Production gate

axe reports zero violations at the WCAG 2.1 A and AA rule sets across the sampled pages, including one page with a form and one with a listing.

Without it, the cheap third of WCAG failures ships anyway, and a Lighthouse score of 98 gets read as a pass it never was.

Standard EN 301 549 - Accessibility requirements for ICT products and services 9.6, in part

Developer The build proves it Why this rule exists About A11y a11y.axe-clean Comment on this rule

Only when the site serves more than one language.

Each language home page returns 200 at its own URL when requested with no cookie, no referrer and an Accept-Language naming a different language. 0 automatic redirects between languages. Every switcher control is an a element with an href.

Without it, Googlebot arrives with one country and one header, gets bounced to French every time, and the English pages never enter the index.

Vendor documentation Google Search Central documentation managing-multi-regional-sites#let-the-user-switch-the-page-language, in part

Developer The build proves it About Crawl and indexation crawl.language-urls Comment on this rule

Every published URL and every navigation link answers 200, following at most one redirect. Anything answering 404 or 410 is given a template or unpublished before launch. Drafts and private posts are out of scope.

Without it, a menu item the client clicks on launch day lands on a 404, and no link checker reports it because the link itself is fine.

House rule Delivered reference builds, audited together a nav item published, sitemapped and 404 on a live build, 2026-08-25not public

Developer The build proves it About Crawl and indexation crawl.published-urls-resolve Comment on this rule

Every enumerated host except production returns 401, 403, or a noindex on both the home page and one deep page. No non-production host returns an indexable 200. The enumerated list ships with the handover, dated.

Without it, Google can pick the staging copy as the canonical one, and the production URLs quietly stop being the ones that rank.

Client document Technical SEO control grid row 6not public

Developer The build proves it Why this rule exists About Crawl and indexation crawl.sibling-hosts Comment on this rule

On ten sampled URLs, none is both noindex and Disallowed in robots.txt, no noindex URL is listed in a sitemap, and no page canonicalises to a URL that answers noindex, a redirect or a 404.

Without it, the page you meant to drop stays indexed for good: robots.txt stops the fetch, so the noindex that would have removed it is never read.

Automated check: seo-status:robots, seo-status:home-index

Client document Website Design and Development Checklist section 7, item 13not public

Developer The build proves it About Crawl and indexation crawl.signals-agree Comment on this rule

A grep across every URL in the sitemap returns 0 matches for lorem, ipsum, TODO, FIXME and placeholder, and 0 references to a starter-theme demo image. Drafts and private posts are out of scope.

Without it, the client finds our lorem in the hero on launch day, and Google has already indexed the page carrying it.

Client document Website Design and Development Checklist section 15, item 1, in partnot public

Developer The build proves it About Launch and handover delivery.real-content Comment on this rule

Every sampled page has the doctype and a lang attribute whose value matches the language of the visible copy.

Without it, the English page inherits fr-FR from the header partial, and a screen reader pronounces the whole thing in French.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 3.1.1 (A), in part

Developer The build proves it About HTML html.doctype-and-lang Comment on this rule

Only when the project replaces an existing live site.

Every URL on the inventory returns 200, or exactly one 301 to a 200. Zero chains of two or more hops, measured with the http and www variants included. No more than 5 per cent of the inventory lands on the home page, and each one that does has a reason recorded.

Without it, every old deep link lands on the home page, Google reads the lot as soft 404s, and the rankings the old site had are gone.

Client document Website Design and Development Checklist section 8, item 24, in partnot public

Developer The build proves it About Migration migration.redirect-map Comment on this rule

Median mobile CLS is 0.1 or less, and no visible shift occurs during a slow-network reload watched by eye.

Without it, a reader taps one link and lands on another, because a late image or web font shoved the page down under their thumb.

Vendor documentation Web Vitals cls, in part

Developer The build proves it About Perf perf.cls Comment on this rule

Median of three or more mobile runs is 2.5s or less, and the identified LCP element is stated in the report alongside the number.

Without it, a faded-in hero is dropped from the running and something slower below becomes the metric, so shaving bytes off the hero changes nothing.

Vendor documentation Web Vitals lcp, in part

Developer The build proves it Why this rule exists About Perf perf.lcp Comment on this rule

No credential appears in git history or in the deployed web root. Requesting the environment file over HTTP returns 403 or 404.

Without it, a licence key gets fetched off the live site by anyone who guesses the filename, and rotating it is the only real fix.

House rule CONVENTIONS.md CONVENTIONS.md:76-80, in partnot public

Developer The build proves it Why this rule exists About Practices practices.no-secrets Comment on this rule

Only when the project has a form that collects data from a visitor.

wp post type list --public=1 lists no submission type, and requesting a stored submission by permalink and through its REST route without logging in returns 401 or 404 in both cases.

Without it, every message the contact form ever took is readable at a guessable URL, which is a personal-data breach the client has to report.

Law Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text Art. 32(1)(b), in part

Developer The build proves it Why this rule exists About Security and hardening security.submission-store-private Comment on this rule

Each sampled page returns one canonical, absolute, on the live host, equal to the URL that was requested once redirects have resolved.

Without it, one rename leaves 87 URLs canonicalising somewhere else, and the crawler consolidates the whole set onto the wrong address.

Automated check: seo-status:canonical

Vendor documentation Google Search Central documentation crawling-indexing/consolidate-duplicate-urls, in part

Developer The build proves it About SEO seo.canonical Comment on this rule

http:// returns a single 301 to https://, and no sampled page contains an http:// asset URL.

Without it, a migrated page pulls one script over http, the browser blocks it outright, and that block only shows up on the client's live domain.

Automated check: seo-status:https-redirect, seo-status:mixed-content

Vendor documentation web.dev developer guides articles/what-is-mixed-content, in part

Developer The build proves it About SEO seo.https-and-mixed-content Comment on this rule

The production home page carries no noindex in the meta robots or the X-Robots-Tag header, and its robots.txt does not disallow the whole site. Staging carries noindex everywhere.

Without it, a database pull from staging carries blog_public=0 into production and the site goes dark after a deploy that reported success.

Automated check: seo-status:home-index, seo-status:robots

Vendor documentation Google Search Central documentation crawling-indexing/block-indexing, in part

Developer The build proves it Why this rule exists About SEO seo.no-noindex-leak Comment on this rule

Submitting an invalid form produces a text message identifying the field and the fix, the message is announced, and focus lands on the first invalid control.

Without it, a red border alone says nothing to the one man in twelve who cannot see it, and the failed field sits off-screen unfound.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 3.3.1; 3.3.3; 1.4.1; 4.1.3 (A, AA), in part

Developer The build proves it Why this rule exists About A11y a11y.form-errors Comment on this rule

No two links on a page share the same text but different destinations, and no link text is only "here", "read more" or "click".

Without it, a listing of twenty cards gives a screen reader twenty links all reading Découvrir and all going somewhere different.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 2.4.4; 2.4.9 (A, AAA), in part

Developer The build proves it About A11y a11y.link-text Comment on this rule

At a 390px viewport, every button, icon control and menu item is 24 by 24 CSS pixels, or a 24 px circle centred on it clears its neighbours' circles - the spec's test, 24 px centre to centre, not 24 px of space. Links in a sentence are exempt.

Without it, ad-hoc floors on the primary buttons leave the small ones untested, and a thumb on a 390px screen hits the neighbour.

Standard Web Content Accessibility Guidelines (WCAG) 2.2 2.5.8 (AA), in part

Developer The build proves it About A11y a11y.target-size Comment on this rule

For each block, the four names agree. No block has a stylesheet or script with no template, or a data-block value that matches no SCSS class.

Without it, dead stylesheets and scripts pile up for blocks that no longer have a template, and every one of them still builds and ships.

House rule CONVENTIONS.md CONVENTIONS.md:144-149, in partnot public

Developer The build proves it About Colibrity colibrity.block-file-triple Comment on this rule

No querySelector or querySelectorAll in block or module scripts selects by a styling class. Renaming a BEM class in the stylesheet breaks nothing at runtime.

Without it, a restyle renames a BEM class and an animation silently stops working, on the client's site, weeks after anyone reviewed the code.

