Front-End Checklist is the open-source front-end quality system for humans and AI agents. It turns front-end best practices into a practical review workflow you can browse on the web, run through with MCP-compatible tools, or work through directly in this README.
Companion project: UX Patterns for Devs helps developers choose the right UI pattern before using Front-End Checklist to verify implementation quality.
[!IMPORTANT]
Use the website for browsing and filtering, the MCP server for agent workflows, and this README when you want the checklist in one place.
What you get
385 English rules across 11 active categories
11 MCP tools exposed by the hosted server
Rule pages with explanations, remediation guidance, and verification steps
How to use this checklist
Start with the category navigator below and jump straight to the part of the checklist you need.
Work through the checkbox items that apply to your project, audit, or pull request.
Open the linked rule pages when you need the full guidance, examples, verification steps, and AI prompts.
Open a category page for focused audits and implementation guidance
Choose the right pattern first
Front-End Checklist helps you review implementation quality. If you are still deciding what interface to build, use UX Patterns for Devs to compare common UI patterns, understand tradeoffs, and find practical guidance for forms, navigation, data display, feedback states, authentication, and AI interfaces.
Contribute to the checklist
Install dependencies: pnpm install
Run local development: pnpm dev
Validate structure: pnpm validate:rule-structure
Score the corpus: pnpm score:rules
Regenerate derived artifacts: pnpm generate:skills and pnpm generate:readme
Use with MCP
Connect an MCP-capable agent to Front-End Checklist for structured rule lookup, audits, and remediation workflows.
[!TIP]
Best first use: point an MCP-capable agent at a real component, page, or public URL and ask for the highest-confidence Front-End Checklist findings first.
Add Subresource Integrity to external scripts: Use Subresource Integrity (SRI) hash attributes on external scripts and stylesheets loaded from CDNs to ensure the content hasn't been tampered with.
Add thumbnail images to videos: HTML5 video elements should have a poster attribute providing a thumbnail image displayed before the video loads or is played.
Link a Web App Manifest for installability: Include a Web App Manifest (manifest.json) linked from the HTML head to enable Progressive Web App features like home screen installation, standalone display, and splash screens.
Load scripts with defer, async, or type=module: Prevent JavaScript from blocking HTML parsing by using defer, async, or type=module attributes on script tags so the browser can continue building the DOM while scripts download.
Make custom elements and Web Components accessible: Custom elements must implement ARIA reflection via ElementInternals, keyboard interaction, and form association so that screen readers and assistive technologies can interpret them correctly.
Make file uploads accessible: File upload components are accessible with proper labels, file type restrictions, and progress feedback.
Make pagination accessible: Pagination controls are accessible with proper ARIA labels, keyboard navigation, and current page indication.
Make search inputs accessible: Search functionality is accessible with proper input type, label, role, and autocomplete suggestions.
Make videos accessible with captions: Videos have captions, audio descriptions, transcripts, pause controls, and avoid autoplay for users with hearing, vision, or cognitive impairments.
Meet PWA installability criteria: The web app satisfies the browser's minimum PWA installability requirements: a valid web app manifest, a registered service worker, HTTPS, and maskable icons.
Set the page lang attribute: The element must have a lang attribute with a valid BCP 47 language code so screen readers, translation tools, and search engines know the primary language of the page.
Use semantic HTML elements: HTML5 Semantic Elements are used appropriately (header, section, footer, main, article, aside...).
Use semantic input type attributes: Set the correct type attribute on input elements to trigger the right mobile keyboard, enable browser validation, and improve autofill accuracy.
Use the HTML5 doctype: The HTML5 doctype declaration must appear as the first line of every HTML document to trigger standards mode rendering in all browsers.
Validate forms accessibly: Forms provide clear validation feedback with accessible error messages and proper ARIA attributes.
Apply Flexbox best practices: Use Flexbox for one-dimensional layouts with the right properties, avoiding common mistakes like overusing flex:1, ignoring min-width:0, and misunderstanding flex-basis.
Avoid embedded and inline CSS: Embedded and inline CSS are avoided except for critical CSS and performance optimization.
