The Website Specification

Speculation Rules

Sat, 30 May 2026 00:00:00 GMT

Tell the browser which links to prefetch or prerender before the user clicks. Done well, navigations feel instant; done carelessly, you burn bandwidth on pages nobody visits.

A2A agent cards

Fri, 29 May 2026 00:00:00 GMT

The Agent-to-Agent (A2A) protocol lets an autonomous agent find another autonomous agent and call it over JSON-RPC. Discovery hinges on a single well-known file: `/.well-known/agent-card.json`. Relevant whenever your service exposes agentic behaviour another agent might want to delegate to.

Accessibility overlays

Fri, 29 May 2026 00:00:00 GMT

Third-party JavaScript widgets that claim to make a site WCAG-compliant at runtime. They do not work, often harm screen-reader users, and attract lawsuits.

Agent readiness

Fri, 29 May 2026 00:00:00 GMT

Agent readiness is the set of choices that make a site legible to AI agents and LLMs: stable URLs, structured data, clean semantics, robots controls, and machine-readable endpoints.

Agent Skills discovery

Fri, 29 May 2026 00:00:00 GMT

A well-known URI that lists Agent Skills — short, scoped instructions an AI agent can load to work better with your site. Emerging convention via a Cloudflare-led RFC; still draft, still cheap to ship.

Privacy-respecting analytics

Fri, 29 May 2026 00:00:00 GMT

You can measure traffic without surveilling visitors. Aggregate, cookieless, EU-hosted analytics tools answer most product questions without the consent and transfer problems of ad-tech analytics.

/.well-known/api-catalog

Fri, 29 May 2026 00:00:00 GMT

RFC 9727 publishes a machine-readable index of the APIs and resources a host exposes. Served as a Linkset (RFC 9264) JSON document, discoverable via the api-catalog link relation.

/.well-known/apple-app-site-association

Fri, 29 May 2026 00:00:00 GMT

A JSON file that tells iOS, iPadOS and macOS which Apple apps may handle which URLs on your domain. Required for Universal Links and several other Apple features.

ARIA — first rule of ARIA

Fri, 29 May 2026 00:00:00 GMT

ARIA can make custom widgets accessible, but the first rule of ARIA is don't use ARIA. Reach for a native HTML element first; add ARIA only when nothing native fits.

/.well-known/assetlinks.json

Fri, 29 May 2026 00:00:00 GMT

Android's Digital Asset Links file proves that an Android app and a web domain are owned by the same entity. It powers App Links and Smart Lock for Passwords.

Back/forward cache (BFCache)

Fri, 29 May 2026 00:00:00 GMT

Keep pages BFCache-eligible so back/forward navigation restores them instantly from memory, with no reload, no hydration, and no repaint.

Breadcrumbs

Fri, 29 May 2026 00:00:00 GMT

A short trail showing the page's position in the site hierarchy. Visible in the UI for users, marked up as BreadcrumbList JSON-LD for search engines.

DNS CAA records

Fri, 29 May 2026 00:00:00 GMT

A CAA record tells certificate authorities which of them are allowed to issue certificates for your domain. Cheap to add, blocks a class of mis-issuance attacks.

Cache-Control headers

Fri, 29 May 2026 00:00:00 GMT

Cache-Control tells browsers and CDNs how long to keep a response. Use immutable + max-age=31536000 for fingerprinted assets and short or no-cache for HTML.

Canonical URL (rel="canonical")

Fri, 29 May 2026 00:00:00 GMT

Declare the preferred URL for a page so search engines and crawlers consolidate ranking signals on one address, even when several URLs serve the same content.

Captions and transcripts

Fri, 29 May 2026 00:00:00 GMT

Video needs synchronised captions, audio-only content needs a transcript, and visuals that carry meaning need audio description. Auto-captions alone are not enough.

/.well-known/change-password

Fri, 29 May 2026 00:00:00 GMT

A standard redirect endpoint that points password managers and users at your real change-password page. Only applicable if the site has user accounts — sites without logins have nothing to point at and should not implement it.

Colour contrast

Fri, 29 May 2026 00:00:00 GMT

Text and meaningful non-text elements must have enough contrast against their background so people with low vision and people in harsh light can read them.