House rule This standard's own decision record docs/decisions.md:33-35

Developer The build proves it About Colibrity colibrity.js-hooks-are-data-attributes Comment on this rule

Only when the listing has more items than fit on one page.

The canonical on page two equals page two's own URL, and page two's title differs from page one's.

Without it, page two tells the crawler it does not exist, so it stops being followed and the items only listed there quietly leave the index.

Automated check: seo-status:canonical

Vendor documentation Google Search Central documentation pagination-and-incremental-page-loading#use-urls-correctly, in part

Developer The build proves it About Colibrity colibrity.paged-canonical Comment on this rule

curl on one URL of each template returns HTML containing the h1 text, the first paragraph of body copy and every link in the main navigation. Nothing that has to rank appears only once JavaScript has run.

Without it, the copy that has to rank waits in a render queue that may never come round, and DevTools shows it present the whole time.

Vendor documentation Google Search Central documentation javascript-seo-basics#how-googlebot-processes-javascript, in part

Developer The build proves it About Crawl and indexation crawl.content-in-server-html Comment on this rule

PHP major and minor, server software, Content-Encoding on a built asset and Cache-Control on an HTML response are identical on both hosts, or every remaining difference is named in a dated parity note in the handover.

Without it, staging answers on a different web server with different cache headers, so a speed or caching result signed off there describes nothing live.

Vendor documentation The Twelve-Factor App X. Dev/prod parity, in part

Operations The build proves it About Environments and deployment env.staging-parity Comment on this rule

Only when the project has a form that collects data from a visitor.

Typing three characters into an empty email field shows no error. Leaving the field shows one. Typing until the value is valid clears it without leaving the field again.

Without it, half a typed email address gets marked wrong in red mid-word, and the message sits there after the visitor has finished fixing it.

Client document Website Design and Development Checklist section 4, item 5, in partnot public

Developer The build proves it About Forms forms.error-timing Comment on this rule

Only when the project has a form that collects data from a visitor.

At a 390px viewport, every input, select and textarea computes to 16px or more, focusing one does not change the page scale, and the viewport meta sets neither user-scalable=no nor a maximum-scale.

Without it, tapping the email field on an iPhone zooms the page in and leaves the rest of the form off the right edge with no way back.

Client document Website Design and Development Checklist section 4, item 1, in partnot public

Developer The build proves it About Forms forms.input-font-size Comment on this rule

Only when the project has a form that collects data from a visitor.

Every identity field on the sampled forms carries an autocomplete token from the HTML spec list and an input type matching its data, with zero invalid-token findings. Focusing the email field on a phone brings up the email keyboard.

Without it, a phone user retypes name, email, phone and postcode by hand - a delivered contact form ships six identity fields with no autofill token.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.3.5 (AA), in part

Developer The build proves it About Forms forms.input-type-and-autocomplete Comment on this rule

Each sampled page exposes exactly one main landmark, all content sits inside a landmark, and no two navigation landmarks share a name.

Without it, jumping by region skips the mobile menu and the site header, because neither one sits inside a landmark.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.3.1 (A), in part

Developer The build proves it About HTML html.landmarks Comment on this rule

The validator reports no duplicate id on any sampled page, including pages that render the same block more than once.

Without it, clicking a label jumps focus to the first copy of a repeated block, and the visitor fills in the wrong form.

Standard HTML Living Standard 3.2.6 Global attributes, in part

Developer The build proves it About HTML html.no-duplicate-ids Comment on this rule

No rendered page contains an on* event attribute or an href starting with javascript:.

Without it, any Content-Security-Policy worth having has to ship with unsafe-inline, the one setting that lets the injected script run.

House rule Delivered reference builds, audited together no on* attribute in either theme, both buildsnot public

Developer The build proves it About HTML html.no-inline-handlers Comment on this rule

Each sampled page has exactly one h1, no two sampled pages share an h1, and the heading outline never jumps a level going down, for example h2 straight to h4.

Without it, a screen-reader user skimming by heading level hits an h3 under an h1 and cannot tell which section it belongs to.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.3.1 (A), in part

Developer The build proves it About HTML html.single-h1 Comment on this rule

The validator reports zero errors on the sampled pages. Warnings are read and either fixed or noted with a reason.

Without it, browsers each guess a different repair for broken markup, so the bug reproduces on the client's machine and not on yours.

Standard HTML Living Standard 2.1.8 Conformance classes, in part

Developer The build proves it About HTML html.valid-markup Comment on this rule

Submit every form and follow each redirect: no resulting URL contains an email, a name, a phone number or an identifying token. A search of the analytics page-path report returns zero such URLs.

Without it, an address typed into one form turns up months later in the analytics page-path report and in a shared browser's history.

Law Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text Art. 5(1)(f), in part

Developer The build proves it About Consent and legal legal.no-pii-in-urls Comment on this rule

wp post list over each public post type returns 0 published items with an empty post_title, an empty post_excerpt or no featured image, run on the content-complete site and dated. A post type that deliberately uses none of the three is listed with its reason.

Without it, site search returns blank rows and shared links show no description, while the page itself looks perfect to everyone checking it.

Client document Website Design and Development Checklist section 8, item 12not public

Developer The agency proves it About On-page signals onpage.core-fields Comment on this rule

On three sampled pages every emitted value matches the rendered page: headline equals the visible title, author is a name rather than a language code, dates match, and no rating, price or count is emitted that the page itself does not show.

Without it, Google is told the article is 8 words long when 659 are on screen, and the validator that would catch a typo reports it all green.

Automated check: seo-status:org-brand, seo-status:org-sameas

Vendor documentation Google Search Central documentation appearance/structured-data/sd-policies, in part

Developer The build proves it About On-page signals onpage.schema-fidelity Comment on this rule

The production site's scheduled event list shows no event whose next run is in the past by more than its own interval, read after the site has been idle rather than immediately after a visit.

Without it, a scheduled post on a quiet site publishes whenever the next visitor happens to arrive, or not at all that day.

Vendor documentation WordPress Developer Resources plugins/cron/hooking-wp-cron-into-the-system-task-scheduler, in part

Operations The build proves it About Operations ops.cron-runs Comment on this rule

The site's stored admin email is on the client's or the agency's own domain, is not the developer of record's address, and the handover names the person who reads that mailbox and the date they took it on.

Without it, the recovery link for a white-screened site goes to an address that routes nowhere, so the client finds the outage first.

Vendor documentation WordPress Developer Resources wordpress/common-errors#critical-error-message, in part

Operations The client proves it About Operations ops.fatal-alerts Comment on this rule

Content-Encoding is br or gzip on HTML, CSS and JS, and hashed assets carry a cache lifetime of a year with immutable.

Without it, a returning visitor re-downloads a byte-identical hashed bundle on every page view, paying for files that could not have changed.

Vendor documentation Web Vitals http-cache, in part

Developer The build proves it Why this rule exists About Perf perf.caching-and-compression Comment on this rule

No font file over 100 KB, no ttf or otf served to browsers, font-display is set, and at most one font is preloaded.

Without it, half a megabyte of typefaces ships unnoticed, since nothing in the performance score is weighted against font bytes.

House rule PERFORMANCE.md PERFORMANCE.md:135-144, in partnot public

Developer The build proves it Why this rule exists About Perf perf.fonts Comment on this rule

No image transfers more than twice the bytes needed at its displayed size, the image audits report no meaningful savings from format or sizing, no single image exceeds 200 KB on the wire, and no animated GIF is served.

Without it, a phone on mobile data downloads the 2000px desktop hero to paint it 390px wide, several times the bytes it needed.

Vendor documentation Web Vitals choose-the-right-image-format, in part

Developer The build proves it About Perf perf.image-formats Comment on this rule

Median mobile TBT is 200ms or less. Where field data exists, INP at the 75th percentile is 200ms or less.

Without it, a tap on the burger does nothing while the main thread finishes parsing script, so people tap twice and open then close the menu.

Vendor documentation Web Vitals inp, in part

Developer The build proves it About Perf perf.inp-tbt Comment on this rule

Every below-the-fold image has loading lazy, the LCP image has neither lazy nor async decoding and carries fetchpriority high.

Without it, a bulk find-and-replace puts loading=lazy on the hero and delays the one request the entire metric hangs on.

