# The specification.website Checklist
A single-page checklist on [[specification-website|specification.website]] that catalogs everything a modern web page is expected to ship. Each item is one line of explanation linking out to a longer spec page on the same site, tagged Required / Recommended / Optional / Avoid. The interesting move is that the checklist puts agent-facing concerns next to the older SEO and accessibility ones — same nine-category table, same tagging vocabulary, no hierarchy between "Google can index this" and "an LLM can parse this."
## The nine categories
**Foundations** — doctype, `lang`, `meta charset`, viewport, title, meta description, canonical, favicons (SVG + ICO + apple-touch-icon + maskable PWA), theme-color (per scheme), color-scheme, Open Graph, feed ``. The newer items here are interesting: maskable PWA icons, dark/light theme-color via the `media` attribute, color-scheme to prevent the dark-mode white flash before CSS loads.
**SEO** — robots.txt (RFC 9309), sitemaps, sitemap index, image/video sitemap extensions, URL hygiene, 301/302/308 redirects, avoiding soft 404s, meta robots / X-Robots-Tag policy, heading hierarchy, internal links, JSON-LD structured data, breadcrumbs, IndexNow.
**Accessibility** — WCAG-aligned: contrast, alt text, form labels, keyboard reachability, visible focus indicators, skip links, semantic HTML and landmarks, the "first rule of ARIA is don't use ARIA," descriptive link text, no empty buttons, accessible form errors, document/parts language, prefers-reduced-motion, the warning against accessibility-overlay widgets, captions/transcripts, accessible tables, 24×24 (and 44×44 enhanced) touch targets. Newer items: `hidden="until-found"` for collapsible content, preferring native interactive elements over div+JS, using `:has()` + `:user-invalid` to express form state in CSS.
**Security** — HTTPS/TLS 1.2+, HSTS with the irreversibility warning, CSP, `/.well-known/security.txt`, `X-Content-Type-Options: nosniff`, frame-ancestors / X-Frame-Options, Referrer-Policy (`strict-origin-when-cross-origin` default), Permissions-Policy, SRI for third-party JS/CSS, secure cookies (`__Host-`/`__Secure-` prefixes, SameSite), CAA records, DNSSEC.
**Well-Known URIs** — `/.well-known/` standardized per RFC 8615 with an IANA registry. The site catalogs: `change-password`, `openid-configuration`, `api-catalog` (RFC 9727 Linkset), `webfinger`, `apple-app-site-association`, `assetlinks.json`, `nodeinfo`, `traffic-advice`.
**Agent Readiness** — the section closest to this wiki's interests. Stable URLs, [[llms-txt|llms.txt]], `/llms-full.txt`, exposing markdown source at `.md` URLs, AI-vendor user-agent allow/disallow, robots.txt **Content-Signal** directives (search / ingest / train), **Web Bot Auth** (RFC 9421 HTTP Message Signatures), JSON-LD for agents, alternate data formats (JSON / RSS / markdown), HTTP `Link` header advertising the discovery files, **MCP** for tool discovery, **A2A agent cards** at `/.well-known/agent-card.json`, an emerging "Agent Skills" well-known file (Cloudflare-led RFC), **DNS-AID** (SVCB/HTTPS records under `_agents.example.com`), **NLWeb** (conversational AI endpoint discovery via `rel="nlweb"`), **WebMCP** (`navigator.modelContext` for in-browser agent tools), **Schemamap** (the site's own proposed `/schemamap.xml` for per-resource JSON-LD endpoints).
**Performance** — Core Web Vitals (LCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1 at p75), image optimization, lazy loading (never on LCP), resource hints, Cache-Control, **No-Vary-Search** for tracking-param-invariant caching, compression (brotli/gzip/zstd), self-hosted WOFF2 fonts, critical CSS, script-loading attributes, HTTP/2 and /3, prefetch/prerender, the five-hint catalog (dns-prefetch / preconnect / preload / modulepreload / prefetch), View Transitions API, BFCache eligibility, `content-visibility`, CSS containment, scroll-driven animations, `scrollbar-gutter: stable`.
**Resilience** — custom 404/500 pages with correct status codes, 503 + Retry-After for maintenance, offline support via service workers, web app manifest, third-party uptime monitoring + status page on separate infra.
**Internationalisation** — URL pattern choice (ccTLD / subdomain / subdirectory), hreflang (reciprocal, BCP 47), translating head and JSON-LD (not just body), hreflang in sitemaps, the *anti-pattern* of IP-based auto-redirect, `lang` on inline foreign content, language picker in native names (not flags), `dir="rtl"` and CSS logical properties, writing-mode for CJK, locale-aware Intl formatters, CLDR plural categories, Internationalised Domain Names.
## What's worth pulling out
The **Agent Readiness** section is the densest cluster of emerging-but-shippable AI-facing standards in one place. Many sit on different ladders of maturity:
- **Shipped / ratified** — `robots.txt`, `Link` header, JSON-LD, HTTP Message Signatures (RFC 9421).
- **Proposed / draft, partially adopted** — [[llms-txt]], `llms-full.txt`, Content-Signal directives, Web Bot Auth, MCP tool discovery, A2A agent cards.
- **Emerging convention, site-proposed** — NLWeb, WebMCP, DNS-AID, Schemamap, Agent Skills well-known file.
Two patterns recur. First, the well-known-URI pattern is the dominant discovery shape: drop a JSON or markdown file at a fixed path, advertise it via a `Link` header, let the agent find it. Second, the `Content-Signal` / Web Bot Auth pair points at where this is going — site-side declarations of what AI access is allowed, plus crypto-verified bot identity so allow/deny decisions don't hinge on user-agent strings.
A few items deserve their own pages later: Web Bot Auth, Content-Signal directives, NLWeb, WebMCP, A2A agent cards. The Schemamap proposal is more idiosyncratic but worth tracking since it's the site's own work.
## Cross-references
- [[llms-txt]] — already had a page; the checklist treats it as a base layer that `llms-full.txt`, markdown-source exposure, and HTTP `Link`-header advertisement compose on top of.
- [[agent-readiness]] — umbrella concept extracted from this section.
- [[supply-chain-security]] — adjacent but not the same; supply-chain is about code-to-artifact, the Security section here is about HTTP transport and policy.
- [[domain-fronting]], [[ebpf-sock-ops]] — both rely on the SNI/TLS layer that the Security section's HSTS + CAA + DNSSEC stack hardens.