The Checklist
Every spec item as a checkable list, grouped by category. 35 required, 53 recommended, 20 optional.
Foundations
- Required The HTML doctype
- Required The lang attribute on <html>
- Required <meta charset>
- Required <meta viewport>
- Required The <title> element
- Recommended <meta name=\"description\">
- Recommended Canonical URL (rel=\"canonical\")
- Recommended Favicons and app icons
- Recommended <meta name=\"theme-color\">
- Recommended <meta name=\"color-scheme\">
- Recommended Open Graph protocol
- Recommended Feed discovery with rel=\"alternate\"
- Recommended Feed content hygiene
SEO
- Recommended robots.txt
- Recommended XML sitemaps
- Recommended Sitemap index files
- Optional Image and video sitemap extensions
- Recommended URL structure
- Required Redirects (301/302/308)
- Avoid Soft 404s
- Required Meta robots and X-Robots-Tag
- Required Heading hierarchy
- Recommended Internal linking
- Recommended Structured data (JSON-LD)
- Recommended Breadcrumbs
- Optional IndexNow
Accessibility
- Required Colour contrast
- Required Image alt text
- Required Form labels
- Required Keyboard navigation
- Required Visible focus indicators
- Recommended Skip links
- Required Semantic HTML and landmarks
- Recommended ARIA — first rule of ARIA
- Required Descriptive link text
- Avoid Empty links and buttons
- Required Accessible form errors
- Required Document and parts language
- Required Reduced motion
- Avoid Accessibility overlays
- Required Captions and transcripts
- Required Accessible data tables
- Required Touch target size
Security
- Required HTTPS and TLS
- Required HSTS (Strict-Transport-Security)
- Recommended Content Security Policy (CSP)
- Recommended /.well-known/security.txt
- Required X-Content-Type-Options: nosniff
- Required Clickjacking protection (frame-ancestors / X-Frame-Options)
- Recommended Referrer-Policy
- Recommended Permissions-Policy
- Recommended Subresource Integrity (SRI)
- Required Cookie attributes — Secure, HttpOnly, SameSite
- Recommended DNS CAA records
- Optional DNSSEC
Well-Known URIs
- Recommended Well-known URIs
- Optional /.well-known/change-password
- Optional /.well-known/openid-configuration
- Recommended /.well-known/api-catalog
- Optional /.well-known/webfinger
- Optional /.well-known/apple-app-site-association
- Optional /.well-known/assetlinks.json
- Optional /.well-known/nodeinfo
Agent Readiness
- Recommended Agent readiness
- Recommended /llms.txt
- Optional /llms-full.txt
- Recommended Per-page Markdown source endpoints
- Recommended robots.txt for AI crawlers
- Optional Content Signals in robots.txt
- Optional Web Bot Auth — verifiable bot identity
- Required Stable URLs
- Recommended Structured data for agents
- Recommended Machine-readable formats
- Recommended HTTP Link headers for discovery
- Optional MCP and tool discovery
- Optional A2A agent cards
- Recommended Agent Skills discovery
- Optional DNS for AI Discovery (DNS-AID)
- Optional NLWeb — conversational interface discovery
- Optional WebMCP — browser-native tools for agents
- Optional Schemamap — discoverable JSON-LD endpoints per resource
Performance
- Required Core Web Vitals (LCP, INP, CLS)
- Required Image optimisation
- Recommended Lazy loading images, iframes, and video
- Recommended Preload, prefetch, preconnect
- Required Cache-Control headers
- Recommended No-Vary-Search response header
- Required Compression (gzip, brotli, zstd)
- Recommended Web font loading
- Recommended Critical CSS and render-blocking resources
- Recommended Script loading — defer, async, module
- Recommended HTTP/2 and HTTP/3
- Recommended Speculation Rules
- Recommended Resource hints overview
- Recommended View Transitions
Privacy
- Required Privacy policy
- Required Cookie consent
- Recommended Global Privacy Control (GPC)
- Recommended Third-party scripts and privacy
- Recommended Privacy-respecting analytics
- Recommended Data minimisation
Resilience
- Required Custom error pages (404, 500)
- Recommended Maintenance pages and 503
- Optional Offline support and service workers
- Recommended Web app manifest
- Recommended Monitoring and uptime
Internationalisation
- Recommended hreflang for language and regional URLs
- Required lang attribute on inline content
- Recommended RTL and bidirectional text
- Recommended Locale-aware content
- Optional Internationalised Domain Names (IDN)