spiderlint 0.0.0 → 0.143.0

package/package.json

@@ -1,10 +1,142 @@
 {
   "name": "spiderlint",
-  "version": "0.0.0",
-  "description": "Placeholder reserving the name; real releases are published from CI.",
+  "version": "0.143.0",
+  "type": "module",
+  "description": "Site-wide linter for SEO tags, security headers, TLS and links",
   "license": "AGPL-3.0-only",
+  "engines": {
+    "node": ">=26"
+  },
+  "bin": {
+    "spiderlint": "bin/spiderlint.js"
+  },
+  "files": [
+    "bin/",
+    "dist/",
+    "src/server/*.png",
+    "presets/",
+    "vendors/",
+    "locales/"
+  ],
+  "scripts": {
+    "start": "node --experimental-strip-types src/cli.ts",
+    "lint": "eslint ./",
+    "fix": "eslint ./ --fix",
+    "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\" bin/spiderlint.js eslint.config.js",
+    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\" bin/spiderlint.js eslint.config.js",
+    "test": "SPIDERLINT_LOG_LEVEL=warn node --test --test-timeout=120000 --experimental-strip-types tests/**/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "prepack": "tsc --project tsconfig.build.json",
+    "postpack": "rm --recursive --force dist"
+  },
+  "dependencies": {
+    "@axe-core/playwright": "4.13.0",
+    "@hono/node-server": "2.1.4",
+    "@opentelemetry/api": "1.9.1",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.223.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.223.0",
+    "@opentelemetry/resources": "2.12.0",
+    "@opentelemetry/sdk-metrics": "2.12.0",
+    "@opentelemetry/sdk-trace-node": "2.12.0",
+    "@tgwf/co2": "0.19.0",
+    "ajv": "8.20.0",
+    "any-ascii": "0.3.3",
+    "axe-core": "4.14.0",
+    "browserslist": "4.29.3",
+    "bullmq": "6.3.12",
+    "caniuse-lite": "1.0.30001815",
+    "cheerio": "1.2.0",
+    "commander": "15.0.0",
+    "crawlee": "3.18.2",
+    "css-tree": "3.2.1",
+    "csstree-validator": "4.0.1",
+    "dns-packet": "5.6.1",
+    "doiuse": "6.0.6",
+    "eld": "2.1.0",
+    "esbuild": "0.28.2",
+    "gettext-parser": "9.1.1",
+    "hono": "4.13.13",
+    "html-validate": "11.16.2",
+    "htmlhint": "1.9.2",
+    "htmlparser2": "12.0.0",
+    "http-cache-semantics": "4.3.0",
+    "ioredis": "6.0.0",
+    "lighthouse": "13.5.0",
+    "lightningcss": "1.33.0",
+    "log-update": "8.0.0",
+    "marked": "18.1.0",
+    "picomatch": "4.0.7",
+    "pino": "10.4.0",
+    "pino-opentelemetry-transport": "4.0.2",
+    "pino-pretty": "13.2.0",
+    "playwright": "1.64.0",
+    "postcss": "8.5.29",
+    "proper-lockfile": "4.1.2",
+    "proxy-chain": "3.0.1",
+    "saxes": "6.0.0",
+    "sharp": "0.35.5",
+    "smol-toml": "1.9.1",
+    "structured-headers": "2.1.1",
+    "svgo": "4.1.0",
+    "tldts": "7.4.18",
+    "yaml": "2.9.1"
+  },
+  "devDependencies": {
+    "@eslint/js": "10.0.1",
+    "@types/caniuse-lite": "1.0.5",
+    "@types/css-tree": "3.2.0",
+    "@types/dns-packet": "5.6.5",
+    "@types/gettext-parser": "9.0.0",
+    "@types/http-cache-semantics": "4.2.0",
+    "@types/node": "26.6.5",
+    "@types/picomatch": "4.0.3",
+    "@types/proper-lockfile": "4.1.4",
+    "eslint": "10.12.0",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-plugin-import-x": "4.17.1",
+    "eslint-plugin-n": "18.4.1",
+    "eslint-plugin-promise": "7.3.0",
+    "eslint-plugin-tsdoc": "0.5.4",
+    "eslint-plugin-unicorn": "76.0.0",
+    "globals": "17.13.0",
+    "prettier": "3.9.10",
+    "typescript": "6.0.3",
+    "typescript-eslint": "8.71.1"
+  },
+  "keywords": [
+    "spiderlint",
+    "linter",
+    "crawler",
+    "seo",
+    "security-headers",
+    "sarif"
+  ],
+  "author": {
+    "email": "damian.buho@proton.me",
+    "name": "Damián Búho",
+    "url": "https://dbuho.me"
+  },
+  "maintainers": [
+    {
+      "email": "damian.buho@proton.me",
+      "name": "Damián Búho",
+      "url": "https://dbuho.me"
+    }
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/damian-buho/spiderlint.git"
+  },
+  "os": [
+    "linux",
+    "darwin"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "homepage": "https://dbuho.me/project/spiderlint/",
+  "bugs": {
+    "url": "https://github.com/damian-buho/spiderlint/issues"
   }
 }

