People keep asking me two things. What does xTQ mean, and how come the site stays up when others go down? Here's the answer to both.
Why xTQ
xTQ is a nickname I had a long time ago. I left it behind for a few years, and then I came back to it, because it never stopped feeling like mine.
Today it's more than a nickname. It's the name I put on everything I build. xtq.ro is my home on the internet, and every project lives under it at its own address: xTQ PHP, xTQ Web, and this blog. I'm a web and software developer from Timișoara, and I believe nothing is impossible. That's not a slogan, it's the reason most of what you see here exists.
What this site runs on
Most websites are built from the same few parts. WordPress on top, a database underneath, a pile of plugins in between, and a web server like Apache or nginx in front. Millions of sites share the exact same pieces, and the same weaknesses.
This one doesn't. It runs on my own technology, from the front door to the last page, behind Deflecto.
xTQ Web is the front door. Every visitor talks to it first. It's a web server I wrote myself in Rust, a language built so that whole families of memory bugs simply can't happen. It handles HTTPS, sends each visitor to the right place and keeps floods out. It replaced the well-known server this site used before.
The blog is plain pages. When I publish a post, my own generator turns it into finished HTML files, once. When you open a post, nothing gets assembled for you, no database is asked anything, no code runs. You just get a file that's already done.
xTQ PHP is for the sites that need PHP. It's my own PHP server, also written in Rust, and it's what I run WordPress and WHMCS on when they're needed. When PHP had its worst bug in years, I patched it the same week and built protection into xTQ PHP for the next one.
No WordPress. No plugins from strangers. No bs.
Why it's so hard to take down
Let me be honest first: nothing on the internet is impossible to take down. But you can make it so hard and so pointless that people give up. Here's how this site does it.
There's nothing to break into. Most hacked websites are hacked through WordPress, an old plugin, a login page or a database. This site has none of those for visitors. No accounts, no comment forms, no database behind the pages, no plugins. You can't break into something that isn't there.
There's nothing to overload. A WordPress page is built from scratch for every visitor, with PHP and database queries each time. Here every page is already finished, so sending it costs the server almost nothing. A wave of traffic that would choke a normal site barely gets noticed here.
It runs three times over. The site runs as three separate copies side by side. xTQ Web checks every copy all the time, and if one stops answering, visitors are sent to the others without noticing a thing.
The front door fights back. xTQ Web keeps a cap on open connections and on the expensive work every new connection needs, so no flood can eat the whole machine and the visitors already inside keep getting served. Bots that scan every server on the internet for secret files and config leftovers get turned away before they reach anything. And if it ever gets really ugly, xTQ Web has a browser check I can switch on: each browser proves it's a real browser before it gets in. Real people barely notice. Bots get stuck at the door.
Updates never break it. When I publish a post, the new version of the blog is built on the side and switched in all at once. Visitors see either the old blog or the new one, never something half updated.
And Deflecto stands in front of all of it. Before traffic even reaches my server, it goes through Deflecto, a protection layer built for exactly this: soaking up floods and filtering out bad traffic before it ever touches the site. So an attacker doesn't just have to beat xTQ Web. They have to get through Deflecto first, and then find a site with nothing to break and nothing to overload.
Why build it yourself?
Because then I understand every part of it. When something goes wrong, I don't wait for a plugin author on the other side of the world to fix it. I open the code and fix it myself, usually the same day. And when a new kind of attack shows up, I can add a defence against it right away.
It's also more fun. Most people use what everybody else uses. I'd rather build my own and know exactly why it works.
So when someone asks me if this blog can be taken down, my answer is the same as for everything else: nothing is impossible. But good luck.