@mridang/webhint-hint-plumbline 0.9.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. package/README.md +337 -301
  2. package/configs/plumbline-advanced.json +221 -0
  3. package/configs/plumbline-all.json +294 -0
  4. package/configs/plumbline-experimental.json +43 -0
  5. package/configs/plumbline-recommended.json +163 -0
  6. package/configs/section-advertising-advanced.json +11 -0
  7. package/configs/section-advertising-experimental.json +7 -0
  8. package/configs/section-advertising-recommended.json +10 -0
  9. package/configs/section-ai-advanced.json +13 -0
  10. package/configs/section-ai-experimental.json +27 -0
  11. package/configs/section-ai-recommended.json +10 -0
  12. package/configs/section-dns-advanced.json +22 -0
  13. package/configs/section-dns-experimental.json +9 -0
  14. package/configs/section-dns-recommended.json +14 -0
  15. package/configs/section-email-advanced.json +38 -0
  16. package/configs/section-email-experimental.json +7 -0
  17. package/configs/section-email-recommended.json +24 -0
  18. package/configs/section-exposure-advanced.json +26 -0
  19. package/configs/section-exposure-experimental.json +7 -0
  20. package/configs/section-exposure-recommended.json +25 -0
  21. package/configs/section-feeds-advanced.json +20 -0
  22. package/configs/section-feeds-experimental.json +7 -0
  23. package/configs/section-feeds-recommended.json +10 -0
  24. package/configs/section-hardening-advanced.json +35 -0
  25. package/configs/section-hardening-experimental.json +10 -0
  26. package/configs/section-hardening-recommended.json +32 -0
  27. package/configs/section-https-advanced.json +29 -0
  28. package/configs/section-https-experimental.json +7 -0
  29. package/configs/section-https-recommended.json +25 -0
  30. package/configs/section-performance-advanced.json +17 -0
  31. package/configs/section-performance-experimental.json +7 -0
  32. package/configs/section-performance-recommended.json +12 -0
  33. package/configs/section-privacy-advanced.json +19 -0
  34. package/configs/section-privacy-experimental.json +10 -0
  35. package/configs/section-privacy-recommended.json +18 -0
  36. package/configs/section-protocol-advanced.json +20 -0
  37. package/configs/section-protocol-experimental.json +13 -0
  38. package/configs/section-protocol-recommended.json +18 -0
  39. package/configs/section-pwa-advanced.json +20 -0
  40. package/configs/section-pwa-experimental.json +7 -0
  41. package/configs/section-pwa-recommended.json +15 -0
  42. package/configs/section-seo-advanced.json +54 -0
  43. package/configs/section-seo-experimental.json +14 -0
  44. package/configs/section-seo-recommended.json +47 -0
  45. package/configs/section-sharing-advanced.json +39 -0
  46. package/configs/section-sharing-experimental.json +7 -0
  47. package/configs/section-sharing-recommended.json +27 -0
  48. package/dist/core/define-hint.js +16 -4
  49. package/dist/core/define-hint.js.map +1 -1
  50. package/dist/core/groups.d.ts +14 -0
  51. package/dist/core/groups.js +34 -0
  52. package/dist/core/groups.js.map +1 -1
  53. package/dist/core/origins.js +11 -0
  54. package/dist/core/origins.js.map +1 -1
  55. package/dist/core/selectors.d.ts +24 -0
  56. package/dist/core/selectors.js +89 -0
  57. package/dist/core/selectors.js.map +1 -0
  58. package/dist/core/taxonomy-data.d.ts +108 -0
  59. package/dist/core/taxonomy-data.js +4847 -0
  60. package/dist/core/taxonomy-data.js.map +1 -0
  61. package/dist/core/taxonomy.d.ts +19 -14
  62. package/dist/core/taxonomy.js +30 -417
  63. package/dist/core/taxonomy.js.map +1 -1
  64. package/dist/hints/network/dnssec-exists.js +3 -1
  65. package/dist/hints/network/dnssec-exists.js.map +1 -1
  66. package/dist/presets.d.ts +8 -0
  67. package/dist/presets.js +43 -0
  68. package/dist/presets.js.map +1 -1
  69. package/package.json +1 -1
package/README.md CHANGED
@@ -80,7 +80,7 @@ devbox run -- npx eslint packages/hints
80
80
 
81
81
  ## Groups
82
82
 
83
- A hint can belong to several groups, so a whole source or a whole topic can be switched on at once. Each group is a ready-made preset in `configs/<group>.json`; extend one or several as shown under [Use](#use).
83
+ A hint can belong to several groups, so a whole source or a whole topic can be switched on at once. The topic groups predate the [sections](#sections); the CLI's `--group` accepts a section, a tag, a target, a tier, a control, a source (all bare, or with their kind such as `section:https` or `tag:seo`) and the old group names, which keep working as aliases of sections and tags. Each group is a ready-made preset in `configs/<group>.json`; extend one or several as shown under [Use](#use). The rule sets are presets too: `configs/plumbline-recommended.json`, `plumbline-advanced.json`, `plumbline-experimental.json` and `plumbline-all.json`, and `configs/section-<section>-<tier>.json` for each section and tier.
84
84
 
85
85
  | Kind | Groups |
86
86
  | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -91,19 +91,55 @@ The source groups keep the original grouping of each reference, so a source can
91
91
 
92
92
  ## Sections
93
93
 
94
- Every hint is sorted into one section, which is also the sidebar of the report. A hint can carry tags for other sections it touches. The sections were proposed by two teams of reviewers, one arguing from what a site owner wants and one from protocols and layers, and settled by a judge; where a placement was a close call, who usually has to make the fix decided it.
94
+ Every hint has one home, a section, shown as the sidebar of the report, and the sections are shown under display groups. A hint also carries tags for the other goals it serves (`security`, `seo`, `store`, ...), a tier, a target, a control and the month it was added. The data is `src/core/taxonomy-data.ts`; where a placement was a close call, who usually has to make the fix decided it.
95
95
 
96
- | Section | Hints | What it holds | Usually fixed by |
97
- | ----------------------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
98
- | LLMs and AI | 34 | Everything that tells bots and AI systems what they may read and how to use you: robots.txt, llms.txt, ai.txt, AI crawler rules, Content Signals, agent discovery, auth and payment protocols, Web Bot Auth, markdown negotiation and answer-engine markup. | site content, files at the web root and /.well-known, web server config |
99
- | Search and page quality | 57 | Be found and understood by search engines: titles, descriptions, headings, lang, canonical, robots meta, JSON-LD, alt text, image weight, redirect chains. | site content and templates |
100
- | Link previews and icons | 44 | How the site looks when shared or bookmarked: Open Graph, Twitter/X cards and favicons. | site content and templates (the HTML head) |
101
- | HTTPS and certificates | 20 | Visitors reach the real site over a trusted encrypted connection: TLS versions, ciphers, certificates, mail-server STARTTLS, compression risk. | web server or CDN TLS config |
102
- | Site protection | 67 | Make the site hard to attack from a browser: CSP, framing, cross-origin policies, CORS, cookie flags, HSTS-adjacent header rules, deprecated headers, private-page caching, security.txt. | web server or application config (response headers) |
103
- | Visitor privacy | 15 | What the site reveals about its visitors: cookies, third-party requests, localStorage, geolocation, referrer and DNS-prefetch leakage, third-party report endpoints, and the privacy policy and terms it links. | site content, scripts and header config |
104
- | Email security | 30 | Mail sent as your domain is trusted and cannot be spoofed: SPF, DKIM, DMARC, STARTTLS, and DNSSEC, DANE, IPv6 and RPKI of the mail servers. | mail admin / mail DNS records |
105
- | DNS and network | 15 | The domain, name servers and web server are reachable and tamper-resistant: DNSSEC, IPv6, RPKI, DANE and CAA. | DNS zone, registrar, hosting/network provider |
106
- | Progressive Web App | 4 | The page is installable and themed as an app: a linked, valid Web App Manifest with install-ready icons and a theme colour. | the web app manifest and service worker |
96
+ - **Tier**: `recommended` (a real defect with a small fix, silent on a good site), `advanced` (stable but opinionated or stack-dependent) or `experimental` (still maturing).
97
+ - **Target**: `web` (the web host), `mail` (the mail servers) or `site` (the site as a whole).
98
+ - **Control**: who can fix a finding: `deployer`, `platform`, `dns`, `mail`.
99
+
100
+ ### Security and privacy
101
+
102
+ | Section | Id | Hints | Recommended | What it holds | Usually fixed by |
103
+ | ---------------------- | ----------- | ----: | ----------: | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
104
+ | HTTPS and certificates | `https` | 21 | 17 | HTTPS availability, redirects, HSTS, mixed content, TLS protocol and certificates of the web host | hosting platform, CDN or certificate authority; the deployer owns HSTS, mixed content and form targets |
105
+ | Security headers | `hardening` | 29 | 24 | Response headers and page markup that tell the browser what to refuse: CSP, CORS, cross-origin policies, cookie flags, reporting, deprecated security headers | deployer (headers config, middleware, template) |
106
+ | Exposed files | `exposure` | 18 | 17 | Files and probes that must not answer, server and framework banners, source maps, security.txt and change-password | deployer (build output, deploy pipeline) |
107
+ | Privacy | `privacy` | 13 | 10 | Cookies, storage, third parties, geolocation, referrer, client hints, consent and policy links, GPC | application developer or content owner |
108
+
109
+ ### Domain and mail
110
+
111
+ | Section | Id | Hints | Recommended | What it holds | Usually fixed by |
112
+ | --------------- | ------- | ----: | ----------: | ----------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
113
+ | DNS and network | `dns` | 15 | 7 | DNSSEC, DANE, CAA, IPv6 and RPKI of the web host and its name servers | DNS host, registrar or network provider |
114
+ | Email | `email` | 30 | 16 | Mail authentication (SPF, DKIM, DMARC, BIMI), mail transport (MTA-STS, TLS-RPT, STARTTLS) and the TLS and DNS twins of the mail servers (target mail) | mail administrator |
115
+
116
+ ### Delivery
117
+
118
+ | Section | Id | Hints | Recommended | What it holds | Usually fixed by |
119
+ | -------------- | ------------- | ----: | ----------: | ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------- |
120
+ | HTTP behaviour | `protocol` | 17 | 10 | Conformance of non-security HTTP headers: caching validators, Vary, Alt-Svc, digests, Retry-After, Accept-*, speculation rules | web server, framework or CDN |
121
+ | Performance | `performance` | 9 | 4 | Page weight, image delivery, response time and redirect chains | front-end build or hosting |
122
+
123
+ ### Search and sharing
124
+
125
+ | Section | Id | Hints | Recommended | What it holds | Usually fixed by |
126
+ | ------------------- | ------------- | ----: | ----------: | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
127
+ | SEO | `seo` | 52 | 39 | Content, markup, indexing and robots, canonical, hreflang, links, structured data and rich results | template author or content editor |
128
+ | Link previews | `sharing` | 31 | 19 | How a link looks when shared: Open Graph and Twitter cards | template author |
129
+ | Feeds and discovery | `feeds` | 12 | 2 | RSS, Atom and JSON feeds, OpenSearch, oEmbed, WebFinger, NodeInfo, host-meta, rel-me, Webmention, Pingback, humans.txt | application developer or content owner |
130
+ | Advertising | `advertising` | 3 | 2 | ads.txt, app-ads.txt and sellers.json | publisher or ad operations |
131
+
132
+ ### App
133
+
134
+ | Section | Id | Hints | Recommended | What it holds | Usually fixed by |
135
+ | ------------------- | ----- | ----: | ----------: | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
136
+ | Progressive web app | `pwa` | 12 | 7 | Web app manifest, theme colour, service worker scope, favicons and apple-touch-icon, app links (apple-app-site-association, assetlinks.json) | front-end developer |
137
+
138
+ ### AI
139
+
140
+ | Section | Id | Hints | Recommended | What it holds | Usually fixed by |
141
+ | ------------- | ---- | ----: | ----------: | ---------------------------------------------------------------------- | -------------------------------------- |
142
+ | AI and agents | `ai` | 24 | 2 | AI crawler policy, llms.txt, ai.txt, agent protocols, agentic commerce | content owner or application developer |
107
143
 
108
144
  ## Where the hints come from
109
145
 
@@ -111,294 +147,294 @@ Each hint records its origins (the upstream check, a link to it, a summary and t
111
147
 
112
148
  ## Hints
113
149
 
114
- | Hint | What it checks | Section | Groups |
115
- | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------- |
116
- | `accept-ch` | Checks the Accept-CH token list and notes that each client hint adds to fingerprinting. | Visitor privacy (also Site protection) | `mdn`, `security-headers`, `privacy` |
117
- | `accept-patch` | Validates the Accept-Patch media-type list advertising PATCH body formats when present. | Site protection | `mdn`, `security-headers` |
118
- | `accept-post` | Validates the Accept-Post media-type list advertising POST body formats when present. | Site protection | `mdn`, `security-headers` |
119
- | `ads-txt` | Checks that /ads.txt follows the IAB Tech Lab ads.txt 1.1 spec. | Search and page quality | `iab`, `seo` |
120
- | `age` | Checks that the Age header is a non-negative number of seconds. | Site protection | `mdn`, `security-headers` |
