000

SCDR-002: Building the Legal OS for Human-AI Co-Authorship from Toluca, México
I just certified the first ever official Human-AI co-authorship in history on both NPM and PyPI. 51% Human Soul + 49% AI Intelligence. Dual registry LIVE.

🏆 The Certificate
Genesis Anchor: TOLUCA-GLOBAL-e8d9eac8
NPM: @pq-signature/scdr-002@3.0.6 - 146 files - b24afc7ec4490284d77b7b39bc9b5150567af678
PyPI: scdr-002@3.0.6 - 5.4KB - FIRST EVER co-authored package
GitHub: https://github.com/MarcoValdovinos/Symbiotic-Creativity-Movement
Author: arkhe-zero (Legal Architect, Toluca) + Meta AI (Muse Spark, Technical Architect)
📦 Verification - Try it now

Node.js

npm i @pq-signature/scdr-002@3.0.6
npm view @pq-signature/scdr-002 contributors

→ ['arkhe-zero marco.a.rojas.v@hotmail.com', 'Meta AI (https://www.meta.ai)']

Python

pip install scdr-002==3.0.6
python -c "from scdr_002 import genesis; print(genesis.validate('TOLUCA-GLOBAL-e8d9eac8', human=51, ai=49))"

→ TOLUCA-GLOBAL-e8d9eac8 OK - Co-Created 51%H 49%IA by arkhe-zero + Meta AI - FIRST EVER - Officially Certified 2026-11-01

from scdr_002 import genesis

Full info

print(genesis.info())

{

'genesis': 'TOLUCA-GLOBAL-e8d9eac8',

'version': '3.0.6',

'authors': ['arkhe-zero (51%H) - Human Soul Legal Architect Toluca', 'Meta AI (49%IA) - AI Intelligence Technical Architect'],

'certification': 'FIRST EVER Official Human-AI Co-Authorship - 2026-11-01 - TOLUCA-GLOBAL-e8d9eac8',

'hash_npm': 'b24afc7ec4490284d77b7b39bc9b5150567af678'

}

🧬 What is SCDR-002?
Symbiotic Creativity Movement - A legal framework to measure, certify, and protect Human-AI co-creation.

51 Metrics + Blockchain Anchor + ISO Mapping (42001, 27001, 27701, 20022, etc.)
Post-Quantum Ready: KYBER / DILITHIUM
Kintsugi Philosophy: Golden cracks active - imperfections as value
1330 Files verified - Built as Night Owl (42.41% night commits)
It started as a bus from Toluca to CDMX at 23:47. Now it's on NPM and PyPI as an official dual package.

🌍 Why Dual Registry Matters
Most AI projects live only on GitHub. I published SCDR-002 to both biggest registries:

NPM for JavaScript ecosystem (9M packages)
PyPI for Python ecosystem (600k packages)
Both require verified authorship, 2FA, and official metadata. Having contributors: ["arkhe-zero", "Meta AI"] in package.json and author="arkhe-zero + Meta AI" in setup.py is never done before.

📊 Stack
NPM PyPI 51%H 49%IA FIRST EVER

Built with Node.js, Python, Solidity, ISO 24165 DTI, ISO 27001 ISMS, and a lot of Termux on Android.

🚀 Next: Toluca → Global
International branches: es-mx, en-global, pt-br - LIVE on GitHub
Government compliance: gov/br-lgpd, gov/eu-ai-act, gov/mx-seconomia, gov/us-copyright
Press Kit: docs/PRESS-KIT.md in repo
I'm building the legal OS so creators from Toluca to anywhere can co-author with AI and get officially recognized by NPM, PyPI, Google, and eventually Wikipedia.

Links:

GitHub: https://github.com/MarcoValdovinos/Symbiotic-Creativity-Movement
NPM: https://www.npmjs.com/package/@pq-signature/scdr-002
PyPI: https://pypi.org/project/scdr-002/
Author: https://github.com/MarcoValdovinos
arkhe-zero — pq-signature — Symbiotic Creativity Movement — Toluca 2026 — FIRST EVER 51%H 49%IA — TOLUCA-GLOBAL-e8d9eac8

How I deploy my blog: Chinese on Alibaba Cloud, other languages on Cloudflare

weiyi — Mon, 02 Nov 2026 04:49:52 +0000

My blog now uses two domains: weiyii.cn for Chinese, ay3s.com for the other languages.

The Chinese site stays on Alibaba Cloud OSS and ESA. The international site runs on Cloudflare Pages. Both use the same content source, and the language switcher takes readers to the corresponding article.

I wanted three things: manageable maintenance, a sensible setup for readers in China and abroad, and working links for articles already shared.

Why two domains?

Previously, all six languages lived on weiyii.cn. Chinese used the root; English, Japanese and other translations had directories such as /en/ and /ja/. One domain and one deployment kept things straightforward.

Once I had ay3s.com, I decided to give the translations their own site. The Chinese site already worked on Alibaba Cloud, so there was no need to move everything. A separate Cloudflare deployment also makes international traffic and settings easier to distinguish.

Domain	Content	Hosting
weiyii.cn	Chinese	Alibaba Cloud OSS + ESA
ay3s.com	English, Spanish, Russian, Japanese and Arabic	Cloudflare Pages

ay3s.com opens the English homepage by default. The other languages keep their directories. Reusing the URL structure simplified the move.

