The Website Specification: an open reference for what a good site should do

An open project called The Website Specification sets out in one place the technical features a good website should have, regardless of the stack it is built on. It is maintained by Joost de Valk and contributors, developed in public on GitHub, and released under an MIT licence for code and CC BY 4.0 for content.

Ten topic areas, from doctype to DNSSEC

The document is organised into ten areas. Foundations covers the basics of every HTML document: the doctype, a valid BCP 47 lang attribute, UTF-8 declared within the first 1024 bytes, and a viewport meta tag that never disables user scaling. SEO covers robots.txt as standardised in RFC 9309, XML sitemaps and sitemap indexes, JSON-LD structured data, heading hierarchy, internal linking and IndexNow — the push protocol that reaches Bing, Yandex, Naver and Seznam, but not Google.

Accessibility entries require alt text on every image, full keyboard operation, visible focus indicators, skip links and the inert attribute for overlays. Security covers HTTPS with TLS 1.2 or 1.3, Content Security Policy, X-Content-Type-Options: nosniff and DNSSEC. The remaining sections address well-known URIs, agent readiness, performance (modern image formats, brotli and gzip compression, ETag validators), privacy, resilience — correct 404 and 500 pages, and 503 with Retry-After during maintenance — and internationalisation, including hreflang and a warning against redirecting visitors by IP address.

Written for agents as well as people

Every spec page is available as raw Markdown in two ways: by appending .md to the URL, or by sending Accept: text/markdown to the canonical address, which returns Markdown with a Content-Location header and Vary: Accept set for caches. The full corpus is concatenated in a single llms-full.txt file. A stateless MCP server at mcp.specification.website exposes search, list_topics, get_topic, get_checklist and audit_url tools without authentication, and an agent skill file is published under /.well-known/agent-skills/.

A site that follows its own rules

The project is itself a worked example. It is a static site generated with Astro and deployed to Cloudflare Pages from GitHub, serving a strict Content-Security-Policy as a response header, a full set of security headers, /.well-known/security.txt, robots.txt, a sitemap index and an RSS feed. Sources are part of the content schema — a page without a source link should not be merged. A flat checklist and a copy-and-paste Markdown task list summarise the whole spec, while a separate page documents standards deliberately left out and what would change that decision. A companion project applies the same approach to email.

For teams that audit sites, the value lies less in any single rule than in having one reference that separates what is required from what is merely recommended — and a machine-readable version of it that a crawler or an agent can act on.