Avoid intrusive interstitials: Full-screen interstitials (pop-ups, overlays, cookie banners) that block the main content on mobile are a ranking penalty signal and accessibility barrier. Use non-intrusive alternatives.
Do not disable pinch zoom: The viewport meta tag must not set user-scalable=no or maximum-scale=1 as these prevent users from zooming in to read content, violating WCAG 2.1 SC 1.4.4 (Resize Text).
Keep CSS specificity low and flat: Write selectors at the lowest specificity that works, avoiding ID selectors and deep nesting, so styles can be overridden cleanly without resorting to !important.
Lint CSS and SCSS files: All CSS/SCSS files are linted with Stylelint to detect errors and enforce standards.
Minify all CSS files: All CSS files are minified to reduce file size and improve page load performance.
Optimize web font formats: Web fonts use modern formats (WOFF2, WOFF) with proper fallbacks and loading strategies.
Order CSS files correctly: All CSS files are loaded before JavaScript files to prevent render blocking.
Prevent horizontal scrolling: Web pages must not require horizontal scrolling at standard viewport widths. Horizontal overflow breaks responsive layouts and makes content inaccessible to low-vision users who zoom in.
Provide visible custom focus indicators: Ensure all interactive elements have a clearly visible focus indicator for keyboard navigation β never just remove the default outline without providing a better alternative.
Remove unused CSS rules: Unused CSS is removed to reduce bundle size and improve performance.
Support dark mode with prefers-color-scheme: Implement dark mode using the prefers-color-scheme media query and CSS custom properties so the site automatically adapts to the user's system preference.
Use @layer to manage CSS cascade order explicitly: CSS Cascade Layers (@layer) are used to give the codebase explicit, predictable control over specificity and cascade order, eliminating the need to fight specificity with !important.
Use consistent CSS naming conventions: Adopt a consistent class naming methodology (BEM, CUBE CSS, or a team-agreed pattern) to make class names self-documenting and prevent style conflicts.
Use CSS containment to limit repaint scope: Apply the contain property to components to tell the browser they are independent from the rest of the page, enabling rendering optimizations that reduce repaint and reflow scope.
Use CSS custom properties for design tokens: Define design system values (colors, spacing, typography) as CSS custom properties on :root to enable consistent theming, dynamic updates, and dark mode support.
Use CSS Grid for two-dimensional layouts: Use CSS Grid when you need to control both rows and columns simultaneously, such as page layouts, card grids, and complex component arrangements.
Use CSS logical properties for i18n and RTL support: Use CSS logical properties (margin-inline, padding-block, border-inline-start) instead of physical properties (margin-left, padding-top) to support right-to-left languages automatically.
Use CSS subgrid to align nested grid items to parent tracks: Use grid-template-columns: subgrid (or subgrid for rows) to make nested grid items participate in the parent grid's tracks, solving the card-content alignment problem without JavaScript height matching.
Use readable font sizes on mobile: Text must be large enough to read without zooming on mobile devices. Using relative units (rem/em) allows browser font size preferences to be respected.
Use relative units for responsive layouts: Use rem, em, %, vw, vh, and clamp() instead of fixed px values to build layouts that scale with user font size preferences and viewport dimensions.
Use transform and opacity for animations: Animate with CSS transform and opacity properties to keep animations running on the GPU compositor thread at 60fps, avoiding layout-triggering properties like top, left, width, and height.
Avoid implicit type coercion: Use strict equality (===), explicit type conversion, and Number/String/Boolean constructors to avoid JavaScript's implicit type coercion producing unexpected results.
Avoid inline JavaScript: Inline JavaScript is avoided. JavaScript is kept in external files for caching and maintainability.
Enable TypeScript strict mode in tsconfig.json: Enable "strict": true in tsconfig.json to activate the full suite of TypeScript type-checking flags and catch the most common runtime bugs at compile time.
Handle cross-origin requests securely: Use CORS correctly, validate message origins with postMessage, and understand the Same-Origin Policy to prevent cross-origin attacks.
Implement proper error handling: Use try-catch blocks and error boundaries to gracefully handle errors in async operations and UI components.