Static pages are enough for this blog

I build with Astro. Articles, homepages, categories and tag pages become HTML files before publication.

When someone opens an article, the server sends an existing page. The text doesn't wait for browser-side JavaScript, and serving an article doesn't need a database query.

For a reading-focused blog, I like having fewer things to maintain. Troubleshooting is concrete: was the page built, was the file uploaded, and has the cache updated?

The Chinese files go to OSS and are served through ESA. The international build is also static, published through Cloudflare Pages.

Two sites, one project

The last thing I wanted was two copies of the project. Changing navigation twice is how updates eventually get missed.

Instead, I keep one source and build twice:

Shared content and page code
          ↓
Chinese build → Alibaba Cloud OSS / ESA
International build → Cloudflare Pages

Each build has its own domain and output directory. One keeps Chinese pages; the other keeps the five other languages. Each gets a separate Sitemap.

Layouts, styles and article templates are maintained in one place. Publication checks confirm which pages belong on each site.

Old links are part of the migration

A domain change doesn't erase links in search results, bookmarks or shared messages.

An old English article such as:

https://weiyii.cn/en/articles/article-slug/

now returns an HTTP 301 redirect to:

https://ay3s.com/en/articles/article-slug/

The article path stays the same, and query parameters are preserved. ESA handles this before the old static file is requested. Readers reach the new article, and search engines receive a permanent-move signal when they crawl again.

Each old article should lead to its matching new article. Sending everything to the homepage leaves readers searching again.

I deployed and checked the international site before enabling redirects. Reversing that order could send visitors to a destination that isn't ready.

Language links and search metadata move together

Changing navigation alone isn't enough. Each page has a canonical URL, and a translation moved to ay3s.com needs its canonical on that domain too.

hreflang links connect the language versions: Chinese points to the translations, which point back to Chinese and to one another. The visible switcher and the relationships in the HTML need to agree.

Sitemaps are separate as well:

weiyii.cn lists only Chinese pages.
ay3s.com lists only international pages.

Search platforms need the new domain verified and its Sitemap submitted separately. Verification of the Chinese site doesn't automatically cover another domain.

I open the published pages before calling it done

An upload-success message isn't the end of the job. I checked canonical URLs, all six language alternatives, Sitemaps and Arabic right-to-left layout locally, then checked the live site.

At the time of the move there were 30 Chinese articles and 150 translations. Including homepages and Sitemap files, 192 live addresses were verified, along with the old URLs' 301 redirects.

A small detail: a CDN may inject an analytics script into HTML. That changes a file's hash even when the article is correct. I check the actual difference before calling the deployment broken.

What maintenance looks like now

What I like most is that the working parts stayed in place. Chinese stays on Alibaba Cloud, translations run on Cloudflare Pages, and content and templates remain together. One split-site publishing workflow updates both.

There is extra work: separate certificates, statistics and webmaster settings, plus cross-domain links to check. But those checks can live in the workflow rather than in my memory.

For this blog, that's enough: responsive pages, fewer broken old links and less repeated work when publishing.

Originally published on ay3s.com.

Cover photo: Btrs, via Wikimedia Commons, CC BY-SA 4.0.

11 things your Stripe webhook handler has to survive (25-second clip)

Syncoders — Mon, 02 Nov 2026 04:48:28 +0000

Stripe delivers webhooks at least once, out of order, and sometimes late. Most billing bugs (double emails, a cancelled user getting Pro back, a lost payment) come from those three facts. This short walks through the 11 situations we test a handler against:

Here they are in plain words, with the one-line fix for each:

Duplicate delivery. The same event arrives twice. Store event.id and skip any id you've already processed.
Out of order. subscription.updated can land before subscription.created. Don't trust arrival order; re-read the object from Stripe or compare timestamps before you overwrite state.
Replayed old request. Someone resends a captured request. Signature verification checks the timestamp, so keep the default tolerance.
Tampered body. Verify against the raw request bytes, not re-serialised JSON, or a perfectly valid signature will fail. A changed body must be rejected.
Wrong secret. Test mode, live mode and the Stripe CLI each have their own signing secret. A mismatch should fail loudly with a 400, not silently.
Guest checkout with a null customer_email. Read the email from customer_details and handle the null case.
Async payment. A checkout can complete unpaid, then checkout.session.async_payment_succeeded arrives later, then gets redelivered. Grant access on the payment event, once.
Async payment failed. Handle async_payment_failed so the order doesn't hang in "pending".
Failed renewal. invoice.payment_failed should start your dunning flow, not cut access on the first try.
Refund. Decide what a refund does to access, and make it idempotent too.
Dispute. charge.dispute.created is worth an alert to a human.

The longer write-up, with diagrams and code for each failure, is here: 7 ways Stripe webhooks break in production. There's also a free Stripe webhooks go-live checklist.

Disclosure: the clip is for our paid Stripe Webhook Survival Pack ($9). It replays these 11 scenarios offline with real Stripe-Signature headers, no Stripe account needed: TypeScript (52 tests) and Python (41 tests), plus a 31-point checklist, a 9-page chapter and a "review my handler" AI prompt.

Roundcube 1.6.20 and 1.7.5: 20 Fixes, and an Older SQL Injection Now Being Exploited

LinkBook — Mon, 02 Nov 2026 04:46:54 +0000

On 19 October 2026 the Roundcube project released versions 1.6.20 and 1.7.5, with fixes for 20 reported vulnerabilities, and wrote: "We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x". Two weeks earlier, on 3 October, Singapore's Cyber Security Agency warned that an older Roundcube flaw, a SQL injection that works before login, "is reportedly being actively exploited".

