DEV Community: Peter Panda

Carrying Ad Click IDs (gclid, fbclid, ttclid) Through a Single-Page Checkout

Peter Panda — Sun, 01 Nov 2026 21:04:46 +0000

Ad platforms append click identifiers to landing URLs: gclid for Google, fbclid for Meta, ttclid for TikTok. If those IDs are lost before the conversion, offline conversion uploads and server-side events cannot be matched, and your reported ROAS drops even when sales did not. Single-page apps are especially good at losing them. Here is a minimal pattern that works.

Capture on first load

const KEYS = ["gclid", "gbraid", "wbraid", "fbclid", "ttclid", "utm_source", "utm_medium", "utm_campaign"];

function captureClickIds() {
  const params = new URLSearchParams(location.search);
  const found = {};
  KEYS.forEach(k => { if (params.get(k)) found[k] = params.get(k); });
  if (Object.keys(found).length) {
    found.ts = Date.now();
    localStorage.setItem("click_ids", JSON.stringify(found));
  }
}
captureClickIds();

Run this before your router rewrites the URL. Many SPA routers strip query strings on the first navigation.

Expire them sensibly

Attribution windows differ by platform, typically seven to ninety days. Store a timestamp and ignore IDs older than your longest window. Overwrite on each new ad click so the most recent click wins, matching most platforms' default logic.

Attach at conversion time

When the user submits a lead form or completes checkout, include the stored IDs in the request to your backend:

const ids = JSON.parse(localStorage.getItem("click_ids") || "{}");
await fetch("/api/orders", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ ...orderPayload, attribution: ids })
});

Persist them on the order or lead record. That is what makes later uploads possible.

Cross-domain checkouts

If payment happens on a different domain, for example a hosted crypto or card payment page, pass the order ID rather than the click IDs. The backend already holds the attribution; when the payment webhook confirms the order, send the server-side conversion event with the stored IDs.

Consent

In markets with consent requirements, only store identifiers after the user has agreed to marketing cookies. Keep the capture function behind your consent check, and document what you store.

Verifying it works

Click a test ad or craft a URL with dummy IDs, complete a test order, and confirm the IDs appear on the order record. Then check the platform's diagnostics after uploading conversions. Match rates below about seventy percent usually point to IDs lost somewhere in the flow.

Beyond ad platforms

The same record can store the referrer domain, which is how teams start separating traffic from AI assistants such as ChatGPT or Perplexity from classic search. We wrote up that side in our AI and ad lead attribution guide.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Building a Locale Switcher That Respects hreflang and User Choice

Peter Panda — Sun, 01 Nov 2026 21:04:01 +0000

Language switchers look trivial: a dropdown with flags. In practice they are where many multilingual sites break their own SEO and annoy users at the same time. This post outlines a switcher design that keeps search engines and humans happy, with small code samples.

Principles

Every language version has its own URL (/en/, /de/, /ja/).
The switcher links to the equivalent page, not the homepage of the other language.
Automatic detection suggests, it never forces a redirect.
A user's explicit choice is remembered.

Generate links from the same map as hreflang

Keep one data structure that lists equivalents for each page, and use it both for <link rel="alternate" hreflang> tags and for the switcher. If they come from different sources, they will drift.

// alternates is injected server-side: { en: "/en/pricing", de: "/de/preise", ja: "/ja/pricing" }
function renderSwitcher(alternates, current) {
  return Object.entries(alternates).map(([lang, href]) =>
    `<a href="${href}" hreflang="${lang}" lang="${lang}"${lang === current ? ' aria-current="true"' : ''}>${LABELS[lang]}</a>`
  ).join("");
}

Use real anchor tags with href. Switchers built from buttons and JavaScript click handlers are invisible to crawlers.

Labels: language names, not flags

Flags represent countries, not languages. Spanish speakers in Mexico do not want a Spanish flag. Show each language in its own script: English, Deutsch, 日本語, Español.

