Website audit glossary: SEO, performance and AX terms
Short definitions of the terms in squirrelscan reports and rule pages, from canonical URL to llms.txt, each linked to the rules that check it.
This glossary defines the terms you meet in squirrelscan reports and on the rule pages: crawling and indexing, page speed, security headers, accessibility and agent experience (AX). Each entry links to the rules that check it, and the rule page has the details and the fix.
A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · R · S · T · U · V · W · X · Y
A
Accessible name
The name assistive technology announces for an element, computed from its content, label, aria-label or aria-labelledby.
Also called: aria-label.
Checked by aria-label: which elements need one and how to check, Accessible names for buttons: what counts and how to check, Input fields with no accessible name, ARIA and native, Command roles: buttons, links and menu items need names, Dialog accessible name: role=dialog and the dialog element, Dropdowns with no accessible name: naming a select, iframe title: naming embedded frames for screen readers, Visible label missing from the accessible name, Accessible name for a meter element and role=meter, Accessible name for a progress bar and role=progressbar, Checkboxes, radios and switches with no accessible name, role=tooltip with no content: what to check, role=treeitem: naming every node in a tree, Tables sharing a name, and tables with none.
Ad blocker filter lists
Community-maintained rule lists (EasyList, EasyPrivacy) that ad and tracker blockers use to hide elements and block requests.
Also called: EasyList.
Checked by Adblock cosmetic filters: classes that get hidden, Requests ad blockers stop: links and resources on EasyList, EasyPrivacy matches: analytics that silently does not run.
Affiliate disclosure
A clear statement that a page earns commission from links, required by the FTC in the US and similar rules elsewhere.
Checked by Affiliate disclosure: detecting affiliate links without one.
Agent experience (AX)
How well a site serves AI agents that read it, find their way around it and act on it, the way UX serves people.
Also called: AX.
Checked by Content that needs JavaScript: invisible to raw-HTML agents, Text to HTML ratio: the token cost of a page for an agent, Accept: text/markdown: serving Markdown to AI agents, AI crawlers in robots.txt: which bots you block, by class, Blocking AI agents at the edge: what robots.txt hides, llms.txt: what the file is and how squirrel validates it, AGENTS.md: the paths squirrel probes and what counts, MCP and A2A manifests under .well-known: what squirrel finds, Content-Signal in robots.txt: search, ai-input, ai-train, api-catalog and OpenAPI: how an agent finds your API.
AGENTS.md
A Markdown file of instructions for coding agents working in a repository or against a docs site.
Checked by AGENTS.md: the paths squirrel probes and what counts.
AI crawler
A bot that fetches pages for AI companies, in three classes: training crawlers, AI search indexers and user-triggered fetchers, each with its own user-agent token.
Also called: GPTBot, ClaudeBot, Common Crawl.
Checked by AI crawlers in robots.txt: which bots you block, by class, Blocking AI agents at the edge: what robots.txt hides, robots.txt: what to put in it and how squirrel checks it, Common Crawl and Wayback: is your site in the archives.
AI-generated content
Text written by a language model; Google’s position is that how content is made matters less than whether it is helpful. The related rule is retired and does not run.
Checked by AI content detection: why this rule is retired.
Alt text
The alt attribute that gives an image a text alternative for screen readers, failed loads and search engines.
Checked by Missing alt attribute: what an empty alt means, Redundant alt text: image of, filenames and captions, input type=image without alt: an unnamed submit button, object elements with no alternative content.
Anchor text
The visible, clickable text of a link, which tells readers and search engines what the target is about.
Checked by Empty and generic anchor text: click here and icons, Link text: why ‘click here’ fails and what to use, Identical link text pointing at different pages.
ARIA
Accessible Rich Internet Applications: roles, states and properties that describe custom widgets to assistive technology.
Also called: WAI-ARIA.
Checked by Invalid ARIA role values and how to check them, Invalid aria-* attribute names, aria-labeledby included, Invalid ARIA attribute values and the types they need, ARIA attributes that are not allowed on an element, Required ARIA attributes for a role, and what is missing, ARIA roles that require particular child roles, ARIA roles that require a particular parent role, Deprecated and abstract ARIA roles, and what to use instead, aria-hidden on body or html: what it breaks, Focusable elements inside aria-hidden: the tab trap, ARIA references pointing at duplicate or missing ids, role=text with focusable children: why it breaks.
Article schema
Article, NewsArticle or BlogPosting structured data with headline, dates, author and publisher.
Checked by Article schema: headline, author and datePublished checks, An author who is only a name string is not an entity, Your pages disagree about who publishes this site.
Author byline
The visible author name on an article, ideally linked to an author page and matched by an author entity in structured data.
