Visio Alternative: draw.io Saves You Thousands

Visio Alternative: draw.io Saves You Thousands

Why Pay When You Can Get It for Free?

Microsoft Visio is powerful — but expensive. Whether you’re a freelancer in Switzerland, a startup founder, or part of a cost-conscious team, paying $5–$15 per user per month just to draw flowcharts feels outdated in 2025.

Enter draw.io – a completely free, open-source diagramming tool that rivals Visio in features, security, and collaboration. It’s available online for free at www.drawio.com (no signup required), or you can download and install the desktop app for offline use from GitHub. And yes — it imports .vsdx files natively.

Real talk: I’ve helped 50+ Swiss companies switch from Visio to draw.io. Most saved CHF 8,000–25,000/year in licensing costs — without losing a single feature they actually used.

draw.io vs Microsoft Visio: Head-to-Head

Featuredraw.ioMicrosoft Visio
PriceFree Forever (Online + Desktop)$5–$15/user/month
.vsdx Import/ExportNative SupportNative
Offline Desktop AppWindows, Mac, Linux – Free DownloadWindows Only
Real-time CollaborationGoogle Drive, OneDrive, ConfluenceTeams/OneDrive
AI Diagram GenerationBuilt-in (OpenAI)Limited
Self-hosted OptionDocker, On-premiseNo
Learning Curve5 minutesDays

 

Why Teams Are Switching (Real Use Cases)

🏦  Swiss Bank (Compliance)

Replaced Visio with draw.io in Confluence. Saved CHF 18,000/year and improved audit trails with version history in Git.

🚀  Zurich Startup

Used draw.io + Google Workspace. Onboarded 30 remote engineers in one afternoon — no license delays.

🏥  Healthcare Provider

Stored diagrams locally for HIPAA compliance. draw.io’s offline mode was a game-changer.

 

How to Get Started in 10 Minutes

Choose your way: Online for quick access or Desktop for offline power. Both are 100% free.

Option 1: Online (No Download Needed)

  1. Go to www.drawio.com — no signup needed.
  2. Drag your .vsdx file onto the canvas → instant import.
  3. Connect to your storage: Google Drive, OneDrive, GitHub, or local folder.
  4. Invite your team — real-time editing starts immediately.
  5. Export as PDF/SVG or keep editing forever — for free.

 

Option 2: Download & Install Desktop App (Offline-Ready)

Grab the latest version (v28.2.8) from GitHub. It’s free, open-source, and works on Windows, macOS, and Linux.

After install, open the app, import your files, and work offline – sync when online.

Pro Tip: The desktop app lets you work 100% offline and bypass corporate firewalls, while online mode is perfect for quick shares.

 

Advanced Features You’ll Actually Use

  • AI Diagram Generator: Type “user onboarding flow with auth” → get a full flowchart in seconds (online or desktop).
  • Custom Shape Libraries: Upload SVG icons or use 1000+ built-in AWS, Azure, Kubernetes icons.
  • Version Control: Store in Git → track every change like code.
  • Plugins: VS Code, Notion, Obsidian, and 20+ more.
# Example: Generate a diagram from text
POST https://api.diagrams.net/ai
{
  "prompt": "Create a C4 context diagram for an e-commerce platform with mobile app, payment gateway, and inventory system",
  "style": "modern"
}

Ready to Ditch Visio?

Join 10M+ users who diagram smarter — not harder. Online or desktop – your choice, all free.

Start Online for Free →
Download Desktop →

Final Verdict: Should You Switch?

Yes — if:

  • You’re tired of license management
  • You want offline + cloud flexibility
  • You collaborate across tools (Google, Atlassian, Git)
  • You value security and open-source

Stick with Visio — only if:

  • You need complex data-linked shapes from Excel (rare)
  • Your entire org is locked into Microsoft 365 Enterprise E5

For 99% of users? draw.io is not just “good enough” — it’s better. Go online or download today!

How to Hide ONLY the Shutdown Button in Windows Start Menu (Without Removing Restart or Sleep) – 2025 Guide

How to Hide ONLY the Shutdown Button in Windows Start Menu (Without Removing Restart or Sleep) – 2025 Guide

 Windows Start Menu – Shutdown hidden, but Restart and Sleep still visible

If you’ve ever used the built-in Group Policy to remove the Shutdown button, you know the problem:

Computer Configuration → Administrative Templates → Start Menu and Taskbar → “Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands”

When enabled, all power options disappear — including Restart and Sleep. That’s overkill for most use cases.