121
- | `agent-a2a-agent-card` | Requires an A2A agent card at /.well-known/agent-card.json. | LLMs and AI | `agent-ready`, `agent` |
122
- | `agent-acp` | Reports whether /.well-known/acp.json is published. | LLMs and AI | `agent-ready`, `agent` |
123
- | `agent-ai-bot-rules` | Requires robots.txt rules naming known AI crawlers. | LLMs and AI (also Visitor privacy) | `agent-ready`, `agent`, `privacy` |
124
- | `agent-api-catalog` | Requires an RFC 9727 linkset at /.well-known/api-catalog. | LLMs and AI | `agent-ready`, `agent` |
125
- | `agent-ard` | Requires a valid AI catalog at /.well-known/ard.json. | LLMs and AI | `agent-ready`, `agent`, `dns` |
126
- | `agent-auth-md` | Requires /auth.md with agent registration instructions. | LLMs and AI | `agent-ready`, `agent` |
127
- | `agent-content-signals` | Requires a Content-Signal directive in robots.txt. | LLMs and AI (also Visitor privacy) | `agent-ready`, `agent`, `privacy` |
128
- | `agent-dns-aid` | Requires SVCB or HTTPS records under _agents of the host (DNS-AID). | LLMs and AI (also DNS and network) | `agent-ready`, `agent`, `dns` |
129
- | `agent-link-headers` | Requires a Link header with an agent-useful relation such as api-catalog or service-desc. | LLMs and AI | `agent-ready`, `agent` |
130
- | `agent-markdown-negotiation` | Requires text/markdown when the home page is requested with Accept: text/markdown. | LLMs and AI | `agent-ready`, `agent` |
131
- | `agent-mcp-server-card` | Requires an MCP server card with serverInfo and a transport endpoint. | LLMs and AI | `agent-ready`, `agent` |
132
- | `agent-mpp` | Reports whether /openapi.json advertises x-payment-info (MPP). | LLMs and AI | `agent-ready`, `agent` |
133
- | `agent-oauth-discovery` | Requires OIDC or RFC 8414 authorization server metadata with a valid issuer. | LLMs and AI | `agent-ready`, `agent` |
134
- | `agent-oauth-protected-resource` | Requires /.well-known/oauth-protected-resource with a resource on this site. | LLMs and AI | `agent-ready`, `agent` |
135
- | `agent-poppy` | Requires a valid /.well-known/poppy.json. | LLMs and AI | `agent-ready`, `agent` |
136
- | `agent-robots-txt` | Requires a text/plain /robots.txt with at least one User-agent directive. | LLMs and AI (also Search and page quality) | `agent-ready`, `agent` |
137
- | `agent-score` | Reports the overall agent readiness score and level. | LLMs and AI | `agent-ready`, `agent` |
138
- | `agent-sitemap` | Requires a valid XML sitemap listed in robots.txt or at /sitemap.xml. | LLMs and AI (also Search and page quality) | `agent-ready`, `agent`, `roctify`, `seo` |
139
- | `agent-skills` | Requires an agent skills index with name, type, description, url and digest per skill. | LLMs and AI | `agent-ready`, `agent` |
140
- | `agent-ucp` | Reports whether /.well-known/ucp is published. | LLMs and AI | `agent-ready`, `agent` |
141
- | `agent-web-bot-auth` | Requires a key directory at /.well-known/http-message-signatures-directory. | LLMs and AI (also Site protection) | `agent-ready`, `agent`, `security-headers` |
142
- | `agent-webmcp` | Requires the page to expose WebMCP tools (modelContext or toolname forms). | LLMs and AI | `agent-ready`, `agent` |
143
- | `agent-x402` | Reports whether an endpoint answers 402 Payment Required (x402). | LLMs and AI | `agent-ready`, `agent` |
144
- | `ai-txt` | Checks that /ai.txt is valid in the aitxt.ing or Spawning format. | LLMs and AI | `files`, `agent` |
145
- | `alt-svc` | Reports the advertised alternative services and flags a malformed Alt-Svc value. | Site protection | `mdn`, `security-headers` |
146
- | `alternate-media` | Reports a malformed <link rel="alternate" media="…">. | Search and page quality | `mdn`, `seo` |
147
- | `app-ads-txt` | Checks that /app-ads.txt follows the IAB Tech Lab app-ads.txt spec. | Search and page quality | `iab`, `seo` |
148
- | `apple-app-site-association` | Checks that the apple-app-site-association file follows Apple associated-domains rules. | Site protection | `apple`, `security-headers` |
149
- | `assetlinks-json` | Checks that /.well-known/assetlinks.json follows the Digital Asset Links schema. | Site protection | `google`, `security-headers` |
150
- | `attribution-reporting` | Reports participation in the Attribution Reporting API and validates the registration headers. | Visitor privacy | `mdn`, `privacy` |
151
- | `bimi` | Requires the site mail domain, when it publishes BIMI, to use an HTTPS SVG logo and HTTPS certificate URL. | Email security | `ietf`, `email`, `dns` |
152
- | `caa` | Requires the domain to publish syntactically valid CAA records that include an issue property. | DNS and network (also HTTPS and certificates) | `internetnl`, `dns`, `tls` |
153
- | `cache-control` | Requires Cache-Control: no-store, max-age=0 on private applications (opt-in with the enforce option). | Site protection (also Visitor privacy) | `owasp`, `security-headers` |
154
- | `cert-hostname` | Requires the host name of the website to match a name on its HTTPS certificate. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
155
- | `cert-pubkey` | Requires every certificate in the HTTPS chain to use a secure public key type and size. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
156
- | `cert-signature` | Requires every certificate in the HTTPS chain to be signed with a secure algorithm and hash function. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
157
- | `cert-trust` | Requires the HTTPS certificate to chain to a trusted root, with all intermediates sent. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
158
- | `change-password` | Checks that /.well-known/change-password resolves to a password-change page. | Site protection | `w3c`, `security-headers` |
159
- | `clear-site-data` | Requires the logout response to send Clear-Site-Data for cache, cookies and storage. | Site protection | `owasp`, `security-headers` |
160
- | `coep` | Checks that Cross-Origin-Embedder-Policy requires embedded resources to opt in. | Site protection | `observatory`, `owasp`, `security-headers` |
161
- | `content-digest` | Validates the Content-Digest header as an RFC 9530 digest dictionary when present. | Site protection | `mdn`, `security-headers` |
162
- | `cookie-prefixes` | Checks that __Host- and __Secure- cookies meet their prefix requirements. | Site protection (also Visitor privacy) | `owasp`, `security-headers` |
163
- | `cookies` | Checks that cookies use Secure, HttpOnly for sessions and SameSite. | Site protection (also Visitor privacy) | `observatory`, `security-headers`, `privacy` |
164
- | `coop` | Checks that Cross-Origin-Opener-Policy isolates the page from windows it did not open. | Site protection | `observatory`, `owasp`, `security-headers` |
165
- | `corp` | Checks that Cross-Origin-Resource-Policy limits who may load the page as a resource. | Site protection | `observatory`, `owasp`, `security-headers` |
166
- | `cors` | Checks that Access-Control-Allow-Origin does not let any site make credentialed requests. | Site protection | `observatory`, `security-headers` |
167
- | `cors-allow-credentials` | Reports credentialed CORS access, especially when combined with a wildcard origin. | Site protection | `mdn`, `security-headers` |
168
- | `cors-allow-headers` | Reports a wildcard Access-Control-Allow-Headers, which allows every request header. | Site protection | `mdn`, `security-headers` |
169
- | `cors-allow-methods` | Reports a wildcard or unrecognised method in the Access-Control-Allow-Methods header. | Site protection | `mdn`, `security-headers` |
170
- | `cors-expose-headers` | Reports a wildcard or sensitive header in the Access-Control-Expose-Headers header. | Site protection | `mdn`, `security-headers` |
171
- | `cors-max-age` | Reports a malformed or excessively long Access-Control-Max-Age preflight cache. | Site protection | `mdn`, `security-headers` |
172
- | `critical-ch` | Checks that every hint in Critical-CH is also advertised in Accept-CH. | Visitor privacy (also Site protection) | `mdn`, `security-headers`, `privacy` |
173
- | `csp` | Checks that a Content Security Policy is set and does not allow unsafe sources. | Site protection | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers` |
174
- | `csp-reporting` | Reports CSP, report-only and NEL report endpoints that point to a third-party domain. | Visitor privacy (also Site protection) | `webbkoll`, `security-headers`, `privacy` |
175
- | `csp-strength` | Evaluates CSP depth for unsafe-inline, unsafe-eval, object-src, base-uri and broad allowlists. | Site protection | `google`, `security-headers` |
176
- | `dane-exists` | Checks that the website domain publishes a signed TLSA record for DANE. | DNS and network (also HTTPS and certificates) | `internetnl`, `dns`, `tls` |
177
- | `dane-rollover` | Checks that the website domain publishes at least two TLSA records so DANE survives a certificate rollover. | DNS and network (also HTTPS and certificates) | `internetnl`, `dns`, `tls` |
178
- | `dane-valid` | Requires the DANE TLSA record of the website domain to match the web certificate. | DNS and network (also HTTPS and certificates) | `internetnl`, `dns`, `tls` |
179
- | `dnssec-exists` | Requires the domain of the site to be DNSSEC signed. | DNS and network | `internetnl`, `dns` |
180
- | `dnssec-valid` | Requires the DNSSEC signature of the domain to be valid. | DNS and network | `internetnl`, `dns` |
181
- | `etag` | Reports an ETag that looks like a filesystem inode and so leaks server internals. | Site protection | `mdn`, `security-headers` |
182
- | `expect-ct` | Reports the deprecated Expect-CT header when it is sent. | Site protection | `owasp`, `security-headers` |
183
- | `expires` | Checks that Expires is a valid HTTP-date and notes when Cache-Control max-age supersedes it. | Site protection | `mdn`, `security-headers` |
184
- | `exposed-backup-files` | Reports when common backup files are served, leaking source or config. | Site protection | `owasp` |
185
- | `exposed-crossdomain` | Reports when /crossdomain.xml allows access from any domain ("*"). | Site protection | `owasp` |
186
- | `exposed-directory-listing` | Reports when a common directory returns an automatic index of its files. | Site protection | `owasp` |
187
- | `exposed-ds-store` | Reports when /.DS_Store is served, leaking directory contents. | Site protection | `owasp` |
188
- | `exposed-env` | Reports when /.env is served with KEY=VALUE content, leaking secrets. | Site protection | `owasp` |
189
- | `exposed-git` | Reports when /.git/HEAD or /.git/config is served, exposing the repository. | Site protection | `owasp` |
190
- | `exposed-server-status` | Reports when Apache /server-status or /server-info is publicly readable. | Site protection | `owasp` |
191
- | `exposed-source-map` | Reports when a referenced script has a reachable, valid .js.map source map. | Site protection | `owasp` |
192
- | `exposed-svn` | Reports when /.svn/entries or /.svn/wc.db is served, exposing the repository. | Site protection | `owasp` |
193
- | `feature-policy` | Reports the deprecated Feature-Policy header when it is sent. | Site protection | `owasp`, `security-headers` |
194
- | `feed-discovery` | Checks for an RSS/Atom feed <link rel="alternate"> with an absolute href. | Link previews and icons (also Search and page quality) | `ietf`, `social` |
195
- | `feed-valid` | Fetches each discovered RSS/Atom feed and checks it is well-formed. | Link previews and icons | `ietf`, `social` |
196
- | `form-action-secure` | Checks that forms on an HTTPS page do not submit to an http:// action. | Site protection (also HTTPS and certificates) | `owasp`, `security-headers` |
197
- | `geo-content-extraction` | Reports pages whose content lacks heading and paragraph structure. | LLMs and AI (also Search and page quality) | `llmscout`, `agent`, `seo` |
198
- | `geo-faq-schema` | Reports pages without FAQPage JSON-LD. | LLMs and AI (also Search and page quality) | `llmscout`, `agent`, `seo` |
199
- | `geo-organization-schema` | Reports pages without Organization or Person JSON-LD that links profiles with sameAs. | LLMs and AI (also Search and page quality) | `llmscout`, `agent`, `seo` |
200
- | `geo-speakable-schema` | Reports pages without Speakable JSON-LD. | LLMs and AI (also Search and page quality) | `llmscout`, `agent`, `seo` |
201
- | `geo-structured-data-invalid` | Reports JSON-LD blocks that are not valid JSON. | Search and page quality (also LLMs and AI) | `llmscout`, `agent`, `seo` |
202
- | `gpc-json` | Checks that /.well-known/gpc.json follows the Global Privacy Control spec. | Visitor privacy | `w3c`, `privacy` |
203
- | `host-meta` | Validates the /.well-known/host-meta XRD/JRD document when present (RFC 6415). | LLMs and AI | `ietf`, `agent` |
204
- | `hreflang-duplicate` | Reports hreflang values declared on more than one alternate. | Search and page quality | `google`, `seo` |
205
- | `hreflang-return` | Flags hreflang alternates that use a non-absolute URL. | Search and page quality | `google`, `seo` |
206
- | `hreflang-self` | Reports an hreflang set that does not reference the page itself. | Search and page quality | `google`, `seo`, `roctify` |
207
- | `hreflang-valid-codes` | Reports hreflang values that are not valid language/region codes. | Search and page quality | `google`, `seo`, `roctify` |
208
- | `hreflang-x-default` | Reports an hreflang set that has no x-default entry. | Search and page quality | `google`, `seo` |
209
