Secure

Site Standards Check — The Files Every Site Should Publish

A number of small conventions have accumulated around what a well-configured site publishes: a robots file, a sitemap, a security contact, a web manifest, favicons in the right sizes. Individually each is minor. Collectively their absence is a reliable indicator that nobody has looked at the site's configuration in a while.

When it helps

Because these are quick to fix and quietly consequential. A missing or wrong robots file can prevent indexing entirely, or permit indexing of things that should not be public. A missing sitemap slows discovery of new content. A missing security contact means a researcher who finds a vulnerability in your site has no way to tell you, and their next option is usually worse for you than an email would have been.

Worth running automatically

The failure worth catching is a deploy that changes one of these without anyone noticing, and the expensive version is a robots file that arrives from staging with a blanket disallow. That is a catastrophic and completely silent SEO failure: the site works perfectly, and search engines stop crawling it. Nobody notices until traffic falls off weeks later. A scheduled check on a handful of well-known paths costs nothing and catches it within a day.

What you get out of it

Covers a set of small configuration details that are individually trivial and collectively diagnostic — including the staging robots file, which is one of the most expensive one-line mistakes available.

Also in Secure