package/presets/browser.yaml

@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Checks that need a rendered page — console errors and unused preloads
+extends:
+  - spiderlint:cookies:browser
+when:
+  http.status: {minimum: 200, maximum: 299}
+rules:
+  browser/console-errors:
+    fact: browser.console.errors
+    expect: {maxItems: 0}
+    severity: warning
+    score: 5.8
+    message: "the browser console logged errors ({got})"
+    docs: https://developer.mozilla.org/docs/Web/API/console/error_static
+    fix: "Fix the JavaScript error logged to the console."
+  browser/unused-preload:
+    fact: browser.console.warnings
+    expect: {not: {contains: {type: string, pattern: "preloaded using link preload but not used"}}}
+    severity: info
+    score: 1.8
+    message: "a preloaded resource went unused ({got})"
+    docs: https://developer.mozilla.org/docs/Web/HTML/Attributes/rel/preload
+    fix: "Remove the preload link, or use the resource it points at."

package/presets/graph.yaml

@@ -0,0 +1,35 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Internal linking across the whole crawl, click depth, dead ends and weakly linked pages
+when:
+  http.status: {minimum: 200, maximum: 299}
+  http.content-type: {pattern: "^text/html"}
+rules:
+  links/click-depth:
+    fact: graph.depth
+    expect: {maximum: 3}
+    when: {graph.depth: {type: integer}}
+    severity: info
+    score: [[4, 1.6], [10, 3.0]]
+    message: "a page is {got} links away from the start page, more than 3"
+    fix: "Link the page from a hub, a section index or the navigation."
+    docs: https://developers.google.com/search/docs/crawling-indexing/links-crawlable
+  links/dead-end:
+    fact: graph.out-degree
+    expect: {minimum: 1}
+    severity: info
+    score: 1.6
+    message: "a page links to no other page of the site"
+    fix: "Add navigation or related links back into the site."
+    docs: https://developers.google.com/search/docs/crawling-indexing/links-crawlable
+  links/weakly-linked:
+    fact: graph.in-degree
+    expect: {minimum: 2}
+    when: {graph.in-degree: {minimum: 1}, crawl.discovered-via: {not: {const: seed}}}
+    severity: info
+    score: 1.8
+    message: "only {got} page of the site links here"
+    fix: "Link the page from its section index or related pages."
+    docs: https://developers.google.com/search/docs/crawling-indexing/links-crawlable

package/presets/i18n.yaml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: hreflang alternates that name each other back and answer 2xx, and lang against Content-Language and the language of the title and description
+rules:
+  i18n/hreflang-reciprocal:
+    severity: warning
+    score: 5.2
+  i18n/hreflang-status:
+    severity: warning
+    score: 5.6
+  i18n/content-language:
+    severity: info
+    score: 2.4
+  i18n/metadata-language:
+    severity: info
+    score: 2.8

