What an SEO-optimized platform must deliver

Test and staging sites are protected by a login only, and in everything else, what search engines are shown, hosting and speed, they are exactly as the live site, because that is the only way to test before launch that everything works as it should.

Every hostname answers /robots.txt with a plain text file that blocks only what should not be crawled.

Firewalls, bot protection and rate limits answer a crawler the way they answer a visitor: with the page, status 200, from any country. A crawler never meets a challenge page, a rate limit or a block.

Every page is delivered complete from the server (server-side rendering). Everything search engines need to understand, rank and show the page, such as the main content, links, prices and metadata, is in the HTML the server sends and can be read in a browser with JavaScript disabled. JavaScript may only be used for what has no effect on the meaning of the page, such as a contact form, a calendar or a filter control.

Every link the platform generates to a page that should be indexed, in the menu, in lists, in filters, in the footer or anywhere else, is a normal link: an <a> element with the real address in its href. A page the platform generates that should not be indexed, such as internal search results or a filter view that is not meant for the index, gets no such link; visitors reach it through a button or another control that gives a crawler no address to follow. Crawl budget is spent only on pages that should be indexed.

No internal link the platform generates carries unnecessary parameters; every internal link points to an SEO- and user-friendly URL.

The XML sitemap contains every page, image and file, such as a PDF, that should be indexed and nothing else, and it updates automatically, so a page, image or file the platform or a user adds, changes or removes is in or out of the sitemap at once. lastmod is the date of the page's last real change.

Placement: at the root of the site, such as /sitemap.xml, and named in robots.txt with a Sitemap: line.

Important pages are never buried deep in the site. A crawler starting on the front page reaches them in a few links, preferably no more than three clicks from the front page.

A list split over several pages uses one of two solutions.

• Solution 1, which Google recommends: pages 2, 3, 4 and so on are linked with normal links, each on its own address with its own canonical tag, its own title and meta description, so every product gets a link from its category.
• Solution 2: later pages name page one as canonical and get no crawlable link, so link equity stays on page one and products on later pages are linked from somewhere else.

In both, a page number past the end answers 404, page one has one address, and the page addresses are preferably built without query strings. The client decides which solution is used.

The content of a page is never placed in an iframe; what sits in an iframe is not part of the page for a crawler.

Crawlers and visitors get the same content. Every page exists in one version, and the site never makes a separate version for crawlers.

The first request to a page, with no cookies, no session and no consent given, returns the full page.

While the site or a page is down for maintenance, it answers 503 with a Retry-After header, so crawlers come back later instead of dropping the pages.

The HTML the server sends holds only what is needed to show the page's content, and nothing else. An e-commerce template stays under 1 MB uncompressed.

The server answers every crawler request without server errors or timeouts, apart from a 503 during maintenance, and the host status in Search Console's Crawl Stats report stays green.

Every page carries a robots meta tag in the head of the HTML the server sends, and every combination of index or noindex with follow or nofollow can be set on every page. The platform sets noindex by itself on the pages it generates that should not be indexed, such as internal search results, filter and sort views, the basket and account pages. A page set to noindex is not blocked in robots.txt.

Placement: between <head> and </head>.

Internal links never carry rel="nofollow", and it is never used to save crawl budget or steer crawlers.

Every page lives on exactly one address, and every other spelling of it redirects there with a single 301:

• from http to https
• from without www to with www, or from with www to without
• from uppercase letters to lowercase
• from with a trailing slash to without, or from without to with

Which way the www and trailing-slash redirects go follows from the chosen root domain and address form: a site on the domain without www redirects to the address without www, and a site whose addresses end without a slash redirects to the address without a slash.

Every page that should be indexed has exactly one canonical tag that points to the page itself, as a full https address in the exact spelling the page lives on, in the head of the HTML the server sends.

Placement: between <head> and </head>.

iProspect: found the canonical tag rendered in the body instead of the head (BOLIA-7397, DEPT moved it into the head).

A canonical tag that points to another page is used only on an exact copy of that page, and the page it points to answers 200, is indexable (never noindex) and names itself as canonical. The one exception is a paginated list under solution 2 in 2.7, where later pages name page one as canonical.