Vendor documentation Web Vitals optimize-lcp, in part

Developer The build proves it Why this rule exists About Perf perf.lazy-and-priority Comment on this rule

The render-blocking resources audit lists nothing beyond the site's own critical stylesheet.

Without it, a blank white page for as long as another company's font server takes to answer, and longer still on the day it is down.

Vendor documentation Web Vitals optimize-lcp, in part

Developer The build proves it About Perf perf.no-render-blocking Comment on this rule

First-load transfer is under 2 MB per sampled template, video excluded, and anything over names its three largest resources. Element count is under 1400, or over it with a median mobile TBT at or under 200 ms recorded on the largest page that template renders.

Without it, a template renders 2774 DOM elements against a 1400 budget, and every style recalc and scroll handler pays for all of them.

Client document Technical SEO control grid rows 134, 139, in partnot public

Developer The build proves it About Perf perf.page-weight Comment on this rule

Median of three or more mobile runs is 90 or above, quoted with the spread of the runs.

Without it, the client runs PageSpeed themselves a week after launch, gets a red number, and there is no recorded median to answer it with.

Vendor documentation Lighthouse performance scoring performance/performance-scoring, in part

Developer The build proves it Why this rule exists About Perf perf.score-floor Comment on this rule

The build fails when the negative assertion is broken and fails when the positive one is, each confirmed by breaking it on purpose. The assertion reads the build manifest, not the bundler's exit code, and no module appears in two chunks.

Without it, a mistyped dynamic import makes the build smaller and greener while the feature it was meant to load is quietly dead in production.

House rule Delivered reference builds, audited together bin/assert-chunks.mjs, one build of the twonot public

Developer The build proves it About Perf perf.split-points-asserted Comment on this rule

The server response time audit reports 800 ms or less as the median of three or more mobile runs on the slowest template, with the spread of the runs quoted.

Without it, a second passes before the browser holds a single byte, and a week of image work cannot buy back what the server already spent.

Vendor documentation Web Vitals ttfb, in part

Developer The build proves it About Perf perf.ttfb Comment on this rule

Only when the project has background or hero video.

The video's own bytes are not on the critical path, LCP resolves to the poster or another element, total transfer on first load stays inside the page budget, and no video file served from the site exceeds 2 MB.

Without it, someone on mobile data pays for two megabytes of decorative clip before the page is usable, and never presses play.

House rule PERFORMANCE.md PERFORMANCE.md:465-520, in partnot public

Developer The build proves it About Perf perf.video-weight Comment on this rule

Loading each sampled page and navigating between two of them produces no console error, no unhandled rejection and no failed network request.

Without it, the asset 404 that broke the client's tracking sits unread for months underneath the debug logging.

House rule CONVENTIONS.md PERFORMANCE.md:267-276, in partnot public

Developer The build proves it About Practices practices.console-clean Comment on this rule

Only when the project uses client-side page transitions.

Navigating between two pages five times and returning leaves the same number of listeners and scroll triggers as the first load.

Without it, the fifth page a visitor opens runs five copies of the same scroll handler, and only long sessions ever show it.

House rule Delivered reference builds, audited together src/js/core/page-lifecycle.js destroyPage(), both buildsnot public

Developer The build proves it About Practices practices.self-cleaning-modules Comment on this rule

Only when the project uses client-side page transitions.

Navigate two pages by transition, then compare the live document with a hard load of the same URL: title, canonical, og:url, og:type, body classes and loaded stylesheets match, and exactly one page view fired per navigation.

Without it, every share, analytics hit and screen-reader title from the second page onward describes the page the visitor arrived on.

House rule Delivered reference builds, audited together head-sync.js in the third build and the starter since 2026-08-29; neither older build re-derives the headnot public

Developer The build proves it About Practices practices.soft-navigation-parity Comment on this rule

curl -sI returns both header names on the same response, and the enforcing one contains all four directives. Clicking through every template with the console open produces zero violations attributed to the enforcing header.

Without it, a report-only header watches an injected script send the form data elsewhere and does nothing but log it.

Standard Content Security Policy Level 3 §3.2, in part

Developer The build proves it Why this rule exists About Security and hardening security.csp-enforced-baseline Comment on this rule

/xmlrpc.php returns 403 or 405, /?author=1 does not redirect to an author archive, /wp-json/wp/v2/users returns 401 to an anonymous request, and wp config get DISALLOW_FILE_EDIT returns true.

Without it, a bot reads a real login name off /wp-json/wp/v2/users and gets a second unwatched door at xmlrpc.php that nothing disables.

Vendor documentation Hardening WordPress security/hardening#disable-file-editing, in part

Operations The build proves it About Security and hardening security.wp-attack-surface Comment on this rule

Only when the site serves more than one language.

Each language version lists every other version plus itself plus x-default, following any alternate lands on a page that lists the original back, and every code is an ISO 639-1 language with at most an ISO 3166-1 region, never a locale such as fr_FR.

Without it, a visitor searching in French is served the English URL, and nothing in the markup looks broken because a discarded set is silent.

Automated check: seo-status:hreflang

Vendor documentation Google Search Central documentation specialty/international/localized-versions, in part

Developer The build proves it About SEO seo.hreflang Comment on this rule

A crawl of the sampled pages returns no 404 and no 5xx on internal links, and no chain of more than one redirect.

Without it, a published page sits twice in the main menu and 404s from every template on the site, reaching the sitemap before anyone notices.

Automated check: seo-status:link-ok, seo-status:link

Vendor documentation Google Search Central documentation crawling/docs/troubleshooting/http-status-codes, in part

Developer The build proves it About SEO seo.internal-links-resolve Comment on this rule

All eight tags are present on a sampled page, og:url matches the canonical, and the og:image URL is absolute and returns an image of at least 1200 by 630.

Without it, the client shares the launch post on LinkedIn and gets a grey box with a bare URL where the brand image should be.

Standard The Open Graph protocol og:title, og:type, og:image, og:url, in part

Developer The build proves it About SEO seo.open-graph Comment on this rule

/robots.txt returns 200, contains a Sitemap: line with an absolute URL that itself returns 200, does not disallow any route that should rank, and disallows nothing a page needs to render: scripts, styles, images or fonts.

Without it, a relative Sitemap line is never resolved, and the preview routes sit crawlable - /sandbox/ answered 200 on a live site.

Automated check: seo-status:robots

Vendor documentation Google Search Central documentation crawling/docs/robots-txt/create-robots-txt, in part

Developer The build proves it About SEO seo.robots-txt Comment on this rule

The sitemap index returns 200, every child returns 200, a sample of ten listed URLs returns 200 with no redirect, and no listed URL carries noindex. Only one sitemap source answers; the other returns 404, and robots.txt names the one that does.

Without it, seven URLs in one live sitemap answer 404, six of them category archives with no template, and the crawler is handed them on purpose.

Automated check: seo-status:sitemap, seo-status:tax-sitemaps

Vendor documentation Google Search Central documentation crawling-indexing/sitemaps/build-sitemap, in part

Developer The build proves it About SEO seo.sitemap Comment on this rule

No sampled page is missing a title or description, no two sampled pages share either, lengths sit in range, and each page carries exactly one title element, one description and one robots meta.

Without it, two templates share one title, so the results give no way to tell the pages apart and Google rewrites the title link itself.

Vendor documentation Google Search Central documentation appearance/title-link, in part

Developer The build proves it About SEO seo.title-description Comment on this rule

On five pages including one section landing page, the main navigation carries exactly one aria-current="page" and it is the item for the URL loaded. No other navigation on the page carries more than one.

Without it, a screen-reader user tabbing through the menu gets nothing saying which item is the page they are already standing on.

Client document Website Design and Development Checklist section 3, item 7, in partnot public

Developer The build proves it About Interface states states.current-page Comment on this rule

Request a made-up path under each language root: every one answers 404, not 200 and not 302. The HTML returned carries that language's lang attribute and that language's copy.

Without it, a missing URL answers 200, so Search Console files it as a soft 404 and no monitoring tool ever flags the broken link.

Vendor documentation Google Search Central documentation http-network-errors#2xx-success, in part

Developer The build proves it About Interface states states.error-pages Comment on this rule

Only when content on the project animates in as the visitor scrolls.