package/presets/insights.yaml

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Pages that stand out from the rest of the site, all info
+rules:
+  insight/numeric-outlier:
+    severity: info
+    score: 3.0
+  insight/minority-value:
+    severity: info
+    score: 2.0

package/presets/links.yaml

@@ -0,0 +1,22 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Links that answer an error, internal links that redirect or carry nofollow, rel=me profiles that do not link back
+rules:
+  links/broken-internal:
+    severity: error
+    score: [[0, 8.4], [404, 7.4], [500, 8.4]]
+  links/redirected-internal:
+    severity: warning
+    score: 4.6
+  links/broken-external:
+    severity: warning
+    score: [[0, 6.0], [404, 4.6], [500, 6.0]]
+  links/internal-nofollow:
+    severity: warning
+    score: 4.2
+  links/external-rel: off
+  links/rel-me:
+    severity: info
+    score: 2.2

package/presets/parity.yaml

@@ -0,0 +1,59 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: What a page loses without JavaScript, from its raw HTML and its rendered DOM; browser mode only
+when:
+  http.status: {minimum: 200, maximum: 299}
+rules:
+  parity/title:
+    fact: parity.missing
+    expect: {properties: {title: false}}
+    severity: warning
+    score: 6.0
+    message: "the title exists only after JavaScript runs: {got}"
+    fix: "Render <title> on the server."
+    docs: https://developers.google.com/search/docs/crawling-indexing/javascript/javascript-seo-basics
+  parity/description:
+    fact: parity.missing
+    expect: {properties: {description: false}}
+    severity: info
+    score: 2.6
+    message: "the meta description exists only after JavaScript runs: {got}"
+    fix: "Render <meta name=\"description\"> on the server."
+    docs: https://developers.google.com/search/docs/crawling-indexing/javascript/javascript-seo-basics
+  parity/canonical:
+    fact: parity.missing
+    expect: {properties: {canonical: false}}
+    severity: warning
+    score: 5.5
+    message: "the canonical link exists only after JavaScript runs: {got}"
+    fix: "Render <link rel=\"canonical\"> on the server."
+    docs: https://developers.google.com/search/docs/crawling-indexing/javascript/javascript-seo-basics#properly-inject-canonical-links
+  parity/h1:
+    fact: parity.missing
+    expect: {properties: {h1: false}}
+    severity: info
+    score: 2.4
+    message: "the h1 exists only after JavaScript runs: {got}"
+    fix: "Render the page heading on the server."
+    docs: https://developers.google.com/search/docs/crawling-indexing/javascript/javascript-seo-basics
+  parity/text:
+    fact: parity
+    expect: {if: {properties: {rendered: {properties: {text: {minimum: 200}}}}}, then: {properties: {text-share: {minimum: 0.5}}}}
+    severity: warning
+    score: 5.2
+    message: "the raw HTML carries a {got} share of the text the rendered page shows"
+    fix: "Render the main content on the server, or give it a <noscript> fallback."
+    docs: https://developer.mozilla.org/docs/Glossary/SSR
+  parity/links:
+    fact: parity.missing
+    expect: {properties: {links: false}}
+    severity: warning
+    score: 5.8
+    message: "internal links exist only after JavaScript runs: {got}"
+    fix: "Render navigation links as <a href> on the server."
+    docs: https://developers.google.com/search/docs/crawling-indexing/links-crawlable
+  html/declaration-rewritten:
+    severity: info
+    score: 1.5