Every PDF and other document file on the site has a canonical, sent in the HTTP Link header, naming the page that holds the same content or otherwise the file's own address.

A page carries either a canonical tag to another page or a noindex, never both.

Addresses are written in lowercase with hyphens between words, and never contain spaces, underscores, special characters, letters outside a to z or encoded characters.

An address is made of readable words that describe the page, follows the structure of the site, stays under 115 characters and holds no parameters and no internal IDs. The one exception is pagination, where a page number may be a query string, though a path is preferred.

The address of a page does not change when its title or its place in the menu changes, and when an address has to change, the old one redirects to the new one with a 301 that stays in place for good.

Every internal link the platform generates, on every kind of page, points to the address the page lives on, in its canonical spelling, and gets a 200 answer.

A redirect leads to the final address in one step. A redirect never points to another redirect, and never back to itself.

A page that has moved for good redirects with a 301 sent by the server to the full address of the new page; a 302 is used only for moves that really are temporary, and a redirect is never made with JavaScript or a meta refresh.

Every page that should be indexed and exists in several languages or markets lists all its versions in hreflang annotations, itself included, and every version links back. Pages that should not be indexed carry no hreflang. The annotations use full addresses, valid language and region codes, each combination once and an x-default, and sit in the head of the HTML the server sends.

Placement: as <link rel="alternate" hreflang="…"> elements between <head> and </head>.

Every address in an hreflang annotation answers 200, is indexable (never noindex) and names itself as canonical; a page that has not been translated is left out instead of pointing to another language.

Each version has its own address and one language throughout, and the lang attribute on the <html> element states that language.

The site never redirects a visitor or crawler to another language or market version based on location, IP address or browser language.

Every internal link the platform generates leads to a page that answers 200, never to one that answers 3xx, 4xx or 5xx.

An address that no redirect rule applies to and that does not exist answers 404 (or 410) directly, at that address, with a helpful error page. It is never redirected to a separate error page, and it never answers 200 with an error message.

A product that is out of stock keeps its page. A product that is discontinued does not: its address answers 404 or redirects with a 301 to a similar product or a product that replaces it.

Structured data is written as JSON-LD in the HTML the server sends, never added by a tag manager or another script, and it describes only what is true of the page and the site; it never claims content, prices or ratings that the page does not have.

Placement: a <script type="application/ld+json"> element between <head> and </head>; Google also accepts it in the <body>.

Every page carries the structured data type that fits it, with the fields Google requires filled in: Product on product pages, CollectionPage with an ItemList on collection pages, Article on articles, Organization on the front page, LocalBusiness on store pages, and the matching type for every other kind of page the platform generates.

Every template passes Google's Rich Results Test, and the structured data reports in Search Console show no errors.

Every page below the front page shows a breadcrumb of real links from the front page down to its parent, with the page's own name last as plain text, and the same path is marked up as BreadcrumbList.

The whole site runs on HTTPS with a valid, trusted certificate and sends a Strict-Transport-Security header; no page loads scripts, styles or images over http, and nothing ever redirects from https to http.

iProspect: found the missing HSTS header (BOLIA-7400, DEPT set it in a Cloudflare edge rule).

The site is served over HTTP/2 or HTTP/3 so a crawler fetches a page and all its resources over one connection.

The server starts sending the HTML of every page within 600 milliseconds, measured from another country and as a crawler that arrives without cookies; a page served from the content delivery network's cache answers within 200 milliseconds.

HTML, CSS, JavaScript and every other text file are sent compressed with Brotli or gzip, and CSS and JavaScript files are minified.

Every script, stylesheet and font file carries a hash of its content in its name, so a changed file has a new address and an unchanged file is cached for a year.

Pages and every file they load are served through a content delivery network close to the visitor. A page that is the same for every visitor is served from its cache, and a change to the content replaces the cached copy at once.

Scripts that are not needed for the first screen, such as tracking and chat, load after the content, and the consent tool loads async so it blocks neither rendering nor the tags that wait for it.

Placement: a script in <head> carries defer or async; every other script sits at the end of <body> or is loaded after the content is shown.

