Front-End Checklist

Front-End Checklist is the open-source front-end quality system for humans and AI agents. It turns front-end best practices into a practical review workflow you can browse on the web, run through with MCP-compatible tools, or work through directly in this README.

• Website: frontendchecklist.io
• Rules: frontendchecklist.io/rules
• MCP server: mcp.frontendchecklist.io

Companion project: UX Patterns for Devs helps developers choose the right UI pattern before using Front-End Checklist to verify implementation quality.

[!IMPORTANT] Use the website for browsing and filtering, the MCP server for agent workflows, and this README when you want the checklist in one place.

What you get

• 385 English rules across 11 active categories
• 11 MCP tools exposed by the hosted server
• Rule pages with explanations, remediation guidance, and verification steps

How to use this checklist

1. Start with the category navigator below and jump straight to the part of the checklist you need.
2. Work through the checkbox items that apply to your project, audit, or pull request.
3. Open the linked rule pages when you need the full guidance, examples, verification steps, and AI prompts.
4. Use frontendchecklist.io for interactive browsing, and mcp.frontendchecklist.io when you want agents to use the same rule corpus directly.

Priority legend

• ![Critical][critical_img] means site-breaking, compliance-sensitive, or security-sensitive issues that should be fixed first.
• ![High][high_img] means issues with major impact on user experience, accessibility, performance, or discoverability.
• ![Medium][medium_img] means strong best practices that should be part of normal frontend quality review.
• ![Low][low_img] means useful improvements that are situational or lower urgency.

Choose your workflow

Browse online

• Explore all rules at frontendchecklist.io/rules
• Use curated checklists at frontendchecklist.io/checklists
• Open a category page for focused audits and implementation guidance

Choose the right pattern first

Front-End Checklist helps you review implementation quality. If you are still deciding what interface to build, use UX Patterns for Devs to compare common UI patterns, understand tradeoffs, and find practical guidance for forms, navigation, data display, feedback states, authentication, and AI interfaces.

Contribute to the checklist

• Install dependencies: pnpm install
• Run local development: pnpm dev
• Validate structure: pnpm validate:rule-structure
• Score the corpus: pnpm score:rules
• Regenerate derived artifacts: pnpm generate:skills and pnpm generate:readme

Use with MCP

Connect an MCP-capable agent to Front-End Checklist for frontend code review, structured rule lookup, audits, and remediation workflows across React, Next.js, HTML, CSS, JavaScript, accessibility, performance, SEO, security, images, privacy, i18n, and testing.

[!TIP] Best first use: point an MCP-capable agent at a real component, page, or public URL and explicitly ask it to use the Front-End Checklist MCP for the highest-confidence frontend findings first. Some clients discover installed MCP tools lazily, so naming the server in the prompt helps.

• Public endpoint: mcp.frontendchecklist.io
• Public docs: frontendchecklist.io/mcp
• Local/editor integration: stdio server at packages/mcp/src/cli.ts

What you can do:

• Review pasted code or file contents against the checklist
• Audit a live public URL
• Fetch a specific rule with remediation guidance
• Search rules by keyword, category, or priority
• Get a workflow or quick reference for a focused audit

Agent usage guidance:

• Use review_code first for pasted HTML, CSS, JavaScript, React, or Next.js code
• Use search_rules before making frontend accessibility, performance, SEO, security, or image recommendations
• Use get_workflow or get_checklist_rules for launch, accessibility, SEO, security, and performance audits
• Use audit_url for public https:// pages

Example prompts:

• Use the Front-End Checklist MCP to review this React component and report the highest-confidence findings first.
• Use the Front-End Checklist MCP to audit https://example.com for accessibility, performance, and SEO issues.
• Use the Front-End Checklist MCP to explain the canonical URL rule and suggest a fix with code examples.

Use with skills

Install Front-End Checklist skills when you want reusable audit workflows or focused rule-specific guidance in tools that support them.

Install:

npx skills add frontendchecklist/skills
npx skills add frontendchecklist/skills --skill https

Useful entry points:

• Global audit entry point: skills/frontend-checklist-global/SKILL.md
• Focused rule skill example: skills/https/SKILL.md

Example uses:

• Run a broad frontend audit against the full Front-End Checklist corpus
• Use a focused skill like https for security review on one concern
• Use rule-specific skills to explain why a rule matters and how to fix it

Checklist

Jump to a category

• HTML (25) · Open on the site
• CSS (32) · Open on the site
• JavaScript (26) · Open on the site
• Performance (43) · Open on the site
• Accessibility (95) · Open on the site
• SEO (94) · Open on the site
• Security (22) · Open on the site
• Images (25) · Open on the site
• Testing (13) · Open on the site
• Privacy (5) · Open on the site
• Internationalization (5) · Open on the site

Categories

HTML

25 rules. Semantic markup, metadata, forms, and document structure rules.

Browse HTML on frontendchecklist.io

• Add Subresource Integrity to external scripts ![High][high_img]: Use Subresource Integrity (SRI) hash attributes on external scripts and stylesheets loaded from CDNs to ensure the content hasn't been tampered with.
• Add thumbnail images to videos ![Medium][medium_img]: HTML5 video elements should have a poster attribute providing a thumbnail image displayed before the video loads or is played.
• Create a custom 404 error page ![Medium][medium_img]: A custom 404 error page is designed with helpful navigation options for lost users.
• Declare UTF-8 character encoding ![Critical][critical_img]: The charset (UTF-8) is declared correctly as the first element in the head.
• Ensure all IDs are unique ![High][high_img]: All ID attributes are unique within the document. No duplicate IDs exist on the page.
• Implement accessible breadcrumb navigation ![Medium][medium_img]: Breadcrumb navigation is implemented with proper semantic markup and ARIA attributes for accessibility.
• Implement favicons for all devices ![Medium][medium_img]: All necessary favicon formats are implemented for browsers, devices, and PWA support.
• Link a Web App Manifest for installability ![Medium][medium_img]: Include a Web App Manifest (manifest.json) linked from the HTML head to enable Progressive Web App features like home screen installation, standalone display, and splash screens.
• Load scripts with defer, async, or type=module ![High][high_img]: Prevent JavaScript from blocking HTML parsing by using defer, async, or type=module attributes on script tags so the browser can continue building the DOM while scripts download.
• Make custom elements and Web Components accessible ![Medium][medium_img]: Custom elements must implement ARIA reflection via ElementInternals, keyboard interaction, and form association so that screen readers and assistive technologies can interpret them correctly.
• Make file uploads accessible ![Medium][medium_img]: File upload components are accessible with proper labels, file type restrictions, and progress feedback.
• Make pagination accessible ![Medium][medium_img]: Pagination controls are accessible with proper ARIA labels, keyboard navigation, and current page indication.
• Make search inputs accessible ![Medium][medium_img]: Search functionality is accessible with proper input type, label, role, and autocomplete suggestions.
• Make videos accessible with captions ![High][high_img]: Videos have captions, audio descriptions, transcripts, pause controls, and avoid autoplay for users with hearing, vision, or cognitive impairments.
• Meet PWA installability criteria ![Low][low_img]: The web app satisfies the browser's minimum PWA installability requirements: a valid web app manifest, a registered service worker, HTTPS, and maskable icons.
• Provide noscript fallback content ![Medium][medium_img]: A noscript tag provides fallback content for users with JavaScript disabled.
• Remove comments and debug code in production ![Medium][medium_img]: Unnecessary code, comments, and debug elements are removed before deploying to production.
• Set text direction for RTL languages ![Medium][medium_img]: The dir attribute is used for languages that read right-to-left (RTL) or mixed content.
• Set the page lang attribute ![High][high_img]: The element must have a lang attribute with a valid BCP 47 language code so screen readers, translation tools, and search engines know the primary language of the page.
• Set the responsive viewport meta tag ![Critical][critical_img]: The viewport meta tag is declared correctly for responsive design.
• Use semantic HTML elements ![High][high_img]: HTML5 Semantic Elements are used appropriately (header, section, footer, main, article, aside...).
• Use semantic input type attributes ![High][high_img]: Set the correct type attribute on input elements to trigger the right mobile keyboard, enable browser validation, and improve autofill accuracy.
• Use the HTML5 doctype ![Critical][critical_img]: The HTML5 doctype declaration must appear as the first line of every HTML document to trigger standards mode rendering in all browsers.
• Validate forms accessibly ![High][high_img]: Forms provide clear validation feedback with accessible error messages and proper ARIA attributes.
• Validate HTML against W3C standards ![High][high_img]: HTML markup is validated against W3C standards for cross-browser compatibility.