package/presets/performance.yaml

@@ -0,0 +1,271 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Compression, caching, validators, protocol version and render-blocking HTML, no browser needed
+rules:
+  http/compression:
+    fact: http.headers.content-encoding
+    expect: {type: string, pattern: "^\\s*(br|gzip|zstd)\\s*$"}
+    when:
+      http.status: {minimum: 200, maximum: 299}
+      http.content-type: {pattern: "^(text/|application/([\\w.-]+\\+)?(json|xml|javascript)\\b|image/svg\\+xml)"}
+      http.size.decoded: {minimum: 1024}
+    severity: warning
+    score: 6.3
+    message: "a text response over 1 KB should be sent br, zstd or gzip, found {got}"
+    fix: "Compress text responses with br, zstd or gzip at the edge or in the server."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Compression
+  http/vary-encoding:
+    fact: http.parsed.vary.value
+    expect: {type: array, contains: {enum: [accept-encoding, "*"]}}
+    when: {http.headers.content-encoding: {type: string}, http.parsed.vary.errors: {maxItems: 0}}
+    severity: warning
+    score: 5.4
+    message: "a compressed response should carry Vary: Accept-Encoding, found {got}"
+    fix: "Add Vary: Accept-Encoding to the response."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/Vary
+  http/vary-star:
+    fact: http.parsed.vary.value
+    expect: {not: {contains: {const: "*"}}}
+    when: {http.parsed.vary.value: {type: array}}
+    severity: warning
+    score: 5.6
+    message: "Vary: * makes the response uncacheable, found {got}"
+    fix: "Replace Vary: * with the specific header names the response varies by."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/Vary
+  http/validator:
+    fact: http.headers
+    expect: {anyOf: [{required: [etag]}, {required: [last-modified]}]}
+    when: {http.status: {minimum: 200, maximum: 299}}
+    severity: info
+    score: 2.6
+    message: "no ETag or Last-Modified to revalidate against"
+    fix: "Add an ETag or Last-Modified header to the response."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Caching#validation
+  http/html-cache-control:
+    fact: http.parsed.cache-control.value
+    expect: {type: object, minProperties: 1}
+    when: {http.status: {minimum: 200, maximum: 299}, http.content-type: {pattern: "^text/html"}, http.parsed.cache-control.errors: {maxItems: 0}}
+    severity: info
+    score: 2.7
+    message: "no Cache-Control directive on an HTML page, found {got}"
+    fix: "Add a Cache-Control header, e.g. no-cache to revalidate, or public with a max-age."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/Cache-Control
+  http/no-store-bfcache:
+    fact: http.parsed.cache-control.value
+    expect: {not: {required: [no-store]}}
+    when: {http.content-type: {pattern: "^text/html"}, http.parsed.cache-control.value: {type: object}}
+    severity: info
+    score: 2.4
+    message: "Cache-Control no-store keeps the page out of the back/forward cache, found {got}"
+    fix: "Remove no-store from Cache-Control, or replace it with no-cache."
+    docs: https://web.dev/articles/bfcache#minimize-use-of-cache-control-no-store
+  caching/long-without-hash:
+    severity: warning
+  http/version:
+    fact: http.version
+    expect: {type: string, pattern: "^[23]"}
+    when: {http.version: {type: string}}
+    severity: warning
+    score: 5.8
+    message: "the server should speak HTTP/2 or HTTP/3, found {got}"
+    fix: "Enable HTTP/2 or HTTP/3 on the server."
+    docs: https://developer.mozilla.org/docs/Glossary/HTTP_2
+  http/alt-svc-h3:
+    fact: http.parsed.alt-svc.value
+    expect: {type: array, contains: {properties: {protocol: {const: h3}}, required: [protocol]}}
+    when: {url.protocol: "https:", http.version: {not: {const: "3.0"}}, http.parsed.alt-svc.errors: {maxItems: 0}}
+    severity: warning
+    score: 5.2
+    message: "Alt-Svc should advertise h3, found {got}"
+    fix: "Add h3 to the Alt-Svc header."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/Alt-Svc
+  tls/ec-key:
+    fact: tls.cert.key.type
+    expect: {not: {const: RSA}}
+    when: {url.protocol: "https:", tls.cert.key: {type: object}}
+    severity: hint
+    score: 0.6
+    message: "the certificate carries an RSA key, where an EC key makes a smaller handshake"
+    fix: "Issue the certificate for an EC P-256 key."
