Changelog

New Security topic on cross-origin isolation — the Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy response headers that sever risky cross-window links (tabnabbing, XS-Leaks) and keep your resources out of an attacker’s process (Spectre). The site already ships COOP and CORP on every response, so this closes a ship-it-before-you-spec-it gap; status: recommended.

New Performance topic on Compression Dictionary Transport (RFC 9842) — reusing a previously served response, or a dedicated dictionary, as a Brotli/Zstandard dictionary so updated assets compress to a fraction of their size. Pure progressive enhancement over ordinary compression; status: optional.

Updated Structured data to reflect that Google retired the FAQ rich result in 2026. FAQPage is still valid schema.org vocabulary, but it no longer produces a search feature and no answer engine has confirmed it favours the markup over rendered HTML — so add it only for genuine, visible Q-and-A content, never for SERP or “GEO” gain.

New Performance topic on conditional requests — how ETag, Last-Modified and 304 Not Modified responses let browsers and agents revalidate cached responses cheaply instead of re-downloading unchanged bodies. Status: recommended.

A batch of new pages landed: Mobile-friendly form inputs, dynamic viewport units, graceful degradation when JavaScript fails, mixed content and upgrade-insecure-requests, server-side rendering, and /.well-known/webauthn for Related Origin Requests.

First public version: a platform-agnostic specification of what a good website does, spanning Foundations, SEO, Accessibility, Security, Well-Known URIs, Agent Readiness, Performance, Privacy, Resilience and Internationalisation. Every topic is tagged required, recommended, optional or avoid, and cited from primary sources. Available as HTML, Markdown, a checklist, llms.txt, RSS, and an MCP server.