Checked by Author bylines on content pages: what share carry one, Author expertise: bio pages and Person schema, Author attribution: schema, rel=author and visible bylines, An author who is only a name string is not an entity.
B
Broken link
A link whose target answers with an error, does not resolve, or is malformed.
Also called: dead link.
Checked by Broken internal links: 404s inside your own site, Broken external links: link rot on pages you cannot fix, Cloud dead-link checking: the shared external link cache, Invalid links: hrefs that do not parse as a URL, Broken anchor links: #fragments that point at nothing, Broken images: empty and placeholder src attributes.
C
Canonical URL
The URL a page declares, with <link rel="canonical"> or a Link header, as the preferred address for its content.
Also called: rel=canonical.
Checked by rel=canonical: presence, absolute form and self-reference, Link rel=canonical header vs the HTML tag: the mismatch, Canonicals in two forms: www, scheme and trailing slash, Canonical URL resolves through a redirect: how to spot it, Pagination canonicals: why page 2 is not page 1, og:url versus canonical: why they should be the same URL.
Captions
Synchronised text of a video’s dialogue and sounds, supplied as a <track kind="captions"> file.
Checked by Video captions: track elements and embedded players, Video captions: the track element and why it is required.
Character encoding
The mapping from bytes to characters (normally UTF-8) declared in the Content-Type header or a meta charset tag; a mismatch produces mojibake.
Also called: charset, mojibake.
Checked by meta charset UTF-8: where it goes and what squirrel checks, Mojibake: ’ and other encoding corruption in page text.
Client-side redirect
A redirect done in the page (meta refresh or JavaScript) rather than with an HTTP 3xx response.
Also called: meta refresh.
Checked by meta http-equiv=refresh: redirects and auto-refresh, Script URL redirects: a 3xx in front of every script load.
Client-side rendering
Building page content in the browser with JavaScript; agents and many fetchers that do not run JavaScript see an empty page.
Also called: JavaScript rendering.
Checked by Content that needs JavaScript: invisible to raw-HTML agents, Audits that need a browser: what a static crawl cannot see.
Cloaking
Serving search engines or particular user agents different content from what visitors see, a Google spam policy violation.
Also called: hidden text and links.
Checked by Cloaking: showing Googlebot a different page, Hidden text and links: what Google’s spam policy covers.
Color contrast ratio
The luminance ratio between text and its background; WCAG AA asks for 4.5:1 for body text and 3:1 for large text.
Checked by Color contrast: the 4.5:1 rule and how to check it, Links in a paragraph told apart by color alone.
Content freshness
How current a page is and how consistently it says so: visible dates, dateModified, sitemap lastmod and copyright year.
Checked by Freshness signals: the dates a page publishes about itself, datePublished and dateModified across content pages, Visible date disagrees with schema: which date is wrong, Footer copyright year behind the current year, Sitemap lastmod disagrees with the page’s dateModified.
Content gap analysis
Finding the topics and queries a site’s audience searches for that the site does not yet cover. The related rules are disabled and do not run.
Also called: keyword gap.
Checked by Content gaps: topic clusters your site does not cover, Keyword gaps: terms competitors rank for and you do not.
Content Security Policy (CSP)
A response header listing where a page may load scripts, styles, frames and other resources from, limiting what injected code can do.
Checked by Content-Security-Policy: what to set and how to check it, CSP blocks your own scripts, frames and analytics endpoints.
Content Signals
Content-Signal lines in robots.txt that state whether content may be used for search, AI input or AI training.
Checked by Content-Signal in robots.txt: search, ai-input, ai-train.
Cookie attributes
The Secure, HttpOnly and SameSite flags on Set-Cookie that limit where a cookie is sent and whether scripts can read it.
Also called: Secure, HttpOnly, SameSite.
Checked by Cookie flags: Secure, HttpOnly and SameSite on Set-Cookie, Third-party cookies: which external domains a page loads.
Cookie consent
The banner and mechanism that asks visitors before setting non-essential cookies, as GDPR and ePrivacy require in the EU.
Also called: Google Consent Mode.
Checked by Cookie consent banner: detecting a consent mechanism, Google Consent Mode v2: the four consent parameters.
Core Web Vitals
Google’s three user-experience metrics: LCP for loading, INP for responsiveness and CLS for visual stability, judged at the 75th percentile of real visits.
Checked by LCP image not preloaded: what squirrel counts as a hero, Third-party scripts and INP: what squirrel counts per page, Images without width and height: the CLS risk squirrel finds, Audits that need a browser: what a static crawl cannot see.
Crawl budget
The number of URLs a search engine is willing and able to crawl on a site in a given time, set by crawl capacity and crawl demand.