+    docs: https://www.rfc-editor.org/rfc/rfc9325#section-4.5
+  http/retry-after:
+    fact: http.parsed.retry-after.value
+    expect: {type: object}
+    when: {http.status: 503, http.parsed.retry-after.errors: {maxItems: 0}}
+    severity: warning
+    score: 4.8
+    message: "a 503 should say when to retry with Retry-After"
+    fix: "Send Retry-After with a delay, or an HTTP-date for when to try again."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/Retry-After
+  http/sunset-format:
+    fact: http.headers.sunset
+    expect: {type: string, pattern: "^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \\d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\d{4} \\d{2}:\\d{2}:\\d{2} GMT$"}
+    when: {http.headers.sunset: {type: string}}
+    severity: warning
+    score: 3.7
+    message: "Sunset should be an HTTP-date, found {got}"
+    fix: "Send Sunset as an HTTP-date, e.g. Sun, 01 Jan 2027 00:00:00 GMT."
+    docs: https://www.rfc-editor.org/rfc/rfc8594
+  http/deprecation-format:
+    fact: http.headers.deprecation
+    expect: {type: string, pattern: "^@-?\\d+$"}
+    when: {http.headers.deprecation: {type: string}}
+    severity: warning
+    score: 3.6
+    message: "Deprecation should be @ and Unix seconds, found {got}"
+    fix: "Send Deprecation: @1704067200 with the Unix timestamp of the removal."
+    docs: https://www.rfc-editor.org/rfc/rfc9745
+  html/render-blocking-script:
+    fact: html.scripts
+    expect: {items: {if: {required: [src], properties: {head: {const: true}, async: {const: false}, defer: {const: false}}}, then: {required: [type], properties: {type: {const: module}}}}}
+    severity: info
+    score: 3.0
+    message: "a script in <head> without async, defer or type=module blocks rendering: {got}"
+    fix: "Add async, defer, or type=module to the script, or move it to the end of <body>."
+    docs: https://developer.mozilla.org/docs/Web/HTML/Element/script#defer
+  html/first-img-lazy:
+    fact: html.images.0
+    expect: {not: {type: object, required: [loading], properties: {loading: {pattern: "^(?i:lazy)$"}}}}
+    severity: info
+    score: 2.9
+    message: "the first <img> is usually above the fold, and loading=lazy delays it: {got}"
+    fix: "Remove loading=lazy from the first <img>, or set it to eager."
+    docs: https://web.dev/articles/lcp-lazy-loading
+  html/img-dimensions:
+    fact: html.images
+    expect: {items: {if: {not: {required: [noscript]}}, then: {required: [width, height]}}}
+    severity: warning
+    score: 6.0
+    message: "an <img> without width and height shifts the layout as it loads: {got}"
+    fix: "Add width and height attributes to the <img>."
+    docs: https://web.dev/articles/optimize-cls#images-without-dimensions
+  http/early-hints-preload:
+    severity: info
+    score: 1.8
+  html/preconnect-unused:
+    severity: info
+    score: 1.4
+  html/preconnect-missing:
+    severity: info
+    score: 2.2
+  html/preconnect-crossorigin:
+    severity: info
+    score: 1.6
+  http/link-syntax:
+    fact: http.parsed.link.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.link: {type: object}}
+    severity: warning
+    score: 4.6
+    message: "Link breaks RFC 8288 §3, so clients drop the links they cannot read: {got}"
+    fix: "Write each Link entry as <https://example.com/a>; rel=preload, separated by commas."
+    docs: https://www.rfc-editor.org/rfc/rfc8288#section-3
+  http/dictionary-format:
+    fact: http.parsed.use-as-dictionary.value
+    expect: {required: [match], properties: {match: {type: string}}}
+    when: {http.parsed.use-as-dictionary.value: {type: object}}
+    severity: warning
+    score: 3.5
+    message: "Use-As-Dictionary needs a match=\"<URL pattern>\" member, found {got}"
+    fix: "Send Use-As-Dictionary: match=\"/assets/app-*.js\"."
+    docs: https://www.rfc-editor.org/rfc/rfc9842#section-2.1
+  html/render-blocking-css:
+    fact: html.head.links
+    expect: {minContains: 0, maxContains: 1, contains: {required: [rel], properties: {rel: {pattern: "^\\s*(?i:stylesheet)\\s*$"}, media: {pattern: "^\\s*(?i:all|screen)?\\s*$"}}}}
+    severity: info
+    score: 2.3
+    message: "more than one stylesheet in <head> blocks rendering: {got}"
+    fix: "Inline the critical CSS and load the rest with media=print onload, or merge the stylesheets into one."
