Rules catalog
Every check a scan grades
A WWWWeb.net scan runs 243 checks across 8 families - the same checks the reports grade page by page, listed here so coverage is visible before a single scan runs.
SEO
Search engine visibility 59
SEO-001
Title tag present, 30-60 characters
SEO-002
Meta description present, 120-160 characters
SEO-003
Exactly one H1 heading
SEO-004
At least one H2 heading
SEO-005
Canonical URL present and on this site
SEO-006
Page is indexable (no noindex)
SEO-007
Viewport meta tag present
SEO-008
HTML lang attribute present
SEO-009
Open Graph title present
SEO-010
Open Graph image present
SEO-011
Structured data (JSON-LD) present
SEO-012
All images have alt attributes
SEO-013
One canonical URL only
SEO-014
No AI opt-out directives in robots meta
SEO-015
robots.txt does not block AI crawlers
SEO-016
hreflang annotations are usable
SEO-017
hreflang set lists the page itself
SEO-018
hreflang set declares x-default
SEO-019
twitter:card names a card X renders
SEO-020
X card names an image
SEO-021
AI crawlers can read this page
SEO-022
JSON-LD blocks parse
SEO-023
Prose reads at plain-English level
SEO-024
og:image URL is fully qualified
SEO-025
twitter:image URL is fully qualified
SEO-026
html lang names a real language
SEO-027
Robots meta directives are recognized
SEO-028
X-Robots-Tag directives are recognized
SEO-029
og:url matches the canonical address
SEO-030
og:description length is appropriate
SEO-031
og:site_name matches the site's brand
SEO-032
og:type is a recognized Open Graph type
SEO-033
Open Graph audio and video URLs are absolute
SEO-034
og:image dimensions are positive integers
SEO-035
og:image:alt is descriptive when an image is declared
SEO-036
og:determiner is a valid Open Graph determiner
SEO-037
og:locale is a valid BCP 47 language tag
SEO-038
og:image:secure_url is a valid HTTPS URL
SEO-039
twitter:image:alt is descriptive when an image is declared
SEO-040
og:video dimensions are positive integers
SEO-041
og:video:secure_url is a valid HTTPS URL
SEO-042
og:audio:secure_url is a valid HTTPS URL
SEO-043
og:image:type is a recognized MIME type
SEO-044
og:audio:type is a recognized audio MIME type
SEO-045
og:video:type is a recognized video MIME type
SEO-046
og:video:duration is a positive integer
SEO-047
og:audio:duration is a positive integer
SEO-048
og:video:frame_width is a positive integer
SEO-049
og:video:frame_height is a positive integer
SEO-050
og:video:tag values are present
SEO-051
og:audio:artist is present
SEO-052
og:audio:album is present
SEO-053
og:video:series is present
SEO-054
og:video:release_date is a valid ISO 8601 date
SEO-055
og:video:actor values are present
SEO-056
og:video:director values are present
SEO-057
og:video:writer values are present
SEO-058
og:audio:track is a positive integer
SEO-059
og:audio:disc is a positive integer
TECH
Technical health 11
TECH-001
Server responds with a success status
TECH-002
Content-Type is an HTML document
TECH-003
Favicon declared
TECH-004
Not a soft 404
TECH-005
Character encoding declared
TECH-006
Sitemap is XML and lists URLs
TECH-007
robots.txt declares the sitemap
TECH-008
In-page anchors resolve to elements
TECH-009
DOCTYPE puts the page in standards mode
TECH-011
No automatic meta refresh redirect
TECH-012
Encoding declarations agree
PERF
Performance 21
PERF-001
Response time under threshold
PERF-002
Page transfer size under 1 MB
PERF-003
Response is compressed
PERF-004
Cache-Control policy is usable
PERF-005
At most 10 JavaScript resources
PERF-006
At most 5 CSS resources
PERF-007
Document HTML under 100 KB
PERF-008
Time to first byte under 800 ms
PERF-009
Page body not truncated by the scan
PERF-010
HTTP/2 or newer negotiated
PERF-011
Images declare width, height or aspect-ratio
PERF-012
Images served in WebP or AVIF
PERF-013
No redirect chain
PERF-014
DOM size reasonable
PERF-015
Images after the first are lazily loaded
PERF-016