Checked by Redirect chains: when one hop turns into three, 4XX pages in sitemap: dead URLs you are still submitting, Soft 404: error content served with an HTTP 200 status, URL parameters: how many is too many, and what to do, Links pointing at redirecting URLs: the hop on every click.
Cumulative Layout Shift (CLS)
A score for how much visible content moves unexpectedly while the page is in use; good is 0.1 or less.
Checked by Images without width and height: the CLS risk squirrel finds, Image width and height attributes: preventing layout shift, font-display swap: the @font-face rule squirrel looks for.
D
DOM size
The number and depth of elements in a page’s document tree; large DOMs slow style calculation and interactions.
Checked by Large DOM: node count, depth and children per element.
Doorway page
A page made to rank for a query and funnel visitors elsewhere, often many near-identical pages per keyword or city.
Checked by Doorway page: injected affiliate spam on a legitimate site, Service area pages: the location URLs squirrel looks for.
Duplicate content
The same or near-identical content reachable at more than one URL, or repeated titles and descriptions across pages.
Checked by Duplicate title tags: the same title on several pages, Duplicate meta descriptions across pages, Duplicate page titles: the site-wide uniqueness check, rel=canonical: presence, absolute form and self-reference, Trailing slash: /page and /page/ are two different URLs, Uppercase in a URL: the duplicate content it creates, URL parameters: how many is too many, and what to do.
E
E-E-A-T
Experience, expertise, authoritativeness and trustworthiness: the qualities Google’s quality raters are told to assess, with trust at the centre.
Also called: EEAT.
Checked by Author bylines on content pages: what share carry one, Author expertise: bio pages and Person schema, About page: what it establishes and how squirrel finds it, Contact page: finding it and counting the contact methods, Authoritative citations: sources a reader can check, Trust signals: reviews, testimonials and social proof, Editorial policy: publishing how the content gets made, Authority signals: an AI read of authorship and citations.
Entity
A thing a site describes in structured data, such as an organization, person or product, identified across pages so search engines and agents can tell it is one thing.
Checked by One organization, or sixty? Entities declared without an @id, A business with nothing to attach its reputation to, Your organization is not connected to anything that corroborates it, The same entity, two different logos, An Organization on one page, a LocalBusiness on another, An @id that nothing points at.
F
FAQ schema
FAQPage structured data marking up question-and-answer pairs; Google now shows FAQ rich results only for a narrow set of sites.
Also called: FAQPage.
Checked by FAQPage schema: mainEntity, Question and acceptedAnswer.
fetchpriority
An HTML attribute (high, low, auto) that hints how urgently the browser should fetch an image, script or link.
Checked by fetchpriority=‘high’: the LCP image hint squirrel checks.
font-display
The @font-face descriptor (swap, optional, fallback) that decides what text shows while a web font loads.
Also called: web font loading.
Checked by font-display swap: the @font-face rule squirrel looks for, Google Fonts blocking render: the font CSS squirrel flags.
Form labels
The <label> or accessible name tied to each form control, plus autocomplete tokens, so people know what to enter.
Checked by Form labels: which inputs need one and how to check, One control, two labels: why multiple labels confuse, autocomplete: the right token for every form field, Input type, enterkeyhint and novalidate on forms, Inputs that block paste, and why that fails users.
Fragment link
A link to an id within a page (#section); it is broken when no element on the target page carries that id.
Also called: jump link, #anchor.
Checked by Broken anchor links: #fragments that point at nothing.
G
Generative engine optimization (GEO)
Making content more likely to be retrieved, cited and quoted by AI answer engines; the term comes from a 2023 research paper.
Also called: GEO, AEO.
Checked by AI crawlers in robots.txt: which bots you block, by class, Content that needs JavaScript: invisible to raw-HTML agents, llms.txt: what the file is and how squirrel validates it, LLM parsability score: what it measures and how to raise it, Invalid JSON-LD syntax: what breaks it and how to fix, Blocking AI agents at the edge: what robots.txt hides.
Geo meta tags
Legacy geo.region, geo.placename and geo.position meta tags that state a page’s location; not to be confused with GEO, generative engine optimization.
Also called: geo.position, ICBM.
Checked by geo.placename: what geo meta tags do and who reads them.
Googlebot file size limit
The byte limit after which Googlebot stops reading a fetched HTML file or PDF; content past it is not indexed.
Checked by HTML document size: when a page is too big to crawl fully, PDF size: large linked documents and what gets indexed.
GraphQL introspection
The GraphQL feature that returns the full schema on request; left on in production it maps the API for attackers.
Checked by GraphQL introspection in production: what an open schema exposes, GraphQL mutations over GET: why they open the door to CSRF.
