How a bakery should handle mobile forms

We write notes like this one because the same problems come back. If someone at a bakery reads it and avoids a 404 that still returns 200, the note paid for itself.

The most expensive outage for a bakery was not a hack — it was a 404 that still returns 200. Nobody attacked anything. The config just drifted.

The real issue was not mobile forms itself — it was a 404 that still returns 200. One feeds the other, and fixing only the visible symptom means it comes back in three weeks.

We rotate API keys for mobile forms annually. a bakery did not see the point until we showed them the access log: the old key had been used from an IP in a country nobody on their team has visited.

For a bakery, we wrote a three-line script that checks mobile forms every morning and emails the owner if anything changes. Total cost: zero.

Launch day for a bakery is usually light. Week three is when leftover tags, fonts, and staging URLs show up. a 404 that still returns 200 is the usual passenger.

Automate mobile forms if you can. If you cannot, write a quarterly reminder in a calendar that someone actually checks. a 404 that still returns 200 is what happens when nobody does either.

More notes

How a bakery should handle mobile forms

Related notes

Tell us what you need.