Load a /page#section link deep in the page, then leave and press back. Zero elements above the scroll position are still hidden, and the same holds after a bfcache restore rather than a fresh load.

Without it, arriving on a /page#section link or pressing back lands the visitor in a stretch of page that never un-hides.

Client document Website Design and Development Checklist section 2, item 14not public

Developer The build proves it About Interface states states.scroll-reveal-recovery Comment on this rule

Every block's root class equals its slug, and no class name outside the design system describes a colour or a size.

Without it, the next developer greps a block's slug, gets no hits in the SCSS, and ends up editing the wrong stylesheet.

House rule CONVENTIONS.md CONVENTIONS.md:144-149, in partnot public

Developer The build proves it About HTML html.bem-naming Comment on this rule

The home page head references an icon, that URL returns 200 with a square image at least 48 pixels wide, and robots.txt disallows neither it nor its directory. The WordPress default icon appears nowhere.

Without it, the WordPress W, or a blank globe, sits next to the brand in every mobile search result and every browser tab.

Vendor documentation Google Search Central documentation favicon-in-search#guidelines, in part

Developer The build proves it About On-page signals onpage.favicon Comment on this rule

The third-party summary is reviewed, each origin has a stated purpose, and their combined main-thread time stays under 250ms.

Without it, a Meta pixel nobody on the team added eats most of the main-thread budget, and no one can say who owns it or whether it may go.

Vendor documentation Web Vitals third-party-javascript, in part

Developer The build proves it About Perf perf.third-party Comment on this rule

No contrast violation is reported, and text over imagery is checked manually at its worst point rather than its best.

Without it, a body token measured at 4.37:1 sits under the AA bar and ships as real running text on every page that uses it.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.4.3; 1.4.11 (AA), in part

Developer The build proves it About A11y a11y.contrast Comment on this rule

Every input, select and textarea has an associated label element that is visible. Placeholders, where present, are supplementary rather than the only name. Required fields are marked in the label and in the markup, and the form says which convention it uses.

Without it, someone using voice control has no visible text to say, and a half-filled form gives back no clue what each box was for.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 3.3.2; 1.3.1; 1.3.5 (A, AA), in part

Developer The build proves it Why this rule exists About A11y a11y.form-labels Comment on this rule

Zero icon-only controls in the sampled templates lack an accessible name, every decorative icon is hidden from the accessibility tree, and no icon announces a leftover title from the export tool.

Without it, a bare icon button announces as just button, and a decorative tick gets read out on every badge it appears in.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.1.1; 4.1.2 (A), in part

Developer The build proves it About A11y a11y.icon-semantics Comment on this rule

Only when the project has a form that collects data from a visitor, and submissions go to a CRM or another third-party system.

Submit one test entry. Either open it in the CRM and check every field on the signed map is in its named field, or read the dated log line showing that payload leaving with the agreed field names. Keep whichever you used.

Without it, a lead arrives in the CRM with its phone number in a notes field and its consent value missing, and nobody can prove where it went.

Client document Website Design and Development Checklist section 13, item 4, in partnot public

Operations The client proves it About Email, CRM and analytics comms.crm-field-map Comment on this rule

Only when the site sends email of its own - notifications, autoresponders, transactional.

Send the live form to a Gmail account and open Show original. The Authentication-Results header reads spf=pass and dkim=pass, and dmarc=pass once the record is published. That dated header is the evidence, filed with the handover.

Without it, Gmail and Yahoo drop unauthenticated mail into spam or refuse it outright, so the enquiry is lost and nobody gets a bounce.

Vendor documentation Email sender guidelines Requirements for all senders, in part

Operations The client proves it Why this rule exists About Email, CRM and analytics comms.email-authentication Comment on this rule

Only when the project has a form that collects data from a visitor.

Break mail sending on purpose and submit once. The entry is in the admin list inside a minute, flagged as not notified, and it carries the consent value that goes on to the CRM. Nothing is lost when mail fails.

Without it, one SMTP failure takes the whole enquiry with it, leaving no record, no consent proof and nothing to replay once mail works again.

House rule Delivered reference builds, audited together inc/rest-contact.php stores before mailing, both buildsnot public

Developer The build proves it Why this rule exists About Email, CRM and analytics comms.submission-delivery Comment on this rule

Only when the project has a form that collects data from a visitor.

Row counts on staging and local for the submission, consent, order and non-staff user tables are zero against production's. The anonymisation runs inside the committed sync script, not from a runbook step.

Without it, real form submissions with names, emails and IP addresses end up in plaintext dumps on a laptop and in a backups folder nobody prunes.

Regulator Guide de la securite des donnees personnelles - fiche "Encadrer les developpements informatiques" Fiche: Encadrer les developpements informatiques, in part

Developer The build proves it Why this rule exists About Environments and deployment env.no-production-data-off-production Comment on this rule

Only when the project has a form that collects data from a visitor, and a form on the project accepts a file upload.

A PHP file renamed to .pdf is refused. A file one byte over the documented cap is refused. Both refusals name the reason on screen. Requesting a stored file's URL returns a download or 403, never executed output.

Without it, an extension check passes a file that is not what it claims, and it lands in a folder that will happily execute PHP.

Client document Website Design and Development Checklist section 4, item 16, in partnot public

Developer The build proves it About Forms forms.file-uploads Comment on this rule

No clickable element is a div or span. Every navigating control has an href that resolves. Every control is reachable and operable with Tab and Enter.

Without it, a project card that navigates from a JavaScript click has no URL to copy, open in a new tab or share, since there is no href to take one from.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 4.1.2 (A), in part

Developer The build proves it About HTML html.buttons-vs-links Comment on this rule

The policy URL returns 200 on its own permalink, is linked from the footer and from every form that collects personal data, and carries no noindex. The client has confirmed in writing that the published text is the version their counsel approved.

Without it, a form collects names and emails while its policy link 404s or sits behind a noindex sweep.

Law Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text Art. 13(1), in part

Developer The client proves it About Consent and legal legal.documents-published Comment on this rule

Only when the project has a form that collects data from a visitor, and the project captures newsletter or marketing consent.

Submit with the terms ticked and the newsletter box untouched: zero subscriber records are created and no address reaches a mailing list. The newsletter box is unticked on a fresh load and the form submits successfully without it.

Without it, somebody downloading a PDF lands on the mailing list from a box that never mentioned one, and no record says which they agreed to.

Law Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text Art. 4(11), in part

Developer The build proves it About Consent and legal legal.newsletter-separate Comment on this rule

Only when the project has a form that collects data from a visitor.

Submit with the box unticked: the server returns an error and stores nothing. Tick it, submit, then press back - it is unticked again. The stored record names the document and the version that was shown.

Without it, Safari and Firefox re-tick the box on a back-navigation, so the record shows an acceptance the visitor never made.

Client document Website Design and Development Checklist section 5, item 3, in partnot public

Developer The build proves it About Consent and legal legal.terms-consent-checkbox Comment on this rule

Only when the project replaces an existing live site.

A committed URL list with a stated total, broken down by language and template, dated, and naming which of the four sources each URL came from. Any section whose count nobody can explain is treated as unknown rather than as zero.

Without it, 2,362 old blog posts nobody counted turn up as a 404 spike a week after launch, when the old site is gone and the list cannot be rebuilt.

Vendor documentation Google Search Central documentation site-move-with-url-changes#determine-your-current-urls, in part

Developer The build proves it Why this rule exists About Migration migration.url-inventory Comment on this rule

No template prints an unescaped dynamic value. A field containing a script tag renders as visible text rather than executing.

Without it, an editor pastes a script tag into a title field and it runs for every visitor on that page.

House rule CONVENTIONS.md CONVENTIONS.md:37-41, in partnot public

Developer The build proves it About Practices practices.output-escaping Comment on this rule

Every register_rest_route in the repository either passes a capability check or appears in the handover's public-route list with its bound named. No route that returns true unconditionally writes to the database without at least one named bound.

Without it, a custom route left open takes whatever a stranger posts straight into the database, with nothing capping how much lands there.

Vendor documentation REST API Handbook rest-api/extending/adding-custom-endpoints#permissions-callback, in part

Developer The build proves it Why this rule exists About Security and hardening security.rest-route-authorisation Comment on this rule

The upload_mimes filter adds no script-capable type, or names both the sanitiser and the capability gating it. The deny-execution file for wp-content/uploads is shown to the review, read off the server rather than out of the repository.