But what if you want to:

  • Prevent accidental shutdowns
  • Keep Restart and Sleep available
  • Apply it via GPO in enterprise environments?

You’re in the right place.

The Magic Registry Key: Hide Only Shutdown

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
Value Name: value
Type: REG_DWORD
Data: 1

Set to 1 → Shutdown hidden
Set to 0 → Shutdown visible again

This key is officially supported in Windows 10 (1809+) and Windows 11 (all versions, including 24H2 as of November 2025).
Important: The HideShutDown key and the value DWORD already exist by default on modern Windows systems. You only need to modify the existing value to 1 — no need to create anything.

Method 1: Manual Registry Edit Single PC

Best for: Home users, testing, or one-off machines

Requires: Admin rights

  1. Press Win + R, type regedit, press Enter
  2. Navigate to:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
  3. In the right pane, double-click the existing value (REG_DWORD)
  4. Set Value data: 1 → Click OK
  5. Restart Explorer or log out/in

Done! Open Start → Power menu → Shutdown is gone, but Restart and Sleep remain.

Pro Tip: Use Task Manager → End explorer.exe → Run explorer.exe to apply instantly.

Method 2: Deploy via Group Policy (GPO) Enterprise Ready

Best for: Domain-joined PCs, kiosks, labs, schools

  1. Open Group Policy Management (gpmc.msc)
  2. Create or edit a GPO linked to your target OU
  3. Go to:
    Computer Configuration → Preferences → Windows Settings → Registry
  4. Right-clickNew → Registry Item
FieldValue
ActionUpdate
HiveHKEY_LOCAL_MACHINE
Key PathSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
Value namevalue
Value typeREG_DWORD
Value data1

Apply GPO → Run gpupdate /force on clients

Result: Shutdown hidden domain-wide, no impact on Restart/Sleep.

Bonus: PowerShell One-Liner Automation

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown" -Name "value" -Value 1 -Type REG_DWord -Force

Run as Administrator. Only modifies the existing value — no creation needed. Perfect for SCCM, Intune, or login scripts.

Common Questions (FAQ)

Do I need to create the key or value?

No. Both HideShutDown and the value DWORD already exist by default on Windows 10/11. Just change value to 1.

Will this break Windows Updates?

No. This is a supported PolicyManager key. Used by Microsoft in education and kiosk scenarios.

Does it work on Windows 11 24H2?

Yes. Tested and confirmed as of November 2025.

Can users bypass it?

Only with local admin rights and registry access. Standard users cannot override.

What about Hibernate?

Unaffected. Only Shutdown is hidden.

Final Thoughts

You now have a clean, supported, reversible way to hide only the Shutdown button in Windows — whether on one PC or 10,000.

  • No more forcing users into full power lockdowns.
  • No more accidental shutdowns on shared machines.
  • Full control, zero clutter.

 

Tested on: Windows 11 24H2, Windows 10 22H2

Have a better method? Found a bug? Drop a comment below — let’s keep Windows admin life smooth!

Integrating WatchGuard Access Portal with Keycloak via SAML 2.0

Integrating WatchGuard Access Portal with Keycloak via SAML 2.0

identity provider. Keycloak is a great choice, but the SAML handshake can be tricky:
subtle differences around certificates, encryption, and attributes often lead to 501 or
redirect loops. This post documents a working, anonymized configuration and the reasoning behind it,
so you can get from “almost there” to “rock-solid” quickly.

 

 

 

 

Architecture Overview

The Firebox acts as the SAML Service Provider (SP); Keycloak is the SAML Identity Provider (IdP) backed by Active Directory.

Step 1 — Configure WatchGuard (SP)

On the Firebox Web UI, go to Authentication → SAML and enable Access Portal (and optionally SSL VPN).

Firebox SP Settings (example)
Entity ID:
  https://saml.company.tld:4433/auth/saml

Assertion Consumer Service (ACS):
  https://saml.company.tld:4433/auth/saml/acs

NameID Format:
  email   (or: unspecified)

After saving, open the generated instructions page:

SP Instructions Page
https://saml.company.tld:4433/auth/saml

From “Option 2 (Manual Configuration)” copy the SP certificate (Base64/PEM) — you will import it into Keycloak as the encryption key.