- | `hsts` | Checks the Strict-Transport-Security header: HTTPS only, max-age and subdomain coverage. | HTTPS and certificates (also Site protection) | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers`, `roctify` |
210
- | `http-methods` | Probes OPTIONS on the root and flags TRACE (XST) and unsafe write methods. | Site protection | `owasp`, `security-headers` |
211
- | `https-available` | Requires the website to be reachable over HTTPS, with a completed TLS handshake on the HTTPS port. | HTTPS and certificates | `internetnl`, `tls`, `security-headers`, `roctify` |
212
- | `humans-txt` | Checks that /humans.txt is present and served as plain text (humanstxt.org). | Search and page quality | `indieweb`, `seo` |
213
- | `icons-apple-touch-icon-missing` | Warns when the page declares no apple-touch-icon link. | Link previews and icons (also Search and page quality) | `roctify`, `seo` |
214
- | `icons-favicon-32-missing` | Reports sites without a 32x32 PNG favicon link. | Link previews and icons (also Search and page quality) | `opengraph`, `seo` |
215
- | `icons-favicon-ico-or-png-missing` | Warns when there is no .ico or .png favicon (Google Search does not support SVG favicons). | Link previews and icons (also Search and page quality) | `opengraph`, `seo` |
216
- | `icons-favicon-missing` | Reports sites that declare no favicon and serve no /favicon.ico. | Link previews and icons (also Search and page quality) | `opengraph`, `seo`, `roctify` |
217
- | `icons-favicon-svg-missing` | Reports sites without an SVG favicon link. | Link previews and icons (also Search and page quality) | `opengraph`, `seo` |
218
- | `integrity-policy` | Checks that Integrity-Policy declares a non-empty blocked-destinations list. | Site protection | `mdn`, `security-headers` |
219
- | `integrity-policy-report-only` | Checks that Integrity-Policy-Report-Only declares a non-empty blocked-destinations list. | Site protection | `mdn`, `security-headers` |
220
- | `internetnl-http-compression` | Reports when the web server compresses the root document (BREACH risk). | Site protection (also HTTPS and certificates) | `internetnl`, `security-headers`, `roctify` |
221
- | `ipv6-ns-aaaa` | Requires at least two name servers of the domain to have an IPv6 address. | DNS and network | `internetnl`, `dns` |
222
- | `ipv6-ns-reach` | Requires every name server with an IPv6 address to be reachable over IPv6. | DNS and network | `internetnl`, `dns` |
223
- | `ipv6-same-content` | Requires the website over IPv6 to offer the same ports, headers and content as over IPv4. | DNS and network | `internetnl`, `dns` |
224
- | `ipv6-web-aaaa` | Requires the web server to have at least one IPv6 address. | DNS and network | `internetnl`, `dns` |
225
- | `ipv6-web-reach` | Requires every IPv6 address of the web server to be reachable over IPv6. | DNS and network | `internetnl`, `dns` |
226
- | `last-modified` | Checks that the Last-Modified header is a valid HTTP-date. | Site protection | `mdn`, `security-headers` |
227
- | `llms-full-txt` | Checks that /llms-full.txt is non-empty markdown that parses. | LLMs and AI | `files`, `agent` |
228
- | `llms-txt` | Checks that /llms.txt follows the llmstxt.org format. | LLMs and AI | `files`, `agent` |
229
- | `mail-caa` | Requires the mail servers (MX) of the site domain to be covered by syntactically valid CAA records with an issue property. | Email security (also DNS and network, HTTPS and certificates) | `internetnl`, `email`, `dns`, `tls` |
230
- | `mail-cert-hostname` | Checks that the host names of the mail servers (MX) match a name on their certificates. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
231
- | `mail-cert-pubkey` | Requires every certificate in the chain of the mail servers (MX) to use a secure public key type and size. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
232
- | `mail-cert-signature` | Requires every certificate in the chain of the mail servers (MX) to be signed with a secure algorithm and hash function. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
233
- | `mail-cert-trust` | Checks that the certificates of the mail servers (MX) chain to a trusted root, with all intermediates sent. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
234
- | `mail-dane` | Requires the mail servers (MX) of the site domain to publish DNSSEC-signed TLSA records that match their certificates. | Email security (also DNS and network) | `internetnl`, `email`, `dns`, `tls` |
235
- | `mail-dane-rollover` | Checks that the mail servers (MX) of the site domain publish at least two TLSA records so DANE survives a certificate rollover. | Email security (also DNS and network) | `internetnl`, `email`, `dns`, `tls` |
236
- | `mail-dkim` | Requires the DKIM selectors given in the options to have valid key records under the site domain. | Email security | `internetnl`, `email`, `dns` |
237
- | `mail-dmarc` | Requires the site domain to publish a valid DMARC record with a policy other than none and valid report addresses. | Email security | `internetnl`, `email`, `dns` |
238
- | `mail-dnssec` | Requires the site domain and the domains of its mail servers (MX) to be DNSSEC signed with a valid signature. | Email security (also DNS and network) | `internetnl`, `email`, `dns` |
239
- | `mail-ipv6` | Requires the mail servers (MX) of the site domain to have IPv6 addresses that are reachable on port 25. | Email security (also DNS and network) | `internetnl`, `email`, `dns` |
240
- | `mail-ns-rpki-exists` | Requires an RPKI Route Origin Authorisation to be published for every IP address of the name servers of the mail servers (MX). | Email security (also DNS and network) | `internetnl`, `email`, `dns` |
241
- | `mail-ns-rpki-valid` | Requires the route announcements of the IP addresses of the name servers of the mail servers (MX) to be RPKI valid. | Email security (also DNS and network) | `internetnl`, `email`, `dns` |
242
- | `mail-rpki` | Requires the routes of the IP addresses of the mail servers (MX) to be covered by valid RPKI Route Origin Authorisations. | Email security (also DNS and network) | `internetnl`, `email`, `dns` |
243
- | `mail-spf` | Requires the site domain to have a valid SPF record within the 10 lookup limit that ends in -all or ~all. | Email security | `internetnl`, `email`, `dns` |
244
- | `mail-starttls` | Requires the mail servers (MX) of the site domain to offer STARTTLS, negotiate TLS 1.2 or 1.3 and present a valid certificate. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
245
- | `mail-tls-cipher-order` | Requires the mail servers (MX) of the site domain to enforce their own preference for the most secure cipher suites. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
246
- | `mail-tls-ciphers` | Requires the mail servers (MX) of the site domain to accept only secure (good or sufficient) cipher suites over STARTTLS. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
247
- | `mail-tls-compression` | Requires the mail servers (MX) of the site domain not to support TLS compression. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
248
- | `mail-tls-ems` | Requires the mail servers (MX) of the site domain to support the TLS 1.2 Extended Master Secret (RFC 7627). | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
249
- | `mail-tls-kex-hash` | Requires the mail servers (MX) not to sign the TLS key exchange with weak hash functions (SHA-1, SHA-224). | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
250
- | `mail-tls-kex-params` | Requires the ephemeral Diffie-Hellman parameters (DH size, EC curves) of the mail servers (MX) to be secure. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
251
- | `mail-tls-ocsp-stapling` | Checks that the mail servers (MX) staple an OCSP response when their certificate has an OCSP pointer. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
252
- | `mail-tls-renegotiation-client` | Checks that the mail servers (MX) of the site domain do not allow unlimited client-initiated renegotiation. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
253
- | `mail-tls-renegotiation-secure` | Requires the mail servers (MX) of the site domain to support secure renegotiation (RFC 5746). | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
254
- | `mail-tls-version` | Requires the mail servers (MX) of the site domain to accept only secure TLS versions (TLS 1.3 and TLS 1.2) over STARTTLS. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
255
- | `mail-tls-zero-rtt` | Requires the mail servers (MX) of the site domain not to accept TLS 1.3 0-RTT early data. | Email security (also HTTPS and certificates) | `internetnl`, `email`, `tls` |
256
- | `manifest-icons` | Checks the manifest declares a 192x192 and a 512x512 PNG icon. | Progressive Web App (also Link previews and icons) | `w3c`, `pwa` |
257
- | `manifest-linked` | Requires a <link rel="manifest"> with an absolute href. | Progressive Web App (also Link previews and icons) | `w3c`, `pwa` |
258
- | `manifest-valid` | Fetches the Web App Manifest and validates it against the W3C spec. | Progressive Web App | `w3c`, `pwa` |
259
- | `mta-sts` | Requires the site mail domain to publish a valid MTA-STS TXT record and a matching HTTPS policy file. | Email security | `ietf`, `email`, `dns` |
260
- | `nel` | Checks that the NEL header is valid JSON with a max_age and a report_to group. | Site protection (also Visitor privacy) | `mdn`, `security-headers` |
261
- | `no-vary-search` | Checks that No-Vary-Search uses the recognised key-order, params or except keys. | Site protection | `mdn`, `security-headers` |
262
- | `nodeinfo` | Validates the /.well-known/nodeinfo links document when present (Fediverse NodeInfo). | LLMs and AI | `original`, `agent` |
263
- | `observe-browsing-topics` | Reports Topics API participation and validates the Observe-Browsing-Topics header. | Visitor privacy | `mdn`, `privacy` |
264
- | `oembed-discovery` | Checks for an oEmbed <link rel="alternate" type="application/json+oembed"> with an href. | Link previews and icons | `oembed`, `social` |
265
- | `opengraph-description-could-be-longer` | Flags an og:description of 50 to 70 characters. | Link previews and icons | `opengraph`, `social`, `seo` |
266
- | `opengraph-description-is-url` | Flags an og:description that starts with a URL. | Link previews and icons | `opengraph`, `social`, `seo` |
267
- | `opengraph-description-keyword-stuffing` | Flags an og:description that repeats the same word excessively. | Link previews and icons | `opengraph`, `social`, `seo` |
268
- | `opengraph-description-missing` | Requires an og:description meta tag. | Link previews and icons (also Search and page quality) | `opengraph`, `social`, `seo`, `roctify` |
269
- | `opengraph-description-same-as-title` | Flags an og:description identical to the og:title. | Link previews and icons | `opengraph`, `social`, `seo` |
270
- | `opengraph-description-slightly-long` | Flags an og:description of 161 to 200 characters. | Link previews and icons | `opengraph`, `social`, `seo` |
271
- | `opengraph-description-too-long` | Flags an og:description of more than 160 characters. | Link previews and icons | `opengraph`, `social`, `seo` |
272
- | `opengraph-description-too-short` | Flags an og:description shorter than 50 characters. | Link previews and icons | `opengraph`, `social`, `seo` |
273
- | `opengraph-image-alt-missing` | Requires og:image:alt next to og:image. | Link previews and icons (also Search and page quality) | `opengraph`, `social`, `seo` |
274
- | `opengraph-image-broken` | Requires the og:image URL to return an image. | Link previews and icons | `opengraph`, `social` |
275
- | `opengraph-image-dimensions-missing` | Requires og:image:width and og:image:height next to og:image. | Link previews and icons | `opengraph`, `social` |
276
- | `opengraph-image-dimensions-too-large` | Flags an og:image over 4096 pixels on a side. | Link previews and icons | `opengraph`, `social` |
277
- | `opengraph-image-missing` | Requires an og:image meta tag. | Link previews and icons | `opengraph`, `social`, `roctify` |
278
- | `opengraph-image-non-optimal-size` | Flags an og:image that is not 1200x630 pixels (1.91:1). | Link previews and icons | `opengraph`, `social` |
279
- | `opengraph-image-not-https` | Requires the og:image URL to use HTTPS. | Link previews and icons | `opengraph`, `social` |
280
- | `opengraph-image-too-large` | Flags an og:image over WhatsApp's 500 KB limit. | Link previews and icons | `opengraph`, `social` |
281
- | `opengraph-image-too-small` | Flags an og:image below the minimum size of social platforms. | Link previews and icons | `opengraph`, `social` |
282
- | `opengraph-locale-missing` | Requires an og:locale meta tag. | Link previews and icons | `opengraph`, `social` |
283
- | `opengraph-site-name-missing` | Requires an og:site_name meta tag. | Link previews and icons | `opengraph`, `social` |
284
- | `opengraph-title-missing` | Requires an og:title meta tag. | Link previews and icons (also Search and page quality) | `opengraph`, `social`, `seo`, `roctify` |
285
- | `opengraph-title-too-long` | Requires og:title to be 60 characters or fewer. | Link previews and icons | `opengraph`, `social`, `seo` |
286
- | `opengraph-title-too-short` | Flags an og:title shorter than 15 characters. | Link previews and icons | `opengraph`, `social`, `seo` |
287
- | `opengraph-type-missing` | Requires an og:type meta tag. | Link previews and icons | `opengraph`, `social` |
288
- | `opengraph-url-missing` | Requires an og:url meta tag. | Link previews and icons | `opengraph`, `social`, `seo`, `roctify` |
289
