Security BLOG

AnQiCMS Help Document and User Guide

How much of the AI crawling proportion in the log needs to be limited separately

There is no universal proportion number that can directly trigger speed limit, the judgment depends on which layer the crawling pressure falls. First, use the log to separate the AI crawler from the search engine crawler and count separately, when the proportion increases but the server load is stable, only need to manage the robots instructions; only when the concurrent crawling really slows down the page loading speed, do you need to limit the bandwidth and frequency level, interference code solves another matter.

📅 2026-11-01 👁️ 5

If the search exposure is increasing but the clicks are not, first distinguish between zero clicks or rankings dropping.

The exposure increases while the clicks do not, first use question keywords to split the two sets of data: if the decline is concentrated in question queries, it is mostly caused by zero clicks due to generative abstracts; if the exposure of brand words and model words declines synchronously, it is a ranking issue. Confirm and then check the site map, link push, static rules and 301 redirect one after another, these four steps are about being discovered and seen as soon as possible, not solving the abstract interception.

📅 2026-11-01 👁️ 6

After AI abstracts consume most of the clicks, what indicators should the enterprise site pay attention to?

When AI abstracts appear, the click-through rate of traditional results decreases significantly. At this time, the enterprise station should not focus on total traffic, but on three indicators: brand word search volume and direct visits, visitor quality brought by AI citations, and the conversion rate of inquiries and leads. AnQiCMS's keyword library is maintained by question, and is supported by LLMs.txt and AI writing capabilities, so that each group of data has a verifiable source.

📅 2026-11-01 👁️ 6

The back-end user field is missing a whitelist to change to password hash, where should the permission be collected in that layer.

If the quick change value interface of the back-end does not limit the writable fields, visitors can direct the submitted fields to sensitive columns such as password hash, which is equivalent to bypassing login to obtain identity directly. Permissions should be collected in three places: the list of changeable fields, group authorization and write verification, and hiding the entrance on the interface does not count as collecting. Password storage and session mechanisms should be matched, and content layer sensitive word filtering and review belong to another layer.

📅 2026-11-01 👁️ 6

If the front-end query conditions are not parameter-bound, it will be dragged into the database. Which item on the upgrade list should be pre-checked.

When using string concatenation for front-end query conditions without parameter binding, the values entered by the visitor can change the SQL semantics, which is the root of injection problems. When checking the upgrade log, first determine whether the fix is for injection surface: query conditions and sorting parameters take priority, followed by filtering enhancement. The content system itself has fixed list sorting parameter injection in v3.6.6, built-in SQL injection and XSS protection belong to the system level, and sensitive word filtering belongs to the content level.

📅 2026-11-01 👁️ 6

When the week of the major version release and the discontinuation of old branches fall on the same day, which step should the site take first?

When the major version release of an open-source content system and the discontinuation of old branches fall on the same day, the site should first do is to apply the current security patches and perform backup rollback drills, rather than rushing to go online. The major version change affects the compatibility of templates and extensions, while the discontinuation affects the patch supply, with different risk rhythms; schedule the upgrade window of the content system itself into the same table to avoid gaps where no one is responsible.

📅 2026-11-01 👁️ 6

When moving a hosting website building platform, articles can be exported, but why do we need to rebuild the pages?

The export of hosting website platforms usually only covers structured article content, titles, text, and tags can be taken away, the layout and components belong to the platform's private rendering configuration, which is not in the data, so the home page and landing page pages like these need to be remade in the new system. When moving, separate the schedule for batch importing articles and page reconstruction, and the old address redirection should be in place before the switch.

📅 2026-11-01 👁️ 6

The memory baseline of self-hosted programs is written in the deployment document, how to pick the content system for low-end servers

The memory baseline in the deployment document is a hard requirement for selecting low-end servers: The public threshold of mainstream self-hosted programs is usually hundreds of MB to 1GB or more. When the baseline is higher than the machine's surplus, upgrading the host is more likely to happen earlier than changing the architecture. In the low-end environment, pick in the order of resident memory first, then dependent components, and finally deployment methods. The content system of the Go technology stack is about 80% lower in memory than PHP programs

📅 2026-11-01 👁️ 6

After the AI entry file goes online, the number of references has not increased, first distinguish between the two steps of crawlable and citable references

The entry file (llms.txt) for large model sites solves the issues of discoverability and navigation, and has a low adoption rate: Only 10.13% of the nearly 300,000 domain samples have this file, and it does not affect how the AI system sees or references content. The normal increase in references after launch should focus on verifying the writing style of the sections that can be referenced and the accessibility of crawling.

📅 2026-11-01 👁️ 5

The robots file has been changed, but the crawling log has not changed, first check whether it takes effect or check the writing method.

After modifying the robots file, the crawl log did not change. First, check the effectiveness and then check the syntax: confirm whether the changes have really been read, how much latency there is between caching and the crawler, and then see if the scope of the instructions is too small or omitted. At the same time, distinguish between crawl control and content anti-crawling, interference codes belong to the content layer, and the difference in crawling can't be seen naturally after modifying robots.

📅 2026-11-01 👁️ 5