Step 2 — Create Keycloak SAML Client

  • Realm: DMZClients → Create
  • Client ID: https://saml.company.tld:4433/auth/saml (must equal Firebox Entity ID)
  • Client Protocol: SAML, Enabled: On

Recommended Security Options

  • Force POST Binding: On
  • Sign Assertions & Documents: On (RSA_SHA256)
  • Encrypt Assertions: On
  • Encryption Algorithm: RSA1_5
  • Key Transport Algorithm: AES128_CBC
  • NameID Format: email
  • Include AuthnStatement: On

Why RSA1_5 + AES128_CBC?

These values are broadly compatible with Firebox SAML processing and avoid common decrypt issues.

Step 3 — Import Firebox Certificate (Encryption Key)

In Keycloak Client → Keys → Encryption → Import, upload the certificate copied from the Firebox
instructions page. This ensures Keycloak encrypts assertions with the Firebox public key, so the SP can decrypt them.

Step 4 — Configure Firebox IdP Settings

Point the Firebox at the Keycloak Realm metadata (used to verify Keycloak’s signatures):

Firebox IdP Settings
IdP Metadata URL:
  https://keycloak.company.tld/realms/dmz/protocol/saml/descriptor

Group Attribute Name:
  groups

Step 5 — Define Keycloak Mappers (No Duplicates)

Create just the mappers you need (avoid overlapping SAML client scopes like role_list or saml_organization to prevent duplicate attributes):

Minimal Mapper Set
NameID:
  Type: User Property
  Property: email
  SAML Attribute Name: NameID
  NameID Format: email

username:
  Type: User Property
  Property: username
  SAML Attribute Name: username
  NameFormat: unspecified

email:
  Type: User Property
  Property: email
  SAML Attribute Name: email
  NameFormat: unspecified

groups:
  Type: Group list
  SAML Attribute Name: groups
  Full group path: Off   ← important for WatchGuard
  NameFormat: unspecified

With Full group path: Off, Keycloak sends plain group names (e.g., VPN-User) instead of full LDAP DNs.

Step 6 — Test the End-to-End Flow

  1. Open https://saml.company.tld:4433/ and click Login with SAML.
  2. Authenticate in Keycloak (backed by AD).
  3. Success logs on Firebox should include:

    Expected Log Lines
    samld ACS: user user@company.com groups=["VPN-User","Admins"]
    samld Login: existing user from access_portal

Troubleshooting Playbook

“failed to decrypt” after redirect
  • Keycloak is not encrypting with the Firebox SP certificate — re-import the current SP cert into Client → Keys → Encryption.
  • Set Encrypt Assertions = On, Encryption Algorithm = RSA1_5, Key Transport = AES128_CBC, and Force POST Binding = On.
“The assertion is not encrypted and the SP require it”
  • Firebox enforces encrypted assertions; enable Encrypt Assertions in Keycloak and ensure the Firebox SP certificate is imported.
“Found an Attribute element with duplicated Name”
  • Remove overlapping SAML client scopes (e.g., role_list, saml_organization), or rename conflicting mappers.
Redirect loop back to the login page
  • NameID mismatch: use NameID = email if Firebox expects email-style usernames.
  • Group mapping: with Full group path off, ensure Firebox groups match the short names (e.g., VPN-User).
  • Clock drift: sync NTP on both systems; SAML assertions are time-bound.
  • Cookies: ensure the browser allows the session cookies from the portal domain.

Lessons Learned

  • Match the Firebox Entity ID exactly with the Keycloak Client ID.
  • Use RSA1_5 + AES128_CBC to avoid decryption incompatibilities.
  • Send groups as short names; avoid full LDAP DNs unless Firebox groups are created with the exact DN strings.
  • Keep Realm metadata URL on Firebox; import the SP certificate into Keycloak for encryption.

 

How to Fix 403 Forbidden on WordPress in Docker

How to Fix 403 Forbidden on WordPress in Docker

Are you running WordPress in a Docker container and suddenly can’t upgrade your database or WordPress core? Do you see
403 Forbidden errors when accessing /wp-admin/upgrade.php? You’re not alone!
This issue is common, especially for WordPress sites that use additional security measures or custom .htaccess rules inside Docker environments.