H
Hacked site signals
The traces a compromise leaves on a site: injected pages off the theme, phishing kits, obfuscated scripts and known malicious URLs.
Also called: SEO spam, injected pages.
Checked by Kit signature: matching a page against known phishing kits, Obfuscated inline script: spotting an injected payload, Known malicious URL: checking against threat feeds, Template discontinuity: a page that is not on your theme, Hidden orphan page: reachable but linked from nowhere, Doorway page: injected affiliate spam on a legitimate site, Brand impersonation: a sign-in page that is not the brand’s, Fake authentication overlay: full-screen login iframes.
Heading hierarchy
The nesting of h1 to h6 headings that gives a page its outline for readers, screen readers and parsers.
Also called: H1 tag.
Checked by Skipped heading levels: h1 to h3 and other outline problems, Heading order: why skipping from h1 to h3 matters, Empty headings: what counts as empty and how to check, Missing or multiple H1: what squirrel expects on a page.
hreflang
Link annotations that tell search engines which language or regional versions of a page exist, with x-default as the fallback.
Also called: x-default.
Checked by hreflang: x-default and the self-referencing tag.
HSTS
The Strict-Transport-Security header that tells browsers to use only HTTPS for a host for a set time.
Also called: Strict-Transport-Security.
Checked by HSTS: what Strict-Transport-Security needs to be valid.
HTML validity
Whether the markup parses as intended: closed elements, head-only tags in the head, and no raw markup printed as text.
Also called: doctype.
Checked by Malformed HTML: doctype, nesting and deprecated tags, Meta tags in the body: why they are silently ignored, Literal bold on the page: markdown that never rendered, Doctype must be declared first: what it means and the fix.
HTTP caching
Response headers (Cache-Control, ETag, Expires) that let browsers and CDNs reuse a response instead of fetching it again.
Also called: Cache-Control.
Checked by Cache-Control on a page: what squirrel reads and expects, Weak caching across a site: freshness, validators, gzip.
HTTP compression
Compressing text responses (HTML, CSS, JS, JSON) with gzip, Brotli or zstd, signalled by Content-Encoding.
Also called: gzip, Brotli.
Checked by No compression detected: gzip and Brotli on the response, Uncompressed CSS and JS: assets served without gzip.
HTTP status code
The three-digit code a server returns with every response; 2xx success, 3xx redirect, 4xx client error, 5xx server error.
Also called: 4xx error, 5xx error.
Checked by Broken internal links: 404s inside your own site, 4XX pages in sitemap: dead URLs you are still submitting, Soft 404: error content served with an HTTP 200 status, Broken images: empty and placeholder src attributes, Broken scripts, stylesheets and fonts: files that do not load.
HTTPS
HTTP over TLS, which encrypts traffic and proves the server’s identity; every page and form should use it.
Checked by HTTPS: what it means when a page is not served over HTTPS, HTTP to HTTPS redirect: how squirrel probes for it, Form action over HTTP: the insecure form submission warning, Links from an HTTPS page to an http:// destination.
I
@id (JSON-LD node identifier)
The JSON-LD @id that gives a node a stable IRI, so other nodes and pages can reference the same entity instead of redeclaring it.
Checked by One organization, or sixty? Entities declared without an @id, Two plugins, two @ids, one organization split in half, A publisher that points at nothing, A bare #organization is one entity per page, not one entity, An @id that nothing points at.
Image width and height attributes
Declared width and height on <img> that let the browser reserve space before the file loads, preventing layout shift.
Checked by Image width and height attributes: preventing layout shift, Image aspect ratio mismatch: attributes versus the CSS box, Images without width and height: the CLS risk squirrel finds.
Indexability
Whether a crawled URL is eligible to be indexed: reachable, a 200 response, not noindexed, not blocked and not canonicalised elsewhere.
Checked by Page is blocked from indexing: finding the directive, robots.txt blocked pages without noindex, All non-indexed pages: the full blocked list for review, Redundant noindex: a blocked page nobody reads it on.
Interaction to Next Paint (INP)
The latency from a user interaction to the next frame, taken across the visit; good is 200 milliseconds or less. It replaced FID in March 2024.
Checked by Third-party scripts and INP: what squirrel counts per page, Large DOM: node count, depth and children per element, JavaScript bundle too large: the 250 KB and 1 MB limits, Same library loaded twice: duplicate JavaScript on a page, core-js and Babel helpers: legacy JavaScript in a bundle.
Internal linking
Links between pages of the same site, which carry crawlers and readers through it and signal which pages matter.
Checked by Internal link count per page: too few and too many, Pages with only one internal link pointing to them, Linked only from the nav and footer: no editorial links, Dead-end page: no outgoing internal links to continue with, Orphan pages: pages with too few inbound internal links, rel=nofollow on an internal link: usually a mistake.