In a Lighthouse test on a mobile profile, run without third-party scripts on the staging environment before launch and again on the live site after launch, taken as the median of five runs, every template meets Google's Core Web Vitals thresholds: a Largest Contentful Paint under 2.5 seconds, a Cumulative Layout Shift under 0.1 and a Total Blocking Time under 200 milliseconds, the lab stand-in for Interaction to Next Paint.

Every content image is an <img> with its address in the src in the HTML the server sends, and the image keeps the same address every time the page loads.

Images are served as WebP or AVIF to every browser that accepts them.

iProspect: found images over 100 kB (BOLIA-7399, not verified: DEPT says the Kontainer loader now serves WebP/AVIF with srcset, but the report gives no measured sizes).

Every image is delivered in the size it is shown at on the visitor's screen, and has width and height set so the page does not jump while it loads.

A plain <img> with srcset and sizes serves the same picture at every width; a <picture> element with media sources is used only where the crop differs between phone and desktop. In both, the <img> carries src, alt, width and height, and a <source> with its own crop carries its own width and height.

iProspect: found images over 100 kB (BOLIA-7399, not verified: DEPT says the Kontainer loader now serves WebP/AVIF with srcset, but the report gives no measured sizes).

Every image has an alt attribute describing the image; an image with no description has an empty alt attribute.

Images below the first screen load lazily with the browser's own loading="lazy"; images on the first screen load at once and are never lazy, and the largest of them carries fetchpriority="high" or is preloaded from the head.

No image address is blocked in robots.txt, on the site or on the host that serves the images, and that host answers a crawler with the image and status 200.

The thresholds in this group are measured on the live site, with consent, tracking and every third-party script running, as real Chrome users at the 75th percentile over 28 days in Search Console's Core Web Vitals report.

The largest element on the first screen is painted within 2.5 seconds of the request.

iProspect: found a slow Largest Contentful Paint (BOLIA-7193, not fixed: DEPT closed it as Won't do and tracks the work under BOLIA-8953).

The page responds visibly to a tap, a click or a key press within 200 milliseconds.

Nothing on the page jumps while it loads: the layout shift score stays under 0.1.

When the Core Web Vitals report in Search Console shows a page type outside the good range, the lab test in 10.6 is run on that page type. If it passes with the scripts blocked, the third-party scripts are the cause; if it fails, the platform is. For Interaction to Next Paint, which Lighthouse cannot measure, the slow interaction is recorded in Chrome's performance panel instead, and the platform fixes the part of the delay that comes from its own code.

Every page has exactly one <title> in the head of the HTML the server sends, set per page in the CMS, with a generated default when the field is empty.

Placement: between <head> and </head>.

iProspect: found the title tag rendered in the body instead of the head (BOLIA-7397, DEPT moved it into the head).

iProspect: found pages without a title (BOLIA-7194, not fixed: DEPT calls them empty CMS fields and waits on Bolia content).

Every page has exactly one meta description in the head of the HTML the server sends, set per page in the CMS, with a generated default when the field is empty.

Placement: between <head> and </head>.

iProspect: found the meta description rendered in the body instead of the head (BOLIA-7397, DEPT moved it into the head).

iProspect: found pages without a description (BOLIA-7194, not fixed: DEPT calls them empty CMS fields and waits on Bolia content).

Every page has exactly one <h1>, in the main content, and the platform never adds a second one of its own.

Placement: inside <body>, at the top of the main content, before the other headings of the content.

iProspect: found pages with more than one H1 (BOLIA-7192, DEPT fixed it in PR #2140).

Heading elements <h1> to <h6> are used in the main content only, and always in sequence: an <h2> under the <h1>, an <h3> under an <h2>, never skipping a level such as going from <h1> to <h3>. The platform never uses them for its own design elements, such as the menu, and headings are never empty.

iProspect: found the kicker and the country dialog set as headings (BOLIA-7192, DEPT fixed those two in PR #2140; the menu headings were not in the ticket).

All AI crawlers are allowed in, the ones that feed search and answers and the ones that collect training data, and robots.txt and the firewall never block them.

Googlebot reads only the first 2 MB, uncompressed, of a page's HTML and of every CSS and JavaScript file it fetches; whatever comes after that point is never seen. 2 MB is where a page breaks, not a target: the HTML of every page stays under 1 MB uncompressed.