Back to top

CSS

32 rules. Layout, typography, responsive design, and styling rules.

Browse CSS on frontendchecklist.io

• Apply Flexbox best practices ![Medium][medium_img]: Use Flexbox for one-dimensional layouts with the right properties, avoiding common mistakes like overusing flex:1, ignoring min-width:0, and misunderstanding flex-basis.
• Avoid embedded and inline CSS ![High][high_img]: Embedded and inline CSS are avoided except for critical CSS and performance optimization.
• Avoid intrusive interstitials ![Medium][medium_img]: Full-screen interstitials (pop-ups, overlays, cookie banners) that block the main content on mobile are a ranking penalty signal and accessibility barrier. Use non-intrusive alternatives.
• Do not disable pinch zoom ![High][high_img]: The viewport meta tag must not set user-scalable=no or maximum-scale=1 as these prevent users from zooming in to read content, violating WCAG 2.1 SC 1.4.4 (Resize Text).
• Include a print stylesheet ![Medium][medium_img]: A print stylesheet is provided and correctly optimized for printed pages.
• Inline critical CSS for faster rendering ![High][high_img]: Critical CSS (above-the-fold content) is inlined in the head for faster initial render.
• Keep CSS specificity low and flat ![High][high_img]: Write selectors at the lowest specificity that works, avoiding ID selectors and deep nesting, so styles can be overridden cleanly without resorting to !important.
• Lint CSS and SCSS files ![Medium][medium_img]: All CSS/SCSS files are linted with Stylelint to detect errors and enforce standards.
• Load CSS without blocking render ![High][high_img]: Non-critical CSS is loaded asynchronously to avoid blocking DOM rendering.
• Minify all CSS files ![High][high_img]: All CSS files are minified to reduce file size and improve page load performance.
• Optimize web font formats ![Medium][medium_img]: Web fonts use modern formats (WOFF2, WOFF) with proper fallbacks and loading strategies.
• Order CSS files correctly ![Medium][medium_img]: All CSS files are loaded before JavaScript files to prevent render blocking.
• Prevent horizontal scrolling ![Medium][medium_img]: Web pages must not require horizontal scrolling at standard viewport widths. Horizontal overflow breaks responsive layouts and makes content inaccessible to low-vision users who zoom in.
• Provide visible custom focus indicators ![High][high_img]: Ensure all interactive elements have a clearly visible focus indicator for keyboard navigation — never just remove the default outline without providing a better alternative.
• Register CSS custom properties with @property for animation and type safety ![Low][low_img]: Use @property to register CSS custom properties with a type, initial value, and inheritance control — enabling animation of custom properties and providing compile-time validation for design tokens.
• Remove unused CSS rules ![High][high_img]: Unused CSS is removed to reduce bundle size and improve performance.
• Support dark mode with prefers-color-scheme ![Medium][medium_img]: Implement dark mode using the prefers-color-scheme media query and CSS custom properties so the site automatically adapts to the user's system preference.
• Use :has() to style parent elements based on their descendants ![Low][low_img]: Use the CSS :has() relational pseudo-class to select and style an element based on what it contains, replacing JavaScript DOM manipulation for many common styling scenarios.
• Use @layer to manage CSS cascade order explicitly ![Low][low_img]: CSS Cascade Layers (@layer) are used to give the codebase explicit, predictable control over specificity and cascade order, eliminating the need to fight specificity with !important.
• Use a CSS reset or normalize stylesheet ![Medium][medium_img]: A CSS reset or normalize is used to ensure consistent styling across browsers.
• Use consistent CSS naming conventions ![Medium][medium_img]: Adopt a consistent class naming methodology (BEM, CUBE CSS, or a team-agreed pattern) to make class names self-documenting and prevent style conflicts.
• Use container queries for component-level responsiveness ![Medium][medium_img]: Use CSS container queries to make components respond to their own container's size rather than the viewport, enabling truly reusable responsive components.
• Use CSS containment to limit repaint scope ![Medium][medium_img]: Apply the contain property to components to tell the browser they are independent from the rest of the page, enabling rendering optimizations that reduce repaint and reflow scope.
• Use CSS custom properties for design tokens ![High][high_img]: Define design system values (colors, spacing, typography) as CSS custom properties on :root to enable consistent theming, dynamic updates, and dark mode support.
• Use CSS Grid for two-dimensional layouts ![Medium][medium_img]: Use CSS Grid when you need to control both rows and columns simultaneously, such as page layouts, card grids, and complex component arrangements.
• Use CSS logical properties for i18n and RTL support ![Medium][medium_img]: Use CSS logical properties (margin-inline, padding-block, border-inline-start) instead of physical properties (margin-left, padding-top) to support right-to-left languages automatically.
• Use CSS subgrid to align nested grid items to parent tracks ![Low][low_img]: Use grid-template-columns: subgrid (or subgrid for rows) to make nested grid items participate in the parent grid's tracks, solving the card-content alignment problem without JavaScript height matching.
• Use oklch() and oklab() for perceptually uniform colour palettes ![Low][low_img]: Colour values in the design system use oklch() or oklab() colour functions to produce perceptually uniform palettes where equal numeric steps produce equal perceived lightness changes.
• Use readable font sizes on mobile ![Medium][medium_img]: Text must be large enough to read without zooming on mobile devices. Using relative units (rem/em) allows browser font size preferences to be respected.
• Use relative units for responsive layouts ![High][high_img]: Use rem, em, %, vw, vh, and clamp() instead of fixed px values to build layouts that scale with user font size preferences and viewport dimensions.
• Use the View Transitions API for smooth page and component transitions ![Low][low_img]: The View Transitions API is used to animate between page states or navigations with cross-fade or custom animations, providing a native-app quality transition without JavaScript animation libraries.
• Use transform and opacity for animations ![High][high_img]: Animate with CSS transform and opacity properties to keep animations running on the GPU compositor thread at 60fps, avoiding layout-triggering properties like top, left, width, and height.

Back to top

JavaScript

26 rules. Client-side behavior, async patterns, and runtime quality rules.