Without it, an SVG with a script in it runs on the site's own origin, so one contributor upload becomes a shell or a stolen admin session.

Standard OWASP Application Security Verification Standard 5.0.0 5.3.1 (L1), in part

Operations The build proves it About Security and hardening security.upload-types-and-execution Comment on this rule

Only when the project replaces an existing live site.

Every URL on the old-site list returns 200 or a single 301 to a 200. No mass redirect to the home page. Spot-check the twenty highest-traffic URLs by hand.

Without it, every ranking and inbound link the old site earned dies at cutover, and by the time anyone notices the list of old URLs is gone too.

Vendor documentation Google Search Central documentation crawling-indexing/site-move-with-url-changes, in part

Developer The build proves it Why this rule exists About SEO seo.redirects-on-launch Comment on this rule

With JavaScript disabled, load the home page and two inner templates. Zero elements remain at opacity 0, visibility hidden or translated out of the viewport, and every section's copy is readable.

Without it, one failed script leaves dozens of sections at opacity 0, and the visitor gets a blank page while the copy sits there in the HTML.

Client document Website Design and Development Checklist section 2, item 12not public

Developer The build proves it Why this rule exists About Interface states states.no-js-fallback Comment on this rule

Only when the project shows a preloader before the first paint.

Throttle to Slow 3G, then repeat with the preloader's own assets blocked. The page is readable within 3 seconds of the first byte in both runs, and neither leaves the overlay on screen.

Without it, one font or third-party script that never resolves leaves the visitor staring at an opaque overlay with no way past it.

Client document Website Design and Development Checklist section 2, item 11, in partnot public

Developer The build proves it Why this rule exists About Interface states states.preloader-budget Comment on this rule

For every screen or action the client must not reach, a request made as the client's own account is refused by WordPress, checked at the URL and not in the sidebar. Where hiding is used instead, the repository says in words that it is cosmetic.

Without it, a hidden menu reads as a locked one, and the screen still answers at its own URL to anyone who types it.

House rule Delivered reference builds, audited together create_posts => do_not_allow with map_meta_cap, both buildsnot public

Developer The build proves it Why this rule exists About The admin the client receives admin.capability-boundaries Comment on this rule

Every field group the site depends on is defined in a file in the repository, and a fresh database gets them from that file with nothing imported by hand. No field name in this release differs from the last one without a migration beside it.

Without it, an editor opens the page after a rename and the content is simply gone, the old values still sitting under a key nothing reads.

House rule Delivered reference builds, audited together field groups registered in PHP, both buildsnot public

Developer The build proves it About The admin the client receives admin.fields-in-code Comment on this rule

Only when the site serves more than one language.

A scan over the field definitions finds every registered field carrying a translation preference. Each template loaded in a secondary language shows zero theme strings in the default language, and any one of them can be changed from the admin.

Without it, a translated page keeps the source language in every label and empty state, and a copied field overwrites the translation on the next save.

House rule Delivered reference builds, audited together a preference on every field, all three builds; the string table in two of threenot public

Developer The build proves it About The admin the client receives admin.translation-declared Comment on this rule

Only when the page has a listing, archive or search with filters.

A filtered URL either canonicalises to the base listing or is deliberately indexable and present in the sitemap. No filter combination generates an unbounded set of indexable URLs.

Without it, multi-select filters mint combinations faster than any crawler can exhaust them, and the budget meant for product pages goes there instead.

Vendor documentation Google Search Central documentation crawling-managing-faceted-navigation, in part

Developer The build proves it Why this rule exists About Colibrity colibrity.filter-indexability Comment on this rule

Only when the site sends email of its own - notifications, autoresponders, transactional.

In the received notification and autoresponder, From is on the site's own domain, Reply-To resolves to an inbox someone reads, and a submission from each locale arrives written in that locale's language, subject included.

Without it, an English visitor gets a French autoresponder, and a From on a domain the site does not own fails SPF before anyone reads it.

Client document Website Design and Development Checklist section 13, item 3, in partnot public

Developer The build proves it About Email, CRM and analytics comms.sender-identity Comment on this rule

Each sampled page below the home page shows exactly one trail, its root item in the page's language, its last item not a link, and its BreadcrumbList lists the same items in the same order under the same names. The Rich Results Test reports 0 BreadcrumbList errors.

Without it, the breadcrumb Google prints in the result is not the one on the page - wrong language, a level short, on every result for the site.

Vendor documentation Google Search Central documentation structured-data/breadcrumb#list-item, in part

Developer The build proves it About Crawl and indexation crawl.breadcrumb-trail Comment on this rule

The handover carries a dated table of every URL-minting template and non-HTML route with its decision. For each marked noindex, one sampled URL answers noindex, by X-Robots-Tag where there is no HTML head, and appears in no sitemap.

Without it, author, date and attachment archives nobody thought about get indexed by default, and thin near-duplicates compete with the real pages.

Automated check: seo-status:tax-sitemaps

Client document Website Design and Development Checklist section 8, item 5, in partnot public

Developer The build proves it About Crawl and indexation crawl.indexability-decided Comment on this rule

The raw-HTML crawl reaches every URL in the sitemap: 0 orphans. No indexable page sits more than 3 clicks from the home page. A page found only in the sitemap counts as an orphan, not as reachable.

Without it, whole page sets stay orphaned behind a JavaScript map - live in the CMS, listed in the sitemap, reachable by no anchor a crawler can follow.

Client document Technical SEO control grid row 7not public

Developer The build proves it About Crawl and indexation crawl.internal-reachability Comment on this rule

Only when the site serves more than one language.

A dated parity report per secondary language lists zero unexplained gaps in published items, menus and terms, and every translated page carries the same block count as its source or a written reason.

Without it, the French site ships with no navigation for days while every gate in the project is green.

House rule Delivered reference builds, audited together a parity checker in one older build and the third; nothing of the kind in the other older buildnot public

Developer The build proves it About Crawl and indexation crawl.language-parity Comment on this rule

A dated screenshot taken from the build team's own Google account with the Coverage report open on the production property. Requested at kickoff, not at launch. After go-live the same account shows the sitemap submitted, with a read date.

Without it, nobody can see what Google actually did with the site, so live sitemap 404s and dropped pages go unnoticed until someone complains.

Vendor documentation Google Search Central documentation search-console-start#get-started-with-search-console, in part

Operations The client proves it About Crawl and indexation crawl.search-console Comment on this rule

Every URL in the sitemap snapshot taken before the restructure, plus every old URL rebuilt from _wp_old_slug, returns 200 or exactly one 301 to a 200. 0 of them 404, and 0 chains of two hops or more.

Without it, a renamed page 404s where a renamed post would have self-healed, and every external link and ranking pointing at the old URL dies with it.

Client document Website Design and Development Checklist section 8, item 24, in partnot public

Developer The build proves it About Crawl and indexation crawl.slug-change-redirect Comment on this rule

Every URL in the crawl is under 115 characters, separates words with hyphens rather than underscores, carries no numeric id or date segment, and is in the same language as the page it serves. 0 exceptions across the sampled templates.

Without it, an English page ends up served on a French slug, or /?cat=38 in the results, and fixing it after launch means redirects and a fresh crawl.

Client document Technical SEO control grid row 60not public

Developer The build proves it About Crawl and indexation crawl.url-format Comment on this rule

Only when the build works from a new design file rather than an existing template.

A dated screenshot of the contrast plugin's report on the kit: 4.5:1 for body text, 3:1 for text at 24px or 19px bold and above and for interface components, and 0 pairs left unmeasured.

Without it, a focus ring nobody measured ships at 1.48:1 on the page background, and re-colouring it after the build costs a design change and a rebuild.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.4.3 (AA), in part

Designer The agency proves it Why this rule exists About Design and UI kit design.contrast-in-mockup Comment on this rule

The live site exposes an identifier that resolves to one commit on the default branch of the repository handed over. A deployment naming no commit anywhere in its response or in a stamped file does not pass.

Without it, nobody can tell whether the bug they are chasing lives in the repository or in a file somebody edited on the server months ago.

