Website Review
What is Front-End Checklist?
Front-End Checklist is a reference site that collects front-end quality rules and organizes them into checklists you can work through. Its own summary describes 350+ rules spread across 11 categories, with the same standards offered to both people and AI tools.
What it covers
The categories map closely to the work that tends to get skipped or half-finished before a release:
- Accessibility — WCAG compliance and inclusive design
- SEO — meta tags and search optimization
- Performance — Core Web Vitals and rendering strategies
- HTML, CSS, JavaScript — semantic markup, responsive styling, modern patterns
- Security and Privacy — security practices, consent, tracking, user data rights
- Images, I18n, Testing — responsive images, localization, QA
The largest sections are accessibility and SEO, which is a reasonable signal of where the maintainers see the most common gaps.
Two ways to use it
| Approach | Best for | Trade-off |
|---|---|---|
| Curated checklists | Guided, time-boxed passes | Narrower scope than the full corpus |
| Browse all rules | Reviewers who know the area they need | No guidance on ordering or priority |
The curated workflows are the more practical entry point. Examples from the page include a Launch Checklist (16 rules, roughly 45 minutes) aimed at pre-deployment checks, a SEO Audit (12 rules, about 30 minutes) for traffic and indexing concerns, and Performance Quick Wins (8 rules) for high-impact, low-effort gains. The site frames these for junior developers, senior reviewers, and launch teams.
The AI angle
Beyond the browser-based checklists, the site offers an MCP server so the same rule set can feed structured AI reviews. That matters if your team already uses AI assistants for code review: instead of each person inventing their own prompt, the review draws on a shared, versioned standard. It is not a substitute for human judgment on product-specific risks, but it reduces the "what should we even check?" problem.
A practical next step
If you are preparing a release, start with the Launch Checklist rather than the full corpus — it is scoped to finish in one sitting. Use the category browse afterward to target whichever area your launch pass flagged as weakest. For a broader industry-standard comparison point, web.dev covers Core Web Vitals guidance in more depth than a checklist format allows.
How do I use the Front-End Checklist for a pre-launch review?
Use the Front-End Checklist as a guided pre-launch pass: start with its curated Launch Checklist, work through the items in order, and use the full rule corpus to resolve anything that needs more depth.
A practical pre-launch sequence
- Run the Launch Checklist first. It is designed as a production-readiness workflow covering HTML, SEO, security and performance, so it gives you a fast baseline before you dig into individual categories.
- Then check the high-risk categories. For most sites, that means accessibility, performance, security and SEO. The site separates these into distinct categories with their own rule counts, so you can assign them to different reviewers.
- Use Performance Quick Wins when time is short. If you are close to launch and cannot do a full audit, this workflow targets improvements that are relatively easy to implement with high impact.
- Use the SEO Audit when discoverability matters. It fits sites where indexing, metadata quality or organic traffic are active concerns.
- Bring the same rules into an AI-assisted review. The site supports MCP, which lets you connect the checklist standards to AI tools for structured reviews rather than relying on ad-hoc prompts.
Who should do what
| Role | Useful starting point | Why |
|---|---|---|
| Junior developer | Launch Checklist | Clear, ordered production checks |
| Senior reviewer | SEO Audit or full category browse | Deeper, category-specific verification |
| Launch team | Launch Checklist plus Performance Quick Wins | Balances completeness with time pressure |
| AI-assisted audit | MCP-connected review | Consistent, rule-based output |
A concrete scenario
A small team is two days from a redesign launch. They run the Launch Checklist together, then split the remaining work: one person takes accessibility, another takes performance and images, and a third takes SEO and security. Any item that needs explanation is looked up in the full rule set under its category. If the schedule slips, they fall back to the Performance Quick Wins list and defer the rest to a post-launch pass.
Decision criterion
Choose the curated workflow when you need a guided path and a clear stopping point. Browse the full categories when you already know the weak area and want exhaustive coverage. The trade-off is time versus depth: curated checklists are faster and easier to coordinate, while the full corpus catches more but requires more reviewer judgment.
For a broader view of web quality standards alongside this, web.dev and MDN Web Docs are useful references when a checklist item needs technical detail.
What are the best practices for accessibility in the Front-End Checklist?
The Front-End Checklist treats accessibility as its largest single category, with 95 rules covering WCAG compliance and inclusive design. That weighting reflects a practical reality: accessibility touches markup, styling, interaction and content, so it rarely fits into one pass.
