spiderlint 0.0.0 → 0.143.0

package/presets/seo.yaml

@@ -0,0 +1,380 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Titles, descriptions, headings, canonical, Open Graph and alt text
+when:
+  http.status: {minimum: 200, maximum: 299}
+rules:
+  html/lang:
+    fact: html.lang
+    expect: {type: string, pattern: "^[A-Za-z]{2,3}(-[A-Za-z0-9]{1,8})*$"}
+    severity: error
+    score: 8.2
+    message: "<html lang> should be a BCP 47 language tag, found {got}"
+    docs: https://developer.mozilla.org/docs/Web/HTML/Global_attributes/lang
+    fix: "Set <html lang> to a BCP 47 language tag."
+  html/viewport:
+    fact: html.meta.viewport
+    expect: {type: string, pattern: "^(?!.*(?i:user-scalable)\\s*=\\s*(?i:no|0)\\b)(?!.*(?i:maximum-scale)\\s*=\\s*1(\\.0+)?(?![\\d.]))(?=.*(?i:width\\s*=\\s*device-width))"}
+    severity: warning
+    score: 5.3
+    message: "meta viewport should set width=device-width and allow zoom, found {got}"
+    docs: https://developer.mozilla.org/docs/Web/HTML/Viewport_meta_tag
+    fix: "Set <meta name=viewport content=\"width=device-width\"> and allow zoom."
+  html/viewport-syntax:
+    severity: info
+    score: 1.3
+  html/theme-color:
+    fact: html.meta.theme-color
+    expect: {type: string, minLength: 1}
+    severity: warning
+    score: 3.3
+    message: "no meta theme-color"
+    docs: https://developer.mozilla.org/docs/Web/HTML/Element/meta/name/theme-color
+    fix: "Add <meta name=theme-color> with a color value."
+  html/theme-color-syntax:
+    severity: warning
+    score: 3.3
+  html/color-scheme:
+    fact: html.meta.color-scheme
+    expect: {type: string, pattern: "^\\s*(?:(?i:normal)|(?:(?i:only)\\s+)?(?!(?i:normal|only)\\b)[A-Za-z_-][\\w-]*(?:\\s+(?!(?i:normal|only)\\b)[A-Za-z_-][\\w-]*)*(?:\\s+(?i:only))?)\\s*$"}
+    severity: info
+    score: 1.4
+    message: "meta color-scheme should be normal, or scheme names such as light dark, found {got}"
+    docs: https://developer.mozilla.org/docs/Web/HTML/Element/meta/name/color-scheme
+    fix: "Add <meta name=color-scheme content=\"light dark\">."
+  html/theme-color-schemes:
+    when: {html.meta.color-scheme: {type: string, allOf: [{pattern: "(?i:\\blight\\b)"}, {pattern: "(?i:\\bdark\\b)"}]}}
+    fact: html.metas
+    expect:
+      allOf:
+        - {contains: {properties: {name: {const: theme-color}}, required: [name]}, minContains: 2}
+        - {contains: {properties: {name: {const: theme-color}, media: {pattern: "(?i:prefers-color-scheme)"}}, required: [name, media]}}
+    severity: warning
+    score: 3.4
+    message: "color-scheme names light and dark, but no theme-color pair carries a prefers-color-scheme media"
+    fix: "Add <meta name=theme-color media=\"(prefers-color-scheme: dark)\"> beside the light one."
+    docs: https://developer.mozilla.org/docs/Web/HTML/Element/meta/name/theme-color#media
+  html/noindex-listed:
+    fact: robots.noindex
+    expect: {const: false}
+    when: {sitemap.listed: true, url.twin: {not: {type: string}}, site.role: production}
+    severity: error
+    score: 8.0
+    message: "a page the sitemap lists says noindex, in <meta name=robots> or X-Robots-Tag"
+    docs: https://developers.google.com/search/docs/crawling-indexing/block-indexing
+    fix: "Remove noindex from <meta name=robots> or X-Robots-Tag, or unlist the page from the sitemap."
