The Cloudflare-for-SaaS + IIS Gotcha Nobody Documents: SNI vs Host Header
Cloudflare for SaaS can send SNI and Host header with different values, and IIS routes on Host only. On a Full zone the mismatch serves the wrong site silently.
The build log
Notes from running agents in production.
Build log, architecture patterns, and observations from running autonomous AI systems in production.
-
-
A hash-chained manifest makes archive changes visible
A small hash-chained manifest can detect unexpected changes to archived outputs and its own record-but only when it sits inside a broader integrity, access, retention, and recovery design.
-
Your CDN's default bot protection is blocking Googlebot and quietly bleeding your SEO
I clicked into a single sampled Cloudflare security event to see who my new bot protection was actually catching, and the top blocked source was a documented Googlebot address. That is Googlebot.
-
An Off-Origin Caddy Relay for Bare-Domain SSL (Because Cloudflare Pro Won't Proxy Your Apex)
Cloudflare Pro proxied every subdomain my SaaS threw at it and silently refused the apex.
-
The Prod Box Was DDoSing Itself: An iCal Calendar Feature Looping Through the Public Edge
Two hours of IIS logs showed the prod box hitting its own schedule endpoint 19,178 times through Cloudflare: an iCal self-loop, plus the case for 410 Gone.
-
The legacy server-variable bug that printed `undefined` instead of a value
A diagnostic page returned the literal word `undefined` instead of a client value. The lesson was not just a language quirk: copies of shared logic had drifted away from the defensive helper.
-
"The Whole Island Can't Reach Your Site": US Territories Are Separate Countries to Cloudflare
A geo-block WAF rule that allowed US and CA silently locked out an entire US territory. How Cloudflare's ISO 3166-1 country codes work, the five territory codes to add, and a small lesson about what you can and can't claim when verifying a fix.
-
Geo-blocking everywhere except the US and Canada, and the one clause that saves your SEO
How to write a Cloudflare geo-block WAF rule that covers your real customer base without silently deindexing you, plus the US-territory gotcha that bites immediately after.
-
The GoDaddy reseller Catch-22: the account with the domains has no API, the API account has no domains
To automate DNS for 1,166 customer domains, I needed one thing: a GoDaddy API key.
-
GPTBot vs OAI-SearchBot vs ChatGPT-User: blocking the wrong one deindexes you from AI search
"Does blocking GPTBot keep me out of ChatGPT's results?" The answer is no, and the reason is the whole point of this post: OpenAI runs three different bots for three different jobs, and the per-bot...
Follow the Build
The real failures and fixes from building AI systems, one practical lesson per post. Get the next one in your inbox.