Map
↑specification.website

The specification.website Checklist

Wiki summaryweb-standardsreferencechecklistai-agentsseoaccessibilitysecurityperformance ↳ show in map Markdown
title
The specification.website Checklist
type
summary
summary
A curated, opinionated checklist of nine web-spec categories (foundations, SEO, a11y, security, well-known, agent readiness, performance, resilience, i18n) with Required/Recommended/Optional/Avoid tags
parent
specification-website
tags
web-standards, reference, checklist, ai-agents, seo, accessibility, security, performance
sources
specification-website-checklist
created
2026-05-31
updated
2026-05-31

A single-page checklist on specification.website that catalogs everything a modern web page is expected to ship. Each item is one line of explanation linking out to a longer spec page on the same site, tagged Required / Recommended / Optional / Avoid. The interesting move is that the checklist puts agent-facing concerns next to the older SEO and accessibility ones — same nine-category table, same tagging vocabulary, no hierarchy between "Google can index this" and "an LLM can parse this."

The nine categories

Foundations — doctype, lang, meta charset, viewport, title, meta description, canonical, favicons (SVG + ICO + apple-touch-icon + maskable PWA), theme-color (per scheme), color-scheme, Open Graph, feed <link rel="alternate">, well-formed feed contents, native <dialog>. The newer items here are interesting: maskable PWA icons, dark/light theme-color via the media attribute, color-scheme to prevent the dark-mode white flash before CSS loads.

SEO — robots.txt (RFC 9309), sitemaps, sitemap index, image/video sitemap extensions, URL hygiene, 301/302/308 redirects, avoiding soft 404s, meta robots / X-Robots-Tag policy, heading hierarchy, internal links, JSON-LD structured data, breadcrumbs, IndexNow.

Accessibility — WCAG-aligned: contrast, alt text, form labels, keyboard reachability, visible focus indicators, skip links, semantic HTML and landmarks, the "first rule of ARIA is don't use ARIA," descriptive link text, no empty buttons, accessible form errors, document/parts language, prefers-reduced-motion, the warning against accessibility-overlay widgets, captions/transcripts, accessible tables, 24×24 (and 44×44 enhanced) touch targets. Newer items: hidden="until-found" for collapsible content, preferring native interactive elements over div+JS, using :has() + :user-invalid to express form state in CSS.

Security — HTTPS/TLS 1.2+, HSTS with the irreversibility warning, CSP, /.well-known/security.txt, X-Content-Type-Options: nosniff, frame-ancestors / X-Frame-Options, Referrer-Policy (strict-origin-when-cross-origin default), Permissions-Policy, SRI for third-party JS/CSS, secure cookies (__Host-/__Secure- prefixes, SameSite), CAA records, DNSSEC.

Well-Known URIs — /.well-known/ standardized per RFC 8615 with an IANA registry. The site catalogs: change-password, openid-configuration, api-catalog (RFC 9727 Linkset), webfinger, apple-app-site-association, assetlinks.json, nodeinfo, traffic-advice.

Agent Readiness — the section closest to this wiki's interests. Stable URLs, llms.txt, /llms-full.txt, exposing markdown source at .md URLs, AI-vendor user-agent allow/disallow, robots.txt Content-Signal directives (search / ingest / train), Web Bot Auth (RFC 9421 HTTP Message Signatures), JSON-LD for agents, alternate data formats (JSON / RSS / markdown), HTTP Link header advertising the discovery files, MCP for tool discovery, A2A agent cards at /.well-known/agent-card.json, an emerging "Agent Skills" well-known file (Cloudflare-led RFC), DNS-AID (SVCB/HTTPS records under _agents.example.com), NLWeb (conversational AI endpoint discovery via rel="nlweb"), WebMCP (navigator.modelContext for in-browser agent tools), Schemamap (the site's own proposed /schemamap.xml for per-resource JSON-LD endpoints).

Performance — Core Web Vitals (LCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1 at p75), image optimization, lazy loading (never on LCP), resource hints, Cache-Control, No-Vary-Search for tracking-param-invariant caching, compression (brotli/gzip/zstd), self-hosted WOFF2 fonts, critical CSS, script-loading attributes, HTTP/2 and /3, prefetch/prerender, the five-hint catalog (dns-prefetch / preconnect / preload / modulepreload / prefetch), View Transitions API, BFCache eligibility, content-visibility, CSS containment, scroll-driven animations, scrollbar-gutter: stable.

Resilience — custom 404/500 pages with correct status codes, 503 + Retry-After for maintenance, offline support via service workers, web app manifest, third-party uptime monitoring + status page on separate infra.

Internationalisation — URL pattern choice (ccTLD / subdomain / subdirectory), hreflang (reciprocal, BCP 47), translating head and JSON-LD (not just body), hreflang in sitemaps, the anti-pattern of IP-based auto-redirect, lang on inline foreign content, language picker in native names (not flags), dir="rtl" and CSS logical properties, writing-mode for CJK, locale-aware Intl formatters, CLDR plural categories, Internationalised Domain Names.

What's worth pulling out

The Agent Readiness section is the densest cluster of emerging-but-shippable AI-facing standards in one place. Many sit on different ladders of maturity:

  • Shipped / ratified — robots.txt, Link header, JSON-LD, HTTP Message Signatures (RFC 9421).
  • Proposed / draft, partially adopted — llms-txt, llms-full.txt, Content-Signal directives, Web Bot Auth, MCP tool discovery, A2A agent cards.
  • Emerging convention, site-proposed — NLWeb, WebMCP, DNS-AID, Schemamap, Agent Skills well-known file.

Two patterns recur. First, the well-known-URI pattern is the dominant discovery shape: drop a JSON or markdown file at a fixed path, advertise it via a Link header, let the agent find it. Second, the Content-Signal / Web Bot Auth pair points at where this is going — site-side declarations of what AI access is allowed, plus crypto-verified bot identity so allow/deny decisions don't hinge on user-agent strings.

A few items deserve their own pages later: Web Bot Auth, Content-Signal directives, NLWeb, WebMCP, A2A agent cards. The Schemamap proposal is more idiosyncratic but worth tracking since it's the site's own work.

Cross-references

  • llms-txt — already had a page; the checklist treats it as a base layer that llms-full.txt, markdown-source exposure, and HTTP Link-header advertisement compose on top of.
  • agent-readiness — umbrella concept extracted from this section.
  • supply-chain-security — adjacent but not the same; supply-chain is about code-to-artifact, the Security section here is about HTTP transport and policy.
  • domain-fronting, ebpf-sock-ops — both rely on the SNI/TLS layer that the Security section's HSTS + CAA + DNSSEC stack hardens.
Linked from