+  html/dir-rtl:
+    fact: html.dir
+    expect: {const: rtl}
+    when: {html.lang: {type: string, pattern: "^(?i:ar|arc|ckb|dv|fa|he|ps|sd|ug|ur|yi)(-|$)"}}
+    severity: warning
+    score: 3.8
+    message: "a right-to-left language should set <html dir=rtl>, found {got}"
+    docs: https://www.w3.org/International/questions/qa-html-dir
+    fix: "Add dir=rtl to the <html> element."
+  html/charset:
+    fact: html.charset
+    expect: {type: object, required: [declared, offset], properties: {declared: {pattern: "^(?i:utf-?8)$"}, offset: {maximum: 1024}}}
+    severity: warning
+    score: 5.2
+    message: "<meta charset> should declare UTF-8 within the first 1024 bytes, found {got}"
+    docs: https://html.spec.whatwg.org/multipage/semantics.html#charset
+    fix: "Add <meta charset=utf-8> as the first element of <head>."
+  html/privacy-policy:
+    fact: html.rels.privacy-policy
+    expect: {type: array, minItems: 1}
+    severity: info
+    score: 1.6
+    message: "no link with rel=privacy-policy"
+    docs: https://html.spec.whatwg.org/multipage/links.html#link-type-privacy-policy
+    fix: "Add <link rel=privacy-policy href=/privacy> to the head."
+  html/favicon:
+    fact: html.head.links
+    expect: {contains: {required: [rel], properties: {rel: {pattern: "(?i:(^|\\s)icon(\\s|$))"}}}}
+    severity: info
+    score: 2.2
+    message: "no <link rel=icon> in the head"
+    docs: https://developer.mozilla.org/docs/Web/HTML/Attributes/rel#icon
+    fix: "Add <link rel=icon href=/favicon.ico> to the head."
+  html/hreflang-x-default:
+    fact: html.hreflang
+    expect: {contains: {required: [lang], properties: {lang: {const: x-default}}}}
+    when: {html.hreflang: {minItems: 1}}
+    severity: info
+    score: 2.6
+    message: "hreflang alternates should include x-default, found {got}"
+    docs: https://developers.google.com/search/docs/specialty/international/localized-versions#xdefault
+    fix: "Add <link rel=alternate hreflang=x-default> to the head."
+  html/jsonld-parses:
+    fact: html.jsonld
+    expect: {items: {not: {required: ["@error"]}}}
+    severity: warning
+    score: 4.5
+    message: "a JSON-LD block does not parse: {got}"
+    docs: https://json-ld.org/spec/latest/json-ld/
+    fix: "Fix the JSON-LD block so it is valid JSON."
+  url/shape:
+    fact: url.pathname
+    expect: {type: string, pattern: "^(?!.*//)(%[0-9A-Fa-f]{2}|[^A-Z_%])*$"}
+    severity: info
+    score: 2.8
+    message: "URL path should be lowercase, with hyphens and no empty segment, found {got}"
+    docs: https://developers.google.com/search/docs/crawling-indexing/url-structure
+    fix: "Rewrite the path to be lowercase, with hyphens and no empty segments."
+  html/title:
+    fact: html.title
+    expect: {type: string}
+    severity: error
+    score: 7.8
+    message: "no <title>"
+    docs: https://developers.google.com/search/docs/appearance/title-link
+    fix: "Add a <title> to the head."
+  html/description:
+    fact: html.meta.description
+    expect: {type: string}
+    severity: warning
+    score: 6.0
+    message: "no meta description"
+    docs: https://developers.google.com/search/docs/appearance/snippet
+    fix: "Add <meta name=description> with a summary to the head."
+  html/title-length:
+    when: {html.title: {type: string}}
+    fact: html.title
