Security BLOG

AnQiCMS Help Document and User Guide

That week, the old branch was stopped just as the new version was released, what should the site running Drupal do first?

During the week of the major version release, the old branch just reached the end of support. For sites running Drupal, what should be done first? First, accept the backup, then plan the upgrade path. The official schedule compressed the two time points into adjacent days, effectively compressing the upgrade window. This article explains why the scheduling collided, what level of backup is considered acceptable, the order in which module compatibility should be checked, and what options are left after the discontinuation.

📅 2026-11-01 👁️ 4

The core security version fixed over twenty issues in one go, where did the rollback patch stop on which branch?

When the core security version fixes more than twenty vulnerabilities at once, it is first necessary to clarify the statistical scope, and then to see where the patch追溯 stops on which branch. This article takes a round of repairs made public at the end of this month as an example, explaining the difference between the number of fixes and the number of announcements, the minimum support branch, and why versions below the minimum do not receive any patches, and provides the disposal sequence for sites still on the old branch and the acceptance list for self-built systems during emergency upgrades.

📅 2026-11-01 👁️ 5

Only about 10% of sites have installed llms.txt, can this number indicate that it is useless?

Only about one-tenth of the sites have installed llms.txt, can this adoption rate number indicate that it is useless? No. A low adoption rate indicates that it is not yet a common practice, and an unclear relevance indicates that it is not a lever for citation volume, neither of which equals invalid. This article separates the sample and scope boundaries of two studies, provides a way to judge it as a reading path rather than a ranking method, and explains how to cross-verify whether it has been read using crawl logs and site maps.

📅 2026-11-01 👁️ 7

AI answers mention the brand but do not provide a link, should the mention rate and citation rate be counted separately?

In AI answers, when mentioning a brand without providing a link, should the mention rate and citation rate be separated? Yes. Mention is the brand name appearing in the answer, and citation is the answer accompanied by a link to the source. These are different events, and merging statistics will understate or overstate visibility. This article explains the misjudgment caused by the difference in measurement criteria, provides a ledger field for separate recording, and describes two things that can be improved on the content side.

📅 2026-11-01 👁️ 5

Where does the difference lie in the content selection system of government portals and corporate official websites in terms of audit permissions and backup?

The emphasis of the content selection system of government portals and corporate official websites differs: the former prioritizes pre-publication review, sensitive word filtering, and permission stratification, while the latter prioritizes publication efficiency and column management. The backup range should cover data and static files, and recovery should be practiced at different rhythms. This article provides a checklist for the two types of sites.

📅 2026-11-01 👁️ 4

Static site generator and content system mixed, which pages are suitable for pre-generation

Static site generator compiles content into files during the build phase, with extremely low read cost, but it needs to be regenerated every time it is changed; enterprise content systems are suitable for pages that can be changed at any time and have permission. When both are used together, allocate according to the type of page: documents and landing pages are pre-generated, comments, forms, and member content remain on the dynamic side, and then use pseudo-static rules to unify the address style.

📅 2026-11-01 👁️ 5

Only leave security fixes and not stop supporting, when should the scheduling of the runtime environment be?

PHP version enters the stage of only providing security fixes, which does not mean ending support, but functional defects will no longer be fixed. The scheduling of runtime environments should be traced back from the end date of active support, not the final end date. This article explains the differences between the two stages, the trigger points for scheduling, and the backup and regression preparation before upgrading, as well as the different rollback methods under Docker and panel deployment.

📅 2026-11-01 👁️ 7

Several hours after the patch is released, someone starts probing. How should the affected version range be used to determine the emergency sequence?

After a few hours of patch release, if there is detection traffic, don't rush to change the content. Use the affected version range to confirm whether you are within the scope. Take the example of an unauthorized local file inclusion, the version of the fix and the span of the historical range determine the emergency queuing order: confirm the version, tighten the entrance, upgrade, backup and acceptance, and leave evidence for each step to review.

📅 2026-11-01 👁️ 5

40 percent of websites use the same website-building program, does a higher proportion make it safer?

The same website-building program is used on nearly 40 percent of websites, a higher proportion indicates a mature ecosystem, a long patch chain, and higher benefits from automated scanning. However, it is not a security indicator itself. The truly verifiable capabilities are injection and cross-site protection, content-side filtering, and user group and permission stratification. These should be written into the acceptance checklist when choosing options.

📅 2026-11-01 👁️ 3

AI crawling is divided into three categories: retrieval, training, and agency. Each site needs to decide on its own which category to choose.

After AI crawling is divided into retrieval, training, and agency categories, the site needs to decide on a category-by-category basis: retrieval category brings the opportunity to be cited, training category does not produce immediate feedback, and agency category represents the user's current visit. Using a common switch will block the inclusion, and this article provides the order of judgment by category, as well as where the background robots configuration and llms.txt generation fall.

📅 2026-11-01 👁️ 6