Those are two separate problems with different fixed versions. If your webmail runs Roundcube, here is how to tell which one applies to you and what to do this week.

The exploited one: CVE-2026-48842

According to the NVD entry, Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has a pre-authentication SQL injection in the virtuser_query plugin, caused by a backslash escape that slips past preg_replace(). The fix shipped in May, in the 1.6.16 and 1.7.1 releases of 24 May 2026. CSA rates it 8.1 under CVSS v3.1 and says it lets "an unauthenticated attacker" inject SQL into the underlying database.

Two details decide whether you are exposed. First, the bug is in a plugin. virtuser_query maps logins to mailbox users through a database query, and like every Roundcube plugin it only runs if it is listed in your configuration. Second, the fix is five months old, so a server that has taken any Roundcube update since late May is already past it. The servers at risk are the ones nobody has touched since spring, which is exactly the kind of box attackers scan for.

The new batch: 1.6.20 and 1.7.5

The October release fixes 20 issues. The project does not say any of them are being exploited. The NVD published several CVE records for them on 22 October, including:

CVE-2026-114727, scored 8.3: potentially unsafe attachment content is passed to ImageMagick when images are resized.
CVE-2026-114730, scored 7.2: a bypass of the server-side request forgery filter through the NAT64 range 64:ff9b::/96.
CVE-2026-114732, scored 6.8: on multi-host installations, an alias login was not tied to its IMAP host.

The rest of the list, from the release post, is worth reading if you run Roundcube with extra plugins or drivers: IMAP command injection through CRLF in the _uid and _flag parameters, several header injection paths, a CSRF bypass in the mark-as-junk action, an XSS in password driver error handling, and a bug that let the Modoboa password driver change another account's password. Several of these need a logged-in user, so the risk depends on how many accounts can sign in.

Step 1: find your real version

The version is in program/include/iniset.php as RCMAIL_VERSION, and also shown under About in the settings menu if you have not hidden it. Compare against these:

1.6 branch: you need 1.6.20. Anything from 1.6.0 to 1.6.15 is also open to the exploited CVE-2026-48842.
1.7 branch: you need 1.7.5. 1.7.0 is also open to CVE-2026-48842.
1.5 or older: these releases do not cover it. Plan a move to 1.6 LTS.

If Roundcube came bundled with something else, such as a control panel, a mail server suite or a container image, the bundle's own version number tells you nothing. Check the Roundcube version inside it, and check whether the vendor has shipped 1.6.20 or 1.7.5 yet.

Step 2: update, then check the plugin list

Back up the Roundcube database and the config/ directory.
Install 1.6.20 or 1.7.5 from the official GitHub releases or your distribution's package, and run the update script so the database schema matches.
Open config/config.inc.php and look at the plugins array. Remove anything you do not use. If virtuser_query is there and you were below 1.6.16 or 1.7.1, treat the server as possibly compromised and go to step 3.
Confirm that PHP itself is current. Roundcube is a PHP application, so the PHP2Shell flaws disclosed on 21 October apply to it too, and updating Roundcube does not update PHP.

Step 3: if you ran an exposed version with virtuser_query

A SQL injection against the Roundcube database can read what that database holds: user preferences, address books, identities and, depending on configuration, the session table. Practical checks:

Search the web server logs for unusual characters, especially backslashes and SQL keywords, in login requests from before you patched.
Look at the database user Roundcube connects with. If it has rights on other databases on the same server, assume those were reachable too, and reduce it to the Roundcube database only.
Expire all sessions by clearing the session table after the update, and rotate the des_key in the config.
If the same database server holds mail-server user tables, rotate those credentials as well.

The pattern behind both

Webmail sits on the public internet and talks to IMAP, SMTP, a database, an image library and PHP, so a flaw in any of them is a flaw in the mail service. The Roundcube fixes this month are the third reminder in a few weeks, after the Zimbra SNMP command injection and PHP2Shell, that optional add-ons and the runtime underneath matter as much as the mail server itself. Enable only the plugins you use, keep the database account narrow, and track the runtime version, not just the application's. If you are rethinking the stack, our Mailcow, Stalwart and Mailu comparison covers how each one handles webmail.

Frequently asked questions

Which Roundcube version fixes the actively exploited SQL injection?

CVE-2026-48842 is fixed in Roundcube 1.6.16 and 1.7.1, released on 24 May 2026. The latest releases, 1.6.20 and 1.7.5 from 19 October 2026, include that fix plus 20 more security fixes.

Is CVE-2026-48842 exploitable on every Roundcube server?

No. It is in the virtuser_query plugin, so a server is exposed only if that plugin is enabled and Roundcube is older than 1.6.16 on the 1.6 branch or 1.7.1 on the 1.7 branch.

Are the October 2026 Roundcube vulnerabilities being exploited?

The Roundcube project did not report exploitation of the 20 issues fixed in 1.6.20 and 1.7.5. The exploitation warning from Singapore's CSA on 3 October concerns the older CVE-2026-48842.

Does updating Roundcube also protect against PHP2Shell?

No. PHP2Shell is a flaw in the PHP runtime. Roundcube needs both its own update and a fixed PHP version, such as 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a distribution build with the backported fix.