Fri, 29 May 2026 00:00:00 GMT

Tells the browser which colour schemes your page is designed for. Prevents the white flash that dark-mode users see before your CSS loads, and lets the browser style scrollbars, form controls, and the page background to match.

Compression (gzip, brotli, zstd)

Fri, 29 May 2026 00:00:00 GMT

Compress text responses with brotli where supported, gzip everywhere else. zstd is emerging. Don't compress already-compressed media.

Content Security Policy (CSP)

Fri, 29 May 2026 00:00:00 GMT

A CSP tells browsers which sources of script, style, image, and frame content to trust. A good policy stops most XSS and data-exfiltration attacks dead.

Content Signals in robots.txt

Fri, 29 May 2026 00:00:00 GMT

Add Content-Signal directives to robots.txt to declare whether AI crawlers may search, ingest, or train on your content. An emerging IETF AI Preferences / IAB Tech Lab proposal that some validators already check.

Cookie attributes — Secure, HttpOnly, SameSite

Fri, 29 May 2026 00:00:00 GMT

Every cookie should be Secure, HttpOnly where possible, and have an explicit SameSite. Use __Host- and __Secure- prefixes for session cookies.

Cookie consent

Fri, 29 May 2026 00:00:00 GMT

In the EU and UK, non-essential cookies and similar storage require freely given, informed, specific, and unambiguous opt-in consent before they are set.

Core Web Vitals (LCP, INP, CLS)

Fri, 29 May 2026 00:00:00 GMT

Core Web Vitals measure loading, responsiveness, and visual stability. Hit LCP ≤ 2.5s, INP ≤ 200ms, and CLS ≤ 0.1 at the 75th percentile of real users.

Critical CSS and render-blocking resources

Fri, 29 May 2026 00:00:00 GMT

Inline the CSS needed for above-the-fold content and defer the rest. Render-blocking resources in are the single biggest cause of slow first paint.

CSS containment

Fri, 29 May 2026 00:00:00 GMT

Use `contain: layout paint style` (or the `contain: content` shorthand) to tell the browser that an element's internals cannot affect the rest of the page, so reflow and repaint stay isolated to that subtree.

CSS state and relational selectors

Fri, 29 May 2026 00:00:00 GMT

Use `:has()` together with `:user-invalid`, `:user-valid`, `:placeholder-shown` and `:focus-within` to express form and component state in CSS, removing the JavaScript class-toggling pattern and the race conditions it brings.

Data minimisation

Fri, 29 May 2026 00:00:00 GMT

Collect only the personal data you actually need for a specific purpose, keep it only as long as you need it, and redact it from anywhere it leaks unnecessarily.

Accessible data tables

Fri, 29 May 2026 00:00:00 GMT

Tabular data must use real markup with a caption, header cells, and scope attributes so screen readers can announce row and column relationships.

DNS for AI Discovery (DNS-AID)

Fri, 29 May 2026 00:00:00 GMT

Publish SVCB/HTTPS records under _agents.example.com so agents can discover your services from DNS, before any HTTP round-trip. Pair with DNSSEC so the answer is authenticated.

DNSSEC

Fri, 29 May 2026 00:00:00 GMT

DNSSEC cryptographically signs DNS records so resolvers can verify they have not been tampered with. Strong defence in depth, but only with full registrar and registry support.

The HTML doctype

Fri, 29 May 2026 00:00:00 GMT

Every HTML document must start with as its first line. This opts the browser into standards mode; without it, you get quirks mode and broken layout.

Document and parts language

Fri, 29 May 2026 00:00:00 GMT

Set the page's primary language on and mark any inline content in a different language with its own lang attribute, so screen readers pronounce it correctly.

Empty links and buttons

Fri, 29 May 2026 00:00:00 GMT

A link or button with no accessible name is invisible to screen readers and unreachable for voice control. Icon-only controls without a label are the usual culprit.

Custom error pages (404, 500)

Fri, 29 May 2026 00:00:00 GMT

Custom error pages must return the correct HTTP status code, explain what went wrong in plain language, and offer the user a way forward without leaking implementation details.

Favicons and app icons

Fri, 29 May 2026 00:00:00 GMT

Ship an SVG favicon, an ICO fallback at /favicon.ico, an apple-touch-icon, and a maskable PWA icon. Five files cover every browser and home-screen surface.