What the accessibility category covers
Because the rules sit alongside HTML, CSS, JavaScript, images and SEO categories, the checklist encourages you to fix issues at the layer where they originate rather than patching them at the end. A missing form label is an HTML problem; a focus outline removed for aesthetics is a CSS problem; a custom widget that traps keyboard focus is a JavaScript problem. Working through the accessibility list alongside those categories catches more than an accessibility-only sweep.
Curated checklists that include accessibility
The site's ready-made workflows are shorter and role-targeted:
| Checklist | Audience | Focus |
|---|---|---|
| Launch Checklist | Junior dev / launch teams | Critical HTML, SEO, security and performance items before production |
| SEO Audit | Senior reviewer | Indexing, metadata, discoverability |
| Performance Quick Wins | Junior dev | High-impact, low-effort speed fixes |
Accessibility rules surface inside these workflows rather than as a separate gate, so a launch review naturally pulls in the items most likely to block real users.
A concrete scenario
An e-commerce team prepares a redesign for release. Using the Launch Checklist, they hit the accessibility items early: alt text on product images, visible focus states on the add-to-cart button, contrast on sale badges, and correct heading order on category pages. Fixing these during design review costs hours; fixing them after launch costs a sprint and generates support tickets.
Practical criteria for prioritising
- Start with keyboard and screen-reader paths. If a user cannot complete the primary task without a mouse, nothing else matters yet.
- Contrast and text sizing are cheap to audit and affect the widest audience.
- Forms and errors are where accessibility failures most often block conversions.
- Semantics before ARIA. Correct HTML elements solve more problems than added attributes.
Bringing the rules into an AI workflow
The site supports an MCP server so the same standards can drive structured AI reviews. The value here is consistency: an agent checking against 350+ fixed rules produces more repeatable results than ad-hoc prompting. Treat its output as a first pass, not a substitute for testing with real assistive technology.
For a complementary, standards-focused reference, see W3C and its Web Accessibility Initiative guidance.
Next step: open the accessibility category, run the Launch Checklist against your current staging build, and log every keyboard trap or missing label as a release blocker rather than a backlog item.
How can I improve Core Web Vitals using the performance rules?
Start with the Performance category and its 44 rules, then apply the curated "Performance Quick Wins" checklist if you want the highest-impact fixes first. Front-End Checklist frames Core Web Vitals work as a prioritized pass rather than a full audit: the quick-wins path is described as the fastest route to meaningful gains, while the Launch Checklist folds performance into a broader pre-deployment review.
A practical order of attack
- Run the quick-wins checklist before deeper investigation. It is the shortest guided path and is aimed at developers who want improvement without a full performance project.
- Move to the full Performance category for anything the quick pass leaves unresolved — rendering strategy, asset delivery, and measurement details live there.
- Re-check the Launch Checklist before a redesign or high-risk release, since it bundles performance with HTML, SEO, and security items that can regress together.
Matching the tool to your situation
| Situation | Where to start | Why |
|---|---|---|
| New site or redesign about to ship | Launch Checklist | Catches performance regressions alongside other launch risks |
| Existing site with slow pages, no clear cause | Performance Quick Wins | Cheapest path to visible improvement before a deep audit |
| Metrics already tracked, need systematic coverage | Performance category (44 rules) | Full rule set for rendering, assets, and measurement |
| Team wants rules inside an AI review | MCP server | Same standards applied through AI-assisted audits |
What to watch for
Core Web Vitals combine loading, interactivity, and visual stability, so a checklist that only covers images or only covers JavaScript will leave gaps. Treat the categories as connected: Images (25 rules) and CSS (32 rules) both feed rendering performance, and JavaScript (26 rules) affects interactivity. The accessibility category is the largest at 95 rules, which is a reminder that performance work should not crowd out inclusive design — a fast page that fails WCAG is still a failed launch.
A useful next step: open the quick-wins checklist, complete it, measure your vitals again, and only then decide whether the full Performance category is worth the extra time. If your team already reviews code with AI assistance, connecting the same rule set through MCP keeps human and machine reviews aligned.
What security checks should I perform before deploying a website?
Start with the security subset of any pre-launch review, then treat the rest as launch hygiene. Front-End Checklist groups security into its own category and also folds critical security items into its Launch Checklist, so a practical approach is to work the security category in full and confirm the launch items that overlap with it.
Security checks worth completing before deploy
- Transport and headers: enforce HTTPS, avoid mixed content, and set headers that restrict what the browser will load or execute, such as a Content Security Policy, HSTS, and sensible Referrer-Policy. The Security category covers security best practices across 22 rules.