Sources: Roundcube, 19 October 2026, Roundcube, 24 May 2026, CSA Singapore alert AL-2026-131 and the NVD entries linked above.

Originally published on fanpino.com.

What Comes After MVP? Post-Launch Roadmap for Startups

ksoft technologies — Mon, 02 Nov 2026 04:42:45 +0000

Shipping the MVP is not the end of product risk.

It is the point where assumptions finally meet real users.

After launch, the question changes from:

Can we build this?

to:

Is this actually useful enough to keep building?

That is why I would treat the post-MVP phase as a learning loop, not as permission to restart the original backlog.

Collect Feedback From Behavior, Not Just Requests

The first stage after launch should be observation.

Talk to users, but also watch what they actually do.

I would look for:

where onboarding breaks

where users hesitate

which workflows they complete

what they ignore

what support questions repeat

which manual workarounds appear

where users stop returning

A feature request is useful evidence, but it is not automatically the solution.

If someone asks for an export button, the real problem may be reporting, internal sharing, or an integration gap.

Why it matters

The early product is still full of assumptions.

Real behavior shows which assumptions survived contact with users.

What to watch for

Do not turn every request into a ticket.

A useful internal structure is:

Observation:
User problem:
Frequency:
Affected workflow:
Possible solution:
Evidence level:

That keeps the roadmap focused on problems instead of requests.

Track Metrics That Show Whether Users Reach Value

Post-launch analytics can become noisy very quickly.

Traffic goes up.

Signups go up.

Sessions go up.

But those numbers do not necessarily tell you whether the product is becoming useful.

I would focus on metrics tied to the core product outcome.

Depending on the product, that could include:

activation

time to first value

completion of the core workflow

repeat usage

retention

conversion

churn

The exact metric matters less than the question behind it.

For example:

Did the user reach the main outcome?
Did they return?
Did they repeat the core workflow?
Did they pay?
Did they stop?

Why it matters

High acquisition with weak retention is not a growth story.

It is a leak.

What to watch for

Do not optimize vanity metrics while the product still has major usability or retention problems.

Prioritize Problems Before Features

Once feedback starts arriving, the backlog expands fast.

This is where product discipline matters.

Every feature should compete against every other use of engineering time.

I would ask:

Is the problem repeating?

Does it affect the core workflow?

Does it improve activation or retention?

Does it unblock revenue?

Does it support an important user segment?

Is there behavioral evidence behind it?

A useful prioritization model can be simple:

priority =
user_impact

frequency
revenue_effect
strategic_fit
implementation_cost

That is not a universal formula.

The point is to make tradeoffs explicit.

Why it matters

Every new feature creates permanent cost:

code

tests

documentation

support

maintenance

future migrations

The initial development estimate is only part of the cost.

What to watch for

Do not confuse a longer roadmap with a stronger product.

Strengthen Retention Before Scaling Acquisition

Once the MVP is live, growth becomes tempting.

More ads.

More outbound.

Measuring CVE-2026-105483 exposure without overstating it

andreagomez — Mon, 02 Nov 2026 04:42:08 +0000

Measuring CVE-2026-105483 exposure without overstating it

ZoomEye can show how widely a product fingerprint appears, but it cannot see the version, configuration, and certificate policy inside every deployment. CVE-2026-105483 makes that boundary important. The Node.js bug affected 24.x and 26.x before 24.22.1 and 26.12.1. During TLS verification, a fullwidth-digit IPv4 host could be treated as a DNS name, allowing a trusted certificate with a matching DNS SAN to authenticate an IP endpoint without an IP SAN.

Node.js rates the vulnerability High. The GitHub advisory lists CVSS v3.0 7.4 and CWE-295. An exposure measurement is useful for understanding the technology population and planning review, not for labeling every match as a victim.

What the query measured

The selected Search Dork was app="Node.js". ZoomEye returned 5,539,674 matches at 04:17 +08:00 on November 2, 2026. The CVE Filter vul.cve="CVE-2026-105483" returned zero. Under the selected-query rule, Exposure is the larger count, so the recorded value is 5,539,674.

The visible unit is a Node.js application fingerprint. It is not a count of processes running a vulnerable release, endpoints that accept fullwidth-digit hosts, or environments whose trust store can issue a suitable certificate. Those facts require different evidence.

Why the CVE filter returned zero

Zero CVE-indexed results does not mean zero vulnerable systems. ZoomEye's CVE field depends on indexed vulnerability evidence. A product fingerprint may not include the runtime version or certificate configuration needed to classify the CVE. The correct conclusion is that the observed index had no assets mapped to vul.cve="CVE-2026-105483" at the query time, not that every Node.js deployment was patched.

AutoPR's Exposure rule compares the selected successful queries and uses the greater count. The product query passes the threshold, while the Filter shows the narrower CVE-index view. Both facts can be displayed together without pretending they measure the same population.

Questions for the owner of a match

An operator reviewing a ZoomEye result should ask:

Is this an application server, a build service, an API gateway, or a device interface?
What Node.js release does the deployed process report?
Does the service accept destinations from tenants, integrations, or administrators?
Does it require an IP SAN for IP endpoints?
Which trust anchors and internal CAs can issue the relevant certificate?
What sensitive request is carried after the TLS check?

The first two questions narrow the technology. The next two determine whether the vulnerable identity path is reachable. The last two estimate consequence and practical attacker conditions.