J
JSON-LD
JSON for Linking Data, the format Google recommends for structured data, embedded in a <script type="application/ld+json"> block.
Checked by Invalid JSON-LD syntax: what breaks it and how to fix, A bare #organization is one entity per page, not one entity, A publisher that points at nothing.
K
Keyboard accessibility
Whether every control can be reached and used with a keyboard alone, with a visible focus indicator and sensible tab order.
Checked by focus-visible: keeping a visible keyboard focus ring, Positive tabindex and why it breaks the tab order, accesskey: why duplicate shortcuts break and how to check, Focusable elements inside aria-hidden: the tab trap.
Keyword stuffing
Repeating a term far beyond natural use in the hope of ranking for it, which Google lists as spam.
Checked by Keyword stuffing: measuring density around your CTAs, Hidden text and links: what Google’s spam policy covers.
L
Landmark regions
The page regions (main, nav, header, footer) that screen reader users jump between, plus the skip link to main content.
Also called: skip link.
Checked by One main landmark per page, and what happens without, Landmark regions: main, nav and footer on every page, Skip to content: bypassing repeated navigation.
lang attribute
The lang attribute on <html> (and on passages) that declares the language, so screen readers pick the right voice.
Checked by lang attribute on <html>: declaring the page’s language, html lang: valid values and what a missing one breaks, lang on elements below html: validating every tag, lang and xml:lang disagreeing on the html element.
Largest Contentful Paint (LCP)
The time until the largest image or text block in the viewport renders; good is 2.5 seconds or less.
Checked by LCP image not preloaded: what squirrel counts as a hero, fetchpriority=‘high’: the LCP image hint squirrel checks, loading=lazy on a hero image: the LCP delay squirrel finds, Render-blocking resources: the ones squirrel counts in head, rel=preconnect: the CDN origins squirrel checks for a hint, Time to First Byte: the 600ms and 1000ms thresholds.
Lazy loading
Deferring off-screen images and iframes with loading=“lazy” so they load as the visitor scrolls.
Checked by Lazy loading: how much of the page defers its load, loading=lazy: which images need it and which must not, loading=lazy on a hero image: the LCP delay squirrel finds, Hidden carousel slides still download: eager images inside.
Leaked secrets
Credentials or private keys shipped to the browser in HTML, scripts or source maps.
Also called: exposed API keys, source maps.
Checked by Leaked API key in client-side code: how to find one, Exposed source maps: sourceMappingURL in production output, localhost in production: dev hosts left in the markup.
llms.txt
A proposed Markdown file at /llms.txt that gives language models a curated map of a site’s key content.
Checked by llms.txt: what the file is and how squirrel validates it.
LocalBusiness schema
LocalBusiness structured data with address, opening hours and geo coordinates for a physical business.
Checked by LocalBusiness schema: required name, address or areaServed, The whole LocalBusiness block, on every single page, NAP consistency: same name, address and phone everywhere.
M
Markdown for agents
Serving a clean Markdown version of a page, through Accept: text/markdown or a .md URL, so agents read fewer tokens.
Also called: content negotiation, token weight.
Checked by Accept: text/markdown: serving Markdown to AI agents, Text to HTML ratio: the token cost of a page for an agent.
Meta description
A <meta name="description"> summary of the page that search engines may use as the result snippet.
Checked by Meta description length: the 120 to 160 character range, Duplicate meta descriptions across pages.
Minification
Removing whitespace, comments and long names from CSS and JavaScript so the file is smaller without changing behaviour.
Checked by Unminified CSS: how squirrel tells minified from formatted, Unminified JavaScript: the signals squirrel reads in a file.
Mixed content
An HTTPS page loading scripts, styles, images or media over plain HTTP.
Checked by Mixed content: HTTP resources on an HTTPS page.
Mobile-friendly
A page that works on a phone without zooming or sideways scrolling: viewport set, readable text, tappable controls, no input zoom.
Also called: intrusive interstitials, web app manifest.
Checked by Missing viewport meta tag: what it does and what to set, Font size under 12px: text too small to read on a phone, Horizontal scroll on mobile: the usual causes, Tap target size: the 44 by 44 pixel guideline, Form fields under 16px: why iOS Safari zooms in when one is focused, Intrusive interstitials: popups that cover mobile content, Web app manifest: the file that sets the home-screen icon and name.
Modern image formats
WebP and AVIF, which encode the same image in fewer bytes than JPEG or PNG.
Also called: WebP, AVIF.
Checked by WebP and AVIF: converting from JPEG and PNG, Image optimization signals: CDNs and modern formats, Oversized image files: the 200KB and 1MB thresholds, Animated GIF on a page: convert to video for the bytes.
