The rulebook
The rulebook behind every site
This is what makes it a 2030 website instead of a lucky prompt. The crew works from a written playbook: rules with sources, checks that run on every page, and gates nobody gets to skip.
VeraIf it's not in the rulebook, it doesn't ship. If it is, it gets checked.
The rulebook
- 98best-practice rules
- 52of them rated must-fix
- 94automated checks on every page
- 12landing-page blueprints, one per page type
- 103sources cited, from 30 publishers
Nine areas, checked on every build
Pick an area to see real rules from the playbook. Sources are listed for every rule.
Speed
Core Web Vitals, image and font loading, size budgets.
11 rules10 automated checks
- Owner
- Dot
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- Hero image loads firstMust-fixweb.dev
- Reserve space for mediaMust-fixweb.dev
- Core Web Vitals targetsweb.dev · Google Search Central
- Lazy-load only below the foldweb.dev
Search
Titles, descriptions, canonical links, languages, sitemaps and structured data.
18 rules17 automated checks
- Owner
- Index
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- Specific <title>Must-fixGoogle Search Central
- One absolute, self-referencing canonicalMust-fixGoogle Search Central
- LocalBusiness JSON-LD, most specific typeMust-fixGoogle Search Central · schema.org
- No star markup about yourselfMust-fixGoogle Search Central · Federal Trade Commission
AI search
Letting AI assistants find you, read you and get your details right.
7 rules3 automated checks
- Owner
- Index
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- AI features need normal SEO, not tricksMust-fixGoogle Search Central
- Let AI search crawlers inMust-fixOpenAI (owner of the crawlers) · Google Search Central
- One consistent identity (name, address, phone)Must-fixGoogle Business Profile Help · Microsoft Bing (owner of the system) · Google Search Central
- Real people, never invented onesMust-fixGoogle Search Central · Nielsen Norman Group
Accessibility
WCAG rules: text alternatives, headings, contrast, forms, keyboard use.
18 rules18 automated checks
- Owner
- Dot
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- Text alternatives (1.1.1)Must-fixW3C
- Landmarks and headings (1.3.1)Must-fixW3C
- Language of page (3.1.1)Must-fixW3C
- Identify input purpose (1.3.5)Must-fixW3C · MDN
Conversion
One clear next step, a tappable phone number, short forms, honest trust signals.
18 rules14 automated checks
- Owner
- Dot
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- One primary conversion, repeatedMust-fixUnbounce · Google Ads Help
- What, where, next step: first screenMust-fixNielsen Norman Group · Google Ads Help · Unbounce
- Phone visible and tappableMust-fixNielsen Norman Group · Google Ads Help
- Short formsMust-fixNielsen Norman Group · Baymard Institute
Design
Readable type, clear hierarchy, short menus, room to breathe.
8 rules5 automated checks
- Owner
- Dot
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- Short, whole-word menu labelsMust-fixNielsen Norman Group
- Readable line lengthweb.dev
- Fluid type with a floorweb.dev
- Few sizes, clear hierarchyNielsen Norman Group
Security
HTTPS, security headers, no risky third-party code.
9 rules4 automated checks
- Owner
- Zip
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- HTTPS with HSTSMust-fixMDN · Google Search Central
- X-Content-Type-Options: nosniffMust-fixMDN
- Clickjacking protectionMust-fixMDN
- Third-party code: none, or pinnedMust-fixMDN · web.dev
Privacy
Privacy notices and consent rules by region, before any tracking.
9 rules5 automated checks
- Owner
- Dot
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- Privacy notice whenever we collect dataMust-fixCalifornia Attorney General · Office of the Privacy Commissioner of Canada · Commission d'accès à l'information du Québec
- EU/EEA: opt-in before non-essential tagsMust-fixEuropean Data Protection Board · Google Tag Platform · Google Tag Manager Help
- UK: PECR as amended (DUAA) and ICO 2026 guidanceMust-fixICO (UK)
- Brazil: LGPD cookie guidance (ANPD)Must-fixANPD (Brazil)
Landing pages
A blueprint for each type of landing page: what goes above the fold, the form, the message match.
12 blueprints11 automated checks
- Owner
- Pilar
- Checked by
- Nit
- Signed off by
- Vera
From the playbook
- Paid-search (PPC) lead generationUnbounce · Google Ads Help · Google Ads Policy Help
- Local service quote requestNielsen Norman Group · Baymard Institute · Unbounce
- Booking / appointmentUnbounce · Nielsen Norman Group · web.dev
- Event / registration (in person)Google Search Central · Federal Trade Commission
How a site moves through the checks
Lockbox screens the brief. Unsafe or illegal requests stop here.
Sleuth researches. Only facts you confirm move forward.
Vera sets the goal. Pilar plans, using the blueprint for your page type.
Vera reviews the plan before anyone builds.
The crew builds the page, following the rules for each area.
Nit runs the automated checks and its own review. Must-fix problems go back to Dot for a fix pass.
Vera's final review against the checklist.
Zip packages the preview. You review it, and pay only if you like it.
Researched by Scout. Every rule lists its sources and the date it was last verified (most recent: October 24, 2026). Every Monday, Scout is scheduled to re-check the most time-sensitive rules against their sources and propose updates. Nothing changes until a person reviews it.
Bring the business. The crew brings the rest.
Give me a business name. I'll give you a crew.