Vendor documentation The Twelve-Factor App V. Build, release, run, in part

Operations The build proves it About Environments and deployment env.deploy-provenance Comment on this rule

Pushing a production database onto staging leaves staging's next response firing zero analytics requests with debug output off, and each host still reports its own environment from a server-side constant. Indexability is graded by seo.no-noindex-leak.

Without it, the next content push from production overwrites the one database row that was keeping staging's tracking switched off.

Vendor documentation The Twelve-Factor App III. Config, in part

Developer The build proves it About Environments and deployment env.env-config-not-in-db Comment on this rule

Only when the project has a form that collects data from a visitor.

One staging page load fires zero requests to an analytics, tag or advertising endpoint. One staging form submission arrives in a test inbox and creates no record in the production CRM.

Without it, a form test on staging lands in the client's real public inbox, and test traffic lands in the analytics property they report on.

Vendor documentation The Twelve-Factor App IV. Backing services, in part

Developer The build proves it About Environments and deployment env.staging-sends-nothing-live Comment on this rule

Only when the project has a form that collects data from a visitor.

The hidden field filled in stores nothing. 20 POSTs from one IP inside a minute get a 429 before the last one, and the refused POSTs write no message and no consent record. With the scored gate's verifier unreachable, a submission is refused.

Without it, the captcha verifier times out once and everything sent that minute is waved through - both delivered themes return a pass on a transport error.

Client document Website Design and Development Checklist section 4, item 11, in partnot public

Developer The build proves it Why this rule exists About Forms forms.anti-spam Comment on this rule

Only when the project has a form that collects data from a visitor.

The same payload submitted twice, once by double click and once by replaying the POST, leaves exactly 1 message record and 1 consent record. A failed submit returns the form with every value the visitor typed still in it.

Without it, an impatient double click writes two message records and two consent records, and the consent log is the thing a GDPR auditor counts.

Client document Website Design and Development Checklist section 4, item 12, in partnot public

Developer The build proves it About Forms forms.submit-lifecycle Comment on this rule

Only when the project has a form that collects data from a visitor.

test@example is refused, test@example.com is accepted, and no address in the reviewer's list of 10 valid addresses is refused. +33 6 12 34 56 78 is accepted and stored as +33612345678.

Without it, phone numbers reach the CRM as +33 6 12 34 56 78, spaces and all, so nothing downstream can dial, dedupe or match them.

Standard HTML Living Standard 4.10.5.1.5 Email state (type=email), in part

Developer The build proves it About Forms forms.value-formats Comment on this rule

No layout is built from table elements, every table has header cells with scope, and repeated content is inside a list element.

Without it, a screen reader never announces the grid's item count, so nobody using one can tell how many results the filter returned.

Standard HTML Living Standard 4.9.1 The table element, in part

Developer The build proves it About HTML html.lists-and-tables Comment on this rule

Only when the project has a form that collects data from a visitor.

The period is stated in writing by the client or their DPO and appears in the privacy policy. An export of the log produces a file carrying every stored key. A record aged past the period is gone after the scheduled job has run once.

Without it, records pile up behind a policy that promises they are deleted, which is worse than promising nothing.

Law Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text Art. 13(2)(a); Art. 5(1)(e), in part

Operations The client proves it Why this rule exists About Consent and legal legal.consent-retention Comment on this rule

The home page prints a deliberate title and tagline, every page uses one separator, the Organization node lists each official account in sameAs, and a dated screenshot of the home and one article preview exists for each of the three platforms.

Without it, the client's first share reads Just another WordPress site, and the profile links Google shows beside the brand belong to nobody.

Client document Website Design and Development Checklist section 8, item 4, in partnot public

Developer The build proves it About On-page signals onpage.site-identity Comment on this rule

Every path in the repository that writes to a remote database dumps it first, stops when that dump fails a size and gzip check, and prints the restore command. The dump from the last production write is on disk, dated.

Without it, the dump taken before a push turns out to be a zero-byte gzip, and the only thing printed afterwards is a placeholder nobody can run.

Vendor documentation Hardening WordPress security/hardening#restricting-database-user-privileges, in part

Developer The build proves it About Operations ops.db-write-backup Comment on this rule

No looping animation runs while off screen, a performance trace shows no layout thrash during scroll, and no animation drives a layout-triggering property.

Without it, an accordion animating height relays out the page on every frame, making the one interaction people actually use the jankiest thing there.

Vendor documentation web.dev developer guides articles/animations-guide, in part

Developer The build proves it About Perf perf.animation-cost Comment on this rule

In each sampled template's network log: zero URLs requested more than once, no stylesheet or script under 100 bytes, no library loaded by a template that does not use it, and four or fewer resource hints in the head.

Without it, the same file is fetched twice on one page load, and each request looks reasonable on its own until somebody reads the whole log.

Client document Website Design and Development Checklist section 10, item 5, in partnot public

Developer The build proves it About Perf perf.enqueue-hygiene Comment on this rule

Every class toggled from JavaScript is present in the production stylesheet: open the menu, a modal and one filter on the live URL and confirm the styling applies. The critical CSS is no older than the build it shipped with.

Without it, the menu opens perfectly on staging and unstyled on the live site, once Remove Unused CSS strips the class only JavaScript adds.

Client document Website Design and Development Checklist section 10, item 7not public

Developer The build proves it About Perf perf.optimiser-output-fresh Comment on this rule

The deploy script runs the build, then the suite, then the upload, and exits on a red suite. The suite reads the built output rather than skipping it, and each mechanism the handover names has a test that fails when the mechanism is removed.

Without it, a green suite that no deploy ever runs ships the broken split point it exists to catch.

House rule Delivered reference builds, audited together a suite in the third build and the starter, run by no deploy script in any build; nothing in the two older buildsnot public

Developer The build proves it About Practices practices.tests-before-deploy Comment on this rule

wp user list --role=administrator names no account called admin and no build account above editor, and a dated written confirmation from the client - an email reply or a countersigned handover line - claims every remaining administrator.

Without it, the developer's own login is still an administrator on the live site a year later, and nobody has confirmed who the rest belong to.

Vendor documentation Hardening WordPress security/brute-force#hardening, in part

Operations The client proves it About Security and hardening security.admin-accounts-at-handover Comment on this rule

No sampled page's HTML contains Fatal error, Warning:, Notice:, Stack trace or an absolute server path, a deliberate fatal on staging returns HTTP 500 carrying none of those five strings, and wp config get WP_DEBUG_DISPLAY returns false or is unset.

Without it, the first fatal on the client's site prints a page of PHP at a visitor and a map of the install at whoever asked for it.

Standard OWASP Application Security Verification Standard 5.0.0 16.5.1 (L2), in part

Developer The build proves it About Security and hardening security.no-error-disclosure Comment on this rule

Only when the project has a form that collects data from a visitor.

20 POSTs to wp-login.php inside one minute from one IP are refused with 429 or an explicit rejection before the 20th, and one normal login still succeeds after the window. Public form endpoints are graded by forms.anti-spam, not here.

Without it, wp-login.php takes password guesses as fast as a script can send them, and only the host is counting, if it counts at all.

Standard OWASP Application Security Verification Standard 5.0.0 6.3.1 (L1), in part

Developer The build proves it About Security and hardening security.public-post-rate-limit Comment on this rule

wp core check-update and wp plugin list --update=available --format=count both return zero on handover day, PHP is on a branch php.net still lists under security support, and the handover names the party applying updates for twelve months.

Without it, a published plugin CVE stays open for months on a site where nobody ever agreed to be the person applying updates.

Vendor documentation Hardening WordPress security/hardening#vulnerabilities-in-wordpress, in part

Operations The build proves it About Security and hardening security.versions-current Comment on this rule

Google's Rich Results Test reports no errors on the home page and one interior page, and exactly one Organization node exists per page with a name matching the brand.

Without it, two Organization nodes give Google two different names for the brand, and nobody decides which one it takes.

Automated check: seo-status:org-one, seo-status:org-brand, seo-status:org-sameas

Vendor documentation Google Search Central documentation appearance/structured-data/intro-structured-data, in part

Developer The build proves it About SEO seo.structured-data Comment on this rule

Only when the project has a form that collects data from a visitor.