Browse JavaScript on frontendchecklist.io

• Avoid implicit type coercion ![Medium][medium_img]: Use strict equality (===), explicit type conversion, and Number/String/Boolean constructors to avoid JavaScript's implicit type coercion producing unexpected results.
• Avoid inline JavaScript ![High][high_img]: Inline JavaScript is avoided. JavaScript is kept in external files for caching and maintainability.
• Avoid the any type — use unknown, generics, or type guards instead ![Medium][medium_img]: Replace TypeScript's any type with unknown, proper generics, or narrowed type assertions to preserve type safety without sacrificing expressiveness.
• Debounce and throttle event handlers ![High][high_img]: Use debounce or throttle for high-frequency events like scroll, resize, and input to improve performance.
• Enable noUncheckedIndexedAccess to catch out-of-bounds array bugs ![Medium][medium_img]: Enable noUncheckedIndexedAccess in tsconfig.json to make array and object index access return T | undefined, forcing explicit null checks that prevent out-of-bounds runtime errors.
• Enable TypeScript strict mode in tsconfig.json ![High][high_img]: Enable "strict": true in tsconfig.json to activate the full suite of TypeScript type-checking flags and catch the most common runtime bugs at compile time.
• Handle cross-origin requests securely ![High][high_img]: Use CORS correctly, validate message origins with postMessage, and understand the Same-Origin Policy to prevent cross-origin attacks.
• Implement proper error handling ![High][high_img]: Use try-catch blocks and error boundaries to gracefully handle errors in async operations and UI components.
• Lint JavaScript code ![Medium][medium_img]: JavaScript code is linted with ESLint to detect errors and enforce coding standards.
• Minify all JavaScript files ![High][high_img]: All JavaScript files are minified to reduce file size and improve loading performance.
• Minimize costly DOM read/write operations ![High][high_img]: Batch DOM reads and writes separately to avoid layout thrashing — the performance problem caused by alternating between reading and writing layout properties.
• Never use eval() or unsafe dynamic code execution ![Critical][critical_img]: Avoid eval(), new Function(), setTimeout/setInterval with string arguments, and innerHTML with untrusted content — they execute arbitrary code and create critical XSS vulnerabilities.
• Parse JSON safely with error handling ![Medium][medium_img]: Always wrap JSON.parse() in try/catch and validate the parsed structure before use, as invalid JSON or unexpected data shapes cause runtime errors.
• Prefer const and let over var ![High][high_img]: Use block-scoped const and let declarations instead of function-scoped var to avoid hoisting bugs and unintended variable mutations.
• Prefer immutable data patterns ![Medium][medium_img]: Use spread operators, Object.assign, and array methods that return new values instead of mutating objects and arrays in place, to make data flow predictable and debugging easier.
• Prevent common memory leak patterns ![High][high_img]: Identify and avoid the most common JavaScript memory leak sources: forgotten event listeners, retained DOM references, closures holding large objects, and uncleared timers.
• Remove console statements in production ![Medium][medium_img]: Remove or disable console.log, console.debug, and other console statements before deploying to production.
• Split large JavaScript bundles ![High][high_img]: Use dynamic imports and route-based code splitting to break large bundles into smaller chunks that load on demand, reducing initial page load time.
• Use ES modules (import/export) ![High][high_img]: Use native ES module syntax for imports and exports instead of CommonJS require() to enable static analysis, tree-shaking, and better tooling support.
• Use event delegation for dynamic content ![Medium][medium_img]: Attach event listeners to stable parent elements rather than individual dynamic children to reduce memory usage and handle elements added to the DOM after page load.
• Use import type for type-only imports ![Low][low_img]: Use the import type syntax for imports that are only needed as TypeScript types, ensuring they are fully erased at compile time with zero runtime cost.
• Use modern array and object methods ![Medium][medium_img]: Use ES2015+ array methods (map, filter, reduce, find, flatMap) and object methods (Object.entries, Object.fromEntries, structuredClone) for cleaner, more expressive code.
• Use scheduler.yield() to keep the main thread responsive during long tasks ![Medium][medium_img]: Break up tasks longer than 50 ms by yielding to the browser with scheduler.yield() or a MessageChannel fallback so that user input is never blocked.
• Use Web Storage API safely ![Medium][medium_img]: Use localStorage and sessionStorage with proper serialization, error handling, and security awareness to avoid data corruption and storage quota errors.
• Validate external data at runtime with a schema library ![High][high_img]: Use Zod or Valibot to validate data from API responses, form inputs, localStorage, and environment variables — TypeScript types are erased at runtime and cannot protect against unexpected shapes.
• Write internationalisation-friendly translation strings ![Medium][medium_img]: Translation strings use message format patterns (ICU or similar) rather than string concatenation, and correctly handle pluralisation, gender, and variable interpolation.

Back to top

Performance

43 rules. Loading speed, rendering, optimization, and Core Web Vitals rules.

Browse Performance on frontendchecklist.io

• Analyze performance with WebPageTest ![High][high_img]: Page performance is analyzed with WebPageTest to identify loading bottlenecks and optimization opportunities.
• Avoid JavaScript-based redirects ![Medium][medium_img]: Detects JavaScript resources that return 3XX redirects to reduce latency
• Avoid serving legacy JavaScript to modern browsers ![Medium][medium_img]: Detects ES5 polyfills and legacy JavaScript code to reduce bundle size and improve execution
• Convert animated GIFs to video ![Medium][medium_img]: Large animated GIFs are replaced with more efficient video formats like MP4 or WebM to reduce page weight.
• Disable lazy loading for above-the-fold content ![Medium][medium_img]: Detects lazy loading on likely above-fold images to improve Largest Contentful Paint (LCP)
• Eliminate render-blocking resources ![Medium][medium_img]: Checks for render-blocking CSS and JavaScript that prevent the initial page render
• Enable browser caching ![High][high_img]: Cache-Control and ETag headers are properly configured for static resources.
• Enable HTTP/2 or HTTP/3 ![High][high_img]: Use modern HTTP protocols to enable request multiplexing and reduce network latency.
• Enable text-based compression ![High][high_img]: Compress text resources (HTML, CSS, JS) using Gzip or Brotli to reduce data transfer size.
• Implement Google Consent Mode v2 ![High][high_img]: Adjust Google Tag behavior based on user consent to comply with privacy regulations and maintain data insights.
• Implement lazy loading for offscreen content ![High][high_img]: Images and heavy resources below the fold are lazy loaded to improve initial performance.
• Keep page load time under 3 seconds ![High][high_img]: Page fully loads in under 3 seconds on a standard connection.
• Keep page weight under 1500KB ![High][high_img]: Total page weight including all resources is under 1500KB (ideally under 500KB).
• Load non-critical code on user interaction ![High][high_img]: Defer JavaScript modules, widgets, and third-party code until the user signals intent through a click, focus, hover, or similar interaction.
• Load non-critical code when content approaches the viewport ![High][high_img]: Use viewport-aware loading to fetch components, embeds, and feature code shortly before they become visible instead of shipping them on first load.
• Minimize critical request chains ![High][high_img]: Reduce the number and depth of dependent resource requests that block the initial rendering of the page.
• Minimize cumulative layout shift ![High][high_img]: Page maintains visual stability with a CLS score below 0.1, preventing unexpected content shifts during load.
• Minimize HTTP requests ![High][high_img]: HTTP requests are minimized by combining files, using sprites, and HTTP/2.
• Optimize CSS file size ![Medium][medium_img]: Keep individual CSS files small and remove unused styles to accelerate the critical rendering path.
• Optimize first contentful paint ![High][high_img]: First content renders within 1.8 seconds, providing quick visual feedback that the page is loading.
• Optimize Google Tag Manager implementation ![Medium][medium_img]: Configure Google Tag Manager efficiently to minimize its impact on page load speed and main-thread blocking.
• Optimize interaction to next paint ![High][high_img]: Page responds to user interactions within 200ms, ensuring good responsiveness.
• Optimize JavaScript bundle size ![Medium][medium_img]: Checks for JavaScript files that exceed recommended size limits to ensure fast interaction
• Optimize largest contentful paint ![Critical][critical_img]: The largest content element loads within 2.5 seconds for a good user experience.
• Optimize pages for back/forward cache ![High][high_img]: Pages avoid back/forward cache blockers such as unload listeners and restore state correctly when a browser resumes them from memory.
• Optimize third-party script loading ![High][high_img]: Load third-party scripts asynchronously to prevent blocking the main thread and improve page performance.
• Optimize web font loading ![High][high_img]: Use efficient font formats and loading strategies to prevent layout shifts and invisible text.
• Perform browser-based performance audits ![Medium][medium_img]: Conduct performance audits in a full browser environment to capture accurate runtime metrics and layout shifts.
• Provide an offline fallback page ![Low][low_img]: When the network is unavailable, users are shown a custom offline fallback page rather than the browser's generic error screen.
• Provide source maps for production debugging ![Medium][medium_img]: Checks for source map availability and configuration to ensure easier debugging
• Reduce DOM size and complexity ![Medium][medium_img]: Keep the DOM tree small and shallow to improve memory usage and rendering performance.
• Reduce Time to First Byte (TTFB) ![Medium][medium_img]: Measures and optimizes server response time (TTFB) to ensure a fast initial response
• Register a service worker for caching and offline support ![Medium][medium_img]: A service worker is registered to intercept network requests, cache critical assets, and enable offline functionality for your web application.
• Remove duplicate JavaScript libraries ![Medium][medium_img]: Detect and consolidate duplicate JavaScript libraries to reduce bundle size and prevent version conflicts.
• Show loading indicators ![High][high_img]: Loading indicators provide feedback during asynchronous operations to keep users informed of progress.
• Stream HTML to the browser before the full response is ready ![Medium][medium_img]: Use HTTP chunked transfer encoding and React renderToPipeableStream (or ReadableStream) to begin delivering HTML to the browser as soon as the first bytes are available, reducing Time to First Byte and First Contentful Paint.
• Use a content delivery network ![High][high_img]: Static assets are served from a CDN for reduced latency and faster delivery.
• Use fetchpriority to hint resource loading priority ![Medium][medium_img]: The fetchpriority attribute is applied to critical images, scripts, and preload links to help the browser prioritise the most important resources and defer lower-priority ones.
• Use preconnect for critical third-party origins ![Medium][medium_img]: Checks for preconnect hints to critical third-party origins to reduce connection latency
• Use resource hints for faster loading ![High][high_img]: Implement preload, prefetch, and preconnect hints to optimize resource loading priority.
• Use secure and up-to-date JS libraries ![Medium][medium_img]: Detects JavaScript libraries and checks for known vulnerabilities
• Use the Speculation Rules API to prefetch and prerender navigations ![Low][low_img]: The Speculation Rules API is used to declaratively prefetch or prerender likely next pages, making navigation feel near-instant without the overhead of a full client-side router.
• Virtualize long lists and tables ![High][high_img]: Render only the visible subset of rows or cards in large collections to reduce DOM size, memory usage, and scroll-time rendering work.