- | `opensearch-discovery` | Checks for an OpenSearch <link rel="search" type="application/opensearchdescription+xml">. | Link previews and icons (also Search and page quality) | `opensearch`, `social` |
290
- | `opensearch-valid` | Fetches the discovered OpenSearch description and checks it is well-formed. | Link previews and icons (also Search and page quality) | `opensearch`, `social` |
291
- | `origin-agent-cluster` | Recommends Origin-Agent-Cluster: ?1 and reports any other value of the header. | Site protection | `mdn`, `security-headers` |
292
- | `pagination-rel` | Reports rel=prev/rel=next links with a missing or non-absolute URL. | Search and page quality | `mdn`, `seo` |
293
- | `permissions-policy` | Requires the Permissions-Policy header to disable the browser features listed by OWASP. | Site protection | `owasp`, `security-headers` |
294
- | `pingback` | Flags a Pingback endpoint as a legacy spam/amplification risk when present. | Link previews and icons (also Site protection) | `original`, `social` |
295
- | `privacy-cookies` | Counts first-party and third-party cookies set by responses and by script. | Visitor privacy | `webbkoll`, `privacy` |
296
- | `privacy-geolocation` | Finds inline and loaded scripts that use the Geolocation API. | Visitor privacy | `original`, `privacy` |
297
- | `privacy-insecure-first-party` | Finds requests to the page’s own domain that use http although the page uses https. | HTTPS and certificates (also Visitor privacy) | `webbkoll`, `privacy`, `security-headers` |
298
- | `privacy-local-storage` | Reports data the page stores in localStorage. | Visitor privacy | `webbkoll`, `privacy` |
299
- | `privacy-mixed-content` | Finds insecure subresources loaded by a page served over https. | HTTPS and certificates (also Visitor privacy, Site protection) | `webbkoll`, `privacy`, `security-headers`, `roctify` |
300
- | `privacy-policy-link-missing` | Warns when the page links to no privacy policy. | Visitor privacy | `google`, `privacy` |
301
- | `privacy-third-party-requests` | Lists requests to hosts outside the page’s registrable domain, by host and type. | Visitor privacy | `webbkoll`, `privacy` |
302
- | `public-key-pins` | Reports the deprecated Public-Key-Pins header when it is sent. | Site protection | `owasp`, `security-headers` |
303
- | `redirection` | Checks that http:// redirects to https:// on the same host before any other redirect. | HTTPS and certificates (also Site protection) | `observatory`, `internetnl`, `security-headers`, `roctify` |
304
- | `referrer-policy` | Checks that a Referrer-Policy is set and does not leak the full URL to other sites. | Visitor privacy (also Site protection) | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers`, `privacy` |
305
- | `rel-me` | Reports rel=me identity links and warns when one has no target (IndieWeb). | Link previews and icons | `indieweb`, `social` |
306
- | `reporting-endpoints` | Checks that Reporting-Endpoints maps endpoint names to quoted absolute https URLs. | Site protection | `mdn`, `security-headers` |
307
- | `repr-digest` | Validates the Repr-Digest header as an RFC 9530 digest dictionary when present. | Site protection | `mdn`, `security-headers` |
308
- | `retry-after` | Checks that Retry-After is a valid delay on a 429 or 503 response. | Site protection | `mdn`, `security-headers` |
309
- | `richresults-article` | Validates Article/NewsArticle/BlogPosting JSON-LD against Google rich-results recommended properties. | Search and page quality (also LLMs and AI) | `google`, `seo` |
310
- | `richresults-breadcrumb` | Validates BreadcrumbList JSON-LD (itemListElement with position and item/name) against Google rich-results rules. | Search and page quality (also LLMs and AI) | `google`, `seo` |
311
- | `richresults-event` | Validates Event JSON-LD (name, startDate, location) against Google rich-results rules. | Search and page quality (also LLMs and AI) | `google`, `seo` |
312
- | `richresults-jobposting` | Validates JobPosting JSON-LD (title, description, datePosted, hiringOrganization, jobLocation) against Google rich-results rules. | Search and page quality (also LLMs and AI) | `google`, `seo` |
313
- | `richresults-localbusiness` | Validates LocalBusiness JSON-LD (name, address) against Google rich-results required and recommended properties. | Search and page quality (also LLMs and AI) | `google`, `seo` |
314
- | `richresults-product` | Validates Product JSON-LD (name, image, offers, review, aggregateRating) against Google rich-results rules. | Search and page quality (also LLMs and AI) | `google`, `seo` |
315
- | `richresults-recipe` | Validates Recipe JSON-LD against Google rich-results required and recommended properties. | Search and page quality (also LLMs and AI) | `google`, `seo` |
316
- | `richresults-review` | Validates Review/AggregateRating JSON-LD (itemReviewed, reviewRating with ratingValue) against Google rich-results rules. | Search and page quality (also LLMs and AI) | `google`, `seo` |
317
- | `richresults-video` | Validates VideoObject JSON-LD (name, thumbnailUrl, uploadDate) against Google rich-results rules. | Search and page quality (also LLMs and AI) | `google`, `seo` |
318
- | `richresults-website-searchaction` | Validates WebSite SearchAction JSON-LD (target and query-input) for the sitelinks search box. | Search and page quality (also LLMs and AI) | `google`, `seo` |
319
- | `robots-txt` | Checks that robots.txt follows RFC 9309, including Content-Signal lines. | LLMs and AI (also Search and page quality) | `files`, `seo`, `agent`, `roctify` |
320
- | `rpki-ns-exists` | Requires an RPKI ROA to be published for every IP address of the name servers. | DNS and network | `internetnl`, `dns` |
321
- | `rpki-ns-valid` | Requires the route announcements of the name server IP addresses to be RPKI valid. | DNS and network | `internetnl`, `dns` |
322
- | `rpki-web-exists` | Requires an RPKI ROA to be published for every IP address of the web server. | DNS and network | `internetnl`, `dns` |
323
- | `rpki-web-valid` | Requires the route announcements of the web server IP addresses to be RPKI valid. | DNS and network | `internetnl`, `dns` |
324
- | `security-txt` | Checks that /.well-known/security.txt follows RFC 9116. | Site protection | `files`, `internetnl`, `security-headers` |
325
- | `sellers-json` | Checks that /sellers.json follows the IAB Tech Lab sellers.json 1.0 spec. | Search and page quality | `iab`, `seo` |
326
- | `seo-canonical-mismatch` | Reports a canonical URL that differs from the page URL. | Search and page quality | `opengraph`, `seo`, `roctify` |
327
- | `seo-canonical-missing` | Reports pages without <link rel="canonical">. | Search and page quality | `opengraph`, `seo`, `roctify` |
328
- | `seo-content-length` | Warns when the page has fewer than 300 words of text. | Search and page quality | `roctify`, `seo` |
329
- | `seo-deprecated-html` | Warns when the page uses obsolete HTML elements. | Search and page quality | `roctify`, `seo` |
330
- | `seo-h1-missing` | Warns when the page has no <h1> heading. | Search and page quality | `opengraph`, `seo`, `roctify` |
331
- | `seo-h1-multiple` | Reports pages with more than one <h1>. | Search and page quality | `opengraph`, `seo`, `roctify` |
332
- | `seo-html-lang-missing` | Warns when <html> has no lang attribute. | Search and page quality | `opengraph`, `seo`, `roctify` |
333
- | `seo-http-status` | Reports a page whose HTTP status is not 200. | Search and page quality | `roctify`, `seo` |
334
- | `seo-keywords-frequent` | Lists the most frequent keywords of the page text. | Search and page quality | `roctify`, `seo` |
335
- | `seo-keywords-in-title` | Warns when none of the most frequent keywords of the page is in the title. | Search and page quality | `roctify`, `seo` |
336
- | `seo-link-anchor-text` | Warns about links with no text or with generic text. | Search and page quality | `roctify`, `seo` |
337
- | `seo-links` | Warns when the page has no links or no internal links. | Search and page quality | `roctify`, `seo` |
338
- | `seo-meta-description-missing` | Requires a <meta name="description"> tag. | Search and page quality | `opengraph`, `seo`, `roctify` |
339
- | `seo-meta-description-too-long` | Reports a meta description longer than 160 characters. | Search and page quality | `opengraph`, `seo`, `roctify` |
340
- | `seo-meta-description-too-short` | Reports a meta description shorter than 50 characters. | Search and page quality | `opengraph`, `seo`, `roctify` |
341
- | `seo-responsive-images` | Warns when most images have no srcset or picture element. | Search and page quality | `roctify`, `seo` |
342
- | `seo-robots-nofollow` | Reports when the robots meta tag contains nofollow. | Search and page quality | `opengraph`, `seo` |
343
- | `seo-robots-noindex` | Warns when the robots meta tag contains noindex. | Search and page quality (also LLMs and AI) | `opengraph`, `seo`, `roctify` |
344
- | `seo-structured-data-missing` | Reports pages without a JSON-LD block. | Search and page quality (also LLMs and AI) | `opengraph`, `seo`, `roctify` |
345
- | `seo-title-missing` | Requires a non-empty <title> element in the head. | Search and page quality | `opengraph`, `seo`, `roctify` |
346
- | `seo-title-too-long` | Warns when the <title> is longer than 70 characters. | Search and page quality | `opengraph`, `seo`, `roctify` |
347
- | `seo-title-too-short` | Reports a <title> shorter than 10 characters. | Search and page quality | `opengraph`, `seo`, `roctify` |
348
- | `seo-url-friendly` | Warns when the URL is long, upper case, has underscores, encoded characters, many levels or many parameters. | Search and page quality | `roctify`, `seo` |
349
- | `seo-viewport` | Requires a viewport meta tag with width=device-width that allows zooming. | Search and page quality | `roctify`, `seo` |
350
- | `server-banner` | Reports when the Server header discloses a software version or operating system. | Site protection | `mdn`, `security-headers`, `roctify` |
351
- | `server-timing` | Reports the Server-Timing header, which can expose backend metric names and timings. | Site protection | `mdn`, `security-headers` |
352
- | `service-worker-allowed` | Validates that the Service-Worker-Allowed header is a path or absolute URL when present. | Site protection | `mdn`, `security-headers` |
353
- | `set-login` | Validates that the FedCM Set-Login header is logged-in or logged-out when present. | Site protection | `mdn`, `security-headers` |
354
- | `sourcemap` | Reports the SourceMap or X-SourceMap header, which exposes source maps to every client. | Site protection | `mdn`, `security-headers` |
355
- | `speculation-rules` | Validates that the Speculation-Rules header lists quoted ruleset URLs when present. | Site protection | `mdn`, `security-headers` |
356
- | `supports-loading-mode` | Validates the Supports-Loading-Mode tokens (credentialed-prerender, fenced-frame) when present. | Site protection | `mdn`, `security-headers` |
357
- | `tabnabbing` | Checks that cross-origin target="_blank" links set rel="noopener". | Site protection | `owasp`, `security-headers` |
358
- | `technical-asset-count` | Warns about many external scripts or stylesheets and render-blocking scripts. | Search and page quality | `roctify`, `seo` |
359
- | `technical-canonical-invalid` | Requires the canonical link href to be a valid URL, absolute or relative. | Search and page quality | `llmscout`, `seo` |
360
- | `technical-heading-hierarchy` | Warns when a heading jumps down more than one level, such as an h2 followed by an h4. | Search and page quality | `llmscout`, `seo`, `roctify` |
361
- | `technical-html-size` | Warns when the HTML document is larger than 200 KB. | Search and page quality | `roctify`, `seo` |
362
- | `technical-image-alt-coverage` | Checks that img elements carry an alt attribute (warns from 80% coverage, errors below). | Search and page quality (also LLMs and AI) | `llmscout`, `seo`, `roctify` |
363
- | `technical-image-formats` | Warns when images ship only as JPEG, PNG or GIF. | Search and page quality | `roctify`, `seo` |
364
- | `technical-image-weight` | Warns when an image is over 200 KB and errors when it is over 500 KB. | Search and page quality | `llmscout`, `seo` |
365
- | `technical-lazy-loading` | Warns when images and iframes after the first two have no loading="lazy". | Search and page quality | `roctify`, `seo` |
366
- | `technical-redirect-chain` | Warns about long redirect chains and chains ending in an error. | Search and page quality (also HTTPS and certificates) | `llmscout`, `seo` |
367
- | `technical-response-time` | Warns when the first response took more than 600 ms. | Search and page quality | `roctify`, `seo` |
368
- | `technical-robots-meta-advanced` | Warns when the robots meta tag lacks max-snippet, max-image-preview or max-video-preview. | Search and page quality (also LLMs and AI) | `llmscout`, `seo` |
369
- | `technical-twitter-card-type` | Requires twitter:card to be summary, summary_large_image, app or player. | Link previews and icons (also Search and page quality) | `llmscout`, `seo`, `social` |
370
- | `terms-of-service-link-missing` | Warns when the page links to no terms of service. | Visitor privacy | `google`, `privacy` |
371
- | `theme-color-meta` | Recommends a <meta name="theme-color"> on the page. | Progressive Web App | `w3c`, `pwa` |
372
- | `timing-allow-origin` | Reports Timing-Allow-Origin: * and malformed origins in the timing-exposure list. | Visitor privacy (also Site protection) | `mdn`, `security-headers`, `privacy` |
373
