Blog
Tips and trends on SEO and web development.
Practical articles to improve your digital strategy, no fluff and no unnecessary jargon.
November 2026 Patch Tuesday: an Outlook zero-day that leaks credentials and over a thousand flaws fixed
What is known about the CVE-2026-124194 zero-day (NTLMv2 hash), why each outlet gives a different count, the critical flaws worth watching and what to do with Windows 10, Windows 11 and Office this week.
N-able N-central: over 30 alleged zero-days published for the remote management tool, and what to ask your IT provider
What happened between November 8 and 11, what is confirmed and what is not, why these platforms are an attractive target and eight questions for your provider.
SPF, DKIM and DMARC: what they are, how to set them up and what to do if your company's emails don't arrive (the Outlook.com case)
What each record does, how to set them up without losing legitimate mail, how to check them and what happened with Outlook.com in early November 2026.
Windows Update not working: how to fix it step by step on an office computer
Basic checks, the troubleshooter, repair with SFC and DISM, resetting components, manual installation and what to do in a business with several computers.
Chrome fixes its eighth zero-day of 2026 (CVE-2026-125350): how to update and check you are protected
Google patched an exploited XML component flaw on November 9: what is known, which version you need and how to update Chrome step by step on personal and business computers.
Zyxel GS1900 switches: the earlier patch did not close the flaw and there is new firmware (CVE-2026-107441)
What Zyxel's November 3 advisory says, which ten models are affected, what is known (and not known) about exploitation and how to update and protect your network's admin access.
Zero-day, CVE, CVSS and KEV: how to read a security advisory and how fast a small business should patch
A jargon-free glossary, the five questions for reading any advisory, why the score is not enough and indicative patching timelines for small businesses, with real examples from this autumn.
How to update WordPress without breaking your site: a step-by-step guide for core, plugins and theme
What to check first, update order, the process in the dashboard and with WP-CLI, how to verify afterwards, what to do if something fails and when to turn on automatic updates.
WordPress 7.1.4: the flaw attackers exploit while your site is updating
CVE-2026-119977: what the upgrade-process flaw is, affected versions, why CISA lists it as exploited and what to check on your WordPress today.
Critical Linux kernel flaw (CVE-2026-98432): which servers are affected and how to mitigate it until the patch arrives
Red Hat rates it 9.8: what it has confirmed, which systems are affected, whether it is exploited and the nftables rule it proposes as a temporary mitigation.
OpenSSH 10.6p2: the flaw that lets a very long password get through SSH on Alpine Linux
What OpenSSH and Alpine say, who is affected (musl and sshd without PAM), fixed versions, how to check and what to do today, including turning off passwords.
My WordPress site has been hacked: what to do, how to clean it and how to stop it happening again
Signs of a hack, what to do in the first hour, how to diagnose and clean without reinfection, when to notify Google and the Spanish data protection authority, and prevention that really works.
Smishing in Spain: the fake SMS messages from the DGT, Correos and the tax agency, and how to protect your business
Three 2026 campaigns (a DGT fine, a Correos parcel and a tax refund), warning signs from INCIBE, what to do if someone clicks the link and a protocol for your team.
Payee verification and IBAN change fraud: how to protect your business payments
What payee verification has been since 9 October 2025, what its four results mean, what it does not cover and which internal controls stop fake invoices and CEO fraud.
IT maintenance for small businesses: what it includes, how it is priced and what to ask before signing
Preventive and corrective tasks, contract models (on demand, hour bank, monthly fee, managed service), what drives the price and a list of questions to ask before signing.
Ivanti Connect Secure: a VPN zero-day has been exploited for weeks and updating is not enough
CVE-2026-104935: affected and fixed versions, why it is hard to detect, how to tell whether you use this VPN and what to do today, including checking for a possible intrusion.
QR code scams (QRishing): how they work and how to protect your business and your customers
What the Spanish National Police and the OCU warned about this summer, the most common frauds and how to use QR codes in your business safely, including what to do if someone forges yours.
Black Friday 2026: the scams that impersonate your online store and how to protect your customers
Clone sites, fake emails, ads and QR codes that imitate your store: how to protect your domain and email, secure checkout and what to do if you are impersonated during the campaign.
When the cloud goes down: how to prepare a continuity plan for your business before a service fails
What happened in the AWS, Azure and Cloudflare outages of autumn 2025 and how to build a realistic plan B: dependency map, independent backups, communication and an annual drill.
Web accessibility: what it is, what WCAG says and how to adapt your website step by step
The four principles and the A, AA and AAA levels of WCAG, the most common mistakes, a practical checklist and the tools to check whether your website is accessible.
