Website checklist

Every rule in the website playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it.

HTML basics

• Required Start every page with the doctype
• Required Say the page's language
• Required Declare UTF-8 first
• Required Fit the page to the phone
• Required Give every page its own title
• Recommended Keep the HTML valid
• Recommended Write a summary for search results
• Recommended Ship a full set of icons
• Recommended Support light and dark from the start
• Recommended Control how shared links look
• Recommended Point readers to your feed
• Recommended Keep your feed clean and valid
• Optional Colour the browser bar to match
• Optional Push feed updates to subscribers
• Optional Say in DNS if a domain is for sale

Site architecture

• Required Build on HTML that already works
• Required Keep the previous build's assets
• Required Audit every page in a browser before release
• Recommended Keep pages as data
• Recommended Write each page once for every format
• Recommended Render at build time and serve from memory
• Recommended Load one of each from your own site
• Recommended Build repeated HTML from shared modules
• Recommended Give every module its own class names

Interface

• Recommended Build menus with popover
• Recommended Build modal dialogs with dialog
• Recommended Pin menus to their button with CSS
• Recommended Let parts fit the space they get
• Recommended Let the browser balance line breaks
• Recommended Keep room for the scrollbar
• Recommended Size full-height panels for phones
• Optional Wire buttons without click handlers
• Optional Define every colour once
• Optional Animate on scroll with CSS
• Optional Skip page fades unless they help

Performance

• Required Keep load, response and stability fast
• Required Send small, modern images
• Required Cache files for a year and pages briefly
• Required Compress every text response
• Required Fail the build when pages get heavier
• Recommended Measure speed in visitors' browsers
• Recommended Load far-down images later
• Recommended Hint only what speeds up the first paint
• Recommended Say which request headers change a response
• Recommended Answer repeat requests with 304
• Recommended Ignore tracking parameters in caches
• Recommended Load fonts without moving the page
• Recommended Put the styles in the page
• Recommended Never let a script block the page
• Recommended Break up long tasks
• Recommended Fetch the next page on hover
• Recommended Keep the back button instant
• Optional Send early hints only when they help
• Optional Skip work for what is off screen
• Optional Fence off self-contained parts
• Optional Use shared dictionaries for big bundles
• Optional Report how long the server took
• Avoid Drop old HTTP/1 tricks

SEO

• Required Serve phones the same content
• Required Keep private pages out of search
• Required Use one h1 and keep headings in order
• Recommended Tell crawlers where they may go
• Recommended List every public page in a sitemap
• Recommended Keep addresses short and readable
• Recommended Send the content in the HTML
• Recommended Link every page from another
• Recommended Give paginated lists their own addresses
• Recommended Keep filter combinations out of the crawl
• Recommended Describe each page for machines
• Recommended Show where the page sits
• Recommended Watch how search engines see the site
• Recommended Mark links you do not vouch for
• Optional Split sitemaps only when huge
• Optional List key images in the sitemap
• Optional Tell search engines what changed

Redirects and canonicals

• Required Keep every old address in one redirect map
• Required Send each old page to its closest new page
• Required Link only to final addresses
• Required Use the right redirect code
• Required Make every canonical signal agree
• Recommended Answer 404 or 410 when a page is gone for good
• Recommended Move a site or domain without losing links
• Recommended Watch for broken old links
• Optional Say who made each redirect
• Avoid Avoid meta refresh and JavaScript redirects

Accessibility

• Required Make text easy to read
• Required Describe images in words
• Required Label every form field
• Required Put the visible words in the name
• Required Make everything work by keyboard
• Required Never take over single keys
• Required Always show where focus is
• Required Never hide the focused element
• Required Let people skip to the content
• Required Use the right element for the job
• Required Say where each link goes
• Required Never use colour as the only signal
• Required Name every link and button
• Required Explain form errors next to the field
• Required Let people check before they commit
• Required Announce changes without moving focus
• Required Make signing in easy for everyone
• Required Never ask for the same thing twice
• Required Keep help in the same place
• Required Keep navigation in the same order
• Required Offer two ways to every page
• Required Change nothing on focus or input alone
• Required Show hover content that people can reach
• Required Work in both orientations
• Required Never use flashing content
• Required Respect people who turn motion off
• Required Give people enough time
• Required Caption video, transcribe audio
• Required Give tables headers
• Required Never make people scroll sideways
• Required Let text grow without breaking the page
• Required Make tap targets big enough
• Required Offer a way that needs no dragging
• Required Make every gesture work with one tap
• Required Show the right keyboard on phones
• Recommended Work in high-contrast mode
• Recommended Lock the page behind open menus
• Recommended Reach for HTML before ARIA
• Recommended Make links look like links
• Recommended Know which accessibility law applies
• Recommended Let find-in-page open hidden text
• Recommended Build with native controls
• Recommended Style from the state
• Optional Let the browser pick readable text colour
• Avoid Fix the site instead of adding overlays