+    docs: https://web.dev/articles/defer-non-critical-css
+  http/cache-control-syntax:
+    fact: http.parsed.cache-control.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.cache-control: {type: object}}
+    severity: warning
+    score: 5.0
+    message: "Cache-Control breaks RFC 9111 §5.2, and caches ignore what they cannot read: {got}"
+    fix: "Write Cache-Control with registered directives only, as in public, max-age=3600."
+    docs: https://www.rfc-editor.org/rfc/rfc9111#section-5.2
+  http/vary-syntax:
+    fact: http.parsed.vary.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.vary: {type: object}}
+    severity: warning
+    score: 4.2
+    message: "Vary breaks RFC 9110 §12.5.5: {got}"
+    fix: "List the request header names the response varies by, as in Vary: Accept-Encoding."
+    docs: https://www.rfc-editor.org/rfc/rfc9110#section-12.5.5
+  http/content-type-syntax:
+    fact: http.parsed.content-type.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.content-type: {type: object}}
+    severity: warning
+    score: 4.0
+    message: "Content-Type breaks RFC 9110 §8.3.1: {got}"
+    fix: "Send Content-Type as type/subtype with name=value parameters, as in text/html; charset=utf-8."
+    docs: https://www.rfc-editor.org/rfc/rfc9110#section-8.3.1
+  http/use-as-dictionary-syntax:
+    fact: http.parsed.use-as-dictionary.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.use-as-dictionary: {type: object}}
+    severity: warning
+    score: 3.4
+    message: "Use-As-Dictionary breaks its structured-field grammar, so clients ignore it: {got}"
+    fix: "Send Use-As-Dictionary: match=\"/assets/app-*.js\"."
+    docs: https://www.rfc-editor.org/rfc/rfc9842#section-2.1
+  http/accept-ch-syntax:
+    fact: http.parsed.accept-ch.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.accept-ch: {type: object}}
+    severity: warning
+    score: 3.9
+    message: "Accept-CH breaks its structured-field grammar, so browsers ignore it: {got}"
+    fix: "Send Accept-CH as a list of hint names, as in Accept-CH: Sec-CH-UA-Platform."
+    docs: https://www.rfc-editor.org/rfc/rfc8942#section-3.1
+  http/priority-syntax:
+    fact: http.parsed.priority.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.priority: {type: object}}
+    severity: warning
+    score: 3.8
+    message: "Priority breaks its structured-field grammar, so clients ignore it: {got}"
+    fix: "Send Priority as a dictionary, as in Priority: u=1, i."
+    docs: https://www.rfc-editor.org/rfc/rfc9218#section-5
+  http/cache-status-syntax:
+    fact: http.parsed.cache-status.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.cache-status: {type: object}}
+    severity: warning
+    score: 3.3
+    message: "Cache-Status breaks its structured-field grammar: {got}"
+    fix: "Send Cache-Status as a list of caches with parameters, as in Cache-Status: ExampleCache; hit."
+    docs: https://www.rfc-editor.org/rfc/rfc9211#section-2
+  http/retry-after-short:
+    fact: http.parsed.retry-after.value.seconds
+    expect: {minimum: 10}
+    when: {http.status: {enum: [429, 503]}, http.parsed.retry-after.value: {type: object}}
+    severity: info
+    score: [[0, 3.0], [9, 1.2]]
+    message: "Retry-After asks clients back in {got} seconds, which brings the load straight back to a server that is shedding it"
+    fix: "Send Retry-After: 120, or as long as the server needs to recover."
+    docs: https://www.rfc-editor.org/rfc/rfc9110#section-10.2.3
+  http/retry-after-syntax:
+    fact: http.parsed.retry-after.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.retry-after: {type: object}}
+    severity: warning
+    score: 4.1
+    message: "Retry-After breaks RFC 9110 §10.2.3, so clients cannot tell when to retry: {got}"
+    fix: "Send Retry-After as a number of seconds, as in Retry-After: 120, or an IMF-fixdate."
+    docs: https://www.rfc-editor.org/rfc/rfc9110#section-10.2.3
+  http/alt-svc-syntax:
+    fact: http.parsed.alt-svc.errors
+    expect: {maxItems: 0}
+    when: {http.parsed.alt-svc: {type: object}}
+    severity: warning
+    score: 4.4
+    message: "Alt-Svc breaks RFC 7838 §3, so clients never try the alternative: {got}"
+    fix: "Send Alt-Svc as h3=\":443\"; ma=86400."
+    docs: https://www.rfc-editor.org/rfc/rfc7838#section-3