WhatsApp Business API and chatbot: what it is, what it costs and when it is worth using
The difference between the WhatsApp Business app and API, how Meta charges for messages in 2026, what a chatbot can do, the conditions that apply and when it is worth making the switch.
What is a NAS: what a network storage server is for and whether your business needs one
How a NAS works, what it is for in an office, what RAID is (and why it is not a backup), how to protect it and when the cloud is a better choice.
Cloud storage for business: options, security and how to choose the right service
Types of storage, options such as Google Drive, OneDrive, Dropbox or Nextcloud, criteria for choosing, security, data protection and why syncing is not backing up.
Cloud computing for small businesses: what it is, the types and when moving to the cloud pays off
What “the cloud” really means, the difference between IaaS, PaaS and SaaS, public, private and hybrid cloud, benefits, risks and a seven-step migration plan.
What is a firewall: how it works, the types and what a small business really needs
What a firewall filters, network, host and NGFW types, what a WAF is, how it differs from antivirus and a VPN, and the basic settings that actually make a difference.
How much does it cost to create an online store in 2026: what you pay once and what you pay every month
Platform, design, hosting, payment gateway, shipping, legal and maintenance: the line items of an online store, indicative ranges and how to work out your real budget.
Google Workspace or Microsoft 365: which to choose for your small business email and office suite
A comparison by criteria, when each suite fits best, how to set up SPF, DKIM and DMARC so your email does not end up in spam, security and migration steps.
Domain and hosting: what they are, what they cost and how to choose well for your website
The difference between a domain and hosting, why the domain must be in your name, indicative .es prices, hosting types and how to switch host without losing rankings.
ERP and CRM for small businesses: which to choose, what they really cost and when to build custom
What each one does, how to tell which you need first, what free CRMs include, the costs that are not in the price and when custom software pays off.
Is there a new Kit Digital call in 2026? Official status, deadlines and what to do
There is no open call: all five are closed and the last two closed on October 31, 2025. Official dates from Red.es and alternatives.
Corporate website: what it is, what it needs and how to plan it to win customers
Which pages and content a company website needs, which legal obligations to meet, how long it takes and a checklist for small businesses and freelancers.
Payment gateway for your online store: how to choose, what fees to expect and how to integrate it
Bank virtual POS, Stripe, PayPal and Bizum compared: published fees, an example with a 50-euro sale and how to integrate them into your store.
PHP2Shell: two critical PHP flaws allow code execution on the server; what to do today
PHP released patches on October 21 for CVE-2026-109618 and CVE-2026-109619, remote code execution flaws rated 9.2. Fixed versions, who is affected and a checklist to update your website.
VeriFactu software: how to choose your invoicing program and what free options exist
What an invoicing program must comply with, eight questions for your provider and what the free Tax Agency app does (and doesn't) allow: no till receipts, no exporting records.
VeriFactu and POS systems: what the till of your shop or bar must comply with
The till receipt is a simplified invoice and falls under the regulation. What changes on the receipt, what happens if the internet goes down and what to demand from your POS provider.
Business backup: how to set up copies you can actually restore
The 3-2-1 rule explained for a small business: what to copy, where to keep it, how often, how to protect yourself from ransomware and why you must test restores.
What is VeriFactu: who it applies to, how it works and what to do now
A plain-language guide for freelancers and SMEs: the four-"no" rule, the two modes, whether it's free, what changes on your invoices and the penalties.
Local SEO: how to show up on Google when people search nearby
What Google looks at to pick the businesses on the map and what to work on first: business profile, reviews, consistent data, website and local links. Plus the mistakes that waste the most time.
Digital compliance calendar for SMEs and freelancers in Spain (2026-2029)
VeriFactu, B2B e-invoicing, the AI Act, the Cyber Resilience Act and Windows end of support: every date, ordered by year, plus what is still unapproved.
Cisco Secure Email Gateway and FortiMail: two email gateways with zero-days exploited in October
Cisco (CVE-2026-76519) and Fortinet (CVE-2026-104286) confirm critical zero-days, both CVSS 9.8, in their email gateways. Who is affected, mitigations and what to check today.
October 2026 Patch Tuesday: over 1,400 vulnerabilities and an actively exploited Windows zero-day
On October 13, 2026 Microsoft fixed over 1,400 vulnerabilities, the largest bulletin in its history, including an already-exploited Windows zero-day (CVE-2026-96951). What to patch first.
WordPress plugins exploited in October 2026: Ninja Forms, WPC Product Bundles and Bricksforge
Patchstack has detected active exploitation in three WordPress plugins: two XSS flaws that leave hidden administrators and a CVSS 10 flaw in Bricksforge. What to update and how to check whether you have been infected.