+    expect: {type: string, minLength: 30, maxLength: 60}
+    severity: warning
+    score: 5.7
+    message: "<title> should be 30–60 characters, found {got}"
+    docs: https://developers.google.com/search/docs/appearance/title-link
+    fix: "Shorten or lengthen <title> to 30–60 characters."
+  html/description-length:
+    when: {html.meta.description: {type: string}}
+    fact: html.meta.description
+    expect: {type: string, minLength: 50, maxLength: 160}
+    severity: warning
+    score: 5.5
+    message: "meta description should be 50–160 characters, found {got}"
+    docs: https://developers.google.com/search/docs/appearance/snippet
+    fix: "Shorten or lengthen the meta description to 50–160 characters."
+  html/title-redundant:
+    when: {html.title: {type: string}}
+    fact: html.title
+    expect: {type: string, pattern: "^(?!.*(.{2,120}?)\\s*[-|:–—·»]\\s*\\1$).*$"}
+    severity: warning
+    score: 4.8
+    message: "<title> repeats itself around a separator: {got}"
+    docs: https://developers.google.com/search/docs/appearance/title-link
+    fix: "Remove the repeated suffix from <title>."
+  html/description-redundant:
+    when: {html.meta.description: {type: string}}
+    fact: html.meta.description
+    expect: {type: string, pattern: "^(?!.*(.{2,120}?)\\s*[-|:–—·»]\\s*\\1$).*$"}
+    severity: warning
+    score: 4.7
+    message: "meta description repeats itself around a separator: {got}"
+    docs: https://developers.google.com/search/docs/appearance/snippet
+    fix: "Remove the repeated suffix from the meta description."
+  html/one-h1:
+    fact: html.h1
+    expect: {type: array, minItems: 1, maxItems: 1}
+    severity: error
+    score: 7.4
+    message: "should have exactly one <h1>, found {got}"
+    docs: https://developer.mozilla.org/docs/Web/HTML/Reference/Elements/Heading_Elements
+    fix: "Use exactly one <h1> per page."
+  html/canonical:
+    fact: html.canonical
+    expect: {type: string, pattern: "^https?://"}
+    severity: warning
+    score: 5.4
+    message: "canonical link should be an absolute URL, found {got}"
+    docs: https://developers.google.com/search/docs/crawling-indexing/consolidate-duplicate-urls
+    fix: "Make the canonical link an absolute URL."
+  html/canonical-self:
+    severity: warning
+    score: 6.4
+  html/og-url-self:
+    severity: info
+    score: 2.4
+  html/img-alt:
+    fact: html.images
+    expect: {type: array, items: {required: [alt]}}
+    severity: warning
+    score: 5.0
+    message: "an <img> has no alt attribute: {got}"
+    docs: https://developers.google.com/search/docs/appearance/google-images
+    fix: "Add an alt attribute to every <img>."
+  html/og-title:
+    fact: html.property.og:title
+    expect: {type: string, minLength: 10, maxLength: 90}
+    severity: warning
+    score: 4.0
+    message: "og:title should be 10–90 characters, found {got}"
+    docs: https://ogp.me/#metadata
+    fix: "Set og:title to 10–90 characters."
+  html/og-description:
+    fact: html.property.og:description
+    expect: {type: string, minLength: 50, maxLength: 200}
+    severity: warning
+    score: 3.9
+    message: "og:description should be 50–200 characters, found {got}"
+    docs: https://ogp.me/#optional
+    fix: "Set og:description to 50–200 characters."
+  html/og-image:
+    fact: html.property.og:image