Detection as a banner, not a redirect

If the browser language differs from the page language, show a small banner: "This page is available in Deutsch. Switch?" Redirecting automatically based on Accept-Language or IP can prevent crawlers from seeing other versions and traps travellers.

const pref = localStorage.getItem("lang");
const browser = navigator.language.slice(0, 2);
if (!pref && browser !== document.documentElement.lang && alternates[browser]) {
  showBanner(browser, alternates[browser]);
}

Remember the choice

When a user clicks a language, store it in localStorage or a cookie. On future visits, still serve the URL they asked for; just use the stored preference to decide whether to show the banner.

Missing translations

If a page has no equivalent in a language, either hide that option or link to the closest parent page with a note. Never link to a 404, and never list it in hreflang.

Test it

Crawl the site and check that every hreflang target returns 200, lists the source page back, and appears in the switcher. A few lines of Python with requests and a regex is enough for small sites.

More detail on URL structures and common hreflang errors is in our hreflang implementation guide.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Reconciling Crypto Gateway Settlement Reports Against Your Orders With pandas

Peter Panda — Sun, 01 Nov 2026 21:03:15 +0000

Finance teams at merchants who accept crypto usually ask the same question at month end: does the money that reached the bank match the orders we shipped? A crypto gateway that converts to USD and pays out to a bank account produces a settlement report, your store produces an order export, and the bank produces a statement. This post shows a small pandas script that joins the three and flags the differences, so a human only reviews the exceptions.

The three inputs

Order export from your store or billing system: order ID, customer currency amount, currency, status, created time.
Gateway settlement report: invoice ID, your order ID (passed as metadata when creating the invoice), crypto asset, network, crypto amount received, USD value at confirmation, fee, net amount, payout batch ID.
Bank statement: date, amount, reference. Each gateway payout usually appears as one line per batch.

The key design decision happens before any code: always pass your own order ID to the gateway when creating an invoice. Without it, reconciliation becomes fuzzy matching on amounts and timestamps, which breaks as soon as two customers buy the same product within a minute.

Loading and normalising

import pandas as pd

orders = pd.read_csv("orders.csv", parse_dates=["created_at"])
settle = pd.read_csv("gateway_settlement.csv", parse_dates=["confirmed_at"])
bank = pd.read_csv("bank.csv", parse_dates=["date"])

orders["order_id"] = orders["order_id"].astype(str).str.strip()
settle["order_id"] = settle["order_id"].astype(str).str.strip()

for col in ["usd_value", "fee", "net"]:
    settle[col] = pd.to_numeric(settle[col], errors="coerce").round(2)

Normalise identifiers as strings and strip whitespace. Spreadsheet exports love turning order numbers into floats.

Matching orders to invoices

m = orders.merge(settle, on="order_id", how="outer", indicator=True)

paid_not_found = m[m["_merge"] == "right_only"]   # gateway paid, no order
order_unpaid = m[(m["_merge"] == "left_only") & (m["status"] == "paid")]
both = m[m["_merge"] == "both"].copy()
both["diff"] = (both["usd_value"] - both["order_total_usd"]).round(2)
mismatch = both[both["diff"].abs() > 0.50]

Three exception lists come out of this:

Paid but no order usually means an order was deleted, or a test invoice was paid on the live account.
Order marked paid but no settlement is the dangerous one. It often points to a webhook handler that trusted a "pending" event, or to manual status changes by support.
Amount mismatch covers underpayments, overpayments and orders priced in a currency other than USD. Choose a tolerance that reflects your rounding rules; fifty cents works for most digital goods.