Security

• Required Make browsers always use HTTPS
• Required Allow only the scripts you wrote
• Required Stop browsers guessing file types
• Required Refuse to be framed
• Required Set cookies safely or not at all
• Required Limit how often anyone can call your APIs
• Recommended Load nothing over plain HTTP
• Recommended Collect reports of blocked content
• Recommended Tell people how to report a hole
• Recommended Refuse odd requests from other sites
• Recommended Keep other sites' windows apart
• Recommended Share less in the Referer header
• Recommended Switch off browser features you don't use
• Recommended Lock scripts to a known hash
• Recommended Lock down risky DOM writes
• Optional Send a hash of the body
• Optional Wipe browser data on sign-out
• Avoid Drop the old XSS header

Hosting and network

• Required Serve everything over HTTPS
• Required Renew certificates automatically
• Required Keep the domain name yours
• Recommended Turn off old encryption
• Recommended Serve over HTTP/2 or HTTP/3
• Recommended Choose who may issue your certificates
• Recommended Host where routes are signed
• Recommended Be reachable over IPv6
• Optional Send more in the first round trip
• Optional Sign your DNS
• Optional Use TLSA records only where checked

Standard addresses

• Recommended Serve standard files at fixed addresses
• Recommended List your APIs in one file
• Recommended Require encrypted mail delivery
• Optional Point to the change-password page
• Optional List the sites that share passkeys
• Optional Point to the passkey pages
• Optional Publish identity provider settings
• Optional Publish OAuth server settings
• Optional Explain how to get API access
• Optional Say you honour privacy signals
• Optional Answer account lookups
• Optional Open links in your iOS app
• Optional Open links in your Android app
• Optional Describe a federated server
• Optional Limit prefetch proxies only if needed

Ready for AI agents

• Recommended Make the site easy for AI agents
• Recommended Give AI tools a site guide
• Recommended Offer every page as Markdown
• Recommended Decide what each AI crawler may do
• Recommended Publish each page's data as a file
• Recommended Offer content machines can read
• Recommended Advertise agent files in headers
• Optional Offer all content in one file
• Optional Say how your content may be used
• Optional State your text-mining choice
• Optional Sign your bot's requests
• Optional Explain how agents sign up
• Optional Describe your MCP tools honestly
• Optional Publish an agent card
• Optional List skills agents can learn
• Optional List agent endpoints in DNS
• Optional Keep one catalogue of agent tools
• Optional Answer questions from your own pages
• Optional Give in-browser agents your tools
• Optional Package your knowledge for agents
• Optional Index every page's data file
• Optional Ask agents to credit you
• Avoid Show agents the same page as people

Privacy

• Required Explain what you keep and why
• Required Store nothing extra without a yes
• Required Keep only what you need and delete it on time
• Required Keep personal data out of addresses
• Required Sign a contract with every processor
• Required Plan for a data breach
• Required Let people see and delete their data
• Required Say when people talk to an AI
• Recommended Treat the privacy signal as a no
• Recommended Host everything yourself for privacy
• Recommended Count visits without tracking people
• Recommended Store each preference where it is needed
• Recommended Load embedded videos and maps only after a click
• Optional Ask before embedded content uses cookies

When things break

• Required Make error pages helpful and honest
• Recommended Say when you'll be back
• Recommended Keep working when a script or service fails
• Recommended Hide buttons that need JavaScript until it runs
• Recommended Let people install the site
• Recommended Serve the last good page when the server fails
• Recommended Collect script errors from visitors' browsers
• Optional Keep working when the network drops
• Optional Warn before retiring an address

Languages and regions

• Required Mark foreign words
• Recommended Give each language its own path
• Recommended Link language versions together
• Recommended Translate the metadata too
• Recommended Let people pick their language
• Recommended Support right-to-left text
• Recommended Format dates and numbers for the reader
• Recommended Get plurals right in every language
• Recommended Translate whole sentences
• Recommended Test with a pseudo-locale
• Recommended Sort and compare text by locale
• Recommended Accept names and addresses from every country
• Optional List language versions in the sitemap
• Optional Keep names out of machine translation
• Optional Support vertical and CJK text
• Optional Make non-ASCII domains work
• Avoid Never redirect by location