AI Act delayed: which dates change with the Digital Omnibus and what still applies to your SME
The Digital Omnibus pushes the high-risk obligations back to December 2027 and August 2028, but the Article 50 transparency rules still apply from August 2, 2026. Updated timeline and what to check.
ChatGPT Ads in Spain: how advertising in ChatGPT works and whether it suits an SME
Ads have been running in ChatGPT in Spain since August 24, 2026, and the self-serve manager has been open to businesses since the 31st. Bidding, who sees the ads, limits in Europe and what to prepare before spending.
13 October: Windows 11 24H2 and Office 2021 stop receiving updates
On October 13, 2026, updates for Windows 11 24H2 (Home and Pro) and support for Office 2021 end. Who is affected, what happens with 25H2 and 26H2, and what a small business should do.
Free Gemini is left with only Flash-Lite on 9 October: what changes for your business
From October 9, 2026, free Gemini only gives access to Flash-Lite and AI Plus loses the Pro model. What changes, what isn't known about Workspace and how to decide whether to pay.
First data breach caused by an autonomous AI agent in Spain: what the AEPD says and what to do
On September 15, 2026 the AEPD disclosed the first personal data breach notified in Spain in which an AI agent acted autonomously. What it did, what the agency asks for and five measures for a small business.
Website maintenance: what it includes and what it costs in Spain in 2026
What a website maintenance plan includes and what it costs in Spain according to several providers (from €15 to over €300 a month). What is usually left out of the price and how to compare quotes.
Windows 10 until October 2027: what changes and what to do with your PCs
On June 25, 2026 Microsoft extended Windows 10 ESU to October 12, 2027. What it covers, what it means for businesses ($61, $122 and $244 per device) and when replacing makes sense.
Citrix NetScaler: two critical zero-days that have been exploited for weeks
CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5) allow unauthenticated remote code execution. Over 50,000 exposed instances worldwide, with active exploitation since early September.
Plan IA360 and the AI voucher: €600 million for Spanish SMEs and freelancers
Spain's government presented a plan on September 21, 2026 to bring AI to 25,000 companies. What it is, how it differs from Kit Digital IA, and when it will actually be available.
Renfe and Adif cyberattack: what SMEs should learn from it
An AI agent stole 500 GB of customer data from Renfe and Adif in September 2026: over 150 million records affected. What lessons apply to any business.
Google Spam Update September 2026: the year's fourth update
Google began its fourth 2026 spam update on September 24, with a rollout of up to two weeks, notably longer than the previous three.
WordPress 7.1.2: the critical vulnerability that had been exposed since 2016
CVE-2026-87902 (CVSS 9.2) affects every WordPress version since 4.7. Active exploitation began less than five hours after the patch was released.
Windows Patch Tuesday September 2026: 966 vulnerabilities and two active zero-days
Microsoft has released its largest security bulletin ever: 966 flaws fixed, 105 critical, and two zero-days already being actively exploited.
Critical vulnerability in ScreenConnect: what to ask if your IT support uses it
CISA confirms CVE-2026-84869, in ConnectWise ScreenConnect, is already being exploited. It's one of the most widely used remote-access tools among IT support providers — here's what's worth checking.
Microsoft 365 price increase: what changes for your SME at your next renewal
Since July 1, 2026, Microsoft has raised prices across its commercial plans, by as much as 43% in some cases. If your business runs on Microsoft 365, here's what's worth checking before you renew.
Chrome has an active zero-day: why this update can't wait
Google confirms CVE-2026-85046, in Chrome's V8 engine, is already being exploited. It's the browser's sixth zero-day of 2026, and the fix is already available.
Elementor Pro had a critical vulnerability that let attackers take over your site without a password
CVE-2026-32475, rated 9.0 out of 10, affected Elementor Pro's file upload module. It's already patched, but it's worth understanding what happened and checking your installation.
Google suspends 'site reputation abuse' penalties in Europe: what it means for your site
Since August 30, 2026, manual actions against 'parasite SEO' no longer directly affect rankings in the European Economic Area. Here's what changed after pressure from the European Commission.
Sovereign AI: for the first time, Spain's State takes a stake in an AI company
SETT, the public tech-investment vehicle, has taken a stake in Sherpa.ai, a company specialized in AI that never lets your data leave your own infrastructure. Here's what it means for an SME choosing which AI tools to trust.
ChatGPT named a 'very large search engine' by the EU: what it means for your business
For the first time, an AI chatbot is subject to the strictest obligations of the EU's digital services law. Here's what changes and why it reinforces the need to be ready for AI search.