+    expect: {type: string, format: uri, pattern: "^(?i:https?)://"}
+    severity: warning
+    score: 4.6
+    message: "og:image should be an absolute http(s) URL, found {got}"
+    docs: https://ogp.me/#metadata
+    fix: "Make og:image an absolute URL."
+  html/og-type:
+    fact: html.property.og:type
+    expect: {type: string, pattern: "^(?:website|article|book|profile|music\\.(?:song|album|playlist|radio_station)|video\\.(?:movie|episode|tv_show|other)|[a-z][\\w-]*:[\\w.-]+)$"}
+    severity: info
+    score: 1.1
+    message: "og:type should be an Open Graph type or namespace:type, found {got}"
+    docs: https://ogp.me/#types
+    fix: "Set og:type to website, or article on a post."
+  html/og-url:
+    fact: html.property.og:url
+    expect: {type: string, format: uri, pattern: "^(?i:https?)://"}
+    severity: info
+    score: 2.5
+    message: "og:url should be an absolute http(s) URL, found {got}"
+    docs: https://ogp.me/#metadata
+    fix: "Make og:url an absolute URL of this page."
+  html/author:
+    fact: html.author
+    expect: {type: string, minLength: 1}
+    when: {html.property.og:type: article}
+    severity: warning
+    score: 3.7
+    message: "an article names no author for its link preview"
+    fix: "Add <meta name=author>, article:author, or a JSON-LD author to the article head."
+    docs: https://github.com/mastodon/mastodon/blob/423d0ca875fccbcd02ed4201999cec1625dee9e6/app/lib/link_details_extractor.rb#L195-L197
+  html/published-date:
+    fact: html.published
+    expect: {type: string, minLength: 1}
+    when: {html.property.og:type: article}
+    severity: warning
+    score: 3.6
+    message: "an article gives no publication date for its link preview"
+    fix: "Add <meta property=article:published_time> or a JSON-LD datePublished in ISO 8601."
+    docs: https://ogp.me/#type_article
+  html/unique-title:
+    unique: html.title
+    scope: site
+    severity: warning
+    score: 5.9
+    message: "pages share one <title>: {got}"
+    docs: https://developers.google.com/search/docs/appearance/title-link
+    fix: "Give each page a distinct <title>."
+  html/unique-description:
+    unique: html.meta.description
+    scope: site
+    severity: warning
+    score: 5.6
+    message: "pages share one meta description: {got}"
+    docs: https://developers.google.com/search/docs/appearance/snippet
+    fix: "Give each page a distinct meta description."
+  html/unique-og-title:
+    unique: html.property.og:title
+    scope: site
+    severity: warning
+    score: 4.2
+    message: "pages share one og:title: {got}"
+    docs: https://ogp.me/#metadata
+    fix: "Give each page a distinct og:title."
+  html/unique-og-description:
+    unique: html.property.og:description
+    scope: site
+    severity: warning
+    score: 4.1
+    message: "pages share one og:description: {got}"
+    docs: https://ogp.me/#optional
+    fix: "Give each page a distinct og:description."
+  html/noindex-twin:
+    fact: robots.noindex
+    expect: {const: true}
+    when: {url.twin: {type: string}}
+    severity: info
+    score: 3.0
+    message: "a page served off the canonical origin is indexable; mark the staging twin noindex"
+    fix: "Send X-Robots-Tag: noindex from every origin other than the canonical one."
+    docs: https://developers.google.com/search/docs/crawling-indexing/block-indexing
+  html/noindex-staging:
+    fact: robots.noindex
+    expect: {const: true}
+    when: {site.role: {enum: [development, staging]}, url.twin: {not: {type: string}}}
+    severity: warning
+    score: 6.2
+    message: "a page of a staging or development site is indexable"
+    fix: "Send X-Robots-Tag: noindex from every non-production host."
+    docs: https://developers.google.com/search/docs/crawling-indexing/block-indexing
+  http/tdm-reservation:
+    fact: http.headers.tdm-reservation
+    expect: {type: string, pattern: "^\\s*[01]\\s*$"}
+    when: {http.headers.tdm-reservation: {type: string}}
+    severity: warning
+    score: 3.5
+    message: "tdm-reservation should be 0 or 1, found {got}"
+    fix: "Send tdm-reservation: 1 to reserve text and data mining rights, 0 to waive them."
+    docs: https://www.w3.org/community/reports/tdmrep/CG-FINAL-tdmrep-20240510/
+  html/tdm-reservation:
+    fact: html.meta.tdm-reservation
+    expect: {type: string, pattern: "^\\s*[01]\\s*$"}
+    when: {html.meta.tdm-reservation: {type: string}}
+    severity: warning
+    score: 3.5
+    message: "<meta name=tdm-reservation> should be 0 or 1, found {got}"
+    fix: "Set <meta name=tdm-reservation content=1> to reserve text and data mining rights, 0 to waive them."
+    docs: https://www.w3.org/community/reports/tdmrep/CG-FINAL-tdmrep-20240510/
+  url/length:
+    fact: url.href
+    expect: {type: string, maxLength: 100}
+    severity: info
+    score: 1.8
+    message: "the URL is longer than 100 characters: {got}"
+    fix: "Shorten the path to the few words that name the page."
+    docs: https://developers.google.com/search/docs/crawling-indexing/url-structure
+  url/uppercase:
+    fact: url.pathname
+    expect: {type: string, not: {pattern: "(?<!%)(?<!%[0-9A-Fa-f])[A-Z]"}}
+    severity: warning
+    score: 5.1
+    message: "the path has uppercase letters, which a server may treat as another URL: {got}"
+    fix: "Use lowercase paths, and redirect each mixed-case path to its lowercase form."
+    docs: https://developers.google.com/search/docs/crawling-indexing/url-structure
+  url/session-param:
+    fact: url.href
+    expect: {type: string, not: {pattern: "(?i:[?&;](sid|sessionid|jsessionid|phpsessid)=)"}}
+    severity: warning
+    score: 5.8
+    message: "the URL carries a session ID: {got}"
+    fix: "Keep the session in a cookie, never in the URL."
+    docs: https://developers.google.com/search/docs/crawling-indexing/url-structure
+  url/double-slash:
+    fact: url.pathname
+    expect: {type: string, not: {pattern: "//"}}
+    severity: warning
+    score: 4.9
+    message: "the path has an empty segment: {got}"
+    fix: "Remove the doubled slash from the links, and redirect the doubled path to the single one."
+    docs: https://developers.google.com/search/docs/crawling-indexing/url-structure
+  url/extension:
+    fact: url.pathname
+    expect: {type: string, not: {pattern: "(?i:\\.(php|aspx?|jsp|cgi|html?)$)"}}
+    severity: hint
+    score: 0.6
+    message: "the path exposes the server technology in its extension: {got}"
+    fix: "Serve the page at an extensionless path, and redirect the old one to it."
+    docs: https://www.w3.org/Provider/Style/URI
+  url/readable-slug: info
+  url/separators:
+    severity: warning
+    score: 4.4
+  url/trailing-slash:
+    severity: warning
+    score: 4.3