Lint JavaScript code: JavaScript code is linted with ESLint to detect errors and enforce coding standards.
Minify all JavaScript files: All JavaScript files are minified to reduce file size and improve loading performance.
Minimize costly DOM read/write operations: Batch DOM reads and writes separately to avoid layout thrashing β the performance problem caused by alternating between reading and writing layout properties.
Never use eval() or unsafe dynamic code execution: Avoid eval(), new Function(), setTimeout/setInterval with string arguments, and innerHTML with untrusted content β they execute arbitrary code and create critical XSS vulnerabilities.
Parse JSON safely with error handling: Always wrap JSON.parse() in try/catch and validate the parsed structure before use, as invalid JSON or unexpected data shapes cause runtime errors.
Prefer const and let over var: Use block-scoped const and let declarations instead of function-scoped var to avoid hoisting bugs and unintended variable mutations.
Prefer immutable data patterns: Use spread operators, Object.assign, and array methods that return new values instead of mutating objects and arrays in place, to make data flow predictable and debugging easier.
Prevent common memory leak patterns: Identify and avoid the most common JavaScript memory leak sources: forgotten event listeners, retained DOM references, closures holding large objects, and uncleared timers.
Split large JavaScript bundles: Use dynamic imports and route-based code splitting to break large bundles into smaller chunks that load on demand, reducing initial page load time.
Use ES modules (import/export): Use native ES module syntax for imports and exports instead of CommonJS require() to enable static analysis, tree-shaking, and better tooling support.
Use event delegation for dynamic content: Attach event listeners to stable parent elements rather than individual dynamic children to reduce memory usage and handle elements added to the DOM after page load.
Use import type for type-only imports: Use the import type syntax for imports that are only needed as TypeScript types, ensuring they are fully erased at compile time with zero runtime cost.
Use modern array and object methods: Use ES2015+ array methods (map, filter, reduce, find, flatMap) and object methods (Object.entries, Object.fromEntries, structuredClone) for cleaner, more expressive code.
Use Web Storage API safely: Use localStorage and sessionStorage with proper serialization, error handling, and security awareness to avoid data corruption and storage quota errors.
Validate external data at runtime with a schema library: Use Zod or Valibot to validate data from API responses, form inputs, localStorage, and environment variables β TypeScript types are erased at runtime and cannot protect against unexpected shapes.
Write internationalisation-friendly translation strings: Translation strings use message format patterns (ICU or similar) rather than string concatenation, and correctly handle pluralisation, gender, and variable interpolation.
Load non-critical code on user interaction: Defer JavaScript modules, widgets, and third-party code until the user signals intent through a click, focus, hover, or similar interaction.
Optimize pages for back/forward cache: Pages avoid back/forward cache blockers such as unload listeners and restore state correctly when a browser resumes them from memory.
Optimize third-party script loading: Load third-party scripts asynchronously to prevent blocking the main thread and improve page performance.
Optimize web font loading: Use efficient font formats and loading strategies to prevent layout shifts and invisible text.
Provide an offline fallback page: When the network is unavailable, users are shown a custom offline fallback page rather than the browser's generic error screen.
Show loading indicators: Loading indicators provide feedback during asynchronous operations to keep users informed of progress.
Stream HTML to the browser before the full response is ready: Use HTTP chunked transfer encoding and React renderToPipeableStream (or ReadableStream) to begin delivering HTML to the browser as soon as the first bytes are available, reducing Time to First Byte and First Contentful Paint.
Use fetchpriority to hint resource loading priority: The fetchpriority attribute is applied to critical images, scripts, and preload links to help the browser prioritise the most important resources and defer lower-priority ones.
Virtualize long lists and tables: Render only the visible subset of rows or cards in large collections to reduce DOM size, memory usage, and scroll-time rendering work.
Avoid autofocus on form fields: Form fields do not use the autofocus attribute which can disorient screen reader users and cause unexpected page behavior.
Avoid autoplaying media: Audio and video content does not autoplay, or provides immediate controls to pause or stop playback.
Avoid images of text: Real text is used instead of images containing text, except for logos or when specific visual presentation is essential.
