A trail, and a boundary

We audit this site against The Website Specification, a public checklist of what a modern site should do. Two of the items it still had open are now closed, and a third we have deliberately left open. That third one is the interesting part, so it is at the bottom rather than buried.

You can see where you are. Every domain page and every blog post now carries a breadcrumb trail — Home / All domains / thisname.com — so the route back out is visible rather than something you reconstruct from the browser's back button. The same trail is published in the structured data search engines read, and both halves are built from one source in the generator, so they cannot drift apart and start describing different sites. The page you are currently on is named in the trail but is not a link, because a link to where you already are is a small lie that screen readers read out in full.

Other sites get a weaker handle on ours. Two headers now travel with every response, and neither is a change you will see. The first means that when another site opens one of our pages in a new window, it does not keep a scripting handle on that window afterwards. The second means our responses cannot be pulled into another site as raw resources — fetched as an image or a script by a page that has no business reading them.

Framing was already refused, by two older headers that say this site may not be put inside a frame at all. What is new is narrower than that, and worth saying precisely: these close the gap where a hostile page holds a reference to a real one and measures it, rather than displaying it.

Except the things we publish to be read. Images are exempt on purpose. When a crypto wallet shows our logo during a payment, or a social platform renders a card for a link someone shared, that is our image being loaded by another origin — exactly what the second of those two headers would otherwise block. So images, and the manifest wallets read before a Gram payment, are marked as publicly readable while everything else is not. Getting that boundary wrong in the strict direction would have broken a wallet icon quietly, on the second load rather than the first, in a payment flow.

And the one we did not set. There is a third header in this family, and setting it would let us claim the full badge the checklist calls cross-origin isolation. We have not set it, because it blocks every third-party resource that does not explicitly opt in — which here means the anti-bot challenge on the offer form and the analytics and advertising the consent gate asks you about. Turning it on would trade a working offer form for a better security score.

That trade is available to us at any time and we are not taking it. If those third parties ever leave, the header goes on the same day. Until then, a checklist item stays unticked and the form keeps working, which we think is the right way round.