package/presets/sitemap.yaml

@@ -0,0 +1,34 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Sitemap readability, its agreement with the links and hreflang, and its media answering
+when:
+  http.status: {minimum: 200, maximum: 299}
+rules:
+  sitemap/orphan:
+    fact: crawl.referrers
+    expect: {type: array, minItems: 1}
+    when: {crawl.discovered-via: sitemap, site.crawl.complete: {const: true}}
+    severity: warning
+    score: 5.4
+    message: "listed in the sitemap, yet no crawled page links here"
+    fix: "Add a link to this page from somewhere on the site, or remove it from the sitemap."
+    docs: https://developers.google.com/search/docs/crawling-indexing/links-crawlable
+  sitemap/unlisted:
+    fact: sitemap.listed
+    expect: {const: true}
+    when: {html: {type: object}}
+    severity: info
+    message: "missing from the sitemap"
+    fix: "Add this URL to the sitemap."
+    docs: https://developers.google.com/search/docs/crawling-indexing/sitemaps/overview
+  sitemap/unreadable:
+    severity: warning
+    score: [[0, 5.8], [404, 4.4], [500, 5.8]]
+  sitemap/hreflang:
+    severity: warning
+    score: 4.6
+  sitemap/media:
+    severity: warning
+    score: [[0, 5.2], [404, 4.0], [500, 5.2]]