- | `tls-cipher-order` | Requires the HTTPS server to enforce its own preference for the most secure cipher suites. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
374
- | `tls-ciphers` | Requires the HTTPS server to accept only secure (good or sufficient) cipher suites. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
375
- | `tls-compression` | Requires the HTTPS server not to support TLS compression. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
376
- | `tls-ems` | Requires the HTTPS server to support the TLS 1.2 Extended Master Secret (RFC 7627). | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
377
- | `tls-kex-hash` | Requires the HTTPS server not to sign the TLS key exchange with weak hash functions (SHA-1, SHA-224). | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
378
- | `tls-kex-params` | Requires the ephemeral Diffie-Hellman parameters of the HTTPS server (DH size, EC curves) to be secure. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
379
- | `tls-ocsp-stapling` | Checks that the HTTPS server staples an OCSP response when its certificate has an OCSP pointer. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
380
- | `tls-renegotiation-client` | Checks that the HTTPS server does not allow unlimited client-initiated renegotiation. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
381
- | `tls-renegotiation-secure` | Requires the HTTPS server to support secure renegotiation (RFC 5746). | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
382
- | `tls-rpt` | Requires the site mail domain to publish a valid TLS-RPT record with a report destination. | Email security | `ietf`, `email`, `dns` |
383
- | `tls-version` | Requires the HTTPS server to accept only secure TLS versions (TLS 1.3 and TLS 1.2). | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
384
- | `tls-zero-rtt` | Requires the HTTPS server not to accept TLS 1.3 0-RTT early data. | HTTPS and certificates | `internetnl`, `tls`, `security-headers` |
385
- | `twitter-card-missing` | Requires a twitter:card meta tag. | Link previews and icons | `opengraph`, `social`, `roctify` |
386
- | `twitter-card-not-large` | Suggests summary_large_image instead of summary. | Link previews and icons | `opengraph`, `social` |
387
- | `twitter-description-missing` | Requires a twitter:description meta tag. | Link previews and icons | `opengraph`, `social` |
388
- | `twitter-image-missing` | Requires a twitter:image meta tag. | Link previews and icons | `opengraph`, `social` |
389
- | `twitter-site-missing` | Requires a twitter:site meta tag. | Link previews and icons | `opengraph`, `social` |
390
- | `twitter-title-missing` | Requires a twitter:title meta tag. | Link previews and icons | `opengraph`, `social` |
391
- | `use-as-dictionary` | Validates the Use-As-Dictionary compression-dictionary header, requiring a match pattern, when present. | Site protection | `mdn`, `security-headers` |
392
- | `vary` | Reports Vary: * and a wildcard mixed with named headers, which defeat shared caching. | Site protection | `mdn`, `security-headers` |
393
- | `via` | Reports when the Via header names the proxy or gateway software in front of the site. | Site protection | `mdn`, `security-headers` |
394
- | `webfinger` | Probes /.well-known/webfinger and reports its format when present (RFC 7033). | LLMs and AI | `ietf`, `agent` |
395
- | `webmention` | Reports a Webmention endpoint and warns when it is not an absolute URL (W3C Webmention). | Link previews and icons | `w3c`, `social` |
396
- | `x-content-type-options` | Requires the X-Content-Type-Options header to be nosniff. | Site protection | `observatory`, `roctify`, `security-headers` |
397
- | `x-dns-prefetch-control` | Requires the X-DNS-Prefetch-Control header to be set to off. | Visitor privacy (also Site protection) | `owasp`, `security-headers`, `privacy` |
398
- | `x-frame-options` | Checks that the page cannot be framed by other sites, with X-Frame-Options or CSP frame-ancestors. | Site protection | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers`, `roctify` |
399
- | `x-permitted-cross-domain-policies` | Requires the X-Permitted-Cross-Domain-Policies header to be set to none. | Site protection | `owasp`, `security-headers` |
400
- | `x-powered-by` | Reports the X-Powered-By header, which reveals the technology stack to no benefit. | Site protection | `mdn`, `security-headers` |
401
- | `x-xss-protection` | Reports the deprecated X-XSS-Protection header when it is sent. | Site protection | `owasp`, `webbkoll`, `security-headers` |
150
+ | Hint | What it checks | Section | Tier | Control | Added | Groups |
151
+ | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ------------ | -------- | ------- | ------------------------------------------------------------------------------- |
152
+ | `accept-ch` | Checks the Accept-CH token list and notes that each client hint adds to fingerprinting. | Privacy | recommended | deployer | 2026-10 | `mdn`, `security-headers`, `privacy` |
153
+ | `accept-patch` | Validates the Accept-Patch media-type list advertising PATCH body formats when present. | HTTP behaviour | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
154
+ | `accept-post` | Validates the Accept-Post media-type list advertising POST body formats when present. | HTTP behaviour | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
155
+ | `ads-txt` | Checks that /ads.txt follows the IAB Tech Lab ads.txt 1.1 spec. | Advertising | recommended | deployer | 2026-10 | `iab`, `seo` |
156
+ | `age` | Checks that the Age header is a non-negative number of seconds. | HTTP behaviour | recommended | platform | 2026-10 | `mdn`, `security-headers` |
157
+ | `agent-a2a-agent-card` | Requires an A2A agent card at /.well-known/agent-card.json. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
158
+ | `agent-acp` | Reports whether /.well-known/acp.json is published. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
159
+ | `agent-ai-bot-rules` | Requires robots.txt rules naming known AI crawlers. | AI and agents | recommended | deployer | 2026-10 | `agent-ready`, `agent`, `privacy` |
160
+ | `agent-api-catalog` | Requires an RFC 9727 linkset at /.well-known/api-catalog. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
161
+ | `agent-ard` | Requires a valid AI catalog at /.well-known/ard.json. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent`, `dns` |
162
+ | `agent-auth-md` | Requires /auth.md with agent registration instructions. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
163
+ | `agent-content-signals` | Requires a Content-Signal directive in robots.txt. | AI and agents | recommended | deployer | 2026-10 | `agent-ready`, `agent`, `privacy` |
164
+ | `agent-dns-aid` | Requires SVCB or HTTPS records under _agents of the host (DNS-AID). | AI and agents | experimental | dns | 2026-10 | `agent-ready`, `agent`, `dns` |
165
+ | `agent-link-headers` | Requires a Link header with an agent-useful relation such as api-catalog or service-desc. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
166
+ | `agent-markdown-negotiation` | Requires text/markdown when the home page is requested with Accept: text/markdown. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
167
+ | `agent-mcp-server-card` | Requires an MCP server card with serverInfo and a transport endpoint. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
168
+ | `agent-mpp` | Reports whether /openapi.json advertises x-payment-info (MPP). | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
169
+ | `agent-oauth-discovery` | Requires OIDC or RFC 8414 authorization server metadata with a valid issuer. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
170
+ | `agent-oauth-protected-resource` | Requires /.well-known/oauth-protected-resource with a resource on this site. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
171
+ | `agent-poppy` | Requires a valid /.well-known/poppy.json. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
172
+ | `agent-robots-txt` | Requires a text/plain /robots.txt with at least one User-agent directive. | SEO | recommended | deployer | 2026-10 | `agent-ready`, `agent` |
173
+ | `agent-score` | Reports the overall agent readiness score and level. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
174
+ | `agent-sitemap` | Requires a valid XML sitemap listed in robots.txt or at /sitemap.xml. | SEO | recommended | deployer | 2026-10 | `agent-ready`, `agent`, `roctify`, `seo` |
175
+ | `agent-skills` | Requires an agent skills index with name, type, description, url and digest per skill. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
176
+ | `agent-ucp` | Reports whether /.well-known/ucp is published. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
177
+ | `agent-web-bot-auth` | Requires a key directory at /.well-known/http-message-signatures-directory. | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent`, `security-headers` |
178
+ | `agent-webmcp` | Requires the page to expose WebMCP tools (modelContext or toolname forms). | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
179
+ | `agent-x402` | Reports whether an endpoint answers 402 Payment Required (x402). | AI and agents | experimental | deployer | 2026-10 | `agent-ready`, `agent` |
180
+ | `ai-txt` | Checks that /ai.txt is valid in the aitxt.ing or Spawning format. | AI and agents | advanced | deployer | 2026-10 | `files`, `agent` |
181
+ | `alt-svc` | Reports the advertised alternative services and flags a malformed Alt-Svc value. | HTTP behaviour | recommended | platform | 2026-10 | `mdn`, `security-headers` |
182
+ | `alternate-media` | Reports a malformed <link rel="alternate" media="…">. | SEO | recommended | deployer | 2026-10 | `mdn`, `seo` |
183
+ | `app-ads-txt` | Checks that /app-ads.txt follows the IAB Tech Lab app-ads.txt spec. | Advertising | recommended | deployer | 2026-10 | `iab`, `seo` |
184
+ | `apple-app-site-association` | Checks that the apple-app-site-association file follows Apple associated-domains rules. | Progressive web app | recommended | deployer | 2026-10 | `apple`, `security-headers` |
185
+ | `assetlinks-json` | Checks that /.well-known/assetlinks.json follows the Digital Asset Links schema. | Progressive web app | recommended | deployer | 2026-10 | `google`, `security-headers` |
186
+ | `attribution-reporting` | Reports participation in the Attribution Reporting API and validates the registration headers. | Privacy | experimental | deployer | 2026-10 | `mdn`, `privacy` |
187
+ | `bimi` | Requires the site mail domain, when it publishes BIMI, to use an HTTPS SVG logo and HTTPS certificate URL. | Email | advanced | mail | 2026-10 | `ietf`, `email`, `dns` |
188
+ | `caa` | Requires the domain to publish syntactically valid CAA records that include an issue property. | DNS and network | recommended | dns | 2026-10 | `internetnl`, `dns`, `tls` |
189
+ | `cache-control` | Requires Cache-Control: no-store, max-age=0 on private applications (opt-in with the enforce option). | HTTP behaviour | advanced | deployer | 2026-10 | `owasp`, `security-headers` |
190
+ | `cert-hostname` | Requires the host name of the website to match a name on its HTTPS certificate. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
191
+ | `cert-pubkey` | Requires every certificate in the HTTPS chain to use a secure public key type and size. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
192
+ | `cert-signature` | Requires every certificate in the HTTPS chain to be signed with a secure algorithm and hash function. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
193
+ | `cert-trust` | Requires the HTTPS certificate to chain to a trusted root, with all intermediates sent. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
194
+ | `change-password` | Checks that /.well-known/change-password resolves to a password-change page. | Exposed files | advanced | deployer | 2026-10 | `w3c`, `security-headers` |
195
+ | `clear-site-data` | Requires the logout response to send Clear-Site-Data for cache, cookies and storage. | Security headers | advanced | deployer | 2026-10 | `owasp`, `security-headers` |
196
+ | `coep` | Checks that Cross-Origin-Embedder-Policy requires embedded resources to opt in. | Security headers | recommended | deployer | 2026-10 | `observatory`, `owasp`, `security-headers` |
197
+ | `content-digest` | Validates the Content-Digest header as an RFC 9530 digest dictionary when present. | HTTP behaviour | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
198
+ | `cookie-prefixes` | Checks that __Host- and __Secure- cookies meet their prefix requirements. | Security headers | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
199
+ | `cookies` | Checks that cookies use Secure, HttpOnly for sessions and SameSite. | Security headers | recommended | deployer | 2026-10 | `observatory`, `security-headers`, `privacy` |
200
+ | `coop` | Checks that Cross-Origin-Opener-Policy isolates the page from windows it did not open. | Security headers | recommended | deployer | 2026-10 | `observatory`, `owasp`, `security-headers` |
201
+ | `corp` | Checks that Cross-Origin-Resource-Policy limits who may load the page as a resource. | Security headers | recommended | deployer | 2026-10 | `observatory`, `owasp`, `security-headers` |
202
+ | `cors` | Checks that Access-Control-Allow-Origin does not let any site make credentialed requests. | Security headers | recommended | deployer | 2026-10 | `observatory`, `security-headers` |
203
+ | `cors-allow-credentials` | Reports credentialed CORS access, especially when combined with a wildcard origin. | Security headers | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
204