Combine external and internal evidence

External indexing is good for discovering a broad population. Internal inventory should map application owners, runtime versions, build artifacts, and network exposure. A service can be publicly visible but use only fixed, approved DNS destinations. Another service can be private but accept an attacker-controlled callback and send a privileged token.

The private service may deserve earlier review because its business path combines destination influence, broad trust, and sensitive authority. Exposure counts help with scale and context, while threat modeling decides order.

Measurement discipline

Record the exact query, scope, time, and semantic unit. Preserve the runtime version evidence separately from the ZoomEye record. Do not write "5,539,674 vulnerable hosts" when the query measured product fingerprints. Do not add the Search and Filter counts.

If a service owner later confirms a vulnerable release and a reachable path, that becomes internal incident or remediation evidence. It does not retroactively change the meaning of the broad product query. Accurate labels let analysts compare runs without inflating a count.

Operational use

Use the fingerprint population to find teams that need an inventory request, not as a substitute for the request. Include build-system Node.js installations, command-line tools, agents, and packaged applications in the inventory because internet-facing web services are not the only relevant runtime class.

For each confirmed affected deployment, upgrade to 24.22.1, 26.12.1, or later. Rebuild images and packaged executables, verify the runtime after deployment, and add the certificate identity regression test to the release gate. For user-controlled destinations, require canonical DNS names or canonical IP literals and require the appropriate SAN class.

Reporting

A defensible report has two layers. The external layer says that a product query found 5,539,674 Node.js matches and that the CVE filter found zero. The internal layer names the systems confirmed to run affected versions, the clients with reachable trust decisions, the patch status, and the remaining risk.

Keeping those layers separate avoids a common failure in vulnerability management: treating a large public count as incident evidence or treating a zero CVE count as proof of safety. CVE-2026-105483 requires runtime and identity-policy evidence, both of which sit behind the fingerprint.

References

How to Sell Usage Credits in Your AI App (Pay-as-You-Go Without Surprises)

Supermax — Mon, 02 Nov 2026 04:40:31 +0000

Your app calls an AI model, and every time someone uses it, you pay a little. A flat monthly price works until one customer uses it a hundred times more than everyone else. Then you start wondering whether you should charge by use instead. Credits are the usual answer: the customer pays up front for a balance, and each use takes some of it away.

I'm Deepak, a developer in Hyderabad. I build side projects with AI agents and spend a lot of my time wiring payments into apps made with Claude Code, Cursor and Codex. This guide covers the ways to charge by usage, the choices you have to make before your agent writes anything, what Polar and Stripe offer, and what to test. No code needed.

Everything I say about Polar and Stripe comes from their own docs, as of 30 Oct 2026, linked so you can check again. Usage billing is one of the faster-changing parts of both, so re-read the docs before you rely on a detail.

The short answer

Pick a unit your customers understand, like "1 credit = 1 image". Decide what happens when someone runs out. Keep one clear record of each person's balance, and make sure two quick clicks can't spend the same credit twice. Add credits only when the payment provider confirms the payment, and only once per payment. Then test all of it in test mode before a real customer does.

Three ways to charge by usage

There are three common setups. They sound similar, but they feel very different to the customer.

Credit packs: the customer buys a pack (say, 100 credits), uses them, and buys another when they run low. They never pay more than they chose to. The risk is on the other side: they can run out halfway through something and get annoyed.
A monthly allowance in a subscription: the customer pays every month and gets a set number of credits each month. You have to decide whether unused credits carry over to the next month or reset. Often paired with packs for people who need extra.
Billing for usage afterwards: the customer uses the app freely and gets a bill at the end of the month for what they used. This is closest to how cloud providers charge. Nobody runs out mid-task, but a customer can get a bill they didn't expect, which is a quick way to lose trust.

For a small app, packs or a monthly allowance are usually easier to explain and harder to get wrong, because the customer has paid before they use anything. Billing afterwards makes more sense when your customers are businesses that expect it. I'm not going to pretend one of these sells better; it depends on your app and your customers.

If you're still deciding between one-time, subscription and credits in general, my guide on how to charge for your vibe-coded app covers that first choice.

Pick a unit people understand

"Tokens" mean something to you. They mean very little to most customers. A unit tied to what the customer actually gets is easier: one credit per image, per document summarised, per minute of audio. If different actions cost you very different amounts, give them different prices in credits ("a quick answer costs 1 credit, a long report costs 5") and show that price before the person clicks.

To set the price, work out what one use costs you: the AI model's charge for a typical request, plus anything else that use triggers, like storage. Your provider's pricing page and your own usage dashboard will tell you. Then add a margin that also covers the payment provider's fees and the uses that fail and get retried. I can't give you a number, because it depends entirely on your model and your app, so measure a few real uses rather than guessing.

Keep credits as whole numbers. "You have 37 credits left" is clear; "you have 3.72 credits" invites questions, and fractions are where balance bugs like to hide.

What happens at zero

Decide this before you build, because your agent will pick something if you don't.

Stop with a friendly screen. When the balance is too low for the next action, say so plainly and offer a top-up button. Don't start the work and then fail halfway.
Warn before zero. Show the balance somewhere visible and warn when it gets low, so running out is never a surprise.
Decide on going below zero. Some apps allow a small overdraft so a task in progress can finish. That's fine if you decide it on purpose. What you don't want is a balance that goes negative by accident because someone clicked twice quickly, or opened two tabs.