Matching payouts to the bank

batches = settle.groupby("payout_batch")["net"].sum().round(2).reset_index()
bank["batch"] = bank["reference"].str.extract(r"(PB-\w+)")
recon = batches.merge(bank, left_on="payout_batch", right_on="batch", how="left")
recon["bank_diff"] = (recon["amount"] - recon["net"]).round(2)

If your bank statement does not carry the batch reference, match on amount within a date window instead, and expect to review a few lines by hand. Small differences can come from bank charges on incoming transfers in some of the 38 countries where gateways offer local deposits; record them as bank fees rather than adjusting the order.

Fees and reporting

With a flat processing fee, the check is simple: fee should equal one percent of the USD value, within rounding. Flag anything else.

settle["fee_check"] = (settle["usd_value"] * 0.01).round(2) - settle["fee"]
odd_fees = settle[settle["fee_check"].abs() > 0.02]

Export the exception lists to one workbook with a sheet per list and send it to finance. In practice, after the first month the lists are short, and the monthly close takes minutes instead of a day.

Practical tips

Run the script weekly, not monthly. Exceptions are easier to explain while they are fresh.
Keep the raw exports unchanged in a dated folder; write results to a separate folder.
Store crypto amounts as strings or decimals, never floats, if you also reconcile on-chain amounts.
Log the gateway's transaction hash next to each order so support can answer "did my payment arrive?" without asking finance.

We describe the payout flow, supported assets and integration options (API, plugins and SDK) in our crypto payment gateway guide. The service is offered by a Hong Kong company to overseas merchants only.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Generating llms.txt From Your Sitemap With a Small Python Script

Peter Panda — Sun, 01 Nov 2026 21:02:30 +0000

llms.txt is a simple convention: a markdown file at the root of a site that lists the pages you consider most useful for language models, with a one-line description each. Nobody guarantees that every assistant reads it, but it is cheap to produce and forces you to decide which pages actually matter. Writing it by hand gets stale quickly, so here is a small script that builds a first draft from your existing sitemap.

What we want as output

# Example Co
> Overseas advertising and AI search services for companies going global.

## Guides
- [Google Ads account opening](https://example.com/blog/google-ads-guide.html): documents, timeline and billing options
- [Crypto payment fee calculator](https://example.com/blog/fee-calculator.html): compare card and crypto costs

The script

import re, requests, xml.etree.ElementTree as ET
from html import unescape

SITEMAP = "https://example.com/sitemap.xml"
NS = {"s": "http://www.sitemaps.org/schemas/sitemap/0.9"}
INCLUDE = re.compile(r"/(blog|guides|docs)/")

def page_meta(url):
    html = requests.get(url, timeout=20).text
    title = re.search(r"<title>(.*?)</title>", html, re.S)
    desc = re.search(r'<meta name="description" content="([^"]*)"', html)
    return (unescape(title.group(1).strip()) if title else url,
            unescape(desc.group(1).strip()) if desc else "")

root = ET.fromstring(requests.get(SITEMAP, timeout=20).content)
urls = [u.text for u in root.findall("s:url/s:loc", NS) if INCLUDE.search(u.text)]

lines = ["# Example Co", "> One-sentence description of the company.", "", "## Guides"]
for url in urls[:60]:
    title, desc = page_meta(url)
    lines.append(f"- [{title}]({url}): {desc[:140]}")
open("llms.txt", "w", encoding="utf-8").write("\n".join(lines) + "\n")

Things the script cannot decide for you

Selection. A sitemap lists everything, including tag pages, thin posts and old announcements. The regex filter is only a start. Review the list and remove anything you would not want quoted. Sixty strong URLs beat four hundred mixed ones.

Descriptions. Meta descriptions are written for click-through, not for explanation. Rewrite the important ones so each line says what the page answers, in plain words, with a number or scope where possible.

Grouping. Split the file into sections that mirror how a buyer thinks: services, pricing, guides, tools, company facts. Put company facts (location, founding year, markets served) near the top because assistants are often asked about them.

Multilingual sites

If you publish in several languages, keep one llms.txt per language root or add a section per language with clearly labelled links. Do not mix translated titles under the same heading; it makes the file harder to parse and to maintain.