package/presets/recommended.yaml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: The default ruleset of every group — all presets except browser
+extends:
+  - spiderlint:seo
+  - spiderlint:security-headers
+  - spiderlint:performance
+  - spiderlint:links
+  - spiderlint:tls
+  - spiderlint:cookies
+  - spiderlint:redirects
+  - spiderlint:sitemap
+  - spiderlint:robots
+  - spiderlint:resources
+  - spiderlint:origin
+  - spiderlint:dns:recommended
+  - spiderlint:mail:recommended
+  - spiderlint:images
+  - spiderlint:icons
+  - spiderlint:insights
+rules:
+  http/consistent-origin:
+    severity: info
+    score: 2.8
+  icons/favicon: warning
+  icons/apple-touch: warning
+  icons/declared-size: warning
+  icons/svg: off
+  icons/mask-icon: off
+  icons/ms-tile: off
+  manifest/parse:
+    severity: error
+    score: 7.2
+  origin/www-resolves: info
+  http/clock-skew:
+    severity: warning
+    score: [[-3600, 6.8], [-60, 3.4], [60, 3.4], [3600, 6.8]]
+  http/content-length:
+    severity: warning
+    score: 5.4
+  http/date:
+    fact: http.headers.date
+    expect: {type: string, pattern: "^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \\d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\d{4} \\d{2}:\\d{2}:\\d{2} GMT$"}
+    severity: warning
+    score: 4.2
+    message: "Date should be an IMF-fixdate, found {got}"
+    fix: "Send Date in IMF-fixdate form, as Sun, 06 Nov 1994 08:49:37 GMT."
+    docs: https://www.rfc-editor.org/rfc/rfc9110#section-5.6.7

package/presets/redirects.yaml

@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Redirect chain length and permanent redirects
+rules:
+  redirects/chain-length:
+    fact: http.redirects
+    expect: {type: array, maxItems: 2}
+    severity: warning
+    score: 4.8
+    message: "takes more than 2 redirects to land ({got})"
+    fix: "Collapse the redirect chain so the final URL is reached in one or two hops."
+    docs: https://developers.google.com/search/docs/crawling-indexing/301-redirects
+  redirects/permanent:
+    fact: http.redirects
+    expect: {type: array, items: {properties: {status: {enum: [301, 308]}}}}
+    when: {http.status: {minimum: 200, maximum: 299}}
+    severity: info
+    score: 2.4
+    message: "reached through a temporary redirect ({got})"
+    fix: "Answer a moved page with 301 or 308, not 302, 303 or 307."
+    docs: https://developers.google.com/search/docs/crawling-indexing/301-redirects#permanent-server-side