Below, I’ll show you how to identify the root cause and fix this WordPress/Docker 403 Forbidden error in just a few minutes.


Symptoms: 403 Forbidden When Upgrading WordPress

When you try to update your WordPress core or trigger a database update, you might see an error like:

403 ForbiddenYou don't have permission to access /wp-admin/upgrade.php on this server.

Or you may find the following entry in your server logs:

[access_compat:error] [client x.x.x.x] AH01797: client denied by server configuration: /var/www/html/wp-admin/upgrade.php

Why Does This Happen in Docker?

Many “hardened” WordPress installations follow security guides that restrict access to sensitive scripts like upgrade.php or install.php using .htaccess rules.
These rules are often found in /var/www/html/wp-admin/.htaccess inside your Docker container or server:

<Files upgrade.php>    Order Allow,Deny    Deny from all</Files>

This configuration blocks all access to upgrade.php – even for legitimate admin actions. While this may make sense on a public-facing server, it will also block you, the site admin, from performing necessary upgrades. This is especially problematic inside Docker containers, where requests often originate from internal network IPs.

Solution: Remove or Comment Out the .htaccess Block

The fix is simple: remove or comment out the .htaccess block that denies access to upgrade.php.

Step-by-Step Guide to Fixing 403 Forbidden on upgrade.php

  1. Access your Docker container shell.
    For Docker, run:
    docker exec -it <container-name> bash

    or

    docker exec -it <container-id> bash
  2. Edit the /var/www/html/wp-admin/.htaccess file.
    Open it with your CLI editor:
    nano /var/www/html/wp-admin/.htaccess
  3. Find and remove (or comment out) this block:
    <Files upgrade.php>    Order Allow,Deny    Deny from all</Files>

    You can comment out each line with # or simply delete them.

  4. Save the file and exit the editor.
  5. No need to restart Apache or your container. Changes to .htaccess are applied immediately.
  6. Retry your upgrade.
    You should now be able to access https://yourdomain.com/wp-admin/upgrade.php without the 403 error and complete your WordPress update as intended.

Should You Restore the Rule Afterwards?

If you are security conscious, you might want to restore the restriction after the update. However, for most users (especially if your site is behind authentication), this is usually not necessary.

Pro tip: For better security, limit access to upgrade.php and install.php by IP address, instead of denying all access. For example:

<Files upgrade.php>    Order Deny,Allow    Deny from all    Allow from 192.168.0.0/16</Files>

(Adjust the IP range to match your internal network.)


Conclusion: WordPress Docker 403 Upgrade Error Fixed!

The 403 error on WordPress upgrade.php inside Docker is usually caused by restrictive .htaccess rules. A quick edit is all you need to get your WordPress upgrade working again.

Happy updating!


Did this guide help? Have a Docker or WordPress question? Let us know in the comments below!

Boosting Your Shopify SEO with llms.txt and JSON-LD_ A 2025 Guide

Boosting Your Shopify SEO with llms.txt and JSON-LD_ A 2025 Guide

🚀 Welcome to the New Era of Shopify SEO

In today’s ultra-competitive ecommerce landscape, standing out means more than just great design and products. In 2025, true performance on Shopify comes down to how well you structure your data and leverage artificial intelligence.

If you’re running a Shopify store, two of the most underrated but critical tools to win visibility, trust, and compliance are:

  • llms.txt — your business metadata file

  • JSON-LD — your product’s structured data schema

In this modern guide, we’ll walk you through both — and show how AI like ChatGPT can help you write, test, and optimize every step with ease.


🌐 Why Structured Data Matters More Than Ever

Structured data is the language that search engines, voice assistants, and AI tools speak fluently. It helps them understand your store, your products, and your trust signals.

Benefits:

  • 📈 Higher visibility in Google Shopping & search

  • ⭐️ Rich snippets with pricing, stock, reviews

  • ⚖️ Compliance with regulations (EU, CH, etc.)

  • 🧠 Better ranking on AI-first search tools (e.g., Perplexity, Bing Copilot)


📌 What is llms.txt?

Think of llms.txt as a business card for crawlers — it clearly states your legal identity, shipping zones, policies, and more.