Two consents captured by one submit produce two records with different purposes. Each record names the URL it was given on and a collection method matching how it was actually collected, not a default string.

Without it, every record still claims a ticked checkbox the day a double opt-in ships, and two consents from one form cannot be told apart.

Law Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text Art. 7(1), in part

Developer The build proves it About Consent and legal legal.consent-record-context Comment on this rule

Every image has an alt attribute, decorative ones are empty, and reading the alt text of a page aloud conveys the same information as seeing it.

Without it, a screen reader reads out the filename instead, and a client-filled media library passes the scanner with alt text nobody wrote.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.1.1 (A), in part

Developer The build proves it Why this rule exists About A11y a11y.alt-text Comment on this rule

Every interactive control can be reached and operated by keyboard, focus never enters a hidden element, and no component traps focus except a modal, which releases it on Escape.

Without it, a mobile menu built from an href-less anchor never opens for someone on a keyboard - one delivered build shipped exactly that.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 2.1.1; 2.1.2 (A), in part

Developer The build proves it Why this rule exists About A11y a11y.keyboard-operable Comment on this rule

View the key frames with a greyscale filter on: links, required markers, statuses, chart series, map keys and the active tab are all still tellable apart, with 0 distinctions left to hue alone. Keep the dated greyscale export as the evidence.

Without it, a link inside a rich-text field looks the same as the words around it - both delivered themes strip underlines and never put them back.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.4.1 (A), in part

Designer The agency proves it Why this rule exists About Design and UI kit design.not-colour-alone Comment on this rule

Only when the project loads analytics, advertising or marketing tags.

Both choices are reachable in one click from the banner's first screen, at the same size, weight and contrast. Refusing takes no more clicks than accepting, and neither is styled as the quieter of the two.

Without it, refusing takes more clicks than accepting, so CNIL does not count what the banner collected as consent at all.

Regulator Recommandation cookies et autres traceurs, version consolidee 2.3 (modalites du refus), in part

Designer The build proves it Why this rule exists About Consent and legal legal.cookie-banner Comment on this rule

Only when the project has video or audio, or content that starts moving on its own.

Every video with speech has captions that match the audio, and every auto-playing item can be paused with a keyboard.

Without it, a deaf visitor gets nothing from a video testimonial, and the one delivered build with speech video shipped zero track elements.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.4.2; 1.2.2; 2.2.2 (A), in part

Developer The build proves it About A11y a11y.media-alternatives Comment on this rule

The report names the screen reader and browser used, lists the headings and landmarks in the order they were announced, and confirms the invalid submit was announced. Zero unlabelled controls were met on the two pages.

Without it, nobody has driven the site by ear even once, so an announcement order that makes no sense ships with every automated check green.

Client document Website Design and Development Checklist section 12, item 9, in partnot public

Developer The build proves it About A11y a11y.screen-reader-pass Comment on this rule

At 200 percent zoom no content is lost or overlapping, at 320px wide the page scrolls vertically only, and body text computes to at least 16 px at every sampled width.

Without it, body overflow-x hidden suppresses the measurable instead of passing it, and the clipped content is unreachable, not just off-screen.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.4.10; 1.4.4 (AA), in part

Developer The build proves it About A11y a11y.zoom-and-reflow Comment on this rule

What is hidden is a list in the repository. An account the client actually uses sees the trimmed admin and can still reach the control that undoes it. No account can be locked out of its own reversal.

Without it, the client's own people are administrators, and a trim that exempts administrators leaves the only accounts it exists to help untouched.

House rule Delivered reference builds, audited together inc/admin-cleanup.php, both buildsnot public

Developer The build proves it Why this rule exists About The admin the client receives admin.client-mode Comment on this rule

For each setting the client can change, exactly one control in the admin writes it. Where a plugin supersedes a theme feature, the theme's control is not rendered while that plugin is active, checked with the plugin on and off.

Without it, the client sets the value in the plugin, the theme's box overwrites it on the next save, and nothing says which one won.

House rule Delivered reference builds, audited together theme SEO panel hidden while Yoast is active, both buildsnot public

Developer The build proves it About The admin the client receives admin.one-control-per-setting Comment on this rule

Only when the site sends email of its own - notifications, autoresponders, transactional.

Break the CRM credential on purpose and submit once. An alert naming the site and the failure reaches the named recipient within 24 hours, and the handover names that recipient and the date they took it on.

Without it, a broken credential eats enquiries into a log file nobody reads, and the first to notice is the client asking why nobody called back.

Client document Website Design and Development Checklist section 13, item 5, in partnot public

Operations The agency proves it About Email, CRM and analytics comms.delivery-alerting Comment on this rule

Only when the site sends email of its own - notifications, autoresponders, transactional.

The same message is opened in Gmail, Outlook and iPhone Mail, with a dated screenshot of each: no broken layout, no clipping notice, every link working. The raw source carries a text/plain part.

Without it, an Outlook reader gets a broken stack of tables and a Gmail reader gets the end of the message hidden behind a clipping link.

Client document Website Design and Development Checklist section 13, item 2, in partnot public

Developer The build proves it About Email, CRM and analytics comms.email-rendering Comment on this rule

Every template on the template list has been opened in Chrome, Firefox and desktop Safari - three engines, none checked in fewer - and each difference found is either fixed or written down.

Without it, a Firefox-only break ships because every check ran in Chromium, and the client's own team is the one that finds it.

Client document Website Design and Development Checklist section 15, item 4, in partnot public

Developer The build proves it About Launch and handover delivery.browser-matrix Comment on this rule

The client has a dated recording of the session covering editing content, adding a page and what must not be touched, naming at least 2 attendees. The wider account table is not graded anywhere since ops.account-inventory was withdrawn - raise it, do not check it.

Without it, the client cannot add a page without ringing us, and nobody can say who holds the DNS zone or the mail relay when it breaks.

Client document Website Design and Development Checklist section 15, item 7, in partnot public

Developer The agency proves it About Launch and handover delivery.client-handover Comment on this rule

The monitor's public status URL shows checks on the home page at five minutes or better, and the handover names the person it alerts and the date they took it on. If nobody will own it, the handover records that and it is not ticked.

Without it, the site is down all weekend before anyone notices, because the client is the only monitor and nobody was named to be told.

Client document Website Design and Development Checklist section 15, item 6, in partnot public

Operations The client proves it About Launch and handover delivery.monitoring-and-backups Comment on this rule

Only when the build works from a new design file rather than an existing template.

On the handoff date, the frame count in the file matches the sections and page types in the agreed sitemap: 0 sections and 0 page types without a named frame. Record both counts and that date in the handoff message.

Without it, a page type nobody drew - the archive, the 404, the mobile variant - gets guessed at during the build and was never in the estimate.

Client document Website Design and Development Checklist section 1, item 2not public

Designer The agency proves it About Design and UI kit design.mockup-coverage Comment on this rule

Only when the build works from a new design file rather than an existing template.

The handoff file carries a motion sheet naming all eight surfaces - text reveal, button hover, image reveal, card hover, preloader, page transition, the menu on desktop and mobile, and the footer - each with a trigger, a duration in ms and a named easing, or not applicable.

Without it, the developer picks every duration himself, which is what both delivered themes did, and the client first sees the timing in a browser.

Client document Website Design and Development Checklist section 2, items 1-8, in partnot public

Designer The agency proves it About Design and UI kit design.motion-spec Comment on this rule

Only when the build works from a new design file rather than an existing template.

The kickoff note lists the agreed name of every component and section frame and is countersigned by the developer. At handoff the names in the file are that same list: 0 renames between the agreed list and the delivered file.

Without it, a name agreed in the mockup is renamed after handoff, and one word changed in Figma becomes four file renames and a re-review.

Client document Website Design and Development Checklist section 1, item 7, in partnot public

Designer The agency proves it About Design and UI kit design.naming-convention Comment on this rule

Only when the build works from a new design file rather than an existing template.

Every interactive component in the kit has all six states present as variants, with 0 components missing one. The focus variant is identical across components and matches the kit's single focus style.

Without it, the submit button looks identical while it is sending - one delivered theme sets a loading class in JS that no stylesheet ever consumes.

Client document Website Design and Development Checklist section 3, items 2-7not public

Designer The agency proves it About Design and UI kit design.state-set Comment on this rule

Only when the build works from a new design file rather than an existing template.