Back to top

Accessibility

95 rules. Keyboard, screen reader, ARIA, and inclusive UX rules.

Browse Accessibility on frontendchecklist.io

• Align visible labels with accessible names ![Medium][medium_img]: The accessible name of a control should contain its visible label text.
• Allow pasting into form inputs ![Medium][medium_img]: Users should be able to paste content into form fields to improve usability and reduce errors.
• Announce dynamic content with ARIA live regions ![High][high_img]: Dynamic content updates are announced to screen readers using appropriate ARIA live regions.
• Associate labels with form controls ![Critical][critical_img]: Form inputs must have programmatically associated labels.
• Avoid autofocus on form fields ![Low][low_img]: Form fields do not use the autofocus attribute which can disorient screen reader users and cause unexpected page behavior.
• Avoid autoplaying media ![High][high_img]: Audio and video content does not autoplay, or provides immediate controls to pause or stop playback.
• Avoid focusable descendants in role="text" elements ![Medium][medium_img]: Checks that elements with role='text' have no focusable descendants
• Avoid images of text ![Low][low_img]: Real text is used instead of images containing text, except for logos or when specific visual presentation is essential.
• Avoid meta refresh redirects ![Medium][medium_img]: Meta refresh redirects can disorient users and cause accessibility issues by refreshing the page unexpectedly.
• Avoid redundant entry in the same process ![High][high_img]: Information already provided earlier in a multi-step flow is auto-populated or available for selection instead of being typed again.
• Avoid redundant image alternative text ![Low][low_img]: Alternative text should not contain redundant words like 'image' or 'photo'.
• Avoid scrolljacking and custom scroll behavior ![Medium][medium_img]: Natural scroll behavior is preserved without custom scroll speeds, directions, or hijacked scroll events.
• Avoid sensory-only instructions ![High][high_img]: Instructions do not rely solely on sensory characteristics like color, shape, size, location, or sound.
• Avoid using deprecated ARIA roles ![Medium][medium_img]: Checks for deprecated or abstract ARIA roles to ensure long-term compatibility.
• Create accessible tooltips ![Medium][medium_img]: Tooltips are accessible to keyboard users and screen readers with proper ARIA attributes and focus handling.
• Define proper table headers ![Medium][medium_img]: Checks that data tables have proper headers
• Do not use aria-hidden on the document body ![Critical][critical_img]: Ensures the document body is not set to aria-hidden, which would hide the entire page from screen readers.
• Enable keyboard navigation for all elements ![Critical][critical_img]: All interactive elements are accessible via keyboard with logical focus order and hidden elements excluded from tab sequence.
• Ensure accesskey values are unique ![Medium][medium_img]: Checks that accesskey values are unique to avoid shortcut conflicts.
• Ensure all input fields have accessible names ![Critical][critical_img]: Checks that input fields have accessible names so screen reader users know what data each field expects.
• Ensure ARIA attributes are valid ![High][high_img]: All ARIA attributes must be valid and exist in the WAI-ARIA specification.
• Ensure ARIA roles are contained by required parent roles ![Medium][medium_img]: Checks that elements with certain roles have required parent roles
• Ensure ARIA roles contain required child roles ![High][high_img]: Elements with certain ARIA roles must contain the required child roles or the widget structure will be broken for assistive technologies.
• Ensure content remains usable without CSS ![High][high_img]: Content structure, instructions, and primary tasks remain understandable and operable when author CSS is disabled or replaced by user styles.
• Ensure dialogs have an accessible name ![Medium][medium_img]: Checks that dialog elements have accessible names to orient screen reader users.
• Ensure headings contain text ![Medium][medium_img]: All heading elements (h1-h6) must have visible, descriptive content.
• Ensure identical links have consistent destinations ![Medium][medium_img]: Links with the same text must point to the same destination or be distinguishable.
• Ensure logical focus order ![High][high_img]: Tab focus order follows the visual layout and logical reading sequence of the page.
• Ensure table headers associate with data cells ![Medium][medium_img]: Checks that table headers have associated data cells
• Ensure tables have unique accessible names ![Medium][medium_img]: Checks that data tables have unique accessible names
• Fix empty and broken links ![Medium][medium_img]: All links contain accessible text content and do not lead to broken destinations.
• Hide decorative elements from assistive technology ![Medium][medium_img]: Decorative images and visual elements are hidden from screen readers using aria-hidden or empty alt attributes.
• Implement "Skip to Content" links ![Medium][medium_img]: Checks for bypass mechanisms for keyboard navigation
• Include a skip navigation link ![High][high_img]: A skip navigation link is provided to allow keyboard users to bypass repetitive content and navigate directly to main content.
• Include required ARIA attributes for roles ![Medium][medium_img]: Checks that elements have required ARIA attributes for their roles
• Keep focused elements unobscured ![High][high_img]: Sticky headers, footers, banners, and overlays must not fully hide the element that currently has keyboard focus.
• Keep repeated help mechanisms in a consistent location ![Medium][medium_img]: When help or support mechanisms appear on multiple pages in the same flow, they stay in the same relative order so users can find them predictably.
• Link table cells to headers using IDs ![Medium][medium_img]: Checks that td headers attribute references valid th ids
• Maintain logical heading order ![Medium][medium_img]: Heading levels should follow a sequential, hierarchical order.
• Make accordions keyboard navigable ![Medium][medium_img]: Accordion components use proper ARIA attributes and keyboard interactions for screen reader accessibility.
• Make carousels accessible ![Medium][medium_img]: Carousels and sliders are accessible with pause controls, keyboard navigation, and proper ARIA attributes.
• Make drag and drop accessible ![Medium][medium_img]: Drag and drop interfaces provide keyboard alternatives and proper ARIA attributes for accessibility.
• Make links in text blocks visually distinguishable ![Medium][medium_img]: Links within blocks of text must be distinguishable from surrounding non-link text by more than color alone.
• Make modal dialogs keyboard accessible ![High][high_img]: Modal dialogs are accessible with proper focus trapping, ARIA attributes, and keyboard dismissal.
• Make notifications accessible ![High][high_img]: Toast notifications and alerts are announced to screen readers using ARIA live regions and appropriate roles.
• Make tabs keyboard navigable ![Medium][medium_img]: Tab components implement the ARIA tabs pattern with proper roles, states, and keyboard navigation.
• Manage focus during dynamic interactions ![High][high_img]: Focus is programmatically managed during dynamic interactions like modals, page transitions, and content updates.
• Match lang and xml:lang attributes ![Medium][medium_img]: The lang and xml:lang attributes on the html element must have identical values to avoid conflicting language signals across HTML and XML parsers.