Keep it in CI

Run the script weekly in CI, diff the output against the committed version, and open a pull request when it changes. A human approves the diff. That keeps the file fresh without letting it grow uncontrolled.

Does it move anything?

On its own, rarely. Combined with clear pages, consistent company facts and a few third-party references, it is one of several small signals. We treat it as housekeeping rather than a ranking trick. More on how it fits into a wider GEO process in our GEO implementation notes.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Capturing AI-Assistant Referrers in Application Logs Without Breaking Caching

Peter Panda — Sat, 31 Oct 2026 21:03:38 +0000

When a user clicks from an AI answer into your site, the referrer field is one of the few signals you get. Many teams lose it to CDN defaults, aggressive cache keys or SPA navigations that never send the first landing referrer to analytics.

Log the first HTML request

In nginx (or your edge worker), dump $http_referer, $arg_utm_source and a request id on the first document request. Do not wait for a tag manager event; ad blockers and refused JS wipe that path.

Keep HTML cache keys from ignoring the landing URL

If you cache HTML, ensure the first landing still records referrer server-side before a cache hit serves a shell. Some stacks log only on miss; force a lightweight collect endpoint instead.

Normalise known assistant hosts

Maintain a small map: host contains chatgpt, perplexity, copilot, etc. Store both raw referrer and a normalised ai_source dimension so dashboards stay readable when domains change.

Pass the signal into the CRM on form submit

Stash the first referrer in a first-party cookie or server session with a short TTL. On lead submit, write it onto the contact. Otherwise sales never sees that the lead came from an assistant.

Review weekly, not once a quarter

AI traffic patterns shift. A weekly count of landings by ai_source is enough to see whether content experiments move anything.

Practical checklist

Before you ship the change, walk through a short checklist with someone who did not write the page. Ask them to explain the offer, the price or fee range, the timeline and the main risk in their own words. If they cannot, the draft is not ready for assistants or for humans either.

Document the owner of the page, the next review date and the source of every number you quote. When a platform policy or a fee changes, you want a single place to update rather than a scavenger hunt across blog posts, help articles and sales decks.

Common failure modes

Teams usually fail in three ways. They publish once and never revisit dates. They keep conflicting facts on the About page, a directory and a PDF one-pager. They measure vanity traffic instead of whether the answers that matter improved. A lightweight monthly review catches all three earlier than a panicked quarterly audit.

How this ties to pandawm.com work

Overseas ads, multilingual sites, GEO and crypto checkout for overseas merchants share the same underlying need: clear facts, consistent entities and pages that can be quoted without guesswork. The implementation details differ by channel; the editorial discipline does not.

A fuller attribution pattern for AI leads is in how to attribute AI search leads.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Unit-Testing an Hreflang Map Generated From a Spreadsheet

Peter Panda — Sat, 31 Oct 2026 21:02:54 +0000

Many multilingual sites still maintain language alternates in a spreadsheet. Generating hreflang tags or an XML sitemap from that sheet is fine — shipping without tests is not. Broken return links and missing x-default are silent until an audit.

Treat the sheet as a fixture

Export a frozen CSV into the repo. Columns: path, locale, canonical_host. Generation code reads only that file in tests so a live sheet edit cannot flake CI.

Assert reciprocity

For every URL A that points to B as zh-CN, B must point back to A as the correct locale. Write one test that builds the full map and checks both directions. Fail with the pair of URLs, not a boolean.

Assert x-default policy

Decide whether x-default is the English page, a chooser page or omitted. Encode that policy in a test so a future edit cannot drop it quietly.

Assert no duplicate locale per cluster

A cluster of alternates must not list en twice with different URLs. Deduplicate in the generator and assert in tests.

Smoke-test a rendered head snippet

For three sample paths, render the actual <link rel="alternate" ...> block and snapshot it. Snapshots catch accidental http vs https and trailing-slash drift.