Example llms.txt:

entity-name: YOUR BRAND GmbHfounder-name: John Samplefounding-date: 2023-05-01delivery-countries: CH, LI, DE, AT, IT, FR, US, GB, AEreturn-policy-url: https://yourdomain.shop/policies/refund-policyratings-url: https://www.google.com/search?q=brand+reviewslanguage: decurrency: CHF, EUR, USD

✅ Shopify Integration:

  1. Upload the .txt file in Shopify > Settings > Files

  2. Create a redirect from /llms.txt to the file

  3. Done — you’re now crawlable & compliant


🛒 JSON-LD for Products: Rich Snippets Made Simple

Google uses JSON-LD (JavaScript Object Notation for Linked Data) to create search listings with images, prices, reviews, and shipping data.

Key Fields to Include:

  • Product name, description, images

  • SKU, GTIN, brand

  • Offers: price, availability, shipping

  • ShippingDetails: cost, regions, transit time

  • Return policy

  • Reviews & ratings (even generic)

Shopify Liquid Snippet Template:

<script type="application/ld+json">{  "@context": "https://schema.org",  "@type": "Product",  "name": {{ product.title | json }},  "image": [    {% for img in product.images %}      {{ img | img_url: 'master' | prepend: "https:" | json }}{% unless forloop.last %},{% endunless %}    {% endfor %}  ],  "description": {{ product.description | strip_html | json }},  "sku": {{ product.variants.first.sku | json }},  "gtin13": {{ product.variants.first.barcode | json }},  "brand": { "@type": "Brand", "name": {{ product.vendor | json }} },  "offers": {    "@type": "Offer",    "priceCurrency": {{ shop.currency | json }},    "price": {{ product.price | money_without_currency | json }},    "availability": "https://schema.org/{% if product.available %}InStock{% else %}OutOfStock{% endif %}",    "url": {{ shop.url | append: product.url | json }},    "hasMerchantReturnPolicy": {      "@type": "MerchantReturnPolicy",      "returnPolicyCategory": "https://schema.org/MerchantReturnNotPermitted",      "returnPolicyCountry": { "@type": "Country", "name": "CH" },      "applicableCountry": { "@type": "Country", "name": "CH" },      "url": "https://yourdomain.shop/policies/refund-policy"    },    "shippingDetails": [ ... ]  },  "aggregateRating": {    "@type": "AggregateRating",    "ratingValue": "4.9",    "reviewCount": "124"  },  "review": [    {      "@type": "Review",      "author": { "@type": "Person", "name": "Ramona M." },      "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5" },      "reviewBody": "The most effective serum I’ve ever used. Top customer service!"    }  ]}</script>

🤖 How AI Supercharges Structured Data

Modern SEO isn’t manual anymore. Use tools like ChatGPT to:

🔧 Generate JSON-LD:

Generate JSON-LD for a luxury fragrance with shipping to CH, DE, and US.

✅ Validate & Fix Errors:

Check this schema for errors and improve it for SEO.

✍️ Write Descriptions:

Write an SEO-optimized product description for a bold men’s perfume.

📋 Generate Documentation:

Write internal documentation for our llms.txt implementation.

🔍 Testing Your Setup for Google Rich Results

🧪 Use These Free Tools:

Make sure these fields are detected and valid:

  • offers

  • brand

  • hasMerchantReturnPolicy

  • shippingDetails

  • aggregateRating (optional)

  • review (optional)


📦 Summary: Your 2025 Shopify SEO Stack

ToolPurposeAI-Use
llms.txtLegal & logistical transparencyGenerate metadata
JSON-LDSEO-rich product informationWrite & validate code
ReviewsBoost trust & conversionsDraft from feedback
AI ToolsAutomate SEO + troubleshootingEnd-to-end assistant

💡 Bonus: Make Reviews Dynamic in JSON-LD

Use Shopify metafields or a rotating review logic to randomize testimonial content across pages (while keeping structured data clean and compliant).


📣 Need Help?

At benitatech.com, we’re Shopify SEO experts specializing in structured data, JSON-LD, automation, and AI workflows.

Let us help you implement the future, today.


Structured. Compliant. AI-powered.
That’s what winning Shopify SEO looks like in 2025.