Kit Digital AI 2026: the artificial intelligence grant, category by category
The program dedicates three whole categories to AI-powered solutions, with grants reaching up to €29,000. Here's what each one covers and how much you can claim depending on your business size.
Save time with your website: the automations that actually free up hours for your SME
It's not about spending less, it's about no longer repeating the same manual work every day. Here's how a well-planned website recovers real hours.
Cyber Resilience Act: why September 11, 2026 is a date you can't ignore
The EU's Cyber Resilience Act starts requiring mandatory notification of vulnerabilities and incidents. And no, it's not just for big manufacturers.
Mandatory B2B e-invoicing in Spain: the official calendar is set, October 6, 2027 and 2028
Order HAC/1028/2026, in force since October 6, 2026, sets the dates: 2027 for businesses over €8 million and 2028 for everyone else. Which invoices are covered and how it differs from VeriFactu.
AEPD 2026: multi-million euro GDPR fines for Vodafone, Amadeus and Aena
Spain's Data Protection Agency is collecting record amounts in 2026. The mistakes behind these fines are, at their core, very common ones.
Zuckerberg and open AI: what Meta's 2026 manifesto means
Meta has open-sourced its most powerful language model, challenging the industry's usual secrecy. What it could mean in practice.
Next.js: Vercel patches 9 critical vulnerabilities in 2026
If your website or app is built with Next.js or React, here's what you need to check.
Fiber and 5G in rural Spain: grants and deadlines in 2026
Spain's rural connectivity plan has extended its deadlines with EU funding. Here's what it covers and what it means if your business is outside the big cities.
ChatGPT outages in August 2026: what to do if your business depends on AI
ChatGPT has suffered several global outages this month, including its API. What it means if you use AI for business processes and how to reduce the risk.
TikTok and Instagram in 2026: how their algorithms favor local businesses
It's no longer the content with the most followers that wins, but the content that actually holds attention. Why this works in favor of neighborhood businesses.
Google Ads: what changes from August 17, 2026 in automated bidding
Google has adjusted how budget-limited campaigns with automated bidding behave. Here's what it means if you manage your own advertising.
SSL certificates: now last a maximum of 199 days as of March 2026
The standard governing every website's security certificates has cut their maximum validity — the first of several reductions already scheduled through 2029.
Bizum Pay: mobile payments in physical stores, no card needed
Bizum is jumping from transfers between individuals to letting you pay directly at the counter. What changes for a local business.
WhatsApp Business with AI: what changes for your SME in 2026
Meta launched its global AI agent for WhatsApp Business in June. It resolves up to 80% of repetitive messages, but there's a legal obligation you can't skip.
Mandatory digital time tracking: where the reform stands in 2026
Spain's government wants to end paper and spreadsheets for clocking in. There's still no official date in the BOE, but here's what's coming and when.
Malicious browser extensions in 2026: how to protect yourself
A critical Firefox flaw, hundreds of fraudulent VPN extensions in Chrome, and campaigns that steal corporate credentials. What to check now.
August 2026 Patch Tuesday: 421 vulnerabilities and an active zero-day in Windows
Microsoft fixed 421 flaws this month, 62 of them critical, including a zero-day already being exploited. What to patch first and why.
Local SEO in 2026: what's changed in Google Business Profile
Google no longer just looks at what your listing says — it checks every signal that confirms whether your business is trustworthy.
Spain becomes Europe's AI machine room
Amazon, Microsoft and Google are investing billions in data centers in Spain. Investment through 2030 exceeds €66.9 billion.
The reverse Bizum scam: how to protect your business if you accept Bizum payments
In 2025 there were more than 380,000 reports of digital scams in Spain. What to know if your business accepts Bizum payments.
Web design in Valdemoro, Madrid, for local businesses
Professional design with local SEO built in from the start for businesses in Valdemoro and the surrounding area, no generic templates or cost overruns.
Black Friday 2026: when it is and how to prepare your online store in time
On Friday, November 27, nine out of ten people in Spain will shop online. What to check before the traffic peak hits.
Google's August 2026 spam update: what content is dropping and why
This is the third anti-spam update this year. Google doesn't penalize using AI — it penalizes publishing it unedited.
Kit Consulting 2026: what it is and how it differs from Kit Digital
Vouchers worth up to €24,000 for strategic digital transformation advice, not for implementing tools.
Critical macOS vulnerability: update now if you use screen sharing
A flaw with the highest possible severity score lets an attacker take control of a Mac without a password.
wp2shell: the critical WordPress vulnerability you need to patch now
INCIBE warned in July 2026 of a chain of core WordPress flaws that allows remote code execution without authentication.