N
NAP consistency
Name, address and phone number stated the same way across a site’s pages, schema and listings.
Checked by NAP consistency: same name, address and phone everywhere, LocalBusiness schema: required name, address or areaServed, Physical address: PostalAddress and LocalBusiness schema.
noai and noimageai
Meta robots values some sites use to ask AI systems not to train on their text or images; not part of any standard search engines honour.
Checked by noai and nosnippet: the AI opt-out tags squirrel reports.
noindex
A robots directive, in a meta tag or the X-Robots-Tag header, that asks search engines to keep a page out of their index.
Checked by noindex in a robots meta tag or X-Robots-Tag header: what squirrel reports per page, Page is blocked from indexing: finding the directive, All non-indexed pages: the full blocked list for review, Noindexed page in sitemap: why it is a contradiction, Rich result schema on a noindexed page: wasted markup, Redundant noindex: a blocked page nobody reads it on.
O
Open Graph
A set of og: meta properties (title, description, image, url) that controls how a link previews when it is shared.
Also called: og tags, og:image, Twitter card.
Checked by Missing og:image: the Open Graph tags squirrel checks, og:image size: the 1200 by 630 recommendation, og:url versus canonical: why they should be the same URL, Favicon and theme-color that differ across the site, twitter:card: the card types and the Open Graph fallback.
Organization schema
Organization structured data naming the business behind a site, its logo, contact points and sameAs profiles.
Also called: sameAs.
Checked by Organization schema: name, url, logo and sameAs checks, A business with nothing to attach its reputation to, Your organization is not connected to anything that corroborates it, Social profile links: which platforms a page links to.
Orphan page
A page that no other crawled page links to, so crawlers and readers only reach it through a sitemap or a direct URL.
Checked by Orphan pages: pages with too few inbound internal links, Linked only from the nav and footer: no editorial links, Hidden orphan page: reachable but linked from nowhere.
P
Page weight
The total bytes a page downloads across HTML, CSS, JavaScript, images and fonts.
Also called: legacy JavaScript, polyfills.
Checked by Total page weight: the 1600 KB and 5000 KB thresholds, JavaScript bundle too large: the 250 KB and 1 MB limits, CSS file too large: the 150 KB and 500 KB thresholds, Oversized image files: the 200KB and 1MB thresholds, Large inline SVG: when to move it to an external file, core-js and Babel helpers: legacy JavaScript in a bundle, Outdated jQuery and friends: the libraries squirrel detects.
Pagination
Splitting a long list across numbered URLs; each page should be crawlable and canonicalise to itself.
Checked by Pagination canonicals: why page 2 is not page 1.
Pay per crawl
Charging AI crawlers for access with HTTP 402 Payment Required responses, as in Cloudflare Pay Per Crawl and the x402 protocol.
Also called: HTTP 402, x402.
Checked by HTTP 402 for crawlers: pay-per-crawl and x402 detection.
Placeholder content
Template filler left in production: lorem ipsum text, stock placeholder images, example phone numbers and emails.
Also called: lorem ipsum.
Checked by Lorem ipsum in production: placeholders and leftovers, Placeholder images and camera-default alt text, Fake phone numbers and example.com emails in production.
Privacy policy
The page explaining what personal data a site collects and why; required by law in many places and a trust signal for search.
Checked by Privacy policy link: finding one anywhere on the site, Privacy policy: the page and how widely it is linked, Sub-processor disclosure: what a security review asks.
Product schema
Product structured data with offers, price, availability and reviews, used for product rich results and merchant listings.
Also called: review snippet, aggregateRating.
Checked by Product schema: name, image, offers and review checks, AggregateRating: ratingValue, ratingCount and review checks, AggregateRating on the wrong page: visible and on-topic.
R
Readability
How hard a text is to read, estimated from sentence and word length with formulas such as Flesch reading ease.
Also called: reading level, Flesch reading ease.
Checked by Flesch reading ease: measuring how hard a page is to read.
Redirect chain
A sequence of two or more redirects between the requested URL and the final response.
Checked by Redirect chains: when one hop turns into three, Links pointing at redirecting URLs: the hop on every click, Canonical URL resolves through a redirect: how to spot it, Script URL redirects: a 3xx in front of every script load.
rel=nofollow
A link attribute value asking search engines not to associate the linking page with the target; a hint, not a block.
Checked by rel=nofollow on an internal link: usually a mistake, External link count: how many outbound links a page has.
rel=noopener
A link attribute that stops a page opened with target=_blank from controlling the page that opened it (tabnabbing).
Checked by rel=noopener: external target=_blank links and tabnabbing.
