website-checklist.md

• Replace favicon assets with the provided thinko branding package
• Replace remaining WinXP branding in page title, manifest, and meta tags with thinko

Basics

• Favicon (favicon.ico, apple-touch-icon, mask-icon)
• Web app manifest (manifest.json)
• Theme color meta tag
• robots.txt
• sitemap.xml
• .well-known/security.txt

Performance

• Loading skeletons or spinners
• Lazy loading for images/iframes
• Code splitting
• Minified CSS/JS
• Gzip/Brotli compression
• CDN for static assets
• Cache headers (Cache-Control, ETag)
• Preload critical resources
• DNS prefetch/preconnect
• Image optimization (WebP, srcset)
• Font loading strategy
• Critical CSS inlined

SEO

• Unique title tags per page
• Meta description
• Canonical URLs
• Open Graph tags
• Twitter Card tags
• Structured data (JSON-LD)
• Semantic HTML (header, nav, main, footer)
• Alt text for images

Accessibility

• ARIA labels and roles (only where needed)
• Keyboard navigation support
• Visible focus indicators
• Color contrast (WCAG AA+)
• Screen reader testing
• Skip links
• Associated form labels
• ARIA-live for dynamic errors

Security

• HTTPS enforced
• HSTS header
• Content Security Policy
• X-Frame-Options / frame-ancestors
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• Secure cookies (HttpOnly, SameSite)
• CSRF tokens
• Rate limiting
• Input validation/sanitization
• Moderation flow for user-submitted drawings

UI/UX

• Responsive design
• Touch targets >= 44x44 px
• Loading states
• Custom 404/500 pages
• Consistent navigation

Legal & Privacy

• Privacy policy
• Terms of service
• GDPR/CCPA compliance
• Data deletion process
• Contact information
• Copyright notice

Development & Deployment

• Environment variables documented
• CI/CD pipeline
• Automated tests (unit, e2e)
• Linting (ESLint, Prettier)
• Build pipeline
• Source maps (development)
• Uptime monitoring
• Backup strategy
• Rollback plan