package/presets/suggestions.yaml

@@ -0,0 +1,97 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Optional headers and head links a site may adopt, all hints, outside recommended
+when:
+  http.status: {minimum: 200, maximum: 299}
+  http.content-type: {pattern: "^text/html"}
+rules:
+  http/coep:
+    fact: http.parsed.cross-origin-embedder-policy.value
+    expect: {enum: [require-corp, credentialless]}
+    when: {http.parsed.cross-origin-embedder-policy.errors: {maxItems: 0}}
+    severity: hint
+    score: 0.8
+    message: "Cross-Origin-Embedder-Policy should be require-corp or credentialless, found {got}"
+    fix: "Send Cross-Origin-Embedder-Policy: credentialless once every embed loads under it."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
+  http/digest:
+    fact: http.headers
+    expect: {anyOf: [{required: [content-digest]}, {required: [repr-digest]}]}
+    severity: hint
+    score: 0.6
+    message: "no Content-Digest or Repr-Digest lets a client check the body"
+    fix: "Send Repr-Digest: sha-256=:<base64 digest>: with each response."
+    docs: https://www.rfc-editor.org/rfc/rfc9530
+  http/server-timing:
+    fact: http.headers.server-timing
+    expect: {type: string, minLength: 1}
+    when: {site.role: {enum: [development, staging]}}
+    severity: hint
+    score: 0.2
+    message: "no Server-Timing header shows where the server spent its time"
+    fix: "Send Server-Timing: app;dur=<milliseconds> with durations that name no internals."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/Server-Timing
+  http/no-vary-search:
+    fact: http.headers.no-vary-search
+    expect: {type: string, minLength: 1}
+    when: {url.search: {minLength: 1}}
+    severity: hint
+    score: 0.4
+    message: "a URL with a query has no No-Vary-Search to say which parameters change the page"
+    fix: "Send No-Vary-Search: params=(\"utm_source\" \"utm_medium\") naming the parameters that do not change the page."
+    docs: https://developer.mozilla.org/docs/Web/HTTP/Headers/No-Vary-Search
+  html/speculation-rules:
+    fact: html.scripts
+    expect: {contains: {required: [type], properties: {type: {pattern: "^(?i:speculationrules)$"}}}}
+    when: {http.headers.speculation-rules: {not: {type: string}}}
+    severity: hint
+    score: 0.7
+    message: "no Speculation Rules script or header prefetches likely next pages"
+    fix: "Add <script type=speculationrules> with a prefetch rule for same-origin links."
+    docs: https://developer.mozilla.org/docs/Web/API/Speculation_Rules_API
+  html/feed-discovery:
+    fact: html.head.links
+    expect: {contains: {required: [rel, type], properties: {rel: {pattern: "(?i:(^|\\s)alternate(\\s|$))"}, type: {pattern: "^(?i:application/(rss\\+xml|atom\\+xml|feed\\+json))"}}}}
+    when: {url.pathname: "/"}
+    severity: hint
+    score: 0.5
+    message: "the home page links no RSS, Atom or JSON feed"
+    fix: "Add <link rel=alternate type=application/atom+xml href=/feed.xml> to the head."
+    docs: https://www.rssboard.org/rss-autodiscovery
+  html/alternate-formats:
+    fact: html.head.links
+    expect: {contains: {required: [rel, type], properties: {rel: {pattern: "(?i:(^|\\s)alternate(\\s|$))"}, type: {not: {pattern: "^(?i:text/html)"}}}}}
+    when: {url.pathname: "/"}
+    severity: hint
+    score: 0.5
+    message: "the home page links no machine-readable alternate (feed, JSON, Markdown)"
+    fix: "Add <link rel=alternate type=text/markdown href=/index.md> or a feed to the head."
+    docs: https://html.spec.whatwg.org/multipage/links.html#rel-alternate
+  html/nlweb:
+    fact: html.rels.nlweb
+    expect: {type: array, minItems: 1}
+    when: {url.pathname: "/"}
+    severity: hint
+    score: 0.3
+    message: "the home page links no NLWeb endpoint with rel=nlweb"
+    fix: "Add <link rel=nlweb href=/ask> pointing at the site’s NLWeb endpoint."
+    docs: https://github.com/nlweb-ai/NLWeb
+  html/fediverse-creator:
+    fact: html.meta.fediverse:creator
+    expect: {type: string, pattern: "^@?[^@\\s]+@[^@\\s]+\\.[^@\\s]+$"}
+    when: {html.property.og:type: article}
+    severity: hint
+    score: 0.3
+    message: "an article names no fediverse:creator account for Mastodon previews, found {got}"
+    fix: "Add <meta name=fediverse:creator content=\"@user@instance.example\"> to the article head."
+    docs: https://blog.joinmastodon.org/2024/07/highlighting-journalism-on-mastodon/
+  redirects/by:
+    fact: http.redirects
+    expect: {type: array, items: {required: [by]}}
+    severity: hint
+    score: 0.1
+    message: "a redirect does not say which component sent it with Redirect-By ({got})"
+    fix: "Send Redirect-By: <component> with every redirect."
+    docs: https://specification.website/spec/

