The SidRatnam Web Standard
77 checks. A site ships only when it passes.
This is the baseline every website the SidRatnam builder produces gets by default, and the list the release gate checks before anything goes live. 56 lines apply to every site; 21 more apply to sites that sell. Every failure blocks the release. A line the gate could not see is marked INCOMPLETE, and that blocks the release too: a check that passes what it could not see is not a check.
Lighthouse thresholds
| Measure | Required |
|---|
| Performance | ≥ 90 on mobile, every sampled page |
| Accessibility | ≥ 95, mobile and desktop |
| Best Practices | ≥ 95, mobile and desktop |
| SEO | ≥ 95, mobile and desktop |
| Largest Contentful Paint | < 2.5 s, mobile and desktop |
| Cumulative Layout Shift | < 0.1, mobile and desktop |
The 77 lines
Favicon set
| Check | How it is decided | Applies to |
|---|
| /favicon.ico served, multi-size (16/32/48) | HTTP check | Every site |
| favicon-16x16.png and favicon-32x32.png at their exact sizes | HTTP check | Every site |
| apple-touch-icon.png 180×180 | HTTP check | Every site |
| site.webmanifest with name, theme_color and 192/512 icons that resolve | HTTP check | Every site |
| Every page links icon, apple-touch-icon and manifest, and sets theme-color | Page source | Every site |
Head basics
| Check | How it is decided | Applies to |
|---|
| Every page has a <title> | Page source | Every site |
| Every page has a meta description | Page source | Every site |
| Every page has an absolute rel=canonical | Page source | Every site |
| og:title, og:description, og:url, og:type and og:image on every page | Page source | Every site |
| og:image is a 1200×630 JPEG/PNG (never WebP) | HTTP check | Every site |
| twitter:card summary_large_image with an image | Page source | Every site |
| <html lang> on every page | Page source | Every site |
| Responsive viewport meta on every page | Page source | Every site |
SEO and indexing
| Check | How it is decided | Applies to |
|---|
| robots.txt allows crawling and names the sitemap | HTTP check | Every site |
| XML sitemap is valid and every sampled URL is a real page | HTTP check | Every site |
| Sitemap submitted to Google Search Console (where a GSC key exists) | Recorded evidence | Every site, on the live domain |
| Organization (with legalName) and WebSite JSON-LD on the homepage, all JSON-LD parses | Page source | Every site |
| Product pages carry Product + Offer (price, currency, availability) | Page source | Sites that sell |
| Inner pages carry BreadcrumbList JSON-LD | Page source | Every site |
| Unknown URLs return a real 404 with a branded page (no soft 404) | HTTP check | Every site |
| The other trailing-slash form 301s to the canonical URL | HTTP check | Every site, on the live domain |
| www and apex: the non-canonical host 301s to the canonical one | HTTP check | Every site, on the live domain |
| http:// 301s to https:// | HTTP check | Every site, on the live domain |
| Strict-Transport-Security max-age ≥ 180 days | HTTP check | Every site, on the live domain |
| Ads landing pages are noindex and carry a canonical | Page source | Every site |
Verification hooks
| Check | How it is decided | Applies to |
|---|
| google-site-verification (meta from env GOOGLE_SITE_VERIFICATION, or DNS TXT) | DNS lookup | Every site, on the live domain |
| p:domain_verify (meta from env PINTEREST_DOMAIN_VERIFY, or DNS TXT) | DNS lookup | Sites that sell, on the live domain |
Legal
| Check | How it is decided | Applies to |
|---|
| Privacy policy page, linked from every page | HTTP check | Every site |
| Terms page, linked from every page | HTTP check | Every site |
| Refunds/returns page, linked from every page | HTTP check | Sites that sell |
| Contact page, linked from every page | HTTP check | Every site |
| Legal-entity name in the footer of every page and as Organization.legalName | Page source | Every site |
| Privacy policy names every analytics/ad pixel the site actually loads | HTTP check | Every site |
| No visible "AI-generated" style labels | Page source | Every site |
Analytics and consent
| Check | How it is decided | Applies to |
|---|
| A consent banner / Consent Mode default-denied wherever a tracker loads | Page source | Every site |
Email
| Check | How it is decided | Applies to |
|---|
| SPF record on the apex (exactly one v=spf1) | DNS lookup | Every site, on the live domain |
| DKIM record for the sending provider (resend._domainkey or a configured selector) | DNS lookup | Every site, on the live domain |
| DMARC record at _dmarc | DNS lookup | Every site, on the live domain |