Avoid meta refresh redirects: Meta refresh redirects can disorient users and cause accessibility issues by refreshing the page unexpectedly.
Avoid redundant entry in the same process: Information already provided earlier in a multi-step flow is auto-populated or available for selection instead of being typed again.
Ensure ARIA roles contain required child roles: Elements with certain ARIA roles must contain the required child roles or the widget structure will be broken for assistive technologies.
Ensure content remains usable without CSS: Content structure, instructions, and primary tasks remain understandable and operable when author CSS is disabled or replaced by user styles.
Include a skip navigation link: A skip navigation link is provided to allow keyboard users to bypass repetitive content and navigate directly to main content.
Match lang and xml:lang attributes: The lang and xml:lang attributes on the html element must have identical values to avoid conflicting language signals across HTML and XML parsers.
Meet minimum color contrast ratios: Text and background colors must have sufficient contrast to be readable by users with low vision or color blindness.
Place list items within list containers: List item elements (li) must always be direct children of a list container (ul, ol, or menu) to maintain valid HTML structure and correct screen reader announcements.
Prevent data loss from session timeouts: Users are warned before session expiry, can extend time when appropriate, and can re-authenticate or resume work without losing entered data.
Provide accessible authentication methods: Authentication flows avoid unnecessary cognitive tests and support assistive mechanisms such as password managers, paste, OTP autofill, and passkeys.
Provide accessible names for tree items: All elements with role="treeitem" must have a descriptive accessible name so screen reader users can navigate hierarchical tree widgets.
Provide alternative text for objects: The <object> element must contain alternative content to ensure accessibility for users who cannot view the primary content.
Provide audio descriptions for video: Videos with important visual content include audio descriptions that narrate visual information for blind users.
Provide captions for video content: Prerecorded video with audio must have synchronized captions. Live video must have real-time captions. This is required by WCAG 2.1 SC 1.2.2 and SC 1.2.4.
Provide sufficient touch target size: Interactive elements must have large enough touch targets so users with motor impairments can activate them accurately on touchscreen devices.
Respect reduced motion preferences: Animations respect user motion preferences, avoid seizure-triggering flashing, and include warnings for excessive motion.
Support text resizing to 200%: Text can be resized up to 200% without loss of content or functionality using browser settings.
Test with screen readers: Pages must be tested with actual screen reader software (NVDA, JAWS, VoiceOver, TalkBack) to verify announcements, focus order, and widget behavior beyond what automated tools can detect.
Use correct list structure: Lists (ul, ol) should only contain list item elements (li) to ensure they are correctly interpreted by assistive technology.
Use descriptive link text: Link text clearly describes the destination or purpose without relying on surrounding context.
Use inclusive language: Content uses inclusive, non-discriminatory language that welcomes all users regardless of ability, gender, race, or background.
Use landmark regions correctly: Proper landmark regions (main, nav, footer) help users navigate the page more efficiently.
Use logical heading hierarchy: Headings follow a sequential structure (h1 to h6) that reflects the content hierarchy without skipping levels.
Use navigation landmark regions: Page navigation uses nav elements with proper ARIA labels to distinguish multiple navigation regions.
Add disclaimers to sensitive content: Checks for appropriate disclaimers on sensitive content types such as medical, legal, financial, and affiliate pages
Add FAQPage schema markup: Validates FAQPage JSON-LD structured data for question-and-answer content
Add structured data markup: Schema.org structured data (JSON-LD) is implemented for rich search results.
Add Twitter Card meta tags: Validates Twitter (X) Card meta tags for correct card type, image dimensions, and required fields.
Add VideoObject schema to video pages: Checks for VideoObject structured data on pages containing video content to enable video rich results in Google Search.
Audit all noindex pages: Lists and reviews all pages blocked from indexing to ensure critical content is accessible.
Link to active social profiles: Checks for links to the organization's social media profiles to help search engines connect the site to its social entity and build E-E-A-T signals.
Publish llms.txt for documentation-heavy sites: Offer an optional llms.txt index that points AI tools to high-value documentation pages and, when useful, a fuller llms-full.txt companion.
Resolve internal broken links: Detects and fixes internal links that return 404 or 5xx errors to improve user experience.