package/presets/sustainability.yaml

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: What a site discloses about its footprint in carbon.txt, and what a view of each page emits
+extends: [spiderlint:carbon-txt]
+rules:
+  green/page-weight-co2:
+    fact: co2.grams
+    expect: {maximum: 0.209}
+    when: {http.status: {minimum: 200, maximum: 299}}
+    severity: info
+    score: [[0.209, 1.4], [1.0, 2.6], [3.0, 3.2]]
+    message: "one view emits {got} g CO2e by the Sustainable Web Design model, above the 0.209 g budget (rating C)"
+    fix: "Cut the page’s transfer size: compress and resize images, drop unused scripts and fonts."
+    docs: https://developers.thegreenwebfoundation.org/co2js/explainer/methodologies-for-calculating-website-carbon/

package/presets/tls.yaml

@@ -0,0 +1,72 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Certificate validity, protocol version and expiry
+when:
+  url.protocol: "https:"
+rules:
+  tls/authorized:
+    fact: tls.authorized
+    expect: {const: true}
+    severity: error
+    score: 9.5
+    message: "certificate is not trusted"
+    fix: "Install the CA bundle the server needs, or request a certificate from a trusted CA."
+    docs: https://developer.mozilla.org/docs/Web/Security/Transport_Layer_Security
+  tls/protocol:
+    fact: tls.protocol
+    expect: {enum: [TLSv1.2, TLSv1.3]}
+    severity: warning
+    score: 6.1
+    message: "TLS should be 1.2 or 1.3, found {got}"
+    fix: "Disable TLS 1.0 and 1.1 in the server configuration; keep only TLS 1.2 and 1.3."
+    docs: https://developer.mozilla.org/docs/Web/Security/Transport_Layer_Security
+  tls/cert-expiry:
+    fact: tls.cert.days-left
+    expect: {type: integer, minimum: 14}
+    when: {tls.cert.days-left: {minimum: 2}}
+    severity: info
+    score: [[2, 3.2], [14, 1.0]]
+    message: "certificate expires within 14 days ({got} left)"
+    fix: "Check that certificate renewal is scheduled and has succeeded before."
+    docs: https://developer.mozilla.org/docs/Web/Security/Transport_Layer_Security
+  tls/cert-expiring:
+    fact: tls.cert.days-left
+    expect: {type: integer, minimum: 2}
+    when: {tls.cert.days-left: {minimum: 0}}
+    severity: warning
+    score: [[0, 6.8], [2, 5.2]]
+    message: "certificate expires within 2 days ({got} left)"
+    fix: "Renew the certificate now and find out why automatic renewal did not run."
+    docs: https://developer.mozilla.org/docs/Web/Security/Transport_Layer_Security
+  tls/cert-expired:
+    fact: tls.cert.days-left
+    expect: {type: integer, minimum: 0}
+    severity: error
+    score: 9.3
+    message: "certificate has expired ({got} days left)"
+    fix: "Renew the certificate and reload the server that serves it."
+    docs: https://developer.mozilla.org/docs/Web/Security/Transport_Layer_Security
+  tls/key-strength:
+    fact: tls.cert.key
+    expect:
+      anyOf:
+        - {properties: {type: {const: RSA}, bits: {minimum: 2048}}, required: [bits]}
+        - {properties: {type: {const: EC}, curve: {enum: [P-256, P-384]}}, required: [curve]}
+        - {properties: {type: {const: Ed25519}}}
+    when: {tls.cert.key: {type: object}}
+    severity: error
+    score: 8.8
+    message: "certificate key is weaker than RSA 2048 or EC P-256: {got}"
+    fix: "Issue the certificate for a new EC P-256 key, or an RSA key of at least 2048 bits."
+    docs: https://www.rfc-editor.org/rfc/rfc9325#section-4.5
+  tls/signature:
+    fact: tls.cert.signatures
+    expect: {items: {not: {pattern: "[Ss][Hh][Aa]1|[Mm][Dd][245]"}}}
+    when: {tls.cert.signatures: {type: array}}
+    severity: error
+    score: 8.6
+    message: "the certificate chain is signed with SHA-1 or MD5: {got}"
+    fix: "Reissue the certificate from a CA that signs with SHA-256 or stronger, and serve its current intermediates."
+    docs: https://www.rfc-editor.org/rfc/rfc9155

package/presets/vendor.yaml

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: Features a CDN or host switched on for the site, read from the paths it adds, all info
+rules:
+  vendor/cloudflare-email-obfuscation:
+    fact: site.origins.*.vendor.features
+    expect: {not: {contains: {const: cloudflare/email-obfuscation}}}
+    severity: info
+    score: 2.4
+    message: "Cloudflare’s Email Address Obfuscation rewrites every address into a link only JavaScript decodes, so a visitor without JavaScript sees no address"
+    fix: "Turn off Email Address Obfuscation in the Cloudflare dashboard under Security › Settings, or accept that visitors without JavaScript see no address."
+    docs: https://developers.cloudflare.com/waf/tools/scrape-shield/email-address-obfuscation/

package/presets/web-comprehensive.yaml

@@ -0,0 +1,17 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: The recommended rules plus link graph, language, structured data, manifest, markup, well-known files, trackers and footprint, all over HTTP — for the scan server’s form
+extends:
+  - spiderlint:recommended
+  - spiderlint:graph
+  - spiderlint:i18n
+  - spiderlint:structured-data
+  - spiderlint:manifest
+  - spiderlint:markup
+  - spiderlint:link-text
+  - spiderlint:well-known
+  - spiderlint:trackers
+  - spiderlint:sustainability
+  - spiderlint:vendor

package/presets/web-quick.yaml

@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+---
+description: A fast look at the basics over HTTP — search tags, security headers, caching, TLS, redirects and robots.txt — for the scan server’s form
+extends:
+  - spiderlint:seo
+  - spiderlint:security-headers
+  - spiderlint:performance
+  - spiderlint:tls
+  - spiderlint:redirects
+  - spiderlint:robots
+  - spiderlint:links
+rules:
+  links/broken-external: off