Render-blocking resources
Stylesheets and synchronous scripts in the head that the browser must fetch before it can paint anything.
Also called: critical request chain, preconnect, resource hints.
Checked by Render-blocking resources: the ones squirrel counts in head, Critical request chains: the blocking head resources counted, rel=preconnect: the CDN origins squirrel checks for a hint.
Responsive images
Serving differently sized image files with srcset, sizes and <picture> so each device downloads one that fits.
Also called: srcset, sizes.
Checked by srcset: serving the right image size for the screen, Thumbnails without srcset: small images serving large files, <picture> without an <img>: the fallback that is required.
Rich results
Search result features (stars, breadcrumbs, product prices, video thumbnails) that Google can show when a page has eligible structured data.
Also called: rich snippets, breadcrumb schema.
Checked by Product schema: name, image, offers and review checks, AggregateRating: ratingValue, ratingCount and review checks, BreadcrumbList schema: positions, names and what breaks, VideoObject schema: required props and duration format, Article schema: headline, author and datePublished checks, AggregateRating on the wrong page: visible and on-topic, Rich result schema on a noindexed page: wasted markup.
Robots meta tag
A <meta name="robots"> tag carrying page-level directives such as noindex, nofollow, nosnippet and max-snippet.
Also called: nosnippet, max-snippet.
Checked by noindex in a robots meta tag or X-Robots-Tag header: what squirrel reports per page, nosnippet and max-snippet:0: pages with no search snippet, Redundant noindex: a blocked page nobody reads it on, robots.txt blocked pages without noindex.
robots.txt
A plain-text file at the site root that tells crawlers which paths they may fetch, per user-agent token (RFC 9309).
Checked by robots.txt: what to put in it and how squirrel checks it, Redundant noindex: a blocked page nobody reads it on, robots.txt blocked pages without noindex, AI crawlers in robots.txt: which bots you block, by class, Content-Signal in robots.txt: search, ai-input, ai-train.
RSL (Really Simple Licensing)
A standard for publishing machine-readable licensing terms for AI use of content, referenced from robots.txt.
Checked by robots.txt License: directive and RSL document validation.
S
Security headers
HTTP response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) that tell browsers to restrict risky behaviour.
Also called: Referrer-Policy, Permissions-Policy, X-Powered-By.
Checked by Content-Security-Policy: what to set and how to check it, HSTS: what Strict-Transport-Security needs to be valid, X-Content-Type-Options: nosniff and why it matters, X-Frame-Options: how to stop your pages being framed, Referrer-Policy: which value to send and what leaks, Permissions-Policy: what the header does and how to set it, Version-revealing headers: why Server and X-Powered-By should not name a version.
security.txt
A file at /.well-known/security.txt (RFC 9116) that tells researchers how to report a vulnerability.
Checked by security.txt: how to publish a vulnerability disclosure contact.
Sitemap lastmod
The optional <lastmod> date on a sitemap URL entry, meant to say when the page content last changed.
Checked by Sitemap lastmod stamped at build time: how to detect it, Sitemap lastmod disagrees with the page’s dateModified.
Soft 404
A page that tells the visitor it does not exist (or is empty) while the server answers HTTP 200.
Checked by Soft 404: error content served with an HTTP 200 status.
Structured data
Machine-readable statements about a page’s content, usually schema.org vocabulary in JSON-LD, that search engines and agents can parse.
Also called: schema.org.
Checked by Invalid JSON-LD syntax: what breaks it and how to fix, Structured data coverage: pages that break your own norm, Rich result schema on a noindexed page: wasted markup, Article schema: headline, author and datePublished checks, Product schema: name, image, offers and review checks, Organization schema: name, url, logo and sameAs checks.
Subresource Integrity (SRI)
An integrity attribute holding a hash of a third-party script or stylesheet, so the browser refuses a tampered file.
Checked by Subresource Integrity: which scripts need an integrity hash.
T
Thin content
A page with too little substantive content to be useful, judged here against word count and the site’s own norm.
Checked by Thin content: the 300 word floor and what to do below it, Thin against your own site: outliers by page type.
Time to First Byte (TTFB)
The time from the request until the first byte of the response arrives, covering redirects, DNS, connection and server time.
Checked by Time to First Byte: the 600ms and 1000ms thresholds.
Title tag
The <title> element in the page head; browsers show it in the tab and search engines usually use it as the result headline.
Checked by Title tag length: the 30 to 75 character range squirrel uses, Duplicate page titles: the site-wide uniqueness check, Duplicate title tags: the same title on several pages, Inconsistent page titles: pages breaking the template.
Token storage
Where a web app keeps session or auth tokens; tokens in localStorage are readable by any script on the page.