Image fetchpriority and decoding values are valid
PERF-017
Resource hints (preload, prefetch, dns-prefetch, preconnect) are used
PERF-018
Web fonts use font-display: swap
PERF-019
Web fonts use font-display: optional
PERF-020
Critical web fonts are preloaded
PERF-021
Third-party subresource impact is minimal
SEC
Security 85
SEC-001
Site served over HTTPS
SEC-002
HSTS present with usable max-age
SEC-003
Enforcing Content-Security-Policy present
SEC-004
Framing blocked (X-Frame-Options or CSP)
SEC-005
X-Content-Type-Options is nosniff
SEC-006
Referrer-Policy recognized, not unsafe-url
SEC-007
Permissions-Policy header present
SEC-008
HTTP redirects to HTTPS
SEC-009
No mixed-content subresources
SEC-010
No server software disclosure headers
SEC-011
Cookies set the Secure flag
SEC-012
Cookies set the HttpOnly flag
SEC-013
Cookies set a SameSite attribute
SEC-014
No SameSite=None without Secure
SEC-015
Cookie prefixes used correctly
SEC-016
Cross-origin scripts and styles carry integrity
SEC-017
target=_blank links carry rel=noopener
SEC-018
Cross-Origin-Opener-Policy is same-origin
SEC-019
TLS protocol is modern
SEC-020
security.txt is published
SEC-021
security.txt names a contact
SEC-022
Cross-Origin-Embedder-Policy present
SEC-023
No SHA-1 certificate signature
SEC-024
Certificate covers the scanned host
SEC-025
Expect-CT header present
SEC-026
Certificate public key is strong
SEC-027
Cross-origin resources explicitly governed
SEC-028
Form pages are not cacheable
SEC-029
HSTS preload status reported
SEC-030
CSP defends against mixed content
SEC-031
Report-To header present
SEC-032
Clear-Site-Data on authenticated responses
SEC-033
X-XSS-Protection does not disable the filter
SEC-034
X-Download-Options header present
SEC-035
Expect-Staple header present
SEC-036
CORS restricted to a single origin
SEC-037
Cross-origin isolation in effect
SEC-038
No anonymous TLS key exchange
SEC-039
NEL header present with valid configuration
SEC-040
Permissions-Policy blocks dangerous features
SEC-041
Reporting-Endpoints header present with valid configuration
SEC-042
X-Permitted-Cross-Domain-Policies header restricts cross-domain access
SEC-043
SSL certificate found in Certificate Transparency logs
SEC-044
Cache-Control prevents caching of pages with forms
SEC-045
Origin-Agent-Cluster header requests dedicated resources
SEC-046
Expect-CT header enforces Certificate Transparency
SEC-047
Cross-Origin-Resource-Policy is same-origin
SEC-048
Referrer-Policy is restrictive
SEC-049
CSP includes upgrade-insecure-requests
SEC-050
CSP includes frame-ancestors for clickjacking protection
SEC-051
CSP sets object-src to 'none'
SEC-052
CSP script-src uses nonce or hash for inline scripts
SEC-053
CSP style-src uses nonce or hash for inline styles
SEC-054
CSP restricts base-uri to 'self'
SEC-055
CSP restricts form-action to 'self'
SEC-056
CSP restricts connect-src for fetch/XHR/WebSocket
SEC-057
CSP includes violation reporting (report-uri or report-to)
SEC-058
CSP includes sandbox directive for capability restriction
SEC-059
CSP restricts navigate-to for navigation control
SEC-060
CSP restricts worker-src for worker origin control
SEC-061
CSP restricts prefetch-src for resource prefetch control
SEC-062
CSP restricts manifest-src for web app manifest control
SEC-063
CSP restricts frame-src for frame and iframe origin control
SEC-064
CSP restricts script-src-elem for script element origin control
SEC-065
CSP restricts style-src-elem for style element origin control
SEC-066
CSP restricts img-src for image origin control
SEC-067
CSP restricts font-src for font origin control
SEC-068
CSP restricts media-src for audio and video origin control
SEC-069
CSP restricts child-src for child navigation origin control
SEC-070
CSP restricts form-src for form action origin control
SEC-071
CSP restricts script-src-attr for inline event handler control
SEC-072