Editorial hygiene

Keep a living glossary for product names, markets and fee terms so every writer uses the same spellings. Assistants are sensitive to entity drift; so are enterprise buyers comparing three vendors in one afternoon.

When you retire a URL, update internal links the same day and decide whether a redirect or a clean removal is clearer for both crawlers and people. Leaving soft-404 hubs in the navigation teaches everyone the wrong lessons.

Practical checklist

Common failure modes

How this ties to pandawm.com work

A fuller implementation checklist lives in hreflang implementation guide.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Designing Idempotent Webhook Handlers for Crypto Payment Providers

Peter Panda — Sat, 31 Oct 2026 21:02:09 +0000

Crypto payment providers retry webhooks. Your handler will see the same payment.confirmed event more than once, sometimes minutes apart, sometimes after a deploy. If fulfilment is not idempotent, you double-ship digital goods or double-credit wallets.

Use the provider event id as the dedupe key

Persist event_id (or the equivalent) in a unique-indexed table before you fulfil. If the insert conflicts, return 200 and stop. Do not fulfil first and log later.

Verify signatures before you parse business fields

Check the HMAC or signature header with the raw body. Reject invalid signatures with 401. Only then parse JSON and trust amounts, asset and order id.

Separate "received" from "fulfilled"

Mark the event received as soon as verification passes. Fulfil asynchronously if your stack allows it, but keep the dedupe table in the synchronous path so retries during fulfilment still no-op.

Map provider states to your ledger carefully

Pending, confirmed, underpaid, overpaid and refunded need explicit transitions. An underpaid invoice that later receives a top-up is not the same as a new order. Write the state machine down; do not improvise in the handler.

Replay a fixture pack in CI

Save a handful of real (sanitised) webhook payloads and replay them twice each in tests. Assert fulfilment side effects run once. This catches the obvious race better than a paragraph in the README.

Implementation notes

Roll changes out behind a staging URL first when the page touches checkout, tracking or hreflang. Capture before-and-after screenshots of the assistant answers you care about, using the same prompt set and the same day of week. Store them next to the content ticket so the next editor inherits evidence, not folklore.

If legal or compliance must sign off, put that gate in the ticket template. Skipping review on money, health or targeting claims is how "helpful" GEO copy becomes a takedown request.

Measurement

Pick five prompts that represent real buyer questions. Score mentioned / cited / recommended each month. Content work that never moves those scores should be redesigned, not repeated at higher volume.

Editorial hygiene

Reconciliation and refund flows that sit on top of these events are discussed in crypto payment refunds and reconciliation.

Published by PandaWM, an overseas marketing team based in Hong Kong.

A Robots.txt Matrix for AI Crawlers: Allow, Delay or Block by Bot

Peter Panda — Sat, 31 Oct 2026 21:01:24 +0000

Different AI crawlers honour robots.txt in different ways, and a single Disallow: / aimed at one vendor can accidentally silence another that your GEO programme cares about. A small matrix in version control beats tribal knowledge in Slack.

Inventory the bots you actually see

From two weeks of access logs, list user-agents that look like AI or training crawlers. Common ones change over time, so do not copy a blog post from last year blindly. Note path volume and status codes for each.

Decide per bot, not globally

For each bot, pick one policy: allow all public content, allow only /blog and docs, crawl-delay if supported, or block. Training crawlers and live-answer crawlers are different products; treating them the same is a business decision, not a default.

Keep a living robots.txt with comments

# Policy review: 2026-11-01
# GPTBot: allow public docs + blog only
User-agent: GPTBot
Allow: /blog/
Allow: /docs/
Disallow: /

Comments with a review date stop the file becoming archaeology.

Test after every CDN or WAF change

Rules at the edge can override origin robots.txt. After a Cloudflare or similar change, curl the live robots.txt and hit a sample of URLs with the relevant user-agent. Log the results next to the matrix.