Checked by Auth tokens in localStorage: why a stored JWT is exposed.
Touch target size
The tappable area of a control; WCAG 2.2 sets 24 by 24 CSS pixels as the AA minimum.
Checked by Touch target size: the 24 and 44 pixel minimums, Tap target size: the 44 by 44 pixel guideline.
Trailing slash
Whether URLs end in /; /page and /page/ are different URLs, so a site should pick one and redirect the other.
Checked by Trailing slash: /page and /page/ are two different URLs, Canonicals in two forms: www, scheme and trailing slash.
U
URL parameters
Key-value pairs after ? in a URL; tracking and sort parameters can multiply URLs for the same content.
Also called: query strings.
Checked by URL parameters: how many is too many, and what to do.
URL slug
The readable last part of a URL path; short, lowercase, hyphen-separated words work best.
Checked by Non-descriptive URL slug: numeric IDs and generic patterns, Mixed URL conventions: finding the minority form, Stop words in a URL slug: when to drop them, Underscores in URLs: why hyphens separate words, Special characters in a URL path: what breaks and why, Uppercase in a URL: the duplicate content it creates, URL length: when a URL is long enough to be a problem.
V
VideoObject schema
VideoObject structured data with name, thumbnail, upload date and duration so a video can appear in video results.
Checked by VideoObject schema: required props and duration format, VideoObject schema: video on a page with no markup for it, Video poster attribute: the frame shown before playback.
Viewport meta tag
<meta name="viewport"> that sets the layout width to the device width; disabling zoom in it fails accessibility.
Checked by Missing viewport meta tag: what it does and what to set, user-scalable=no: the viewport setting that blocks zoom, user-scalable=no: viewport settings that block zoom, Horizontal scroll on mobile: the usual causes.
W
WCAG
The W3C’s Web Content Accessibility Guidelines, organised as testable success criteria at levels A, AA and AAA; 2.2 is current.
Also called: Web Content Accessibility Guidelines.
Checked by Color contrast: the 4.5:1 rule and how to check it, Form labels: which inputs need one and how to check, Link text: why ‘click here’ fails and what to use, Heading order: why skipping from h1 to h3 matters, html lang: valid values and what a missing one breaks, Touch target size: the 24 and 44 pixel minimums, Missing alt attribute: what an empty alt means.
WebSite schema
WebSite structured data naming the site, which Google reads for the site name in results, and optionally describing its internal search with a SearchAction.
Checked by WebSite SearchAction and the retired sitelinks searchbox, Nothing says these pages are one site.
Well-known URIs
Fixed paths under /.well-known/ (RFC 8615) where sites publish machine-readable files: security.txt, api-catalog, OAuth metadata and agent manifests.
Also called: .well-known, MCP server card.
Checked by MCP and A2A manifests under .well-known: what squirrel finds, api-catalog and OpenAPI: how an agent finds your API, security.txt: how to publish a vulnerability disclosure contact.
X
X-Content-Type-Options
The nosniff header that stops browsers guessing a response’s type instead of trusting Content-Type.
Also called: MIME type, Content-Type.
Checked by X-Content-Type-Options: nosniff and why it matters, Wrong Content-Type: header and extension disagree.
X-Frame-Options
A response header that controls whether other sites may embed the page in a frame; CSP frame-ancestors is its successor.
Also called: clickjacking.
Checked by X-Frame-Options: how to stop your pages being framed, Content-Security-Policy: what to set and how to check it.
X-Robots-Tag
An HTTP response header that carries the same directives as the robots meta tag, and works for non-HTML files such as PDFs.
Checked by Page is blocked from indexing: finding the directive, Redundant noindex: a blocked page nobody reads it on, PDF size: large linked documents and what gets indexed, Indexable pages missing from the sitemap: measuring the gap.
XML sitemap
An XML file listing the URLs a site wants crawled, with optional lastmod dates, referenced from robots.txt or submitted to search engines.
Also called: sitemap.xml.
Checked by No XML sitemap found: where squirrel looks and what to add, Sitemap validation: XML errors and the 50,000 entry limit, Indexable pages missing from the sitemap: measuring the gap, Cross-domain sitemap URL: why search engines ignore it, 4XX pages in sitemap: dead URLs you are still submitting, Noindexed page in sitemap: why it is a contradiction, Sitemap lastmod stamped at build time: how to detect it, Sitemap lastmod disagrees with the page’s dateModified.
Y
YMYL
Topics that could significantly affect a person’s health, finances, safety or society, which Google’s raters hold to a higher standard.
Also called: Your Money or Your Life.
Checked by YMYL content: what it is and how squirrel detects it, Disclaimers on YMYL content: what to say and where.