The mockup names the overlay colour and opacity, or the gradient stops, for every text-over-media block. A dated export shows each block over the lightest and darkest plausible photo, body copy at 4.5:1 and display text at 3:1 in both.

Without it, an editor uploads a lighter photo than the mockup's and the heading over it falls under 3:1 - a delivered hero already sits at 2.85:1.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 1.4.3 (AA), in part

Designer The agency proves it About Design and UI kit design.text-over-media Comment on this rule

Only when the build works from a new design file rather than an existing template.

Colibrity shares a published library URL at kickoff. Opening it, every colour and text value used in the mockups resolves to a published variable or style, and the file holds 0 detached instances of a kit component.

Without it, raw hex spreads through the stylesheets, 171 of them across 47 files in one delivered theme, and a brand tweak becomes a search and replace.

Client document Website Design and Development Checklist section 1, item 1, in partnot public

Designer The agency proves it About Design and UI kit design.ui-kit Comment on this rule

Only when the project has a form that collects data from a visitor.

After a successful submit, focus is on the confirmation, a screen reader announces it, and it is still on screen 30 seconds later. Where it is a thank-you page, the handover names its URL.

Without it, the confirmation is gone in three seconds, as it is in both delivered themes, and the visitor sends the form again to check it worked.

Client document Website Design and Development Checklist section 4, item 15, in partnot public

Developer The build proves it About Forms forms.confirmation Comment on this rule

A dated screenshot of the backup listing shows a database backup under 24 hours old and a file backup under 7 days old. The handover states retention in days and names the copy held outside the hosting account.

Without it, the newest restorable copy on the box turns out to be a month old, and the uploads have no copy at all.

Vendor documentation Hardening WordPress security/hardening#data-backups, in part

Operations The agency proves it Why this rule exists About Operations ops.backup-coverage Comment on this rule

Pointed at the wrong target on purpose, the production deploy refuses and exits non-zero before transferring anything. A prompt that accepts a typed word and proceeds does not satisfy this.

Without it, an rsync --delete aimed at the wrong alias empties a live site's files, and the typed confirmation was answered correctly.

House rule Delivered reference builds, audited together PROD_EXPECTED_URL_HOST, one build of the twonot public

Operations The build proves it About Operations ops.deploy-target-pinned Comment on this rule

The handover carries dated terminal output from two runs: a restore of a backup no more than 7 days old into a non-production target, ending with that target's home page returning 200, and a rollback to the previous release. A tick with no output does not settle it.

Without it, the first restore anybody attempts is during a real outage, and that is when the rollback turns out not to exist.

Vendor documentation Hardening WordPress security/brute-force#hardening, in part

Operations The build proves it Why this rule exists About Operations ops.recovery-drill Comment on this rule

Emptying a listing shows a deliberate empty state rather than a blank region. A title of double the expected length does not break its layout.

Without it, a filter that matches nothing leaves a blank strip on the page and the visitor decides the site is broken.

House rule Delivered reference builds, audited together a rendered empty state per listing, both buildsnot public

Developer The build proves it About Practices practices.empty-states Comment on this rule

Someone who has never seen the project can build, run and deploy it from that page alone.

Without it, somebody deactivates a plugin the theme quietly depends on, because no page anywhere says which ones are load-bearing.

House rule Delivered reference builds, audited together README.md plus a .claude/ doc set, both buildsnot public

Developer The build proves it About Practices practices.handover-notes Comment on this rule

On a real phone at 390x844: no section clipped by the browser toolbar in either orientation, no text or control under the notch or home indicator, and a sticky header at 15 percent of viewport height or less in landscape.

Without it, the phone's home indicator sits on top of the fixed CTA bar, and the visitor cannot tap the one button that matters.

Client document Website Design and Development Checklist section 11, item 5, in partnot public

Developer The build proves it About Practices practices.mobile-viewport-chrome Comment on this rule

A content editor can change the text and images of every public page, and reorder the sections of a flexible page, without a developer.

Without it, the client emails you to change a phone number, and a one-word fix costs a developer, a deploy and an invoice.

House rule Delivered reference builds, audited together page.php loops have_rows(page_blocks), both buildsnot public

Developer The build proves it About Practices practices.no-hardcoded-content Comment on this rule

Every page with entrance animation or video is opened on a real phone in a fresh private tab, and scrolling stays smooth with video playing.

Without it, the hero video plays in every simulator and stays black on the client's iPhone, where iOS refuses play() outside a real gesture.

House rule Delivered reference builds, audited together a real-device debugging procedure in .claude/, both buildsnot public

Developer The build proves it About Practices practices.real-device-check Comment on this rule

No horizontal scrollbar at any width from 320 up, no clipped or overlapping content, and no layout that only works at the exact design breakpoints.

Without it, a 900px laptop sits between two drawn widths, and nobody opens one before launch, so that is where the heading lands on the image.

House rule Delivered reference builds, audited together one breakpoint map plus body overflow-x hidden, both buildsnot public

Developer The build proves it About Practices practices.responsive-breakpoints Comment on this rule

The 404 opens with the site header, footer and type styles and at least one working link back into the site. Forcing a 500 on staging returns a page in the same chrome, not the raw server or PHP default.

Without it, a PHP fatal drops the visitor onto WordPress core's unstyled critical-error screen, with no header and no way back.

Client document Website Design and Development Checklist section 3, item 11, in partnot public

Developer The build proves it About Interface states states.error-page-design Comment on this rule

Sample one control of each kind on three templates: hover, active, disabled and open each render a visible change. An element inserted by a filter or a load-more shows the same four states as one present at first load. Nothing a hover reveals is the only route to it on touch.

Without it, a card arriving from a filter fetch is dead to the touch while an identical one above it lights up on hover.

Client document Website Design and Development Checklist per-page item 13, in partnot public

Developer The build proves it About Interface states states.interactive-set Comment on this rule

Throttle to Slow 3G, then submit a form and change a filter. Each shows a busy state within 500 ms. Force one to fail and the busy state clears rather than leaving a spinner running forever.

Without it, people hit submit a second time because nothing moved, and a failed request leaves the spinner turning forever.

Client document Website Design and Development Checklist section 4, item 14, in partnot public

Developer The build proves it About Interface states states.loading-feedback Comment on this rule

Scrolling past the stick point shifts the page by 0 pixels. A link to #section leaves its heading fully below the header. With the menu open the page behind it does not scroll, and closing it returns to the same position.

Without it, the page behind an open off-canvas menu scrolls away under the visitor's finger, and every anchor lands its heading under the header.

Client document Website Design and Development Checklist section 11, item 6, in partnot public

Developer The build proves it About Interface states states.sticky-chrome Comment on this rule

A linked, reachable page names the standard targeted, lists known exceptions, and gives a working contact address.

Without it, nobody can say what the site targets or where to report a problem, and the client has nothing to produce when a complaint arrives.

Law Directive (EU) 2019/882 on the accessibility requirements for products and services (European Accessibility Act) Art. 13(2); Annex V(1), in part

Developer The build proves it About A11y a11y.statement Comment on this rule

Only when the site serves more than one language.

Switching the wp-admin display language switches the labels of the site's own post types, columns and meta boxes. No slug, meta key or field name changes with it.

Without it, labels follow the content-language switcher instead of the editor's own, so half the meta boxes stay in a language they cannot read.

House rule Delivered reference builds, audited together bilingual label helper, one build of the twonot public

Developer The build proves it About The admin the client receives admin.editor-language Comment on this rule

Each performance claim in the handover names the single change it came from and the before and after measurement.

Without it, eight changes ship in one commit, the score drops, and there is no way to tell which one did it.

House rule PERFORMANCE.md PERFORMANCE.md:89-92, in partnot public

Developer The build proves it About Practices practices.one-change-per-deploy Comment on this rule

Reading only the headings of a page conveys what the page is about, in order, without needing the body copy.

Without it, a screen-reader user skimming the headings hears the brand name and a sentence fragment ending on a preposition, and learns nothing.

Standard Web Content Accessibility Guidelines (WCAG) 2.1 2.4.6 (AA), in part

Developer The build proves it About SEO seo.headings-describe-content Comment on this rule