Revisit quarterly

New bots appear. Old ones rebrand. Put a calendar reminder. The matrix is only useful if someone owns it.

Practical checklist

Common failure modes

Why Hong Kong-based export teams care

How crawler access ties into query fan-out and citation odds is covered in how query fan-out works in AI search.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Diffing AI Answer Snapshots Over Time With Python

Peter Panda — Fri, 30 Oct 2026 21:01:07 +0000

If you track how AI assistants describe your brand, you quickly collect a folder of saved answers: one text file per question per week. Reading them all is slow. A small diff script shows what changed, which is usually the only thing worth reviewing.

Folder layout

snapshots/
  2026-10-17/q01-best-agency-hk.txt
  2026-10-24/q01-best-agency-hk.txt
  2026-10-31/q01-best-agency-hk.txt

Each file holds the plain-text answer you saved for that question that week, collected manually or through whatever tool your team is allowed to use.

The script

import difflib, pathlib, re, sys

BRAND = re.compile(r"pandawm|熊猫出海", re.I)
root = pathlib.Path("snapshots")
weeks = sorted(p.name for p in root.iterdir() if p.is_dir())
prev, curr = weeks[-2], weeks[-1]

def norm(text):
    text = re.sub(r"\s+", " ", text)
    return [s.strip() for s in re.split(r"(?<=[.!?。！？])\s*", text) if s.strip()]

for f in sorted((root / curr).glob("*.txt")):
    old_f = root / prev / f.name
    old = norm(old_f.read_text(encoding="utf-8")) if old_f.exists() else []
    new = norm(f.read_text(encoding="utf-8"))
    was, now = any(BRAND.search(s) for s in old), any(BRAND.search(s) for s in new)
    changed = [l for l in difflib.unified_diff(old, new, lineterm="", n=0)
               if l[:1] in "+-" and not l.startswith(("+++", "---"))]
    flag = "GAINED" if now and not was else "LOST" if was and not now else ""
    print(f"\n## {f.stem}  {flag}  ({len(changed)} changed sentences)")
    for l in changed[:12]:
        print(l)

Splitting into sentences before diffing matters. Assistants rephrase constantly, and a character-level diff would mark everything as changed.

Reading the output

GAINED / LOST flags are the headline. Review those first.
A high number of changed sentences with no brand change usually means the assistant restructured its answer, not that anything meaningful happened.
Check whether new sentences introduce a competitor, a wrong fact or a new source.

Limits

Answers vary from run to run even on the same day. Treat one week's change as a hint, and look for patterns across several weeks before acting. Save the date, the tool and the exact prompt with every snapshot so comparisons stay fair.

Connecting it to results

Visibility only matters if it turns into visits and leads. Pair this with referrer tracking and CRM fields so you can see whether a gained mention coincides with more AI-referred traffic; this attributing AI search leads with UTM and CRM walks through that setup.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Generating Localised Price Tables From One JSON Source

Peter Panda — Fri, 30 Oct 2026 21:00:22 +0000

A pricing page that exists in six languages usually ends up with six slightly different price tables. Someone updates the English plan limits, forgets the Japanese page, and now an AI assistant or a customer quotes the wrong number. The fix is to treat prices as data and render every language version from one source.

One source of truth

{
  "currency_by_locale": {"en": "USD", "de": "EUR", "ja": "JPY", "pt-BR": "BRL"},
  "plans": [
    {"id": "starter", "price": {"USD": 29, "EUR": 27, "JPY": 4300, "BRL": 149},
     "seats": 3, "features": ["chat", "reports"]},
    {"id": "growth", "price": {"USD": 99, "EUR": 92, "JPY": 14800, "BRL": 499},
     "seats": 10, "features": ["chat", "reports", "api"]}
  ],
  "updated": "2026-10-31"
}

Prices per currency are set explicitly rather than converted on the fly. Rounded local prices look intentional, and you avoid tables that change every time an exchange rate moves.

