# Website best-practices stack checklist

Version: November 7, 2026. For a small business owner and the person who maintains the website.
Companion: https://jwatte.com/blog/best-practice-websites-wcag-aeo-geo-mcp-small-business/

Use the first section as your one-page working checklist. The following sections supply examples and a measurement sheet. Mark each check PASS, FAIL or UNKNOWN, with the public page address and UTC read time. A missing measurement is UNKNOWN. A passing machine check does not establish accessibility, search visibility, security or sales.

## One-page checklist

| Layer | Check on your own website | Free jwatte check | Done when |
|---|---|---|---|
| WCAG: accessibility guidance | Check language, title, image alternatives, field labels, headings, landmarks, skip link and zoom. Use the keyboard and read error messages. | [WCAG Accessibility Audit](https://jwatte.com/tools/wcag-accessibility-audit/) | Machine findings are reviewed and a person can complete the important task with keyboard and enlarged text. |
| SEO: helping search understand pages | Check descriptive titles, useful descriptions, preferred page addresses, main headings, HTTPS, mobile layout and sitemap contents. Read robots.txt for unintended restrictions. | [Mega Analyzer](https://jwatte.com/tools/mega-analyzer/) in passive mode | Your priority pages are readable and their titles, links and sitemap agree. |
| AEO: making answers explicit | Put services, location or service area, contact details, hours and genuine questions in visible text. Match structured data to that text. | [Schema Validator](https://jwatte.com/tools/schema-validator/) | Relevant facts agree across the page and its machine-readable description. |
| GEO: making information useful to AI answers | Read the initial HTML, check source links and truthful update dates, review crawler preferences, and consider a short llms.txt index. | [LLMs.txt Validator](https://jwatte.com/tools/llms-txt-validator/) and [AI Crawler Access Auditor](https://jwatte.com/tools/ai-crawler-access-auditor/) | Public facts can be read without running page scripts; crawler choices are intentional. |
| MCP: connecting an assistant to tools | If useful, document a connector's purpose, inputs, limits, privacy and human handoff. Compare its public listing and discovery files with the documentation. | [Agent Endpoint Inspector](https://jwatte.com/tools/agent-endpoint-inspector/) in passive mode | Published descriptions match the service you actually maintain. |
| Security basics | Review HTTPS response headers for HSTS, CSP and X-Content-Type-Options; check a monitored security contact and expiry. | [Security Headers](https://jwatte.com/tools/security-headers-audit/) | A developer has reviewed applicable protections and the contact route works. |

WCAG means Web Content Accessibility Guidelines. SEO, AEO and GEO mean search engine optimization, answer engine optimization and generative engine optimization. AEO and GEO are planning labels here, not certifications. MCP is Model Context Protocol: a way for an assistant to use a service's named functions, called tools. A connector supplies that connection.

The [MCP Server Audit](https://jwatte.com/tools/mcp-server-audit/) is an additional GET-based checker for your own authorized service. It also reads endpoint addresses, including /mcp and /mcp/tools, so it has a broader scope than a files-only review. Keep the Inspector's optional protocol checks off for passive work. None of these checks proves that a booking, payment or other transaction succeeds. Follow site permissions and robots.txt; do not contact someone else's MCP service to test it.

## Priority plan

These are planning estimates, not measured completion times. Repair work depends on the platform and existing defects.

- **Week 1, owner and web person:** spend an initial half day checking the home page and the page that produces enquiries. Correct wrong contact details, unclear offers, broken links, unlabeled fields and keyboard obstacles. Record a baseline before changing copy. Done when the important path works and remaining issues have an owner.
- **Month 1, web person and developer:** allow one to several focused sessions for titles, sitemap, structured answers, matching JSON-LD, readable HTML and header configuration. Add source links and review dates where facts change. Done when the page and markup agree and any regression is corrected.
- **Quarter 1, owner and developer:** first spend a short discovery session deciding whether customers need a connector. A connector is a separate development and maintenance project, not a fixed afternoon task. If justified, publish documentation and accurate privacy terms, perform authorized tests, then maintain listings. Add llms.txt only if someone will keep it accurate. Done when the supported customer task and ongoing responsibility are clear.