Feed discovery with rel="alternate"

Fri, 29 May 2026 00:00:00 GMT

If your site publishes a feed — RSS, Atom, or JSON Feed — announce it in with . Feed readers, agents, and browsers discover it without guessing the URL.

Feed content hygiene

Fri, 29 May 2026 00:00:00 GMT

If you publish a feed, ship it well-formed. Identify the feed inside itself with atom:link rel="self", give every item a stable guid, declare an update cadence with the Syndication module, and validate before deploy.

Visible focus indicators

Fri, 29 May 2026 00:00:00 GMT

Whenever a control receives keyboard focus, the page must show a clear, high-contrast indicator. Removing focus outlines without a replacement is a top accessibility failure.

Web font loading

Fri, 29 May 2026 00:00:00 GMT

Self-host WOFF2 fonts, subset them, preload the critical face, and use font-display: swap so text is readable while the font is still loading.

Accessible form errors

Fri, 29 May 2026 00:00:00 GMT

When a form submission fails, errors must be identified in text, associated with the input that caused them, and announced to assistive technology.

Form labels

Fri, 29 May 2026 00:00:00 GMT

Every form control needs a programmatically associated label. A placeholder is not a label, and an unlabelled input is unusable for screen-reader and voice-control users.

Clickjacking protection (frame-ancestors / X-Frame-Options)

Fri, 29 May 2026 00:00:00 GMT

Tell browsers who is allowed to embed your pages in an iframe. Use CSP frame-ancestors. X-Frame-Options is the legacy fallback.

Global Privacy Control (GPC)

Fri, 29 May 2026 00:00:00 GMT

Global Privacy Control is a browser-level signal that tells websites the user opts out of the sale or sharing of their personal data. California and Colorado require sites to honour it.

Heading hierarchy

Fri, 29 May 2026 00:00:00 GMT

Headings describe the sections of a page. They must form a nested outline, never be used for visual styling alone, and never skip levels.

Hidden until found

Fri, 29 May 2026 00:00:00 GMT

Use hidden="until-found" (or content-visibility: hidden) for collapsible content so that browser find-in-page, assistive tech, and search engines can still reach the text and auto-expand it.

hreflang for language and regional URLs

Fri, 29 May 2026 00:00:00 GMT

hreflang tells search engines which language or regional version of a page to show to which user. It uses BCP 47 codes and must be reciprocal across all alternates.

HSTS (Strict-Transport-Security)

Fri, 29 May 2026 00:00:00 GMT

HSTS tells browsers to use HTTPS for your domain only, for a long time. Add max-age, includeSubDomains, and preload — but understand it is an irreversible commitment.

The lang attribute on

Fri, 29 May 2026 00:00:00 GMT

Set a valid BCP 47 language tag on the element so screen readers, translators, search engines, and browsers know what language the page is in.

HTTP/2 and HTTP/3

Fri, 29 May 2026 00:00:00 GMT

Serve over HTTP/2 at minimum and HTTP/3 where you can. Multiplexing eliminates head-of-line blocking; QUIC removes TCP handshake delays.

HTTPS and TLS

Fri, 29 May 2026 00:00:00 GMT

Serve every page over HTTPS using TLS 1.2 or 1.3, redirect plain HTTP to HTTPS, and disable obsolete SSL and early TLS versions on every host you control.

Internationalised Domain Names (IDN)

Fri, 29 May 2026 00:00:00 GMT

IDNs let domain names contain non-ASCII characters. They are encoded as Punycode on the wire and rendered as Unicode in the browser, subject to anti-spoofing rules.

Image alt text

Fri, 29 May 2026 00:00:00 GMT

Every element must have an alt attribute. The value describes the image's purpose to screen readers, search engines, and anyone whose image fails to load.

Image optimisation

Fri, 29 May 2026 00:00:00 GMT

Serve images in modern formats (WebP, AVIF), at the right size for the viewport, with explicit dimensions. Images are the largest payload on most pages.

Image and video sitemap extensions

Fri, 29 May 2026 00:00:00 GMT

Optional XML extensions that add image and video metadata to sitemap entries. Useful when media is loaded by JavaScript or hosted on a CDN that crawlers cannot reach by following links.