Web accessibility law in Spain: 98% of private websites still don't comply
Fines can reach up to one million euros and can cut you off from grants like Kit Digital.
Ecommerce in Spain 2026: growing 7.4% and already past €110 billion
Spain is the fastest-growing ecommerce market among the five major Western European economies. Data and what it means for your business.
European Digital Identity Wallet (eIDAS2): what it means for your business in 2026
Spain must have its digital identity wallet ready before the year ends. What changes and why it affects businesses too.
AI Act: what changes from August 2, 2026 for your website
The transparency obligations of the EU's AI Regulation are now enforceable. What to check if your business uses a chatbot or generates content with AI.
ChatGPT and Gemini are taking share from Google in Spain: what it means for your SEO
Traffic from AI search engines has grown 16-fold in two years. Market share data and how to adapt your content.
VeriFactu delayed to 2027, and Hacienda plans to push it to October 2028: what applies today
The legal dates are still January 1 and July 1, 2027. Hacienda has announced a delay to October 2028, but it is not yet law. What applies today and what to do.
Cyber insurance for SMEs: how much it costs and what it covers in 2026
The average cost of a cyberattack on a small business can exceed €35,000. Indicative prices and the minimum measures insurers require.
Free AI tools for SMEs in 2026: where to start
You don't need a budget to start automating repetitive tasks. Here's what you can cover with free plans, and when it's worth stepping up.
Kit Digital 2026: call status, requirements and how to apply
No call is open today, but Order TDF/39/2026 allows grants to keep being awarded until funds run out. Amounts by segment, requirements and how to apply.
Ransomware doubles in Spain in 2026: what SMEs can do
From Inditex to a seaport, attacks no longer discriminate by company size.
AI phishing and deepfakes: the fastest-growing threat of 2026
You no longer need to be a large corporation to be targeted by a cloned-voice or cloned-video fraud.
NIS2 in Spain: what it means for your SME even though the law still hasn't been published
The January 2026 cyberattack on Endesa is a reminder of why this directive exists. Here's what you should already have in place.
Google AI Overviews: why your SEO traffic is dropping even though your ranking hasn't changed
More and more searches end without a single click. Here's what's happening and how to adapt your content to this new scenario.
Vibe coding: what it is and when you need to move to a real developer
Describing what you want and letting AI write the code is changing how products get prototyped. But prototyping isn't the same as shipping to production.
Web design in Las Rozas, Madrid, for local businesses
Professional design with local SEO from day one for businesses in Las Rozas and the surrounding area, no generic templates or hidden costs.
Long tail and middle tail: what they are and why they matter for your website
Not all keywords are worth the same. Understanding this difference is the foundation of any content strategy that actually works.
How much does an SEO audit cost in Madrid
Prices vary a lot depending on scope. Here's what actually drives the cost and what should never be missing.
How much does a cheap website cost: a real pricing guide
Ballpark price ranges, what drives the final cost, and how to compare quotes without just going for the lowest number.
7 mistakes that turn your cheap website into wasted money
Saving on the upfront price is fine. Saving badly is what makes you end up paying twice.
Cheap website or custom website: which to choose for your business
It's not always a final decision. For many businesses, one is simply the starting phase of the other.
Connected V16 beacon: the vulnerability exposing data from thousands of drivers
A device mandatory across Spain since 2026 has shown that 'connected' doesn't always mean 'secure'.
RAM and SSD price crisis in 2026: what it means for your business
AI data center demand is driving up memory prices on every new computer. Here's what you can do about it.
Sam Altman suggests slowing down AI: what it means for SMEs already using it
When even the creators of the technology are asking to slow down, it's worth understanding what changes and what doesn't for your business.
AI microdramas: the business of content that generates (almost) itself
A script, some credits, and in minutes you have a full series. This is the new vertical video industry.
From law to code: how Legalize-es turned Spain's official gazette into open data
Over 12,000 Spanish laws, now on GitHub, versioned like software.
How to protect yourself from the dangers of heuristic viruses
What heuristic detections are, when they're a real threat, and how to keep your computer protected.
The truth behind KRBTGT: the most critical account in your Active Directory
What the KRBTGT account is, why it's the heart of Kerberos authentication, and how to protect it.
Burp Suite: explore the world of web application security
What Burp Suite is, how it works, and why it's the go-to tool for web security testing.
From zero to infinity: discovering the benefits of Zeroshell
A Linux distribution for network services: what Zeroshell offers and when it makes sense to use it.
Would you rather we do it for you?
Reading is good. Having a website that brings in customers is better. Tell us about your project.