Get the playbook

The Playbook / Tech specs

2. Tech specs

The technical bar every site clears before launch. No exceptions.

The technical non-negotiables. Keep the full "how" in your own rules library; this chapter lists what every site MUST have.

Stack choice (the 2-stack policy)

  • Static (default): content sites. Hosted on Cloudflare Pages or existing static hosting. No build step unless the site earns one.
  • Next.js on Vercel: only when the site needs app features (accounts, database, payments).
  • No third stack without changing this policy first. WordPress is legacy: no new WP projects.

Non-negotiables (every site, no exceptions)

  • HTTPS everywhere (SSL Labs test), one canonical host (www or not, pick one, 301 the other)
  • Favicon set at root (favicon.ico, apple-touch-icon.png, SVG) + proven head block (RealFaviconGenerator)
  • robots.txt (never block AI scrapers) + XML sitemap with real lastmod
  • Canonical tag on every page
  • Security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), checked with securityheaders.com
  • 404 page with full site chrome
  • <main> landmark, one H1 per page, valid heading hierarchy
  • Responsive + mobile friendly, readable text (17px html, never below 14px)
  • Performance (PageSpeed Insights): images WebP max 1800px with width/height (Squoosh compresses them), no layout shift
  • Docs never live: .md files and /.claude/ must 404 on the live site

Done when

More