- Secrets and configuration: keep API keys, tokens, and credentials out of client-side bundles and version control. Verify environment variables are scoped to the right deployment target and that debug or staging flags are off.
- Input and output handling: validate and sanitize anything user-supplied, and escape output so injected markup cannot run. This matters most on forms, search, comments, and URL parameters.
- Dependencies: check for known-vulnerable packages, remove unused libraries, and confirm third-party scripts are loaded from trusted origins with integrity attributes where available.
- Authentication and session behavior: confirm cookies are marked Secure and HttpOnly where appropriate, sessions expire, and protected routes cannot be reached by direct URL.
- Data exposure: make sure error pages do not leak stack traces or internal paths, and that source maps and directory listings are not publicly served in production.
- Privacy-adjacent items: consent banners, tracking scripts, and data collection are handled in the Privacy category (5 rules) rather than Security, but they belong in the same pre-launch pass.
A realistic sequence
Run the Launch Checklist first if you are days from release: it is framed as 16 rules and roughly 45 minutes, aimed at juniors and launch teams before a new site, major redesign, or high-risk release. Then work the Security category for depth. If performance or indexing is an active worry, the Performance Quick Wins checklist (8 rules) and SEO Audit checklist (12 rules, about 30 minutes) cover adjacent ground without turning the review into a full audit.
Deciding how deep to go
| Situation | Reasonable scope |
|---|---|
| Static marketing page, no user input | Headers, HTTPS, dependency check, no exposed secrets |
| Site with forms, accounts, or payments | All of the above plus input handling, session and cookie review, error handling |
| High-traffic or regulated site | Full Security category, plus Privacy and SEO, with a second reviewer |
The checklist is available as browsable rules and as curated workflows, with an MCP server for connecting the same standards to AI-assisted reviews. For a first pass, open the Security category, mark items you have genuinely verified rather than assumed, and record anything you deliberately deferred so it does not disappear after deploy.
How do I integrate the Front-End Checklist with AI tools like MCP?
The Front-End Checklist provides an MCP (Model Context Protocol) server so the same 350+ rule corpus it presents to human reviewers can be queried by AI agents. Instead of pasting checklist items into a chat prompt, you connect the MCP server to an AI client, and the agent can pull the relevant rules and structured review criteria directly during a code review or audit. The site frames this as connecting "the same standards to AI tools with MCP," alongside its browsable rules and curated checklists.
What the MCP integration is for
- AI-assisted audits — the curated "AI-assisted audit" checklist is aimed at senior reviewers dealing with traffic, indexing, metadata quality, or editorial discoverability. An MCP-connected agent can fetch the matching rules rather than relying on a generic prompt.
- Consistent standards between humans and agents — the same rules a developer checks manually become the rules an agent evaluates against, which reduces drift between a human review and an automated pass.
- Category-scoped retrieval — with 11 categories (Accessibility, CSS, HTML, I18n, Images, JavaScript, Performance, Privacy, Security, SEO, Testing), an agent can be pointed at the area under review instead of the whole corpus.
A practical integration path
- Decide what the agent should do: a pre-launch gate, a performance pass, or a full accessibility/SEO review. The curated checklists map to these intents.
- Connect the MCP server to your AI client (the site lists an MCP Server entry alongside its GitHub presence). Exact client configuration depends on your tool.
- Give the agent the code or URL plus the target category or checklist, and ask it to report rule-by-rule findings.
- Treat the output as a first pass. An agent can flag missing alt text, absent meta tags, or unlabelled form controls quickly, but judgement calls — whether a contrast ratio is acceptable in context, whether a tracking script is proportionate — still need a person.
When this is worth it, and when it isn't
| Situation | MCP-assisted review | Manual review |
|---|---|---|
| Large codebase, repeated PRs | Good fit — rules retrieved per change | Slow to repeat by hand |
| One-off small site | Probably overkill | Faster to just walk the checklist |
| Accessibility (95 rules) | Useful for catching mechanical gaps | Still needed for real assistive-tech testing |
| SEO (94 rules) | Good for metadata and indexing checks | Needed for content and editorial judgement |
A concrete scenario: a two-person team shipping a marketing site runs the agent over each pull request against the Launch Checklist categories, fixes the flagged HTML, SEO and security items, then does a manual keyboard-and-screen-reader pass before release. The agent handles breadth; the humans handle anything requiring context.
For background on the protocol itself, see Model Context Protocol.
User reviews (0)