• Meet minimum color contrast ratios ![High][high_img]: Text and background colors must have sufficient contrast to be readable by users with low vision or color blindness.
• Place list items within list containers ![Medium][medium_img]: List item elements (li) must always be direct children of a list container (ul, ol, or menu) to maintain valid HTML structure and correct screen reader announcements.
• Prevent data loss from session timeouts ![High][high_img]: Users are warned before session expiry, can extend time when appropriate, and can re-authenticate or resume work without losing entered data.
• Prevent seizure-triggering flashing content ![Critical][critical_img]: Content does not flash more than three times per second to prevent seizures in users with photosensitive epilepsy.
• Provide accessible authentication methods ![High][high_img]: Authentication flows avoid unnecessary cognitive tests and support assistive mechanisms such as password managers, paste, OTP autofill, and passkeys.
• Provide accessible names for all interactive elements ![High][high_img]: Checks that interactive elements have accessible names for clear navigation.
• Provide accessible names for ARIA command elements ![Medium][medium_img]: Checks that command elements like buttons and links have accessible names for screen reader support.
• Provide accessible names for buttons ![Critical][critical_img]: All buttons must have a discernible, descriptive accessible name for screen readers.
• Provide accessible names for meter elements ![Medium][medium_img]: Checks that meter elements have accessible names to provide context for measurements.
• Provide accessible names for progress bars ![Medium][medium_img]: Checks that progressbar elements have accessible names
• Provide accessible names for select elements ![Medium][medium_img]: All <select> elements must have an associated label or an accessible name to be correctly identified by screen readers.
• Provide accessible names for toggle fields ![Medium][medium_img]: Checks that toggle fields (checkbox, radio, switch) have accessible names
• Provide accessible names for tooltips ![Medium][medium_img]: Checks that tooltip elements have accessible names
• Provide accessible names for tree items ![Medium][medium_img]: All elements with role="treeitem" must have a descriptive accessible name so screen reader users can navigate hierarchical tree widgets.
• Provide alt text for image buttons ![Critical][critical_img]: Input elements of type='image' must have a descriptive alt attribute.
• Provide alternative text for objects ![Medium][medium_img]: The <object> element must contain alternative content to ensure accessibility for users who cannot view the primary content.
• Provide alternatives to parallax effects ![Medium][medium_img]: Parallax scrolling effects have reduced-motion alternatives or can be disabled by users.
• Provide audio descriptions for video ![Medium][medium_img]: Videos with important visual content include audio descriptions that narrate visual information for blind users.
• Provide captions for video content ![High][high_img]: Prerecorded video with audio must have synchronized captions. Live video must have real-time captions. This is required by WCAG 2.1 SC 1.2.2 and SC 1.2.4.
• Provide instant anchor scroll option ![Low][low_img]: Smooth scroll animations to anchor links respect motion preferences or provide an instant alternative.
• Provide sufficient touch target size ![Medium][medium_img]: Interactive elements must have large enough touch targets so users with motor impairments can activate them accurately on touchscreen devices.
• Provide titles for iframes and frames ![Medium][medium_img]: iframes and frames must have a title attribute to describe their content.
• Remove focusable elements from aria-hidden containers ![Medium][medium_img]: Ensures aria-hidden elements do not contain focusable content to avoid "ghost" focus.
• Respect reduced motion preferences ![High][high_img]: Animations respect user motion preferences, avoid seizure-triggering flashing, and include warnings for excessive motion.
• Support both portrait and landscape orientation ![High][high_img]: Content and functionality work in both portrait and landscape unless a specific orientation is essential to the activity.
• Support content reflow at 400% zoom ![Critical][critical_img]: Content reflows when zoomed to 400% without requiring horizontal scrolling or loss of functionality.
• Support text resizing to 200% ![High][high_img]: Text can be resized up to 200% without loss of content or functionality using browser settings.
• Test with screen readers ![High][high_img]: Pages must be tested with actual screen reader software (NVDA, JAWS, VoiceOver, TalkBack) to verify announcements, focus order, and widget behavior beyond what automated tools can detect.
• Use a single label for each form field ![Medium][medium_img]: Form fields should have exactly one associated element for maximum clarity.
• Use appropriate tabindex values ![Medium][medium_img]: Checks for appropriate tabindex values
• Use correct definition list structure ![Medium][medium_img]: Definition lists (<dl>) must only contain valid <dt> and <dd> elements.
• Use correct list structure ![Medium][medium_img]: Lists (ul, ol) should only contain list item elements (li) to ensure they are correctly interpreted by assistive technology.
• Use descriptive link text ![High][high_img]: Link text clearly describes the destination or purpose without relying on surrounding context.
• Use exactly one main landmark ![Medium][medium_img]: Each page must have one and only one main landmark.
• Use inclusive language ![Medium][medium_img]: Content uses inclusive, non-discriminatory language that welcomes all users regardless of ability, gender, race, or background.
• Use landmark regions correctly ![Medium][medium_img]: Proper landmark regions (main, nav, footer) help users navigate the page more efficiently.
• Use logical heading hierarchy ![Critical][critical_img]: Headings follow a sequential structure (h1 to h6) that reflects the content hierarchy without skipping levels.
• Use navigation landmark regions ![High][high_img]: Page navigation uses nav elements with proper ARIA labels to distinguish multiple navigation regions.
• Use only allowed ARIA attributes for each role ![Medium][medium_img]: Checks that ARIA attributes are allowed on their elements to ensure valid accessibility trees.
• Use semantic list elements ![Medium][medium_img]: Groups of related items use ul, ol, or dl elements so screen readers announce list context and item count.
• Use semantic table markup for screen readers ![Medium][medium_img]: Data tables use proper semantic markup with headers, captions, and scope attributes for screen reader accessibility.
• Use unique IDs for active elements ![High][high_img]: All focusable or active elements must have a unique ID attribute.
• Use unique IDs for ARIA references ![High][high_img]: IDs referenced by ARIA attributes must be unique to ensure correct accessibility relationships.
• Use valid ARIA role values ![Medium][medium_img]: Checks for valid ARIA role values
• Use valid values for ARIA attributes ![Medium][medium_img]: Checks for valid values in ARIA attributes
• Wrap definition items in a definition list ![Medium][medium_img]: Description terms (<dt>) and details (<dd>) must be contained within a <dl> element.
• Write in plain language ![Medium][medium_img]: Content uses clear, simple language that is easy to understand for users with cognitive disabilities and non-native speakers.

Back to top

SEO

94 rules. Crawlability, metadata, structured data, and search visibility rules.

