6 min read
Certificate renewals and the HSTS header that quietly vanished
An HSTS header lives wherever TLS terminates, and moves with it. How a routine ops change removes it without an error, and how a re-scan with a diff catches it.
Checks D1
Blog category
Trust & freshness
Pillar D: transport security, verifiable identity, policies, freshness and stability.
- 6 min read
Why "should an agent cite this site" is a trust question
The trust pillar asks whether an agent should cite a site. That is a question about provenance, and provenance is files, headers and fields that exist or not.
- 6 min read
Multi-page stability, the template drift that breaks trust
Check D7 wants every crawled page to return 200, none over four seconds, and the same navigation on all of them. How it measures each and what drift looks like.
Checks D7
- 5 min read
security.txt in ten minutes
What RFC 9116 requires, the Expires field that quietly invalidates the file a year later, how check D6 reads it, and how we serve ours from a rolling window.
Checks D6
- 6 min read
Identity consistency, one name across title, Open Graph and schema
How check D5 compares the title element, og site name and schema name, why they drift apart on ordinary sites, and how defining the name once stops it.
Checks D5
- 6 min read
A changelog is a freshness signal
For a product site whose pages rarely change, a dated changelog is the cheapest way to score on D4, if each entry carries a date a crawler can read.
Checks D4
- 6 min read
Freshness signals, lastmod, the 90-day window and visible dates
How check D4 scores freshness, any lastmod, a fifth of sitemap URLs modified in 90 days, a machine-readable date on a crawled page, and how ours stays true.
Checks D4
- 6 min read
Privacy, terms, shipping and returns. The policies an agent looks for, by site type
Check D3 wants a linked privacy policy, plus shipping and returns for shops or a terms page for everyone else. Why linked matters more than existing.
Checks D3
- 6 min read
Verifiable identity, a contact page and a sameAs that resolves
Check D2 wants a discoverable contact route and Organization schema with a sameAs link. How the scanner looks, and why a dead sameAs is worse than none.
Checks D2
- 6 min read
HSTS in one header, and why mixed content still fails you under render
Check D1 awards four points for valid TLS, a Strict-Transport-Security header and no http references in the page. What each part measures, and how we set ours.
Checks D1