Five things that make it feel finished
Skeletons while content loads
Priority: Should
Content-shaped placeholders make a page feel ready, and nothing jumps.
Caching, so it feels instant
Priority: Should
Nobody should wait twice for the same files.
Tooltips on buttons that are only an icon
Priority: Should
An icon without a word makes people guess what it does.
Instant response, where it is safe
Priority: Should
Safe actions respond at once; payments wait for the server.
Short notifications that confirm an action
Priority: Should
Every action gets a clear answer: it worked, or it did not.
About the checklists that go around
Most points of the short checklists that go around on social media hold; several are true only in some cases, and what costs a site most is not on them at all. The e-book weighs each point.
When something goes wrong
Error pages in the site’s language: 404 and 500
Priority: Should
Old links and typos land on a helpful page, with a real 404.
Empty lists that say so
Priority: Should
An empty list says so, instead of a heading over nothing.
Forms that tell the truth
Priority: Must
A false “Thank you” loses people who think they succeeded.
Flaky networks and no network
Priority: Nice to have
Offline, a form says so instead of spinning forever.
A maintenance page, ready before you need it
Priority: Nice to have
A ready 503 page tells search engines you will be back.
Pages that change with time
Priority: Should
After the event, the page stops saying “Register now”.
Nonsense in, a clear “no” out
Priority: Should
Junk in an address gets a clear 4xx, not a server error.
Turning visitors into action
A clear call to action without scrolling
Priority: Should
The one thing you want people to do is visible at once.
A sticky button for the main action on phones
Priority: Nice to have
On long phone pages, the main action stays within reach.
A thank-you page that says what happens next
Priority: Should
People learn that their form arrived, and what happens next.
Real contact details, not only a form
Priority: Should
People trust an organisation they can actually reach.
Privacy and consent
A privacy notice
Priority: Must
Whatever personal data you collect, the law asks you to explain.
Analytics and other tools: what needs consent
Priority: Must
Your tools decide whether you need a banner at all.
Scripts added on the way to the visitor
Priority: Must
Your host can add trackers your consent banner never sees.
Fonts and scripts from your own server
Priority: Must
Fonts loaded from Google send every visitor’s IP address to Google.
No recording of what visitors type
Priority: Must
Recording what visitors type has no legal basis in the EU.
Children
Priority: Must
Under 15, a parent consents; school games are better built not to need it.
Consent you can prove
Priority: Must
If you rely on consent, you must be able to prove it.
No personal data in addresses
Priority: Should
Names in addresses end up in logs, history and analytics.
Visitors from Serbia
Priority: Should
Serving people in Serbia brings Serbia’s data protection law with it.
Records and processor agreements
Priority: Must
The GDPR asks for a record, and a contract with each processor.
SPF, DKIM and DMARC on the sending domain
Priority: Must
Without SPF, DKIM and DMARC, your emails land in spam.
Every email says who sent it
Priority: Must
Every email says who sent it, and why.
A confirmation in the visitor’s language
Priority: Should
A confirmation in their language tells people their form arrived.
Sending limits and bounces
Priority: Should
A rush of sign-ups can hit a free plan’s daily cap.
Selling online
Renewal terms beside the pay button
Priority: Must
Renewal terms go beside the pay button, or renewals can be claimed back.
A confirmation the buyer keeps
Priority: Must
Buyers get a confirmation to keep, with how to cancel.
Cancelling online, as easily as signing up
Priority: Must
Cancelling online is as easy as signing up.
Terms, 14 days to withdraw, and the withdrawal button
Priority: Must
EU consumers get 14 days to withdraw, and a button to do it.
Prices with VAT and delivery
Priority: Must
Prices say whether VAT and delivery are included.
Slovene for consumers in Slovenia
Priority: Must
Consumers in Slovenia are served in Slovene.
Being found and shared
A title and description on every page
Priority: Should
Search results show each page’s own title and description.
Favicon, touch icon and web manifest
Priority: Should
Without icons, browsers and phones show a blank square.
A sitemap with every page in every language
Priority: Should
It tells search engines which pages exist, in every language.
A robots.txt that says what you mean
Priority: Should
robots.txt cannot hide pages from search, but can hide the wrong ones.
One canonical address per page
Priority: Should
Each page names itself as the original, not a copy.
Language versions that point at each other
Priority: Should
Search engines show each reader the page in their language.
Each language has its own address
Priority: Should
A language without its own address cannot be found or shared.
The page says which language it is in
Priority: Must
Screen readers, translators and search engines go by the declared language.
Structured data for events and organisations
Priority: Should
Search engines learn what an event or organisation is, without guessing.
Short addresses and old links redirect
Priority: Should
Poster addresses and old links arrive somewhere, not at an error.
One address for the whole site
Priority: Should
Every variant of the address leads to the one real address, in one step.
Search Console, and no stray noindex
Priority: Nice to have
See what is indexed, and catch a stray noindex in time.
Found and quoted by AI assistants
Answers in the HTML, under clear headings
Priority: Should
Most AI crawlers read only the HTML, so the answers must be there.
AI crawlers: answering and training are separate choices
Priority: Should
Block every AI crawler and you vanish from AI answers too.
llms.txt: optional, and no substitute for the page
Priority: Nice to have
Optional, and useful only if it is true and current.
Dates that are true, facts that are current
Priority: Should
An assistant quoting last year’s price quotes you wrongly.
Accessibility
Text you can read
Priority: Should
Light grey on white is the most common reason text cannot be read.