Robots Meta Conflict: Detects pages blocked by robots.txt that also carry noindex meta tags, creating a paradox where the directive is never read.
Schema + Noindex Conflict: Detects pages that carry rich result schema markup but are blocked from indexing via noindex or robots.txt.
Service Area Pages: Checks for properly structured service-area or location pages for businesses serving multiple geographic regions.
Tel & Mailto Links: Validates that phone numbers use the tel: scheme and email addresses use the mailto: scheme for one-click contact on mobile devices.
URL Special Characters: Checks for problematic special characters in URL paths that can cause crawling, parsing, or canonicalization issues.
URL Stop Words: Flags common stop words in URL slugs that add length without improving keyword relevance.
Use a single descriptive H1: Validates that each page has exactly one H1 tag containing a descriptive, keyword-relevant heading
Use trailing slashes consistently: Checks for consistent trailing slash usage across all URLs to avoid duplicate content and canonicalization issues.
Use valid JSON-LD structured data: Validates JSON-LD structured data for syntax correctness, required properties, and schema.org compliance
Weak Internal Links: Detects pages with very few dofollow internal links pointing to them, indicating poor link equity distribution and crawl discoverability.
WebSite Search Schema: Checks for WebSite schema with SearchAction to enable the Sitelinks Searchbox in Google Search results.
Adblock Element Hiding: Checks for HTML elements and CSS classes that would be hidden by common adblockers, causing layout breaks or missing functionality for users with ad blocking enabled.
Audit dependencies for known vulnerabilities: Dependencies are regularly scanned for known security vulnerabilities using automated tooling, and critical findings are remediated before deployment.
Avoid mixed content on HTTPS pages: An HTTPS page that loads resources over HTTP has mixed content β browsers block or warn about these requests, breaking functionality and undermining transport security.
Blocked Tracking Links: Links and resources pointing to known tracking or advertising domains may be blocked by adblockers, breaking navigation and functionality for a significant portion of users.
External Link Security: Links that open in a new tab using target='_blank' must include rel='noopener noreferrer' to prevent the opened page from accessing the opener's window context.
Leaked Environment Variables: Checks for exposed API keys, tokens, passwords, and other secrets embedded in HTML source, JavaScript bundles, or client-accessible files.
Link to your terms of service in the footer: Websites offering services to users should publish Terms of Service and link to them from every page β this establishes the legal agreement governing use of the service.
Protect public forms with CAPTCHA: Public forms that accept user input without authentication must include bot protection to prevent spam, credential stuffing, and automated abuse.
Redirect HTTP to HTTPS: All HTTP requests must be permanently redirected (301) to HTTPS to prevent users from accessing your site over an insecure connection.
Secure password input fields: Password fields implement security best practices including proper autocomplete, show/hide toggle, and strength indicators.
Serve all pages over HTTPS: Every page and resource on your site must be delivered over HTTPS to protect user data in transit and enable modern browser features.
Set a Permissions-Policy header: The Permissions-Policy header lets servers restrict which browser features (camera, microphone, geolocation, etc.) can be used in a page or its embedded iframes.
Set a Referrer-Policy header: The Referrer-Policy header controls how much referrer information is sent when navigating from your site to another, protecting user privacy and preventing leaking sensitive URL parameters.
Set an HSTS header: The Strict-Transport-Security response header tells browsers to always use HTTPS for your domain, preventing protocol downgrade attacks and cookie hijacking.
Set an X-Frame-Options header: The X-Frame-Options header controls whether your page can be embedded in an iframe, frame, or object β preventing clickjacking attacks.
Set Secure, HttpOnly, and SameSite flags on session cookies: All session and authentication cookies are issued with the Secure, HttpOnly, and an appropriate SameSite flag to prevent interception, JavaScript exfiltration, and cross-site request forgery.
Set X-Content-Type-Options: nosniff: The X-Content-Type-Options: nosniff header prevents browsers from MIME-sniffing a response away from the declared Content-Type, blocking a class of drive-by download and XSS attacks.
Store authentication tokens securely: Sensitive authentication tokens are stored in httpOnly cookies rather than localStorage or sessionStorage to prevent theft via cross-site scripting attacks (OWASP A07).
