Behind the page

What actually happens before a web page reaches you

A page feels like a document sitting on a shelf, waiting to be picked up. Almost none of them are. Most are built to order, in the moment you ask for them, by a machine you will never see.

Open a site and something arrives almost immediately. The speed makes it feel like a file was simply handed over, the way a book is handed across a counter. Occasionally that is true. Far more often the page did not exist a second earlier. Your request travelled to a machine, that machine worked out who you might be, gathered the pieces it needed, arranged them into a finished page, and sent the result back. Then it forgot the whole episode and moved on to the next visitor. The page you are reading is the residue of a short burst of work that has already ended.

This is the split that gives our name its joke, and we will only make it once: a child element sits inside a parent, and the work described here sits inside the work you can see. Everything on this site concerns the inside half. Not the marks that describe a document, not the rules that colour it, not the behaviour that runs once it has landed in front of you. Our subject is the interval before any of that: what a machine does with your request while you are still waiting.

The Two Halves

Before it is sent, and after it arrives

The single most useful line to draw when you are learning is the one between work done at the source and work done at the destination.

Why the boundary decides speed, privacy and trust

Moving a task across the line changes more than where it runs.

Nothing that arrives from a visitor can be believed

The oldest rule in this half of the web, and the one that explains most of the rest.

A Request And Its Life

The short life of a single request

From arrival to reply is a small, complete story that repeats endlessly.

Doing the work again, or doing it once and remembering

The central economy of this half of the web is deciding what deserves to be recalculated.

Cheap for one visitor, expensive for a thousand

Cost does not scale the way intuition suggests, and the surprise usually arrives at the worst moment.

Remembering Who You Are

The web forgets on purpose, and that is a feature

Statelessness sounds like a defect until you consider the alternative.

How a site recognises a visitor it has met before

Recognition works by handing out a token and asking for it back.

What a session actually is, and why signing in is hard

A session is a small record with a lifespan, and the difficulty lies at its edges.

When Things Go Wrong

Unchecked input is where the serious failures begin

Most severe problems trace back to a value that was accepted without ever being questioned.

Secrets that end up somewhere readable

The usual failure is not a broken lock but a key left where anyone could pick it up.

Error messages, and the virtue of failing safely

What a system says when it breaks, and what it does, are two separate design decisions.

About PHP Child

This publication covers one narrow subject: the work a machine does after it receives a request and before it sends a reply. That interval is invisible by design, which makes it easy to overlook and disproportionately important to understand. Sister publications deal with the marks that describe a document, the rules that style it, the stores that hold information, the networks that carry it and the logic of instructions themselves. Those are separate crafts with their own literature. Here the scope is deliberately kept to what happens out of sight, on the side of the boundary the visitor cannot inspect, in the moments before anything appears on a screen.

The intended reader is an adult beginner: someone comfortable using the web who has never had cause to think about how a page is assembled, and who would like a clear mental picture before meeting any specifics. Nothing here assumes prior study. Nothing here contains instructions to follow, because the aim is understanding rather than execution. Particular tools change frequently and everything described here has outlasted several generations of them. The concepts are the durable part, and they transfer intact to whatever a reader eventually chooses to work with.

The house style is plain Australian English, patient rather than brisk, and free of the shorthand that makes technical writing feel exclusive. Security appears throughout, but only as the reason a defensive habit exists. Nothing here describes how to compromise anything, because explaining why a lock is fitted is genuinely useful while explaining how to defeat one is not. Where a judgement is genuinely contested, that is said plainly rather than resolved by assertion. The aim is a reader who can picture the hidden machine well enough to ask better questions about it.