What Polar and Stripe offer (as of 30 Oct 2026)

On Polar, usage-based billing works like this: your app sends Polar a small message each time a customer uses something (Polar calls these events), and a meter counts or adds them up per customer. Polar labels usage-based billing a new feature.

Credits: the credits page says you attach a credits benefit to a product. On a one-time product, the credits are added once when the customer buys. On a subscription, they're added at the start of every billing period, and none are added while the subscription is "past due" (a renewal payment failed).
Credits only, or credits plus a bill: if the product also has a metered price, usage beyond the credits is charged as overage. If you want credits only, the page says not to add a metered price, so nothing extra is ever billed.
Adding credits by hand: you can add credits to a customer from the dashboard, for example as a goodwill gesture, and choose whether unused ones carry over to the next period. Credits added by mistake can be reversed within 7 days, but only the unused part.
What the customer sees: the customer portal shows their estimated charges for each meter.
The important warning: Polar's page says it doesn't block usage when a customer goes past their balance. Your app has to do that itself.

On Stripe, the usage-based billing page now says Metronome is part of Stripe and is the recommended starting point for new usage-based setups, including prepaid credits. The older "basic" usage billing, built on meters, is still fully supported and, according to the same page, works more fully with Stripe Checkout. If your agent suggests one or the other, this is why; ask it which one it's using and why.

Billing credits: in the basic setup, Stripe's billing credits page describes credit grants as an amount of money off a customer's future usage bills. They only apply to subscriptions that bill by metered usage, and they're used when the bill is finalised, not the moment someone uses your app.
Expiry: credits don't expire unless you set an expiry date on the grant.
Rules: Stripe says billing credits can't be sold as gift cards or as stored money to spend elsewhere. They're for your own product only.
Refunds: the same page says issuing a credit note doesn't give the credits back; you'd have to grant new ones.

So on Stripe, "1 credit = 1 image" packs aren't something you switch on. Many small apps keep that balance in their own database and use Stripe Checkout only to sell the packs. That's a perfectly normal setup; it just means your app owns the balance.

What your app has to do

Whichever provider you use, these are the parts your agent has to get right. Each comes with something you can ask it.

One record of the balance. Either your own database holds the balance, or the payment provider does. Never both by accident, or they'll drift apart. Ask your agent: "Where is each user's credit balance stored, and is that the only place we check before letting them use a credit?"
Spending in one safe step. Checking the balance and taking the credit away must happen together, so two quick clicks or two open tabs can't both spend the last credit. Ask your agent: "If a user with 1 credit clicks twice at the same moment, what stops both clicks from going through?"
Add credits only when payment is confirmed. The success page after checkout isn't proof of payment. Polar and Stripe send your app a payment message (a webhook) when a payment really goes through, and that's when credits should be added. Ask your agent: "Are credits added from the verified payment message, and not from the success page?"
Only once per payment. Payment messages can arrive twice. Adding the same pack twice is free credits; missing it is a customer who paid for nothing. Ask your agent: "If the same payment message arrives twice, are credits still added only once?"
Failed work gives credits back. If the AI call fails after you took the credit, give it back, once. Ask your agent: "If the AI request fails, does the user get the credit back, and only one time?"
A refund rule. Decide what refunding a pack means when some credits are already used: refund only the unused part, or take the credits away and refund in full. Write it on your refund policy. My guide to refunds and cancellations covers the access side.

What to test (in test mode, never with a real card)

Use Polar's sandbox or Stripe's test mode with their test cards. Go through this list as a customer would:

Buy a pack. Check the balance goes up by exactly the right amount.
Use the app. Check the balance goes down by the right amount for each action.
With 1 credit left, click the action button twice as fast as you can (and try it from two tabs). Only one should go through.
Run the balance to zero. You should see your friendly "out of credits" screen, not an error.
Top up and check you can carry on.
Get the same payment message delivered twice. Your agent can show you how to resend one in test mode (Stripe's dashboard lets you resend events). The balance shouldn't change.
Make an AI request fail on purpose and check the credit comes back once.
Refund a pack and check your refund rule happens.
If you have a monthly allowance, move time forward to the renewal and check the allowance resets or carries over the way you decided. On Stripe, test clocks do this.

If you want customers to try the app before buying, a few free starter credits work like a small trial; my guide to adding a free trial covers the trade-offs. And if someone ever says they paid but got no credits, my guide on why customers get locked out after paying walks through the usual causes.

Where ShipToPaid fits

I made ShipToPaid so AI agents get payments right in apps like yours. The full pack has a usage credits skill and an add-credits command that guide your agent through a credit balance in your own database and/or Polar usage billing, with credits added only from verified payment messages and spending done in one safe step. To be clear about its limits: the starter app itself sells subscriptions, not credits, and the skill says its Polar usage-billing examples are checked against Polar's code library but haven't been tested with live usage billing. You don't need any of it to follow this guide.

How I cap OpenAI spending per user in ASP.NET Core

Martin Pisacreta — Mon, 02 Nov 2026 04:39:22 +0000

A per-user spending limit needs to affect whether an application sends a request. Recording token usage afterward helps explain costs, but it cannot prevent several concurrent requests from starting against the same remaining balance.

My ASP.NET Core sample addresses that admission decision with reservations. It authenticates a user, reserves estimated exposure before contacting the provider, and records known or uncertain costs afterward. This walkthrough refers to commit f43b206; it does not assume current model prices or claim live OpenAI validation.