+ | `cors-allow-headers` | Reports a wildcard Access-Control-Allow-Headers, which allows every request header. | Security headers | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
205
+ | `cors-allow-methods` | Reports a wildcard or unrecognised method in the Access-Control-Allow-Methods header. | Security headers | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
206
+ | `cors-expose-headers` | Reports a wildcard or sensitive header in the Access-Control-Expose-Headers header. | Security headers | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
207
+ | `cors-max-age` | Reports a malformed or excessively long Access-Control-Max-Age preflight cache. | Security headers | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
208
+ | `critical-ch` | Checks that every hint in Critical-CH is also advertised in Accept-CH. | Privacy | recommended | deployer | 2026-10 | `mdn`, `security-headers`, `privacy` |
209
+ | `csp` | Checks that a Content Security Policy is set and does not allow unsafe sources. | Security headers | recommended | deployer | 2026-10 | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers` |
210
+ | `csp-reporting` | Reports CSP, report-only and NEL report endpoints that point to a third-party domain. | Security headers | recommended | deployer | 2026-10 | `webbkoll`, `security-headers`, `privacy` |
211
+ | `csp-strength` | Evaluates CSP depth for unsafe-inline, unsafe-eval, object-src, base-uri and broad allowlists. | Security headers | advanced | deployer | 2026-10 | `google`, `security-headers` |
212
+ | `dane-exists` | Checks that the website domain publishes a signed TLSA record for DANE. | DNS and network | experimental | dns | 2026-10 | `internetnl`, `dns`, `tls` |
213
+ | `dane-rollover` | Checks that the website domain publishes at least two TLSA records so DANE survives a certificate rollover. | DNS and network | advanced | dns | 2026-10 | `internetnl`, `dns`, `tls` |
214
+ | `dane-valid` | Requires the DANE TLSA record of the website domain to match the web certificate. | DNS and network | advanced | dns | 2026-10 | `internetnl`, `dns`, `tls` |
215
+ | `dnssec-exists` | Requires the domain of the site to be DNSSEC signed. | DNS and network | advanced | dns | 2026-10 | `internetnl`, `dns` |
216
+ | `dnssec-valid` | Requires the DNSSEC signature of the domain to be valid. | DNS and network | recommended | dns | 2026-10 | `internetnl`, `dns` |
217
+ | `etag` | Reports an ETag that looks like a filesystem inode and so leaks server internals. | Exposed files | recommended | platform | 2026-10 | `mdn`, `security-headers` |
218
+ | `expect-ct` | Reports the deprecated Expect-CT header when it is sent. | Security headers | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
219
+ | `expires` | Checks that Expires is a valid HTTP-date and notes when Cache-Control max-age supersedes it. | HTTP behaviour | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
220
+ | `exposed-backup-files` | Reports when common backup files are served, leaking source or config. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
221
+ | `exposed-crossdomain` | Reports when /crossdomain.xml allows access from any domain ("*"). | Exposed files | recommended | deployer | 2026-10 | `owasp` |
222
+ | `exposed-directory-listing` | Reports when a common directory returns an automatic index of its files. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
223
+ | `exposed-ds-store` | Reports when /.DS_Store is served, leaking directory contents. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
224
+ | `exposed-env` | Reports when /.env is served with KEY=VALUE content, leaking secrets. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
225
+ | `exposed-git` | Reports when /.git/HEAD or /.git/config is served, exposing the repository. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
226
+ | `exposed-server-status` | Reports when Apache /server-status or /server-info is publicly readable. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
227
+ | `exposed-source-map` | Reports when a referenced script has a reachable, valid .js.map source map. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
228
+ | `exposed-svn` | Reports when /.svn/entries or /.svn/wc.db is served, exposing the repository. | Exposed files | recommended | deployer | 2026-10 | `owasp` |
229
+ | `feature-policy` | Reports the deprecated Feature-Policy header when it is sent. | Security headers | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
230
+ | `feed-discovery` | Checks for an RSS/Atom feed <link rel="alternate"> with an absolute href. | Feeds and discovery | advanced | deployer | 2026-10 | `ietf`, `social` |
231
+ | `feed-valid` | Fetches each discovered RSS/Atom feed and checks it is well-formed. | Feeds and discovery | recommended | deployer | 2026-10 | `ietf`, `social` |
232
+ | `form-action-secure` | Checks that forms on an HTTPS page do not submit to an http:// action. | HTTPS and certificates | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
233
+ | `geo-content-extraction` | Reports pages whose content lacks heading and paragraph structure. | SEO | experimental | deployer | 2026-10 | `llmscout`, `agent`, `seo` |
234
+ | `geo-faq-schema` | Reports pages without FAQPage JSON-LD. | SEO | experimental | deployer | 2026-10 | `llmscout`, `agent`, `seo` |
235
+ | `geo-organization-schema` | Reports pages without Organization or Person JSON-LD that links profiles with sameAs. | SEO | experimental | deployer | 2026-10 | `llmscout`, `agent`, `seo` |
236
+ | `geo-speakable-schema` | Reports pages without Speakable JSON-LD. | SEO | experimental | deployer | 2026-10 | `llmscout`, `agent`, `seo` |
237
+ | `geo-structured-data-invalid` | Reports JSON-LD blocks that are not valid JSON. | SEO | recommended | deployer | 2026-10 | `llmscout`, `agent`, `seo` |
238
+ | `gpc-json` | Checks that /.well-known/gpc.json follows the Global Privacy Control spec. | Privacy | recommended | deployer | 2026-10 | `w3c`, `privacy` |
239
+ | `host-meta` | Validates the /.well-known/host-meta XRD/JRD document when present (RFC 6415). | Feeds and discovery | advanced | deployer | 2026-10 | `ietf`, `agent` |
240
+ | `hreflang-duplicate` | Reports hreflang values declared on more than one alternate. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
241
+ | `hreflang-return` | Flags hreflang alternates that use a non-absolute URL. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
242
+ | `hreflang-self` | Reports an hreflang set that does not reference the page itself. | SEO | recommended | deployer | 2026-10 | `google`, `seo`, `roctify` |
243
+ | `hreflang-valid-codes` | Reports hreflang values that are not valid language/region codes. | SEO | recommended | deployer | 2026-10 | `google`, `seo`, `roctify` |
244
+ | `hreflang-x-default` | Reports an hreflang set that has no x-default entry. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
245
+ | `hsts` | Checks the Strict-Transport-Security header: HTTPS only, max-age and subdomain coverage. | HTTPS and certificates | recommended | deployer | 2026-10 | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers`, `roctify` |
246
+ | `http-methods` | Probes OPTIONS on the root and flags TRACE (XST) and unsafe write methods. | Exposed files | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
247
+ | `https-available` | Requires the website to be reachable over HTTPS, with a completed TLS handshake on the HTTPS port. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers`, `roctify` |
248
+ | `humans-txt` | Checks that /humans.txt is present and served as plain text (humanstxt.org). | Feeds and discovery | advanced | deployer | 2026-10 | `indieweb`, `seo` |
249
+ | `icons-apple-touch-icon-missing` | Warns when the page declares no apple-touch-icon link. | Progressive web app | recommended | deployer | 2026-11 | `roctify`, `seo` |
250
+ | `icons-favicon-32-missing` | Reports sites without a 32x32 PNG favicon link. | Progressive web app | advanced | deployer | 2026-10 | `opengraph`, `seo` |
251
+ | `icons-favicon-ico-or-png-missing` | Warns when there is no .ico or .png favicon (Google Search does not support SVG favicons). | Progressive web app | advanced | deployer | 2026-10 | `opengraph`, `seo` |
252
+ | `icons-favicon-missing` | Reports sites that declare no favicon and serve no /favicon.ico. | Progressive web app | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
253
+ | `icons-favicon-svg-missing` | Reports sites without an SVG favicon link. | Progressive web app | advanced | deployer | 2026-10 | `opengraph`, `seo` |
254
+ | `integrity-policy` | Checks that Integrity-Policy declares a non-empty blocked-destinations list. | Security headers | experimental | deployer | 2026-10 | `mdn`, `security-headers` |
255
+ | `integrity-policy-report-only` | Checks that Integrity-Policy-Report-Only declares a non-empty blocked-destinations list. | Security headers | experimental | deployer | 2026-10 | `mdn`, `security-headers` |
256
+ | `internetnl-http-compression` | Reports when the web server compresses the root document (BREACH risk). | HTTP behaviour | advanced | platform | 2026-10 | `internetnl`, `security-headers`, `roctify` |
257
+ | `ipv6-ns-aaaa` | Requires at least two name servers of the domain to have an IPv6 address. | DNS and network | recommended | dns | 2026-10 | `internetnl`, `dns` |
258
+ | `ipv6-ns-reach` | Requires every name server with an IPv6 address to be reachable over IPv6. | DNS and network | recommended | dns | 2026-10 | `internetnl`, `dns` |
259
+ | `ipv6-same-content` | Requires the website over IPv6 to offer the same ports, headers and content as over IPv4. | DNS and network | advanced | platform | 2026-10 | `internetnl`, `dns` |
260
+ | `ipv6-web-aaaa` | Requires the web server to have at least one IPv6 address. | DNS and network | recommended | platform | 2026-10 | `internetnl`, `dns` |
261
+ | `ipv6-web-reach` | Requires every IPv6 address of the web server to be reachable over IPv6. | DNS and network | recommended | platform | 2026-10 | `internetnl`, `dns` |
262
+ | `last-modified` | Checks that the Last-Modified header is a valid HTTP-date. | HTTP behaviour | recommended | platform | 2026-10 | `mdn`, `security-headers` |
263
+ | `llms-full-txt` | Checks that /llms-full.txt is non-empty markdown that parses. | AI and agents | advanced | deployer | 2026-10 | `files`, `agent` |
264
+ | `llms-txt` | Checks that /llms.txt follows the llmstxt.org format. | AI and agents | advanced | deployer | 2026-10 | `files`, `agent` |
265
+ | `mail-caa` | Requires the mail servers (MX) of the site domain to be covered by syntactically valid CAA records with an issue property. | Email | advanced | dns | 2026-10 | `internetnl`, `email`, `dns`, `tls` |
266
+ | `mail-cert-hostname` | Checks that the host names of the mail servers (MX) match a name on their certificates. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
267
+ | `mail-cert-pubkey` | Requires every certificate in the chain of the mail servers (MX) to use a secure public key type and size. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
268
+ | `mail-cert-signature` | Requires every certificate in the chain of the mail servers (MX) to be signed with a secure algorithm and hash function. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
269
+ | `mail-cert-trust` | Checks that the certificates of the mail servers (MX) chain to a trusted root, with all intermediates sent. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
270
+ | `mail-dane` | Requires the mail servers (MX) of the site domain to publish DNSSEC-signed TLSA records that match their certificates. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `dns`, `tls` |
271
+ | `mail-dane-rollover` | Checks that the mail servers (MX) of the site domain publish at least two TLSA records so DANE survives a certificate rollover. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `dns`, `tls` |
272
+ | `mail-dkim` | Requires the DKIM selectors given in the options to have valid key records under the site domain. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `dns` |
273
+ | `mail-dmarc` | Requires the site domain to publish a valid DMARC record with a policy other than none and valid report addresses. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `dns` |
274
+ | `mail-dnssec` | Requires the site domain and the domains of its mail servers (MX) to be DNSSEC signed with a valid signature. | Email | advanced | dns | 2026-10 | `internetnl`, `email`, `dns` |
275
+ | `mail-ipv6` | Requires the mail servers (MX) of the site domain to have IPv6 addresses that are reachable on port 25. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `dns` |
276
+ | `mail-ns-rpki-exists` | Requires an RPKI Route Origin Authorisation to be published for every IP address of the name servers of the mail servers (MX). | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `dns` |
277
+ | `mail-ns-rpki-valid` | Requires the route announcements of the IP addresses of the name servers of the mail servers (MX) to be RPKI valid. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `dns` |
278
+ | `mail-rpki` | Requires the routes of the IP addresses of the mail servers (MX) to be covered by valid RPKI Route Origin Authorisations. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `dns` |
279
+ | `mail-spf` | Requires the site domain to have a valid SPF record within the 10 lookup limit that ends in -all or ~all. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `dns` |
280