Submit forms over HTTPS: All HTML form actions must point to HTTPS URLs to ensure form data is encrypted in transit and cannot be intercepted by network attackers.
Lazy load offscreen images: Images below the visible viewport use loading="lazy" to defer download until the user scrolls near them, reducing initial page load time.
Manage inline SVG size and complexity: Large or complex SVGs inlined in HTML are extracted to external files or components, preventing them from bloating the HTML document and blocking parsing.
Optimise images for faster loading: All images are compressed and metadata-stripped before deployment, removing unnecessary bytes without visible quality loss.
Optimize all images for web: Images are optimized with appropriate formats, compression, and modern techniques.
Optimize SVG files: SVG files are optimized with SVGO to remove unnecessary metadata and reduce size.
Provide meaningful alt text for images: Every informative image has a descriptive alt attribute; decorative images use alt="" to be ignored by screen readers.
Serve images at the correct display size: Images are not significantly larger than their display dimensionsβserving a 2000px image for a 400px container wastes bandwidth and hurts LCP.
Serve images from a CDN: Images are served from a CDN with automatic optimization, resizing, and format conversion.
Set explicit width and height on images: All elements have explicit width and height attributes so browsers can reserve space before the image loads, preventing layout shift.
Use and for image captions: Images with visible captions are wrapped in with a child, creating a semantic association between image and caption.
Use with an fallback: Every element contains a required fallback as its last child, ensuring images display in all browsers including those that don't support .
Use descriptive image filenames: Image filenames are descriptive and human-readable, using lowercase letters, hyphens as separators, and meaningful words that reflect the image content.
Use modern image formats (WebP, AVIF): Images are served in modern formats (WebP or AVIF) instead of legacy JPEG/PNG where browser support allows, reducing file size without visible quality loss.
Use srcset for responsive images: Images wider than 100px use the srcset attribute to offer multiple resolution variants, letting the browser download the optimal size for the user's viewport and device pixel ratio.
Enforce performance budgets in CI: Define measurable performance thresholds (bundle size, Lighthouse scores, Core Web Vitals) and fail CI builds automatically when they're exceeded.
Implement consumer-driven contract testing for API boundaries: Consumer-driven contract tests (Pact) define and verify the API contracts between the frontend consumer and backend provider, catching integration mismatches before they reach production.
Implement end-to-end testing: Use E2E testing frameworks like Playwright or Cypress to test critical user journeys.
Include accessibility testing: Automate accessibility testing with tools like axe-core, jest-axe, or Playwright's accessibility testing.
Integrate real-time error monitoring in production: A real-time error monitoring service captures, groups, and alerts on unhandled exceptions and promise rejections in production so issues are discovered before users report them.
Test on real mobile devices and viewports: Verify your application on real mobile devices and browser DevTools device emulation to catch touch interaction issues, viewport bugs, and mobile-specific rendering problems.
Use visual regression testing: Capture screenshots of components and pages, then automatically compare them against approved baselines to detect unintended visual changes before they reach production.
Write integration tests for key workflows: Test how multiple units of code work together β API routes with their database queries, form submissions with validation, and component trees with their state management.
Write unit tests: Critical functionality has unit tests with good coverage for reliability.
Avoid third-party cookies: Third-party cookies set by external domains track users across sites without their knowledge. Modern browsers are phasing them out, and regulations like GDPR and CCPA require consent before setting them.
Collect only the minimum personal data necessary: Limit data collection to only what is strictly required for the stated purpose, in line with GDPR Article 5(1)(c) data minimisation principles.
Implement a user-facing data deletion mechanism: Provide users with a clear way to request deletion of their personal data, fulfilling GDPR Article 17 (right to erasure / right to be forgotten).
Link to your privacy policy in the footer: Websites that collect any personal data must publish a privacy policy and link to it prominently β this is a legal requirement under GDPR, CCPA, and most other privacy regulations.
Show a cookie consent notice: Websites that set non-essential cookies must obtain prior, informed user consent under GDPR, CCPA, and similar privacy regulations before cookies are placed.