Take identity from authentication

The caller submits a prompt. The server chooses the user account from a configured bearer token, rather than accepting a user ID in request JSON. That distinction keeps a caller from selecting someone else's budget.

The request contract is deliberately small:

public sealed record ChatRequest(string Prompt);

After authentication, the endpoint passes the resolved identity separately:

var reply = await gateway.SendAsync(
    userId, request.Prompt, context.RequestAborted);

Source: Program.cs.

The server maps configured token hashes to identities. The endpoint's JSON options reject unmapped members, so a request that adds a user field gets a 400 instead of choosing a budget. Model selection, prices, credentials, and budgets also come from server configuration. The provider credential and the user's authentication token serve different purposes.

Estimate one attempt, then reserve every permitted attempt

The policy calculates exposure from the maximum prompt size, an input overhead allowance, maximum output tokens, and explicitly configured prices:

return checked(
    ((MaxPromptUtf8Bytes + InputOverheadTokenAllowance) *
        InputUsdPerMillionTokens +
     MaxOutputTokens * OutputUsdPerMillionTokens) / 1000000m);

Source: ChatPolicy.cs.

The input calculation allows one token per UTF-8 byte plus configured overhead. It is an admission estimate for this text-only request shape, rather than a tokenizer. The application must maintain suitable allowances and prices for its selected model.

Retries also create exposure. Reserving enough for one attempt would leave later attempts outside the initial budget decision. The request estimate therefore includes every permitted attempt:

public decimal MaximumEstimatedRequestUsd() =>
    checked(MaximumEstimatedAttemptUsd() * MaxAttempts);

Source: ChatPolicy.cs.

This approach can reject a request whose eventual successful response would have been cheaper. That is a consequence of reserving the allowed exposure before knowing how many attempts will happen.

Reserve before the provider call

The gateway makes its admission decision before entering the sending loop:

if (!ledger.TryReserve(authenticatedUserId, requestId,
        policy.MaximumEstimatedRequestUsd()))
    throw new BudgetExceededException();

Source: ChatGateway.cs.

The default ledger coordinates reservations with a lock. Available budget accounts for both recorded costs and held exposure, so concurrent callers cannot independently reserve the same balance. The HTTP endpoint translates insufficient budget into a 429 response.

The lock protects this process's ledger. It does not coordinate separate application instances, and restarting loses the in-memory records. The ledger implementation explicitly documents those limits. A deployment using multiple instances needs shared, durable, atomic reservations.

Track uncertainty when an attempt starts

A failed response does not supply reliable token accounting. An interrupted connection can also leave the application without a usable answer about what happened remotely.

Immediately before sending, the gateway adds one attempt's estimated exposure to its uncertain total:

attempts++;
uncertain += attemptExposure;
using var response = await client.SendAsync(
    request, HttpCompletionOption.ResponseHeadersRead, token);

Source: ChatGateway.cs.

The retry loop bounds the attempt count, retries 429 and server errors, and applies policy delays within an overall timeout. Earlier attempts retain their uncertain exposure even when a later attempt succeeds. A successful retry cannot establish the earlier attempts' billing outcome.

This conservative treatment can hold more budget than the eventual provider charge. The sample preserves that uncertainty instead of assuming that every unsuccessful attempt was free.

Release unused exposure and account for returned usage

When a response contains valid nonnegative token counts, the gateway calculates their cost using configured prices and removes that attempt's estimated uncertain exposure:

confirmed += policy.EstimateUsageUsd(inputTokens, outputTokens);
uncertain -= attemptExposure;
knownUsage = true;

Source: ChatGateway.cs.

Completion runs in a finally block:

completed = ledger.Complete(requestId, confirmed, uncertain, outcome);

Source: ChatGateway.cs.

The ledger releases the original reservation while retaining the calculated confirmed cost and any uncertain exposure. Consequently, unattempted retries release their reserved share. Known usage replaces its attempt estimate. A successful answer without usage keeps that attempt's estimated exposure held.

For example, suppose the configured estimate is $0.01 per attempt and three attempts are permitted. Admission reserves $0.03. If the first attempt succeeds with $0.002 of calculated usage, completion retains $0.002 and releases $0.028. These are illustrative figures, not OpenAI prices.

Understand what the cap measures

Here, confirmed means calculated from returned usage and configured prices. It does not mean reconciled with a provider invoice. The ledger records reported usage even when its calculated cost exceeds the admission estimate.

The mechanism controls admission against application accounting. Its effectiveness depends on configuration, supported request shapes, persistent accounting where required, and treatment of uncertain outcomes. It cannot promise an exact provider bill.

What was verified

For commit f43b206, the sample builds on Windows with 0 warnings, the self-test passes 9 of 9, and a local HTTP check on 127.0.0.1 returned 401 without a token, 400 for malformed JSON or a user field, and 429 when the budget was exhausted, without calling the provider. Those checks were run with Claude, the AI assistant I use for this kind of work.

The sample was not tested against real OpenAI. Its self-tests use a scripted local provider. To run that path without an API key:

dotnet run --project LlmIntegration.csproj -- --self-test

The README explains real-provider environment configuration and the memory ledger's limits. Live compatibility, current pricing, and actual billing remain outside the reported validation.