CSP restricts style-src-attr for inline style attribute control
SEC-073
CSP restricts trusted-types for DOM XSS prevention
SEC-074
CSP restricts require-trusted-types-for for Trusted Types sink enforcement
SEC-075
Content-Type specifies charset on text responses
SEC-076
X-DNS-Prefetch-Control disables DNS prefetching
SEC-077
CSP script-src uses strict-dynamic with nonce or hash
SEC-078
Permissions-Policy blocks privacy-related features (Topics, Attribution, Shared Storage)
SEC-079
CSP default-src restricts fetch directive fallback
SEC-080
Timing-Allow-Origin restricts cross-origin timing exposure
SEC-081
CORS Allow-Methods/Headers restricts cross-origin request methods and headers
SEC-082
Access-Control-Max-Age restricts CORS preflight caching duration
SEC-083
Content-Disposition header validates file downloads use attachment
SEC-084
Access-Control-Expose-Headers restricts exposed response headers
SEC-101
TLS certificate valid and not expiring
A11Y
Accessibility 15
A11Y-001
All images have alt text
A11Y-002
Viewport meta present
A11Y-003
HTML lang attribute set
A11Y-004
Headings used
A11Y-005
Skip link present
A11Y-006
All form controls labelled
A11Y-007
At least two landmark regions
A11Y-008
No duplicate element IDs
A11Y-009
All links have accessible names
A11Y-010
All buttons have accessible names
A11Y-011
Viewport permits user zoom
A11Y-012
Heading levels descend in order
A11Y-013
Embedded documents are named
A11Y-014
Embedded document names are unique
A11Y-015
HTML lang names a speakable language
AI
AI readiness 17
AI-001
Meta description present
AI-002
JSON-LD structured data present
AI-003
Open Graph title and description present
AI-004
At least 300 words of visible text
AI-005
At least three headings
AI-006
llms.txt advertised with a usable URL
AI-007
Entity schema type declared in JSON-LD
AI-008
llms.txt lists pages
AI-009
llms-full.txt is not empty
AI-010
llms.txt links resolve
AI-011
Content has author attribution
AI-012
Content has publication date
AI-013
Content has recent modification date
AI-014
Canonical URL is absolute and on this site
AI-015
Semantic HTML5 elements (article, section, nav, aside, main, header, footer) present
AI-016
Content has topic tags (article:tag) for AI classification
AI-017
Content readability score (avg words per sentence <= 25)
DNS
DNS 18
DNS-001
DNS records resolve for the domain
DNS-002
A record present
DNS-003
MX record present
DNS-004
TXT records present
DNS-005
NS records present
DNS-006
SOA record present
DNS-007
CAA record present
DNS-008
CAA policy authorizes a certificate authority
DNS-009
CAA policy covers the domain's own hostnames
DNS-010
No unsupported critical CAA property
DNS-011
DNSSEC enabled (DNSKEY published)
DNS-012
No CNAME coexisting with other records
DNS-013
DS record published at the parent
DNS-014
AAAA record published (IPv6)
DNS-015
DNSSEC uses modern cryptographic algorithm
DNS-016
SOA timing values within recommended ranges
DNS-017
Authoritative name servers are diverse
DNS-018
NSEC/NSEC3 used for authenticated denial of existence
EMAIL
Email security 17
EMAIL-001
SPF present, within lookup limits, ends in -all or ~all
EMAIL-002
DMARC policy is reject or quarantine
EMAIL-003
DKIM record published at the selector
EMAIL-004
MX records present
EMAIL-005
BIMI published and DMARC enforces it
EMAIL-006
MTA-STS announced
EMAIL-007
TLS reporting record published
EMAIL-008
DMARC aggregate reporting (rua) configured
EMAIL-009
DMARC forensic reporting (ruf) configured
EMAIL-010
DMARC SPF alignment mode (aspf) is strict
EMAIL-011
DMARC DKIM alignment mode (adkim) is strict
EMAIL-012
DMARC percentage (pct) is 100
EMAIL-013
SPF record ends with -all (hard fail)
EMAIL-014
SPF domain aligns with From domain for DMARC
EMAIL-015
DKIM key uses modern algorithm and sufficient size
EMAIL-016
DKIM selector enables key rotation
EMAIL-017
DMARC subdomain policy (sp) is restrictive when main policy enforces