HSTS asks browsers to use HTTPS. CSP, or Content Security Policy, restricts permitted page resources. X-Content-Type-Options with nosniff tells browsers not to reinterpret a response's declared type. Their presence alone does not establish correct configuration. Have your developer assess the actual site before changing policy.

## Original copy-ready examples

These examples were written for this kit. Replace all example names, addresses, hours, links and dates with verified business facts before publishing. The examples are templates, not claims about an existing business. Publishing changes your website; review the completed text first.

### llms.txt starter

Save as public plain text at https://example.com/llms.txt. Keep a short list of useful public pages. Include the connector link only if it exists. This is an optional proposed convention. Google's current guidance says llms.txt does not affect Google Search visibility or rankings; it is not a requirement for search inclusion. See sources below.

```markdown
# Example Repair Shop

> Public service information for Example Repair Shop. Current details are on the linked business pages.

This index describes public information. Requesting service does not reserve an appointment.

## Business information
- [Services](https://example.com/services/): Work offered and service area.
- [Contact and hours](https://example.com/contact/): Current contact routes and opening hours.
- [Questions](https://example.com/questions/): Answers to common customer questions.

## Connector
- [Connector guide](https://example.com/connect/): Supported questions, limits and human handoff.
- [Privacy](https://example.com/privacy/): Actual data handling and support route.
```

### robots.txt AI preference section

Merge this section into your existing robots.txt only after reviewing existing groups. This example permits the uses controlled by Google-Extended for public pages. It repeats the example private-path exclusions because a specific group does not inherit the wildcard group's rules. Replace those paths with your actual policy and protect private information with authentication.

```text
# AI use preference for public business information.
User-agent: Google-Extended
Disallow: /account/
Disallow: /admin/
Allow: /
```

Google-Extended is a policy token for specified Gemini training and grounding uses. It is not a separate browser identity and does not control Google Search inclusion or rankings. If your policy rejects those uses, replace that entire group with a Google-Extended group containing Disallow: /. Each other provider needs its own current documented token and a deliberate choice. Robots instructions are voluntary crawl controls, not authorization or a security barrier. Do not delete your existing search-crawler rules or sitemap declaration.

### LocalBusiness JSON-LD

JSON-LD is a JSON description attached to a page. Give this object to your web person to place in the site's structured-data field. Use LocalBusiness only for a real local business. Use Organization instead for a suitable organization without local-business details, removing inapplicable fields. This example's hours and address are fictitious and must be replaced or omitted.

```json
{
  "@context": "https://schema.org",
  "@type": "LocalBusiness",
  "@id": "https://example.com/#business",
  "name": "Example Repair Shop",
  "url": "https://example.com/",
  "description": "Repair services described on our public services page.",
  "address": {
    "@type": "PostalAddress",
    "streetAddress": "123 Example Street",
    "addressLocality": "Example City",
    "addressRegion": "ID",
    "postalCode": "00000",
    "addressCountry": "US"
  },
  "openingHoursSpecification": {
    "@type": "OpeningHoursSpecification",
    "dayOfWeek": ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday"],
    "opens": "09:00",
    "closes": "17:00"
  }
}
```

Publish only facts visitors can verify on the page. Do not invent reviews, ratings, prices, credentials, service areas or a public street address. A home-based business should make an appropriate privacy decision before exposing an address.