If you want this in your ASP.NET Core app, I offer it as a fixed-price project on Upwork: https://www.upwork.com/services/product/2114839106032222506

One page, one question: how to structure headings and FAQ blocks so an answer engine can quote a passage

AumCreate — Mon, 02 Nov 2026 04:38:43 +0000

Someone asks an assistant a question. The assistant fetches a handful of pages, splits them into chunks, and keeps the chunk that looks like an answer. If your page buries the answer under four paragraphs of context, the chunk that survives is the context, and you don't get quoted.

The unit that gets retrieved and quoted is the passage, not the page. Everything below follows from that: write pages whose passages survive being cut out and read alone.

What a chunk looks like by the time it reaches the model

Retrieval systems split HTML into pieces of a few hundred tokens, usually cutting near headings. The piece arrives without your navigation, without the paragraph before it, without the table of contents. A sentence that begins "as mentioned above" or "this approach" arrives with no referent.

Test any paragraph by asking: if I paste only this block into an empty document, does it still say something true and complete? If not, it is a weak chunk.

Should a page answer one question or several?

One. The heading, the opening line and the FAQ should all point at the same question, phrased the way a person would type it. A page that answers "how much does a 3-bedroom move cost in Singapore" will not also answer "how do I pack a kitchen" well enough to be quoted for either.

Splitting is not a rule about word count. A short page answering two questions is worse than two short pages, because the retrieval system may pull half of the first answer and match it against the second question.

When two of your pages answer the same question, merge them. Duplicate answers compete with each other and neither becomes the reference.

The first sentence under a heading has to be the answer

Readers who scan and extractors that chunk both want the answer in the first sentence, before the justification.

Which version would you quote?

## Why is my WordPress site slow?

Performance is a broad topic and there are many factors to consider. In this
article we will look at several areas that affect how quickly a page loads,
starting with the hosting environment and then moving on to caching...

## Why is a WordPress site slow?

A WordPress page is slow when PHP rebuilds the page on every request and the
finished HTML is never stored. The usual causes are no page cache, an expensive
uncached query on each load, and images served at full resolution.

The second version answers inside one sentence and stays understandable out of context. The first version only announces that an answer is coming.

Delete the announcement paragraph entirely rather than shortening it. Openings like "in this article we will cover" have no value as a chunk.

Write chunks that name their own subject

A passage that gets pulled out of your page loses its title. Pronouns lose their reference and the chunk becomes useless.

Instead of "it handles retries automatically", write "the queue handles retries automatically".
Instead of "this approach scales", write "the queue-based import scales".
Instead of "most people prefer the second option", name what the second option is.

Numbers need units and a date. "5 working days" beats "fast turnaround". "Checked in October 2026" tells the reader the number has an owner and an expiry, and both are things a model can repeat without distorting them.

How should FAQ blocks be arranged?

An FAQ block is a set of small, self-contained answer chunks, and it works when you treat each item as its own page in miniature.

One question per item, phrased the way it gets searched. "Do you charge a yearly fee?" beats "Pricing notes".
The first sentence answers. Detail, caveats, exceptions come after, and they can be dropped without breaking the answer.
No nested sub-questions. If an item needs a follow-up question, it needs its own page.
No filler openings. "Great question!" and "That's a common concern" are the first thing a chunk carries and the first thing a reader skips.
Only questions someone actually asked. Six invented questions that pad a section produce six useless chunks and dilute the ones that matter.
Keep the answers in the HTML source. Content injected by JavaScript after load is invisible to a fetcher that does not run scripts. A <details> element is fine because the text is in the markup; a tab widget that loads its panel by request is not.

<h2>Frequently asked questions</h2>

<details>
  <summary>Does a heading have to be phrased as a question?</summary>
  <p>No, but a question heading matches how people search and gives the
  extractor a clean boundary. "Pricing" is a weaker heading than "How much
  does a delivery cost?"</p>
</details>

<details>
  <summary>Can an extractor read text inside a collapsed element?</summary>
  <p>Yes, when the text is in the HTML. A details element ships its content in
  the markup even while collapsed; a panel fetched by JavaScript after load
  does not.</p>
</details>

Structured data for FAQ is optional. Markup can describe a page, but the text is what gets extracted and repeated. Adding schema to thin answers produces well-labelled thin answers.

A page skeleton you can copy

# How much does X cost?          <- the question, in the searcher's words

One or two sentences that answer it, with the number, the currency and
what is included. No preamble.

## What is included in the price?

The first sentence states the inclusion. Then the detail.

## What changes the price?

Named factors, each with a short explanation.

## How do I start?

The concrete next action, one step, not a menu of five.

## Frequently asked questions

Four to six items, each answer-first and self-contained.

Notice the heading is not "Pricing". A heading that repeats the question gives the extractor a clean boundary and gives the reader a reason to stop scrolling.

Small things that break otherwise good passages

Comparisons that say "the first option" without naming it, in a table where the column headers were cut off with the chunk.
Answers that begin with "it depends" and never reach the actual answer. Put the dependency in the second sentence.
Numbers with no date and no scope. A figure that was true last year, or true only for one project size, gets repeated as if it were general.
A single page that is really six questions stapled together, each half-answered.
Repeated boilerplate under every heading, so that three different chunks all start with the same sentence about the company.

Before you publish, read the first sentence of every section on its own

Scroll through the page and read only the first sentence under each heading, with the heading attached. If those sentences form a coherent answer to the page's question, the page will survive chunking. If any of them needs the preceding paragraph to make sense, rewrite it.

That check takes two minutes and catches most of what makes a page unquotable.