Browse SEO on frontendchecklist.io

• 4XX Pages in Sitemap ![High][high_img]: Checks for sitemap URLs that return 4XX HTTP status codes, indicating broken or removed pages.
• Add a favicon to every page ![Medium][medium_img]: Checks for favicon presence and correct link element configuration
• Add disclaimers to sensitive content ![Medium][medium_img]: Checks for appropriate disclaimers on sensitive content types such as medical, legal, financial, and affiliate pages
• Add FAQPage schema markup ![Medium][medium_img]: Validates FAQPage JSON-LD structured data for question-and-answer content
• Add internal links to key pages ![Medium][medium_img]: Validates that key pages receive adequate internal links from other site pages
• Add internal links to orphan pages ![Medium][medium_img]: Detects pages with no internal links pointing to them
• Add LocalBusiness schema markup ![Medium][medium_img]: Validates LocalBusiness schema for local SEO
• Add Organization schema markup ![Medium][medium_img]: Validates Organization schema for brand presence
• Add outgoing links to dead-end pages ![Medium][medium_img]: Pages with no outgoing internal links, potentially trapping users and crawlers
• Add Product schema markup ![Medium][medium_img]: Validates Product schema for e-commerce
• Add relevant external links ![Medium][medium_img]: Validates that pages include outgoing links to authoritative external sources where appropriate
• Add Review schema markup ![Medium][medium_img]: Validates Review and AggregateRating schema on product, service, and business pages to enable star-rating rich results.
• Add share buttons to content pages ![Low][low_img]: Checks for social sharing buttons on articles, blog posts, and other shareable content pages.
• Add structured data markup ![High][high_img]: Schema.org structured data (JSON-LD) is implemented for rich search results.
• Add Twitter Card meta tags ![Medium][medium_img]: Validates Twitter (X) Card meta tags for correct card type, image dimensions, and required fields.
• Add VideoObject schema to video pages ![Medium][medium_img]: Checks for VideoObject structured data on pages containing video content to enable video rich results in Google Search.
• Audit all noindex pages ![Medium][medium_img]: Lists and reviews all pages blocked from indexing to ensure critical content is accessible.
• Audit and refine AI-generated content ![Medium][medium_img]: Detects and reviews content that appears to be primarily AI-generated to ensure quality.
• Avoid conflicting indexability signals ![Medium][medium_img]: Detects conflicting signals between robots.txt, meta robots, X-Robots-Tag headers, and canonical tags
• Avoid duplicate meta descriptions ![Medium][medium_img]: Checks for duplicate meta descriptions across the site
• Avoid keyword stuffing ![Medium][medium_img]: Detects excessive keyword repetition in content, titles, or meta tags that signals manipulative SEO
• Avoid multi-hop redirect chains ![High][high_img]: Detects multi-hop redirect chains that waste crawl budget
• Avoid nofollow on internal links ![Medium][medium_img]: Flags internal links with rel=nofollow
• Avoid nosnippet on important pages ![Medium][medium_img]: Detects pages preventing search engine snippets
• Avoid redirect chains on canonical URLs ![Medium][medium_img]: Ensures that canonical tags point directly to the final destination URL without intermediate redirects.
• Avoid thin content on key pages ![Medium][medium_img]: Checks content length on key pages to identify thin content that may underperform in search results.
• Check for broken links ![Medium][medium_img]: All links are tested and none are broken. Links redirect to intended destinations.
• Cite authoritative external sources ![Medium][medium_img]: Checks for citations to reputable external websites to back up factual claims and build trust.
• Create a comprehensive Contact page ![Medium][medium_img]: Checks for a dedicated contact page with multiple methods for users to reach out.
• Create a dedicated About page ![Medium][medium_img]: Checks for a dedicated about or company page with meaningful content.
• Create and submit an XML sitemap ![High][high_img]: An XML sitemap is available at /sitemap.xml and includes all important pages.
• Display a physical business address ![Medium][medium_img]: Checks for visible physical address information
• Display clear author bylines ![Medium][medium_img]: Checks for visible author names on content pages to establish transparency and trust.
• Do not link from HTTPS to HTTP ![Medium][medium_img]: Detects links from HTTPS pages to HTTP destinations, which trigger mixed content warnings and lose ranking signals
• Fix invalid links ![Medium][medium_img]: Detects malformed, empty, or syntactically invalid link formats on the page
• Fix malformed HTML structure ![Medium][medium_img]: Ensures that the HTML document is well-formed with correctly nested and closed tags.
• Fix or remove broken external links ![Medium][medium_img]: Detects and resolves external links that return error codes or have timed out.
• Geo Meta Tags ![Medium][medium_img]: Checks for geographic meta tags for local or regional targeting
• Highlight author credentials and expertise ![Medium][medium_img]: Checks for author bios and credentials to establish expertise and trust.
• Identify YMYL content on your site ![High][high_img]: Detects Your Money or Your Life (YMYL) content that is subject to Google's elevated E-E-A-T quality standards.
• Implement comprehensive author markup ![Medium][medium_img]: Uses structured data to provide machine-readable metadata about content authors.
• Implement valid Article structured data ![High][high_img]: Validates that articles use the correct Schema.org properties for improved search visibility.
• Implement valid BreadcrumbList schema ![Medium][medium_img]: Adds structured data to breadcrumb navigation for better site hierarchy and search appearance.
• Include indexable pages in your sitemap ![Medium][medium_img]: Checks for canonical-url, indexable pages that are missing from the XML sitemap.
• Include keywords in URL slugs ![Medium][medium_img]: Checks if URL slugs contain descriptive, keyword-relevant words instead of IDs, random strings, or vague terms.
• Keep HTML documents under crawl limits ![Medium][medium_img]: Checks HTML document size against Googlebot crawl limits
• Keep linked PDFs under 60 MB ![Medium][medium_img]: Checks linked PDF sizes against Googlebot 60MB truncation limit
• Keep NAP details consistent ![Medium][medium_img]: Checks for consistent Name, Address, Phone across site
• Keep page titles unique ![High][high_img]: Checks that the tag is unique across all pages of the site to avoid duplicate title SEO issues.
• Keep sitemap URLs on the correct domain ![Medium][medium_img]: Checks that all URLs in the sitemap belong to the same domain and protocol as the sitemap itself.
• Keep URLs concise ![Medium][medium_img]: Checks URL length for optimal crawlability and usability
• Keep XML sitemaps valid ![High][high_img]: Validates sitemap XML structure against the sitemaps.org protocol, URL limits, and encoding requirements.
• Limit unnecessary URL parameters ![Medium][medium_img]: Checks for excessive URL parameters
• Link directly to final destination URLs ![Medium][medium_img]: Detects URLs that redirect and links pointing to redirects
• Link to active social profiles ![Low][low_img]: Checks for links to the organization's social media profiles to help search engines connect the site to its social entity and build E-E-A-T signals.
• Make content easy for LLMs to parse ![Medium][medium_img]: Analyzes how well LLMs can parse and understand the content
• Make important pages indexable ![Medium][medium_img]: Identifies important pages blocked from search engine indexing by noindex, robots.txt, or other directives
• Meta Tags in Body ![High][high_img]: Detects meta tags incorrectly placed in document body
• MIME Type Validation ![Medium][medium_img]: Detects Content-Type header mismatches with file extensions
• Noindex in Sitemap ![High][high_img]: Checks for noindexed pages listed in sitemap
• OG Image Size ![Medium][medium_img]: Checks og:image meets recommended size (1200x630)
• OG URL Match ![Medium][medium_img]: Checks that og:url matches canonical URL
• Open Graph Tags ![Medium][medium_img]: Validates Open Graph meta tags for social sharing
• Optimize article link density ![Medium][medium_img]: Ensures articles have a healthy balance of internal and external links relative to their length.
• Provide clear affiliate disclosures ![Medium][medium_img]: Checks for affiliate and sponsored content disclosures to maintain transparency.
• Publish a robots.txt file ![High][high_img]: Checks if robots.txt exists at the root, is accessible, and contains valid directives.
• Publish an editorial policy page ![Medium][medium_img]: Checks for editorial and content policy pages that demonstrate site-wide trustworthiness
• Publish high-quality content ![High][high_img]: LLM-based content quality analysis for SEO
• Publish llms.txt for documentation-heavy sites ![Medium][medium_img]: Offer an optional llms.txt index that points AI tools to high-value documentation pages and, when useful, a fuller llms-full.txt companion.
• Resolve internal broken links ![High][high_img]: Detects and fixes internal links that return 404 or 5xx errors to improve user experience.
• Robots Meta Conflict ![High][high_img]: Detects pages blocked by robots.txt that also carry noindex meta tags, creating a paradox where the directive is never read.
• Schema + Noindex Conflict ![High][high_img]: Detects pages that carry rich result schema markup but are blocked from indexing via noindex or robots.txt.
• Service Area Pages ![Medium][medium_img]: Checks for properly structured service-area or location pages for businesses serving multiple geographic regions.
• Set canonical URLs for all pages ![High][high_img]: A canonical URL tag is present to prevent duplicate content issues.
• Set robots meta directives correctly ![High][high_img]: Checks robots meta tag for valid indexing directives in the page head.
• Show content freshness signals ![Medium][medium_img]: Checks for last-modified and published date signals that help Google assess content currency
• Show published and updated dates ![Medium][medium_img]: Checks for published and modified dates on content pages
• Show trust signals on key pages ![Medium][medium_img]: Checks for trust badges, certifications, client logos, testimonials, and social proof on high-conversion pages.
• Sync HTML canonical tags and Link headers ![Medium][medium_img]: Ensures consistency between HTML rel="canonical" tags and HTTP Link canonical-url headers.
• Tel & Mailto Links ![Medium][medium_img]: Validates that phone numbers use the tel: scheme and email addresses use the mailto: scheme for one-click contact on mobile devices.
• URL Special Characters ![Medium][medium_img]: Checks for problematic special characters in URL paths that can cause crawling, parsing, or canonicalization issues.
• URL Stop Words ![Low][low_img]: Flags common stop words in URL slugs that add length without improving keyword relevance.
• Use a single descriptive H1 ![Medium][medium_img]: Validates that each page has exactly one H1 tag containing a descriptive, keyword-relevant heading
• Use canonicals on paginated pages ![Medium][medium_img]: Checks that paginated pages have proper canonicals
• Use descriptive anchor text ![Medium][medium_img]: Checks for descriptive, keyword-rich anchor text that provides context for users and search engines.
• Use hyphens in URLs ![Medium][medium_img]: Checks that URL slugs use hyphens as word separators, not underscores or spaces
• Use lowercase URLs ![Medium][medium_img]: Checks that URLs are lowercase
• Use trailing slashes consistently ![Medium][medium_img]: Checks for consistent trailing slash usage across all URLs to avoid duplicate content and canonicalization issues.
• Use valid JSON-LD structured data ![Medium][medium_img]: Validates JSON-LD structured data for syntax correctness, required properties, and schema.org compliance
• Weak Internal Links ![Medium][medium_img]: Detects pages with very few dofollow internal links pointing to them, indicating poor link equity distribution and crawl discoverability.
• WebSite Search Schema ![Low][low_img]: Checks for WebSite schema with SearchAction to enable the Sitelinks Searchbox in Google Search results.
• Write a descriptive page title ![High][high_img]: Validates page title presence and length
• Write a meta description for each page ![High][high_img]: Validates meta description presence and length
• Write at a clear reading level ![Medium][medium_img]: Analyzes content readability using Flesch-Kincaid

