/ Research
Studies I ran myself
Public websites measured with real browsers, real business data counted in aggregate, a control group when it matters, and the data downloadable. Each study says what was measured, when, and what it cannot prove.
November 2026 · Web security
How long would it take to steal your password?
The same 20 passwords, stored with MD5, SHA-256, bcrypt and Argon2id and attacked from a laptop with an RTX 4060.
Read the study3/20 · 0/20fall with MD5 and with bcrypt
October 2026 · Shopify
What is a supplier catalogue missing for Shopify?
37,948 engine spare parts from five supplier sources, compared field by field with what Shopify and Google need: photos, GTINs, weights, filters and import limits.
Read the study0/37,948products arrive with a photo
October 2026 / Infrastructure
Check your website's TLS/SSL certificate for free
What the 100-day certificates of 2027 mean, how the 1,000 most visited .es sites are doing, and yogurTLS, a free checker for your own site.
Read the study421/958already renew at the 2027 pace
October 2026 · Public websites
How slow and how accessible are city council websites?
Speed (Lighthouse, mobile) and accessibility (axe, WCAG 2.1 AA) of the city council websites of Spain’s 50 provincial capitals.
Read the study42/49home pages with WCAG errors on desktop
October 2026 · AI search
Is the IBEX 35 ready for AI search?
robots.txt, firewall rules and llms.txt of Spain’s 35 largest listed companies, tested with a placebo bot as the control group.
Read the study0/35block AI search bots in robots.txt