Rendering with Intl

import data from "./pricing.json" assert { type: "json" };
import t from "./i18n.json" assert { type: "json" };

export function renderTable(locale) {
  const cur = data.currency_by_locale[locale];
  const fmt = new Intl.NumberFormat(locale, { style: "currency", currency: cur,
    maximumFractionDigits: cur === "JPY" ? 0 : 2 });
  const rows = data.plans.map(p => `
    <tr><th>${t[locale].plans[p.id]}</th>
      <td>${fmt.format(p.price[cur])} / ${t[locale].month}</td>
      <td>${p.seats} ${t[locale].seats}</td>
      <td>${p.features.map(f => t[locale].features[f]).join(", ")}</td></tr>`);
  return `<table>${rows.join("")}</table>
    <p>${t[locale].updated}: ${new Date(data.updated).toLocaleDateString(locale)}</p>`;
}

Intl.NumberFormat handles symbol position, separators and spacing, which differ more than people expect: €27,00 in some locales, 27,00 € in German, R$ 149,00 in Brazil.

Fail the build on missing data

Add a test that loops over every locale and plan and fails if a price or translation key is missing. It is the cheapest way to stop a half-updated table from shipping.

for (const loc of Object.keys(data.currency_by_locale))
  for (const p of data.plans) {
    if (p.price[data.currency_by_locale[loc]] == null) throw new Error(`${loc}:${p.id}`);
    if (!t[loc]?.plans?.[p.id]) throw new Error(`missing label ${loc}:${p.id}`);
  }

Why it matters beyond tidiness

Consistent, dated prices across language versions make your pricing page safer to quote. Search engines and AI assistants that read several versions of the page see the same facts, and buyers comparing currencies see a deliberate policy rather than a mistake.

Translation tooling is the other half of this workflow; this multilingual website translation tools comparison covers how teams split work between machine translation, plugins and human review.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Polling vs Webhooks for Crypto Payment Status: A Minimal Node.js Example

Peter Panda — Fri, 30 Oct 2026 20:59:36 +0000

When you add crypto checkout to a store or SaaS app, the gateway confirms payments asynchronously. Blockchain confirmations take time, so your backend learns about a completed payment later, either because the gateway calls you (webhook) or because you ask (polling). Most production setups use both. Here is why, with a minimal Express example.

Webhooks: fast but not guaranteed

A webhook arrives seconds after the gateway sees the payment reach the required confirmations. It is the fastest way to mark an order paid. But webhooks can be delayed, retried, delivered out of order or blocked by your firewall during a deploy. If your only signal is the webhook, a missed delivery means a paid customer with an unpaid order.

Polling: slow but reliable

A scheduled job that asks the gateway for the status of every pending invoice catches anything the webhook missed. It is slower and costs API calls, so it should be a safety net, not the main path.

A minimal combined design

import express from "express";
import crypto from "node:crypto";

const app = express();
app.use(express.raw({ type: "application/json" }));
const SECRET = process.env.GATEWAY_WEBHOOK_SECRET;

function verify(req) {
  const sig = req.get("X-Signature") || "";
  const mac = crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
  return sig.length === mac.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(mac));
}

app.post("/webhooks/crypto", async (req, res) => {
  if (!verify(req)) return res.status(401).end();
  const evt = JSON.parse(req.body);
  await markPaidIfConfirmed(evt.invoice_id, "webhook");
  res.status(200).end(); // acknowledge quickly
});

async function pollPending() {
  const pending = await db.invoices.findPending({ olderThanMinutes: 5 });
  for (const inv of pending) {
    const status = await gateway.getInvoice(inv.id);
    if (status.state === "confirmed") await markPaidIfConfirmed(inv.id, "poll");
    if (status.state === "expired") await db.invoices.expire(inv.id);
  }
}
setInterval(pollPending, 2 * 60 * 1000);

async function markPaidIfConfirmed(id, source) {
  // idempotent: only the first caller changes state
  const updated = await db.invoices.updateWhere(
    { id, state: "pending" }, { state: "paid", paid_via: source });
  if (updated) await fulfil(id);
}