Everything works with a keyboard, and you can see where you are
Priority: Should
Some people cannot use a mouse; everything must work without one.
Alt text on every image, and a clear structure
Priority: Should
Screen reader users hear the alt text and move by headings.
Forms everyone can fill in
Priority: Should
Labels, errors read aloud and no puzzles let everyone fill in a form.
Targets big enough to tap
Priority: Should
Small buttons and links are hard to hit with a finger.
Less motion for those who ask for it
Priority: Should
Big animations can make some people dizzy or sick.
Does the European Accessibility Act apply to you?
Priority: Must
Selling online to consumers can bring a site under the Act.
Public bodies: an accessibility statement
Priority: Must
Public bodies in Slovenia must meet WCAG and publish a statement.
Every screen: phone, tablet, laptop, foldable
Works on a phone, from 320 pixels wide
Priority: Should
Most visits are on phones; the page must fit from 320 pixels.
Tablets and the widths in between
Priority: Should
Layouts break most often between phone and laptop widths.
Laptops and big monitors
Priority: Should
Laptops are shorter than they look; big screens need narrow text.
Upright and sideways
Priority: Should
Some people cannot turn their device, so both ways up must work.
Foldable phones: closed, open and half-open
Priority: Nice to have
A foldable resizes the page while it is open; nothing typed may be lost.
Notches, rounded corners and the browser’s bars
Priority: Nice to have
Cut-outs, corners and browser bars can hide what sits at the edges.
Tried at real widths, on real devices
Priority: Should
A layout designed at three widths breaks at the fourth.
Security
HTTPS everywhere, and HSTS
Priority: Must
Every page encrypted, and browsers told never to use plain HTTP.
Security headers
Priority: Should
A few response headers stop whole classes of attack.
No secrets or private files in public
Priority: Must
Secret keys and files sometimes end up readable by anyone.
Database access rules
Priority: Must
The browser’s database key is public, so personal data must be locked.
Admin and CMS pages
Priority: Should
Sign-in pages stay out of search and frames, and limit guessing.
Spam protection that does not punish people
Priority: Should
Invisible layers stop most spam; puzzle CAPTCHAs shut people out.
Rate limits that do not lock out mobile users
Priority: Must
Thousands of phones share one IP address; per-IP limits block them.
Dependencies kept up to date
Priority: Must
An outdated framework is open to weaknesses that are already public.
security.txt
Priority: Nice to have
Whoever finds a vulnerability needs to know where to report it.
Tidy DNS
Priority: Nice to have
A forgotten subdomain can be taken over by someone else.
Speed
Core Web Vitals in the green
Priority: Should
Google measures whether a page appears fast, responds fast and stays still.
Images, video and icons in light formats
Priority: Should
One 5 MB photo slows the page for everyone.
Fonts that load fast and have every letter
Priority: Should
Your own fonts load fast and have every letter, č and đ too.
Few third-party scripts, loaded late
Priority: Should
Every widget and tracker adds weight and competes with your content.
Hosting quotas that quietly degrade things
Priority: Should
Free hosting plans hit their limits without a sound.
Keeping it running
Uptime monitoring that checks the content
Priority: Must
You hear the site is down before your visitors tell you.
Error logs you can still read next week
Priority: Should
Hosting logs vanish within hours; errors need a place that lasts.
Form entries kept somewhere durable
Priority: Must
An inbox is not a database; entries kept only there get lost.
Backups and content history
Priority: Should
One bad edit or a failed database must not take the content with it.
Domain and certificate expiry
Priority: Must
A lapsed domain takes the site and its email with it.
Broken links, checked regularly
Priority: Should
Partner and sponsor links break fastest; check them every week.
Changes that actually go live
Priority: Should
Automatic deploys can be skipped silently; know which version is live.
A hosting plan that allows what the site does
Priority: Should
Free plans have rules: Vercel’s Hobby plan is non-commercial only.
Who holds the keys
Priority: Should
The organisation owns its accounts, and knows who can get in.
Real-world failure modes
In-app browsers: Instagram, Facebook, TikTok
Priority: Should
Links opened inside Instagram or TikTok break downloads and sign-ins.
Automatic translation does not break the page
Priority: Should
Automatic translation can crash React pages for the readers who need it.
The page can be read without JavaScript
Priority: Should
JavaScript fails more often than it seems; the text must not depend on it.
Forced dark mode
Priority: Nice to have
Forced dark mode can leave dark text on a dark background.
Slovene, Serbian and their details
Priority: Should
Slovene counts in four forms, Serbian has two scripts, and č stays č.
Ad blockers and privacy browsers
Priority: Nice to have
Ad blockers stop third-party frames, so nothing essential may need one.
Slow and old phones
Priority: Nice to have
Pages drawn in the browser crawl on old phones.
Content from visitors
A way to report illegal content
Priority: Must
Where visitors publish, illegal content needs an easy way to be reported.
A single point of contact
Priority: Must
The Digital Services Act asks for one published point of contact.
A DMCA agent, if you are in the US or aim at it
Priority: Must
In the US, or aiming at it, uploads need a registered DMCA agent.
Who runs this site
Provider details (imprint)
Priority: Must
Visitors and authorities need to know whom they are dealing with.
Terms and conditions, when you need them
Priority: Must
Selling, accounts or publishing need terms, linked before the commitment.
Say when visitors are talking to an AI
Priority: Must
People must be told when they are talking to an AI.
EU funding shown the way the programme asks
Priority: Nice to have
EU-funded projects show the emblem the way their programme asks.