IndexNow

Fri, 29 May 2026 00:00:00 GMT

An open protocol for telling participating search engines that a URL has changed. One HTTP request pushes Bing, Yandex, Naver, and Seznam to recrawl — Google does not participate.

Internal linking

Fri, 29 May 2026 00:00:00 GMT

Links from one page on a site to another. The strongest signal you control for telling crawlers and AI agents what a page is about and how important it is.

Keyboard navigation

Fri, 29 May 2026 00:00:00 GMT

Every interactive element on the page must be reachable and operable with a keyboard alone, in a logical order, with no traps that hold focus.

lang attribute on inline content

Fri, 29 May 2026 00:00:00 GMT

Mark passages, phrases, and inline elements that differ from the document language with a lang attribute. WCAG 3.1.2 requires it so assistive tech can switch pronunciation.

Lazy loading images, iframes, and video

Fri, 29 May 2026 00:00:00 GMT

Native lazy loading defers off-screen images, iframes, and (recently) video until the user scrolls near them. Use loading="lazy" — but never on the LCP element.

HTTP Link headers for discovery

Fri, 29 May 2026 00:00:00 GMT

Use the HTTP Link header to advertise machine-readable resources — llms.txt, sitemap, api-catalog, RSS — directly in the response. Agents that never parse your HTML can still find what they need.

Descriptive link text

Fri, 29 May 2026 00:00:00 GMT

Every link's text must describe where it goes. 'Click here' and 'read more' fail screen-reader users who scan a page by jumping from link to link.

/llms-full.txt

Fri, 29 May 2026 00:00:00 GMT

An extended companion to /llms.txt that concatenates the full markdown content of your key pages into a single file. Useful for small sites, costly for large ones.

/llms.txt

Fri, 29 May 2026 00:00:00 GMT

A proposed markdown file at the site root that gives LLMs a curated index of your most important content. Emerging convention, not a ratified standard.

Locale-aware content

Fri, 29 May 2026 00:00:00 GMT

Dates, numbers, currency, and units should be formatted in the user's locale. Use Intl APIs in the browser and the same locale data server-side so output matches expectations.

Machine-readable formats

Fri, 29 May 2026 00:00:00 GMT

Offer JSON, RSS, or plain markdown endpoints alongside HTML where it makes sense. Agents and feed readers prefer typed data over scraped HTML.

Maintenance pages and 503

Fri, 29 May 2026 00:00:00 GMT

When the site is intentionally offline, return HTTP 503 with a Retry-After header and a page that tells users what is happening and when to come back.

Per-page Markdown source endpoints

Fri, 29 May 2026 00:00:00 GMT

Expose every documentation page's raw Markdown source at a predictable URL — via a .md suffix on the canonical URL, content negotiation, or both. Agents pull source instead of parsing HTML.

MCP and tool discovery

Fri, 29 May 2026 00:00:00 GMT

The Model Context Protocol is an emerging way for sites to expose queryable tools to agents over JSON-RPC. Relevant whenever your content has structure worth filtering — even for a static reference site like this one.

Fri, 29 May 2026 00:00:00 GMT

Declare UTF-8 as the document character encoding in the first 1024 bytes of the HTML, so browsers parse text correctly before they hit any non-ASCII content.

Fri, 29 May 2026 00:00:00 GMT

A short, unique summary of the page used by search engines and social platforms as a snippet. Google may rewrite it, but a good one is rewritten less often.

Meta robots and X-Robots-Tag

Fri, 29 May 2026 00:00:00 GMT

Every page must have an explicit, correct indexing policy — either implicit (default index, follow) on public pages, or an explicit noindex / X-Robots-Tag on staging, admin, thin, or private content. Get this wrong and you either disappear from search or expose what you didn't mean to.

Fri, 29 May 2026 00:00:00 GMT

Tell mobile browsers to render the page at the device's actual width instead of pretending to be a 980-pixel desktop. One line, and never disable user scaling.

Monitoring and uptime

Fri, 29 May 2026 00:00:00 GMT

Monitor the site from outside your own infrastructure, combine synthetic checks with real user data, and run a status page on a separate host so it stays up when the site does not.