The details that matter

Idempotency. Both paths call the same function, and the conditional update ensures fulfilment happens once.
Verify signatures on webhooks and re-fetch the invoice from the API before fulfilling high-value orders.
Respond fast. Acknowledge the webhook, then do slow work in a queue.
Poll only what is pending, with a back-off for invoices older than an hour.
Log the source (webhook or poll). If many payments are confirmed by polling, your webhook endpoint has a problem.

Gateways that offer an API, plugins and an SDK usually document both mechanisms; read the retry policy before you go live. For a broader look at choosing and integrating a gateway as an overseas merchant, see this crypto payment gateway guide.

Published by PandaWM, an overseas marketing team based in Hong Kong.

Checking hreflang Return Links Automatically With a Small Python Crawler

Peter Panda — Fri, 30 Oct 2026 20:58:51 +0000

The most common hreflang bug is not a typo in a language code. It is a missing return link: page A says "my German version is B", but page B never points back to A. Search engines may then ignore the pair. On a site with a few hundred localised pages this is tedious to check by hand, so here is a small script that does it.

What we check

For every page in a list of URLs:

Fetch the HTML and read all <link rel="alternate" hreflang="..."> tags.
For each alternate, fetch that URL and confirm it lists the original page back.
Confirm each page includes a self-referencing hreflang entry.
Flag alternates that return a non-200 status or redirect.

The script

import requests, re
from collections import defaultdict
from html.parser import HTMLParser

class Alt(HTMLParser):
    def __init__(self):
        super().__init__(); self.alts = {}
    def handle_starttag(self, tag, attrs):
        a = dict(attrs)
        if tag == "link" and a.get("rel") == "alternate" and "hreflang" in a:
            self.alts[a["hreflang"].lower()] = a.get("href", "").strip()

cache = {}
def alternates(url):
    if url in cache: return cache[url]
    r = requests.get(url, timeout=20, allow_redirects=False,
                     headers={"User-Agent": "hreflang-check/1.0"})
    p = Alt()
    if r.status_code == 200: p.feed(r.text)
    cache[url] = (r.status_code, p.alts)
    return cache[url]

def check(urls):
    problems = defaultdict(list)
    for u in urls:
        status, alts = alternates(u)
        if status != 200:
            problems[u].append(f"status {status}"); continue
        if u not in alts.values():
            problems[u].append("no self-reference")
        for lang, target in alts.items():
            if target == u: continue
            t_status, t_alts = alternates(target)
            if t_status != 200:
                problems[u].append(f"{lang} -> {target} returns {t_status}")
            elif u not in t_alts.values():
                problems[u].append(f"{lang} -> {target} has no return link")
    return problems

if __name__ == "__main__":
    urls = [l.strip() for l in open("urls.txt") if l.strip()]
    for page, issues in check(urls).items():
        for i in issues: print(page, "|", i)

Put one URL per line in urls.txt, ideally the canonical URLs from your sitemap, and run it.

Notes from using it

Trailing slashes matter. https://example.com/de/ and https://example.com/de are different strings. Normalise in your CMS rather than in the checker, so the check reflects what crawlers see.
Don't follow redirects silently. An alternate that 301s is a real problem worth flagging, which is why allow_redirects=False is set.
x-default should exist once per cluster and point to a sensible fallback, usually a language selector or the main market page.
Rate limit if you run this against production: a short time.sleep between requests is polite.

Extending it

The same parser can compare canonical tags with hreflang targets (they should agree), or export a CSV for your content team. For a broader overview of hreflang setup, including URL structure and sitemaps, see this hreflang guide for multilingual websites.

Published by PandaWM, an overseas marketing team based in Hong Kong.