Back to top

Security

22 rules. Headers, transport, safe linking, and frontend security rules.

Browse Security on frontendchecklist.io

• Adblock Element Hiding ![Low][low_img]: Checks for HTML elements and CSS classes that would be hidden by common adblockers, causing layout breaks or missing functionality for users with ad blocking enabled.
• Audit dependencies for known vulnerabilities ![High][high_img]: Dependencies are regularly scanned for known security vulnerabilities using automated tooling, and critical findings are remediated before deployment.
• Avoid mixed content on HTTPS pages ![High][high_img]: An HTTPS page that loads resources over HTTP has mixed content — browsers block or warn about these requests, breaking functionality and undermining transport security.
• Blocked Tracking Links ![Low][low_img]: Links and resources pointing to known tracking or advertising domains may be blocked by adblockers, breaking navigation and functionality for a significant portion of users.
• External Link Security ![Medium][medium_img]: Links that open in a new tab using target='_blank' must include rel='noopener noreferrer' to prevent the opened page from accessing the opener's window context.
• Implement a content security policy ![High][high_img]: A Content Security Policy is implemented to prevent XSS attacks and control resource loading.
• Leaked Environment Variables ![Critical][critical_img]: Checks for exposed API keys, tokens, passwords, and other secrets embedded in HTML source, JavaScript bundles, or client-accessible files.
• Link to your terms of service in the footer ![Medium][medium_img]: Websites offering services to users should publish Terms of Service and link to them from every page — this establishes the legal agreement governing use of the service.
• Prevent stack trace exposure in production error responses ![High][high_img]: Production error responses never include stack traces, internal file paths, framework internals, or other debugging detail that could aid an attacker (OWASP A09).
• Protect public forms with CAPTCHA ![Medium][medium_img]: Public forms that accept user input without authentication must include bot protection to prevent spam, credential stuffing, and automated abuse.
• Redirect HTTP to HTTPS ![Critical][critical_img]: All HTTP requests must be permanently redirected (301) to HTTPS to prevent users from accessing your site over an insecure connection.
• Secure password input fields ![High][high_img]: Password fields implement security best practices including proper autocomplete, show/hide toggle, and strength indicators.
• Serve all pages over HTTPS ![Critical][critical_img]: Every page and resource on your site must be delivered over HTTPS to protect user data in transit and enable modern browser features.
• Set a Permissions-Policy header ![Medium][medium_img]: The Permissions-Policy header lets servers restrict which browser features (camera, microphone, geolocation, etc.) can be used in a page or its embedded iframes.
• Set a Referrer-Policy header ![Medium][medium_img]: The Referrer-Policy header controls how much referrer information is sent when navigating from your site to another, protecting user privacy and preventing leaking sensitive URL parameters.
• Set an HSTS header ![High][high_img]: The Strict-Transport-Security response header tells browsers to always use HTTPS for your domain, preventing protocol downgrade attacks and cookie hijacking.
• Set an X-Frame-Options header ![High][high_img]: The X-Frame-Options header controls whether your page can be embedded in an iframe, frame, or object — preventing clickjacking attacks.
• Set Secure, HttpOnly, and SameSite flags on session cookies ![High][high_img]: All session and authentication cookies are issued with the Secure, HttpOnly, and an appropriate SameSite flag to prevent interception, JavaScript exfiltration, and cross-site request forgery.
• Set X-Content-Type-Options: nosniff ![High][high_img]: The X-Content-Type-Options: nosniff header prevents browsers from MIME-sniffing a response away from the declared Content-Type, blocking a class of drive-by download and XSS attacks.
• Store authentication tokens securely ![High][high_img]: Sensitive authentication tokens are stored in httpOnly cookies rather than localStorage or sessionStorage to prevent theft via cross-site scripting attacks (OWASP A07).
• Submit forms over HTTPS ![Critical][critical_img]: All HTML form actions must point to HTTPS URLs to ensure form data is encrypted in transit and cannot be intercepted by network attackers.
• Use COOP, COEP, and CORP for cross-origin isolation when needed ![Medium][medium_img]: Sensitive or high-capability applications use COOP, COEP, and CORP deliberately, audit third-party embeds, and verify cross-origin isolation in the browser before relying on it.

Back to top

Images

25 rules. Formats, responsive delivery, optimization, and media quality rules.