| MX records exist so support@ can receive mail | DNS lookup | Every site, on the live domain |
| Transactional sender domain verified for Resend (send.<domain> MX + SPF, resend._domainkey) | DNS lookup | Every site, on the live domain |
Performance and accessibility
| Check | How it is decided | Applies to |
|---|
| Content images are WebP/AVIF (or <picture> with a WebP/AVIF source) | Page source | Every site |
| Every <img> has width and height | Page source | Every site |
| Large content images have srcset and sizes | Page source | Every site |
| Below-the-fold images are loading="lazy" | Page source | Every site |
| Image filenames are content-hashed (or versioned) for long caching | Page source | Every site |
| Every <img> has an alt attribute | Page source | Every site |
| Animations honour prefers-reduced-motion | HTTP check | Every site |
| Colour contrast passes (Lighthouse color-contrast) | Lighthouse | Every site |
| Keyboard and names: no positive tabindex, every button/link has a name | Lighthouse | Every site |
| Lighthouse Performance ≥ 90 on mobile (every page) | Lighthouse | Every site |
| Lighthouse Accessibility ≥ 95, mobile and desktop | Lighthouse | Every site |
| Lighthouse Best Practices ≥ 95, mobile and desktop | Lighthouse | Every site |
| Lighthouse SEO ≥ 95, mobile and desktop | Lighthouse | Every site |
| LCP < 2.5 s, mobile and desktop | Lighthouse | Every site |
| CLS < 0.1, mobile and desktop | Lighthouse | Every site |
Security headers
| Check | How it is decided | Applies to |
|---|
| Content-Security-Policy (enforced, not report-only) | HTTP check | Every site, on the live domain |
| Referrer-Policy | HTTP check | Every site, on the live domain |
| X-Content-Type-Options: nosniff | HTTP check | Every site, on the live domain |
| Permissions-Policy | HTTP check | Every site, on the live domain |
Commerce: buying flow
| Check | How it is decided | Applies to |
|---|
| On-site Stripe Elements checkout — never a hosted/embedded Stripe redirect | Browser walk | Sites that sell |
| Wallet buttons (Apple Pay / Google Pay / Link) on the product page and in the cart | Browser walk | Sites that sell |
| Add-to-cart opens a drawer; the page does not change | Browser walk | Sites that sell |
| Sticky buy bar on mobile product pages | Browser walk | Sites that sell |
| Free-shipping progress meter in the cart | Browser walk | Sites that sell |
| Guest checkout — no forced account, no password field | Browser walk | Sites that sell |
| Landing → payment form within the click budget (default 4 taps) | Browser walk | Sites that sell |
Commerce: pricing honesty
| Check | How it is decided | Applies to |
|---|
| A card price is the price of the exact item pictured — no "From $X" from a cheaper format | Page source | Sites that sell |
| The detail page offers every format the product is sold in | Page source | Sites that sell |
Commerce: growth loop
| Check | How it is decided | Applies to |
|---|
| aggregateRating JSON-LD only from real, moderated reviews | Page source | Sites that sell |
| Post-delivery review-request emails with moderation | Recorded evidence | Sites that sell |
| Google Customer Reviews opt-in on the order confirmation, badge on site | Recorded evidence | Sites that sell, on the live domain |
| Abandoned-cart reminders | Recorded evidence | Sites that sell |
| Customer photo wall (moderated UGC) | Recorded evidence | Sites that sell |
| Referral program hooks (give-10%/get-10% pattern) | Recorded evidence | Sites that sell |
| Email links tagged utm_source=email, utm_medium=lifecycle|transactional, utm_campaign=<flow> | Recorded evidence | Sites that sell |
Commerce: channels
| Check | How it is decided | Applies to |
|---|
| Product feed for Google Merchant Center / Meta / Pinterest (JPEG/PNG image_link) | HTTP check | Sites that sell |
| Checkout links ?products=id:qty (Meta) and ?id= (Google) land on a real cart page | HTTP check | Sites that sell |
Our own score
sidratnam.com is measured with the same gate. On 30 October 2026 it passed 32 of the 55 lines that apply to it, failed 22, and 1 could not be checked from outside. The open items: the full favicon set and web manifest, 1200×630 PNG/JPEG social images, Twitter cards on every page, soft-404 and trailing-slash duplicates, image dimensions, srcset and lazy loading, mobile Performance and LCP on the homepage, colour contrast, a script-protecting Content-Security-Policy, and naming every analytics service in the privacy policy. We are fixing them, and we will not call it a pass until it is one.
See how your site measures up →