Website optimization playbook

A website playbook for any stack. It lists every rule a good website should follow, how to build it, and how to prove it works.

We tested the rules on a reference site. We measured each feature with and without it, in Lighthouse and in browsers. Where a rule has a measured effect, its page says how large it was. Where a feature did nothing measurable, it says that too.

Each rule has its own page, written for people and for AI agents. Every page also comes as Markdown if you add .md to the address. The checklist lists every rule on one page.

Chapters

1. HTML basics

   Everything in the head of a page, such as doctype, language, title, description, canonical address, icons, colours, social cards and feeds.

   • Required 5
   • Recommended 7
   • Optional 3

2. Site architecture

   A structure that makes the other rules easy. Pages are data, built once to static HTML and served from memory, with every machine file from one source.

   • Required 3
   • Recommended 6

3. Interface

   Native HTML and CSS for menus, layout, text, colour and motion. Use what the browser already does instead of JavaScript widgets and fixed layouts.

   • Recommended 7
   • Optional 4

4. Performance

   How to make a page load about as fast as the network allows. The speed rules for any site, what moved the numbers in practice, and what to skip.

   • Required 5
   • Recommended 12
   • Optional 5
   • Avoid 1

5. SEO

   Make every page easy to find and understand with robots.txt, sitemaps, clean addresses, redirects, rendering on the server, structured data and breadcrumbs.

   • Required 3
   • Recommended 11
   • Optional 3

6. Redirects and canonicals

   Keep every old link working. Send each old address to the right new page in one hop, and make every signal point at the one true address of each page.

   • Required 5
   • Recommended 3
   • Optional 1
   • Avoid 1

7. Accessibility

   Make the site work for everyone with readable contrast, full keyboard use, visible focus, clear structure, calm motion, big touch targets and plain HTML first.

   • Required 35
   • Recommended 8
   • Optional 1
   • Avoid 1

8. Security

   HTTPS, a strict Content Security Policy, isolation headers, integrity checks and the other headers, policies and DNS records that keep visitors safe.

   • Required 6
   • Recommended 9
   • Optional 2
   • Avoid 1

9. Hosting and network

   Server and DNS work under every site. It covers HTTPS, TLS, HTTP/2 and HTTP/3, a fast first send, DNS records, IPv6 and certificate renewal.

   • Required 3
   • Recommended 5
   • Optional 3

10. Standard addresses

    Fixed addresses under /.well-known/ that browsers, password managers, privacy tools and agents look for, and which ones a small site needs.

    • Recommended 3
    • Optional 12

11. Ready for AI agents

    Markdown copies, llms.txt, AI crawler rules, structured data, link headers, MCP, A2A, skills and WebMCP make a site easy for AI agents to use.

    • Recommended 7
    • Optional 15
    • Avoid 1

12. Privacy

    Collect nothing you do not need. Write a full privacy policy, skip needless cookies and third parties, honour Global Privacy Control and delete data on time.

    • Required 8
    • Recommended 5
    • Optional 1

13. When things break

    Plan for things going wrong with error pages, maintenance mode, pages that survive failed scripts, offline support and retired addresses.

    • Required 1
    • Recommended 6
    • Optional 2

14. Languages and regions

    Serve each language and script with translated metadata, hreflang, translate hints, right-to-left text, local dates and numbers, and no forced geo redirects.

    • Required 1
    • Recommended 11
    • Optional 4
    • Avoid 1

Evidence

• Measured results

  What each feature is worth, measured on a reference site with Lighthouse and browsers. We took features away one by one and noted what made no difference.

• Measuring it yourself

  A repeatable lab for website features. It runs Lighthouse with and without each one, a Playwright click test with added latency, and live checks from outside.

All 237 rules on one page