Browse Images on frontendchecklist.io

• Compress images without quality loss ![High][high_img]: All images are compressed without significant quality loss to reduce file sizes.
• Fix broken images ![High][high_img]: No images return 404 errors or display broken-image icons to users.
• Handle image loading errors gracefully ![Low][low_img]: Broken images are handled gracefully with fallback images or placeholder content.
• Implement responsive images with srcset ![High][high_img]: Images use srcset and sizes attributes for responsive delivery across devices.
• Keep image file sizes within recommended limits ![High][high_img]: Individual image files are compressed to reasonable sizes to avoid wasted bandwidth and slow load times, especially on mobile networks.
• Lazy load offscreen images ![High][high_img]: Images below the visible viewport use loading="lazy" to defer download until the user scrolls near them, reducing initial page load time.
• Manage inline SVG size and complexity ![Medium][medium_img]: Large or complex SVGs inlined in HTML are extracted to external files or components, preventing them from bloating the HTML document and blocking parsing.
• Optimise images for faster loading ![High][high_img]: All images are compressed and metadata-stripped before deployment, removing unnecessary bytes without visible quality loss.
• Optimize all images for web ![High][high_img]: Images are optimized with appropriate formats, compression, and modern techniques.
• Optimize SVG files ![Medium][medium_img]: SVG files are optimized with SVGO to remove unnecessary metadata and reduce size.
• Prioritize loading critical images ![High][high_img]: Hero and above-the-fold images are preloaded with high fetch priority for LCP.
• Provide meaningful alt text for images ![Critical][critical_img]: Every informative image has a descriptive alt attribute; decorative images use alt="" to be ignored by screen readers.
• Serve images at the correct display size ![High][high_img]: Images are not significantly larger than their display dimensions—serving a 2000px image for a 400px container wastes bandwidth and hurts LCP.
• Serve images from a CDN ![High][high_img]: Images are served from a CDN with automatic optimization, resizing, and format conversion.
• Set explicit width and height on images ![High][high_img]: All elements have explicit width and height attributes so browsers can reserve space before the image loads, preventing layout shift.
• Support high-DPI retina displays ![Medium][medium_img]: High-resolution images (2x, 3x) are provided for retina and high-DPI displays.
• Use and for image captions ![Medium][medium_img]: Images with visible captions are wrapped in with a child, creating a semantic association between image and caption.
• Use with an fallback ![High][high_img]: Every element contains a required fallback as its last child, ensuring images display in all browsers including those that don't support .
• Use AVIF format for modern browsers ![Medium][medium_img]: Images support AVIF format for superior compression with proper browser fallbacks.
• Use descriptive image filenames ![Low][low_img]: Image filenames are descriptive and human-readable, using lowercase letters, hyphens as separators, and meaningful words that reflect the image content.
• Use image sprites where appropriate ![Low][low_img]: Small images and icons use sprites or SVG to reduce HTTP requests.
• Use modern image formats (WebP, AVIF) ![High][high_img]: Images are served in modern formats (WebP or AVIF) instead of legacy JPEG/PNG where browser support allows, reducing file size without visible quality loss.
• Use progressive JPEG encoding ![Low][low_img]: JPEG images use progressive format for better perceived loading performance.
• Use srcset for responsive images ![High][high_img]: Images wider than 100px use the srcset attribute to offer multiple resolution variants, letting the browser download the optimal size for the user's viewport and device pixel ratio.
• Use WebP format with fallbacks ![High][high_img]: Images are served in WebP format with fallbacks for older browsers.

Back to top

Testing

13 rules. Unit, integration, E2E, monitoring, and quality assurance rules.

Browse Testing on frontendchecklist.io

• Enforce performance budgets in CI ![Medium][medium_img]: Define measurable performance thresholds (bundle size, Lighthouse scores, Core Web Vitals) and fail CI builds automatically when they're exceeded.
• Follow mocking best practices ![Medium][medium_img]: Use mocks strategically to isolate units under test without over-mocking.
• Implement consumer-driven contract testing for API boundaries ![Medium][medium_img]: Consumer-driven contract tests (Pact) define and verify the API contracts between the frontend consumer and backend provider, catching integration mismatches before they reach production.
• Implement end-to-end testing ![High][high_img]: Use E2E testing frameworks like Playwright or Cypress to test critical user journeys.
• Include accessibility testing ![High][high_img]: Automate accessibility testing with tools like axe-core, jest-axe, or Playwright's accessibility testing.
• Integrate real-time error monitoring in production ![High][high_img]: A real-time error monitoring service captures, groups, and alerts on unhandled exceptions and promise rejections in production so issues are discovered before users report them.
• Maintain test coverage thresholds ![Medium][medium_img]: Set and enforce minimum code coverage thresholds to ensure adequate test coverage.
• Test across all major browsers ![High][high_img]: Website works correctly across major browsers (Chrome, Firefox, Safari, Edge).
• Test on real mobile devices and viewports ![High][high_img]: Verify your application on real mobile devices and browser DevTools device emulation to catch touch interaction issues, viewport bugs, and mobile-specific rendering problems.
• Use mutation testing to measure how well tests detect bugs ![Medium][medium_img]: Run Stryker mutation testing on critical business logic to verify that your test suite will actually catch real bugs, not just achieve line coverage.
• Use visual regression testing ![Medium][medium_img]: Capture screenshots of components and pages, then automatically compare them against approved baselines to detect unintended visual changes before they reach production.
• Write integration tests for key workflows ![High][high_img]: Test how multiple units of code work together — API routes with their database queries, form submissions with validation, and component trees with their state management.
• Write unit tests ![High][high_img]: Critical functionality has unit tests with good coverage for reliability.

Back to top

Privacy

5 rules. Consent, tracking, retention, and user data rights rules.

Browse Privacy on frontendchecklist.io

• Avoid third-party cookies ![Medium][medium_img]: Third-party cookies set by external domains track users across sites without their knowledge. Modern browsers are phasing them out, and regulations like GDPR and CCPA require consent before setting them.
• Collect only the minimum personal data necessary ![Medium][medium_img]: Limit data collection to only what is strictly required for the stated purpose, in line with GDPR Article 5(1)(c) data minimisation principles.
• Implement a user-facing data deletion mechanism ![Medium][medium_img]: Provide users with a clear way to request deletion of their personal data, fulfilling GDPR Article 17 (right to erasure / right to be forgotten).
• Link to your privacy policy in the footer ![High][high_img]: Websites that collect any personal data must publish a privacy policy and link to it prominently — this is a legal requirement under GDPR, CCPA, and most other privacy regulations.
• Show a cookie consent notice ![High][high_img]: Websites that set non-essential cookies must obtain prior, informed user consent under GDPR, CCPA, and similar privacy regulations before cookies are placed.

Back to top

Internationalization

5 rules. Localization, RTL, language handling, and translation workflow rules.

Browse Internationalization on frontendchecklist.io

• Add hreflang tags for multilingual sites ![Medium][medium_img]: Hreflang tags indicate language and regional variations for multilingual sites.
• Design UI components to accommodate text expansion from translation ![Medium][medium_img]: Ensure that layouts use flexible sizing so that translated text — which can be 30–50% longer than English — does not overflow, clip, or break the UI.
• Handle plural forms with Intl.PluralRules or ICU MessageFormat ![Medium][medium_img]: Select the correct grammatical plural category for every language using Intl.PluralRules or an ICU-aware i18n library instead of simple singular/plural branching.
• Use Intl APIs for currency, number, and date formatting ![Medium][medium_img]: Format monetary values, numbers, and dates using the browser's built-in Intl.NumberFormat and Intl.DateTimeFormat APIs instead of manual string manipulation.
• Use locale-neutral images and provide cultural overrides when needed ![Low][low_img]: Default to abstract, culture-neutral icons and illustrations, and supply locale-specific ima