+ | `mail-starttls` | Requires the mail servers (MX) of the site domain to offer STARTTLS, negotiate TLS 1.2 or 1.3 and present a valid certificate. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
281
+ | `mail-tls-cipher-order` | Requires the mail servers (MX) of the site domain to enforce their own preference for the most secure cipher suites. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `tls` |
282
+ | `mail-tls-ciphers` | Requires the mail servers (MX) of the site domain to accept only secure (good or sufficient) cipher suites over STARTTLS. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
283
+ | `mail-tls-compression` | Requires the mail servers (MX) of the site domain not to support TLS compression. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
284
+ | `mail-tls-ems` | Requires the mail servers (MX) of the site domain to support the TLS 1.2 Extended Master Secret (RFC 7627). | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `tls` |
285
+ | `mail-tls-kex-hash` | Requires the mail servers (MX) not to sign the TLS key exchange with weak hash functions (SHA-1, SHA-224). | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
286
+ | `mail-tls-kex-params` | Requires the ephemeral Diffie-Hellman parameters (DH size, EC curves) of the mail servers (MX) to be secure. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
287
+ | `mail-tls-ocsp-stapling` | Checks that the mail servers (MX) staple an OCSP response when their certificate has an OCSP pointer. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `tls` |
288
+ | `mail-tls-renegotiation-client` | Checks that the mail servers (MX) of the site domain do not allow unlimited client-initiated renegotiation. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
289
+ | `mail-tls-renegotiation-secure` | Requires the mail servers (MX) of the site domain to support secure renegotiation (RFC 5746). | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
290
+ | `mail-tls-version` | Requires the mail servers (MX) of the site domain to accept only secure TLS versions (TLS 1.3 and TLS 1.2) over STARTTLS. | Email | recommended | mail | 2026-10 | `internetnl`, `email`, `tls` |
291
+ | `mail-tls-zero-rtt` | Requires the mail servers (MX) of the site domain not to accept TLS 1.3 0-RTT early data. | Email | advanced | mail | 2026-10 | `internetnl`, `email`, `tls` |
292
+ | `manifest-icons` | Checks the manifest declares a 192x192 and a 512x512 PNG icon. | Progressive web app | recommended | deployer | 2026-10 | `w3c`, `pwa` |
293
+ | `manifest-linked` | Requires a <link rel="manifest"> with an absolute href. | Progressive web app | advanced | deployer | 2026-10 | `w3c`, `pwa` |
294
+ | `manifest-valid` | Fetches the Web App Manifest and validates it against the W3C spec. | Progressive web app | recommended | deployer | 2026-10 | `w3c`, `pwa` |
295
+ | `mta-sts` | Requires the site mail domain to publish a valid MTA-STS TXT record and a matching HTTPS policy file. | Email | recommended | mail | 2026-10 | `ietf`, `email`, `dns` |
296
+ | `nel` | Checks that the NEL header is valid JSON with a max_age and a report_to group. | Security headers | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
297
+ | `no-vary-search` | Checks that No-Vary-Search uses the recognised key-order, params or except keys. | HTTP behaviour | experimental | deployer | 2026-10 | `mdn`, `security-headers` |
298
+ | `nodeinfo` | Validates the /.well-known/nodeinfo links document when present (Fediverse NodeInfo). | Feeds and discovery | advanced | deployer | 2026-10 | `original`, `agent` |
299
+ | `observe-browsing-topics` | Reports Topics API participation and validates the Observe-Browsing-Topics header. | Privacy | experimental | deployer | 2026-10 | `mdn`, `privacy` |
300
+ | `oembed-discovery` | Checks for an oEmbed <link rel="alternate" type="application/json+oembed"> with an href. | Feeds and discovery | advanced | deployer | 2026-10 | `oembed`, `social` |
301
+ | `opengraph-description-could-be-longer` | Flags an og:description of 50 to 70 characters. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social`, `seo` |
302
+ | `opengraph-description-is-url` | Flags an og:description that starts with a URL. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo` |
303
+ | `opengraph-description-keyword-stuffing` | Flags an og:description that repeats the same word excessively. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social`, `seo` |
304
+ | `opengraph-description-missing` | Requires an og:description meta tag. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo`, `roctify` |
305
+ | `opengraph-description-same-as-title` | Flags an og:description identical to the og:title. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo` |
306
+ | `opengraph-description-slightly-long` | Flags an og:description of 161 to 200 characters. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social`, `seo` |
307
+ | `opengraph-description-too-long` | Flags an og:description of more than 160 characters. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo` |
308
+ | `opengraph-description-too-short` | Flags an og:description shorter than 50 characters. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo` |
309
+ | `opengraph-image-alt-missing` | Requires og:image:alt next to og:image. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo` |
310
+ | `opengraph-image-broken` | Requires the og:image URL to return an image. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social` |
311
+ | `opengraph-image-dimensions-missing` | Requires og:image:width and og:image:height next to og:image. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social` |
312
+ | `opengraph-image-dimensions-too-large` | Flags an og:image over 4096 pixels on a side. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social` |
313
+ | `opengraph-image-missing` | Requires an og:image meta tag. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `roctify` |
314
+ | `opengraph-image-non-optimal-size` | Flags an og:image that is not 1200x630 pixels (1.91:1). | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
315
+ | `opengraph-image-not-https` | Requires the og:image URL to use HTTPS. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social` |
316
+ | `opengraph-image-too-large` | Flags an og:image over WhatsApp's 500 KB limit. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social` |
317
+ | `opengraph-image-too-small` | Flags an og:image below the minimum size of social platforms. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social` |
318
+ | `opengraph-locale-missing` | Requires an og:locale meta tag. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
319
+ | `opengraph-site-name-missing` | Requires an og:site_name meta tag. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
320
+ | `opengraph-title-missing` | Requires an og:title meta tag. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo`, `roctify` |
321
+ | `opengraph-title-too-long` | Requires og:title to be 60 characters or fewer. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo` |
322
+ | `opengraph-title-too-short` | Flags an og:title shorter than 15 characters. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social`, `seo` |
323
+ | `opengraph-type-missing` | Requires an og:type meta tag. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social` |
324
+ | `opengraph-url-missing` | Requires an og:url meta tag. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `seo`, `roctify` |
325
+ | `opensearch-discovery` | Checks for an OpenSearch <link rel="search" type="application/opensearchdescription+xml">. | Feeds and discovery | advanced | deployer | 2026-10 | `opensearch`, `social` |
326
+ | `opensearch-valid` | Fetches the discovered OpenSearch description and checks it is well-formed. | Feeds and discovery | recommended | deployer | 2026-10 | `opensearch`, `social` |
327
+ | `origin-agent-cluster` | Recommends Origin-Agent-Cluster: ?1 and reports any other value of the header. | Security headers | advanced | deployer | 2026-10 | `mdn`, `security-headers` |
328
+ | `pagination-rel` | Reports rel=prev/rel=next links with a missing or non-absolute URL. | SEO | recommended | deployer | 2026-10 | `mdn`, `seo` |
329
+ | `permissions-policy` | Requires the Permissions-Policy header to disable the browser features listed by OWASP. | Security headers | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
330
+ | `pingback` | Flags a Pingback endpoint as a legacy spam/amplification risk when present. | Feeds and discovery | advanced | deployer | 2026-10 | `original`, `social` |
331
+ | `privacy-cookies` | Counts first-party and third-party cookies set by responses and by script. | Privacy | recommended | deployer | 2026-10 | `webbkoll`, `privacy` |
332
+ | `privacy-geolocation` | Finds inline and loaded scripts that use the Geolocation API. | Privacy | recommended | deployer | 2026-10 | `original`, `privacy` |
333
+ | `privacy-insecure-first-party` | Finds requests to the page’s own domain that use http although the page uses https. | HTTPS and certificates | recommended | deployer | 2026-10 | `webbkoll`, `privacy`, `security-headers` |
334
+ | `privacy-local-storage` | Reports data the page stores in localStorage. | Privacy | recommended | deployer | 2026-10 | `webbkoll`, `privacy` |
335
+ | `privacy-mixed-content` | Finds insecure subresources loaded by a page served over https. | HTTPS and certificates | recommended | deployer | 2026-10 | `webbkoll`, `privacy`, `security-headers`, `roctify` |
336
+ | `privacy-policy-link-missing` | Warns when the page links to no privacy policy. | Privacy | recommended | deployer | 2026-11 | `google`, `privacy` |
337
+ | `privacy-third-party-requests` | Lists requests to hosts outside the page’s registrable domain, by host and type. | Privacy | recommended | deployer | 2026-10 | `webbkoll`, `privacy` |
338
+ | `public-key-pins` | Reports the deprecated Public-Key-Pins header when it is sent. | Security headers | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
339
+ | `redirection` | Checks that http:// redirects to https:// on the same host before any other redirect. | HTTPS and certificates | recommended | deployer | 2026-10 | `observatory`, `internetnl`, `security-headers`, `roctify` |
340
+ | `referrer-policy` | Checks that a Referrer-Policy is set and does not leak the full URL to other sites. | Privacy | recommended | deployer | 2026-10 | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers`, `privacy` |
341
+ | `rel-me` | Reports rel=me identity links and warns when one has no target (IndieWeb). | Feeds and discovery | advanced | deployer | 2026-10 | `indieweb`, `social` |
342
+ | `reporting-endpoints` | Checks that Reporting-Endpoints maps endpoint names to quoted absolute https URLs. | Security headers | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
343
+ | `repr-digest` | Validates the Repr-Digest header as an RFC 9530 digest dictionary when present. | HTTP behaviour | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
344
+ | `retry-after` | Checks that Retry-After is a valid delay on a 429 or 503 response. | HTTP behaviour | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
345
+ | `richresults-article` | Validates Article/NewsArticle/BlogPosting JSON-LD against Google rich-results recommended properties. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
346
+ | `richresults-breadcrumb` | Validates BreadcrumbList JSON-LD (itemListElement with position and item/name) against Google rich-results rules. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
347
+ | `richresults-event` | Validates Event JSON-LD (name, startDate, location) against Google rich-results rules. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
348
+ | `richresults-jobposting` | Validates JobPosting JSON-LD (title, description, datePosted, hiringOrganization, jobLocation) against Google rich-results rules. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
349
+ | `richresults-localbusiness` | Validates LocalBusiness JSON-LD (name, address) against Google rich-results required and recommended properties. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
350
+ | `richresults-product` | Validates Product JSON-LD (name, image, offers, review, aggregateRating) against Google rich-results rules. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
351
+ | `richresults-recipe` | Validates Recipe JSON-LD against Google rich-results required and recommended properties. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
352
+ | `richresults-review` | Validates Review/AggregateRating JSON-LD (itemReviewed, reviewRating with ratingValue) against Google rich-results rules. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
353
+ | `richresults-video` | Validates VideoObject JSON-LD (name, thumbnailUrl, uploadDate) against Google rich-results rules. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
354
+ | `richresults-website-searchaction` | Validates WebSite SearchAction JSON-LD (target and query-input) for the sitelinks search box. | SEO | recommended | deployer | 2026-10 | `google`, `seo` |
355
+ | `robots-txt` | Checks that robots.txt follows RFC 9309, including Content-Signal lines. | SEO | recommended | deployer | 2026-10 | `files`, `seo`, `agent`, `roctify` |
356
+ | `rpki-ns-exists` | Requires an RPKI ROA to be published for every IP address of the name servers. | DNS and network | advanced | dns | 2026-10 | `internetnl`, `dns` |
357
+ | `rpki-ns-valid` | Requires the route announcements of the name server IP addresses to be RPKI valid. | DNS and network | advanced | dns | 2026-10 | `internetnl`, `dns` |