### FAQPage JSON-LD

Publish the exact question and answer visibly on your questions page before adding the matching object. This illustrative answer assumes requests are reviewed before an appointment is confirmed; change both copies to your actual process. FAQPage markup does not guarantee an AI citation. Google's current documentation says FAQ rich results are no longer shown in Search.

```json
{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "@id": "https://example.com/questions/#faq",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "Does sending a service request confirm an appointment?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. Our team reviews your request and contacts you to confirm an available appointment."
      }
    }
  ]
}
```

### security.txt

Serve this as UTF-8 text/plain at https://example.com/.well-known/security.txt over HTTPS. Replace the mailbox and canonical address. Choose a future expiry within a year and schedule renewal before it expires. The example expiry is a sample date, not an instruction to keep stale information. Include a policy link only after publishing a real disclosure policy.

```text
Contact: mailto:security@example.com
Expires: 2027-05-01T00:00:00Z
Canonical: https://example.com/.well-known/security.txt
Preferred-Languages: en
```

This contact file does not grant permission to test or attack a service. Confirm that someone monitors the completed contact address.

## Measurement sheet and revenue

Use aggregate counts. Add a generic source tag such as source=connector to links you control; never put a person's identity or sensitive query in a URL. An optional fixed-choice "How did you find us?" field can include Search, AI assistant, Recommendation and Other without free text. Use existing call attribution only within its current consent and privacy arrangements; do not enable recordings or collect new caller data for this exercise.

| Week and change | Aggregate source visits | Completed enquiries | Completed sales | Notes and unknowns |
|---|---|---|---|---|
| Baseline: [period] | [count or unknown] | [count] | [count] | [season, campaign, missing attribution] |
| After: [period] | [count or unknown] | [count] | [count] | [same definitions and comparable period] |

Keep a separate issue register: public URL; UTC read time; layer; check; PASS/FAIL/UNKNOWN; evidence; owner; next review date. Do not put personal data or internal system details in a shared copy.

An accessible contact form and clear service information can remove obstacles to enquiries. Many other changes have indirect effects. Compare equivalent periods and record promotions, staffing or seasonal changes. A higher checklist score does not prove additional sales, and a before/after change alone does not establish causation. Leave unobserved attribution unknown rather than assigning it to AI.

## Validation and sources

The two JSON examples passed JSON.parse. The llms.txt example was checked for its heading, summary and HTTPS link structure. The robots example was parsed and checked for the intended public/private path behavior. The security.txt example was checked for contact URI, canonical HTTPS URL, field structure and a parseable future expiry. These syntax checks do not validate your substituted business facts or a production installation.

Primary sources read directly on November 7, 2026; times are UTC:

- [W3C WAI preliminary accessibility checks](https://www.w3.org/WAI/test-evaluate/preliminary/), 21:06:42. Initial checks cover only part of accessibility evaluation.
- [Google SEO Starter Guide](https://developers.google.com/search/docs/fundamentals/seo-starter-guide), 21:06:44. Search basics and useful content.
- [Google Search documentation updates](https://developers.google.com/search/updates#removing-faq-rich-result), 21:06:47. FAQ rich results removed; June 15 clarification on llms.txt and Search visibility.
- [Google common crawlers, Google-Extended](https://developers.google.com/crawling/docs/crawlers-fetchers/google-common-crawlers#google-extended), 21:06:49. The policy token's scope and distinction from Search.
- [Schema.org LocalBusiness](https://schema.org/LocalBusiness), 21:11:41. Vocabulary for local business facts.
- [llms.txt proposal](https://llmstxt.org/), 21:06:53. Suggested Markdown format and purpose.
- [RFC 9116: security.txt](https://www.rfc-editor.org/rfc/rfc9116.html), 21:06:56. Contact, expiry, location and no implied testing permission.
- [RFC 9309: robots exclusion protocol](https://www.rfc-editor.org/rfc/rfc9309.html), 21:06:58. Group selection and crawl rules.
- [Schema.org FAQPage](https://schema.org/FAQPage), 21:11:43. Vocabulary for a page of questions and their answers.
- [OWASP Secure Headers Project: response headers](https://secure-headers-project.owasp.org/response-headers/), 21:12:40. Security header purposes and configuration considerations.

Tool descriptions were checked against jwatte's current tool catalog and implementation on November 7, 2026. Use the tools for evidence and follow their stated limits; a generated suggestion still needs human review.