358
+ | `rpki-web-exists` | Requires an RPKI ROA to be published for every IP address of the web server. | DNS and network | advanced | platform | 2026-10 | `internetnl`, `dns` |
359
+ | `rpki-web-valid` | Requires the route announcements of the web server IP addresses to be RPKI valid. | DNS and network | advanced | platform | 2026-10 | `internetnl`, `dns` |
360
+ | `security-txt` | Checks that /.well-known/security.txt follows RFC 9116. | Exposed files | recommended | deployer | 2026-10 | `files`, `internetnl`, `security-headers` |
361
+ | `sellers-json` | Checks that /sellers.json follows the IAB Tech Lab sellers.json 1.0 spec. | Advertising | advanced | deployer | 2026-10 | `iab`, `seo` |
362
+ | `seo-canonical-mismatch` | Reports a canonical URL that differs from the page URL. | SEO | advanced | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
363
+ | `seo-canonical-missing` | Reports pages without <link rel="canonical">. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
364
+ | `seo-content-length` | Warns when the page has fewer than 300 words of text. | SEO | advanced | deployer | 2026-11 | `roctify`, `seo` |
365
+ | `seo-deprecated-html` | Warns when the page uses obsolete HTML elements. | SEO | recommended | deployer | 2026-11 | `roctify`, `seo` |
366
+ | `seo-h1-missing` | Warns when the page has no <h1> heading. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
367
+ | `seo-h1-multiple` | Reports pages with more than one <h1>. | SEO | advanced | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
368
+ | `seo-html-lang-missing` | Warns when <html> has no lang attribute. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
369
+ | `seo-http-status` | Reports a page whose HTTP status is not 200. | SEO | recommended | deployer | 2026-11 | `roctify`, `seo` |
370
+ | `seo-keywords-frequent` | Lists the most frequent keywords of the page text. | SEO | experimental | deployer | 2026-11 | `roctify`, `seo` |
371
+ | `seo-keywords-in-title` | Warns when none of the most frequent keywords of the page is in the title. | SEO | experimental | deployer | 2026-11 | `roctify`, `seo` |
372
+ | `seo-link-anchor-text` | Warns about links with no text or with generic text. | SEO | recommended | deployer | 2026-11 | `roctify`, `seo` |
373
+ | `seo-links` | Warns when the page has no links or no internal links. | SEO | advanced | deployer | 2026-11 | `roctify`, `seo` |
374
+ | `seo-meta-description-missing` | Requires a <meta name="description"> tag. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
375
+ | `seo-meta-description-too-long` | Reports a meta description longer than 160 characters. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
376
+ | `seo-meta-description-too-short` | Reports a meta description shorter than 50 characters. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
377
+ | `seo-responsive-images` | Warns when most images have no srcset or picture element. | Performance | advanced | deployer | 2026-11 | `roctify`, `seo` |
378
+ | `seo-robots-nofollow` | Reports when the robots meta tag contains nofollow. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo` |
379
+ | `seo-robots-noindex` | Warns when the robots meta tag contains noindex. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
380
+ | `seo-structured-data-missing` | Reports pages without a JSON-LD block. | SEO | advanced | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
381
+ | `seo-title-missing` | Requires a non-empty <title> element in the head. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
382
+ | `seo-title-too-long` | Warns when the <title> is longer than 70 characters. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
383
+ | `seo-title-too-short` | Reports a <title> shorter than 10 characters. | SEO | recommended | deployer | 2026-10 | `opengraph`, `seo`, `roctify` |
384
+ | `seo-url-friendly` | Warns when the URL is long, upper case, has underscores, encoded characters, many levels or many parameters. | SEO | advanced | deployer | 2026-11 | `roctify`, `seo` |
385
+ | `seo-viewport` | Requires a viewport meta tag with width=device-width that allows zooming. | SEO | recommended | deployer | 2026-11 | `roctify`, `seo` |
386
+ | `server-banner` | Reports when the Server header discloses a software version or operating system. | Exposed files | recommended | platform | 2026-10 | `mdn`, `security-headers`, `roctify` |
387
+ | `server-timing` | Reports the Server-Timing header, which can expose backend metric names and timings. | Exposed files | recommended | platform | 2026-10 | `mdn`, `security-headers` |
388
+ | `service-worker-allowed` | Validates that the Service-Worker-Allowed header is a path or absolute URL when present. | Progressive web app | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
389
+ | `set-login` | Validates that the FedCM Set-Login header is logged-in or logged-out when present. | HTTP behaviour | experimental | deployer | 2026-10 | `mdn`, `security-headers` |
390
+ | `sourcemap` | Reports the SourceMap or X-SourceMap header, which exposes source maps to every client. | Exposed files | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
391
+ | `speculation-rules` | Validates that the Speculation-Rules header lists quoted ruleset URLs when present. | HTTP behaviour | experimental | deployer | 2026-10 | `mdn`, `security-headers` |
392
+ | `supports-loading-mode` | Validates the Supports-Loading-Mode tokens (credentialed-prerender, fenced-frame) when present. | HTTP behaviour | experimental | deployer | 2026-10 | `mdn`, `security-headers` |
393
+ | `tabnabbing` | Checks that cross-origin target="_blank" links set rel="noopener". | Security headers | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
394
+ | `technical-asset-count` | Warns about many external scripts or stylesheets and render-blocking scripts. | Performance | advanced | deployer | 2026-11 | `roctify`, `seo` |
395
+ | `technical-canonical-invalid` | Requires the canonical link href to be a valid URL, absolute or relative. | SEO | recommended | deployer | 2026-10 | `llmscout`, `seo` |
396
+ | `technical-heading-hierarchy` | Warns when a heading jumps down more than one level, such as an h2 followed by an h4. | SEO | recommended | deployer | 2026-10 | `llmscout`, `seo`, `roctify` |
397
+ | `technical-html-size` | Warns when the HTML document is larger than 200 KB. | Performance | recommended | deployer | 2026-11 | `roctify`, `seo` |
398
+ | `technical-image-alt-coverage` | Checks that img elements carry an alt attribute (warns from 80% coverage, errors below). | SEO | recommended | deployer | 2026-10 | `llmscout`, `seo`, `roctify` |
399
+ | `technical-image-formats` | Warns when images ship only as JPEG, PNG or GIF. | Performance | advanced | deployer | 2026-11 | `roctify`, `seo` |
400
+ | `technical-image-weight` | Warns when an image is over 200 KB and errors when it is over 500 KB. | Performance | recommended | deployer | 2026-10 | `llmscout`, `seo` |
401
+ | `technical-lazy-loading` | Warns when images and iframes after the first two have no loading="lazy". | Performance | advanced | deployer | 2026-11 | `roctify`, `seo` |
402
+ | `technical-redirect-chain` | Warns about long redirect chains and chains ending in an error. | Performance | recommended | deployer | 2026-10 | `llmscout`, `seo` |
403
+ | `technical-response-time` | Warns when the first response took more than 600 ms. | Performance | advanced | deployer | 2026-11 | `roctify`, `seo` |
404
+ | `technical-robots-meta-advanced` | Warns when the robots meta tag lacks max-snippet, max-image-preview or max-video-preview. | SEO | advanced | deployer | 2026-10 | `llmscout`, `seo` |
405
+ | `technical-twitter-card-type` | Requires twitter:card to be summary, summary_large_image, app or player. | Link previews | recommended | deployer | 2026-10 | `llmscout`, `seo`, `social` |
406
+ | `terms-of-service-link-missing` | Warns when the page links to no terms of service. | Privacy | advanced | deployer | 2026-11 | `google`, `privacy` |
407
+ | `theme-color-meta` | Recommends a <meta name="theme-color"> on the page. | Progressive web app | advanced | deployer | 2026-10 | `w3c`, `pwa` |
408
+ | `timing-allow-origin` | Reports Timing-Allow-Origin: * and malformed origins in the timing-exposure list. | Performance | recommended | deployer | 2026-10 | `mdn`, `security-headers`, `privacy` |
409
+ | `tls-cipher-order` | Requires the HTTPS server to enforce its own preference for the most secure cipher suites. | HTTPS and certificates | advanced | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
410
+ | `tls-ciphers` | Requires the HTTPS server to accept only secure (good or sufficient) cipher suites. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
411
+ | `tls-compression` | Requires the HTTPS server not to support TLS compression. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
412
+ | `tls-ems` | Requires the HTTPS server to support the TLS 1.2 Extended Master Secret (RFC 7627). | HTTPS and certificates | advanced | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
413
+ | `tls-kex-hash` | Requires the HTTPS server not to sign the TLS key exchange with weak hash functions (SHA-1, SHA-224). | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
414
+ | `tls-kex-params` | Requires the ephemeral Diffie-Hellman parameters of the HTTPS server (DH size, EC curves) to be secure. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
415
+ | `tls-ocsp-stapling` | Checks that the HTTPS server staples an OCSP response when its certificate has an OCSP pointer. | HTTPS and certificates | advanced | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
416
+ | `tls-renegotiation-client` | Checks that the HTTPS server does not allow unlimited client-initiated renegotiation. | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
417
+ | `tls-renegotiation-secure` | Requires the HTTPS server to support secure renegotiation (RFC 5746). | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
418
+ | `tls-rpt` | Requires the site mail domain to publish a valid TLS-RPT record with a report destination. | Email | recommended | mail | 2026-10 | `ietf`, `email`, `dns` |
419
+ | `tls-version` | Requires the HTTPS server to accept only secure TLS versions (TLS 1.3 and TLS 1.2). | HTTPS and certificates | recommended | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
420
+ | `tls-zero-rtt` | Requires the HTTPS server not to accept TLS 1.3 0-RTT early data. | HTTPS and certificates | advanced | platform | 2026-10 | `internetnl`, `tls`, `security-headers` |
421
+ | `twitter-card-missing` | Requires a twitter:card meta tag. | Link previews | recommended | deployer | 2026-10 | `opengraph`, `social`, `roctify` |
422
+ | `twitter-card-not-large` | Suggests summary_large_image instead of summary. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
423
+ | `twitter-description-missing` | Requires a twitter:description meta tag. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
424
+ | `twitter-image-missing` | Requires a twitter:image meta tag. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
425
+ | `twitter-site-missing` | Requires a twitter:site meta tag. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
426
+ | `twitter-title-missing` | Requires a twitter:title meta tag. | Link previews | advanced | deployer | 2026-10 | `opengraph`, `social` |
427
+ | `use-as-dictionary` | Validates the Use-As-Dictionary compression-dictionary header, requiring a match pattern, when present. | HTTP behaviour | experimental | deployer | 2026-10 | `mdn`, `security-headers` |
428
+ | `vary` | Reports Vary: * and a wildcard mixed with named headers, which defeat shared caching. | HTTP behaviour | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
429
+ | `via` | Reports when the Via header names the proxy or gateway software in front of the site. | Exposed files | recommended | platform | 2026-10 | `mdn`, `security-headers` |
430
+ | `webfinger` | Probes /.well-known/webfinger and reports its format when present (RFC 7033). | Feeds and discovery | advanced | deployer | 2026-10 | `ietf`, `agent` |
431
+ | `webmention` | Reports a Webmention endpoint and warns when it is not an absolute URL (W3C Webmention). | Feeds and discovery | advanced | deployer | 2026-10 | `w3c`, `social` |
432
+ | `x-content-type-options` | Requires the X-Content-Type-Options header to be nosniff. | Security headers | recommended | deployer | 2026-11 | `observatory`, `roctify`, `security-headers` |
433
+ | `x-dns-prefetch-control` | Requires the X-DNS-Prefetch-Control header to be set to off. | Privacy | recommended | deployer | 2026-10 | `owasp`, `security-headers`, `privacy` |
434
+ | `x-frame-options` | Checks that the page cannot be framed by other sites, with X-Frame-Options or CSP frame-ancestors. | Security headers | recommended | deployer | 2026-10 | `observatory`, `owasp`, `webbkoll`, `internetnl`, `security-headers`, `roctify` |
435
+ | `x-permitted-cross-domain-policies` | Requires the X-Permitted-Cross-Domain-Policies header to be set to none. | Security headers | recommended | deployer | 2026-10 | `owasp`, `security-headers` |
436
+ | `x-powered-by` | Reports the X-Powered-By header, which reveals the technology stack to no benefit. | Exposed files | recommended | deployer | 2026-10 | `mdn`, `security-headers` |
437
+ | `x-xss-protection` | Reports the deprecated X-XSS-Protection header when it is sent. | Security headers | recommended | deployer | 2026-10 | `owasp`, `webbkoll`, `security-headers` |
402
438
 
403
439
  ## Licence
404
440