# The Website Specification — checklist (10 items)

## Well-Known URIs
- [ ] **Well-known URIs** _(recommended)_ — The /.well-known/ path prefix is a standardised place to publish site-level metadata. RFC 8615 defines it; IANA keeps the registry of allowed names.
      https://specification.website/spec/well-known/well-known-overview/
- [ ] **/.well-known/change-password** _(optional)_ — A standard redirect endpoint that points password managers and users at your real change-password page. Only applicable if the site has user accounts — sites without logins have nothing to point at and should not implement it.
      https://specification.website/spec/well-known/change-password/
- [ ] **/.well-known/webauthn** _(optional)_ — A JSON document at /.well-known/webauthn lists the origins allowed to use passkeys scoped to a single Relying Party ID. It enables WebAuthn Related Origin Requests — one passkey shared across several domains you own. Only applicable if the site uses passkeys across more than one origin.
      https://specification.website/spec/well-known/webauthn/
- [ ] **/.well-known/openid-configuration** _(optional)_ — A JSON discovery document that describes an OpenID Connect provider's endpoints and capabilities. Only required if you are an OIDC identity provider.
      https://specification.website/spec/well-known/openid-configuration/
- [ ] **/.well-known/api-catalog** _(recommended)_ — RFC 9727 publishes a machine-readable index of the APIs and resources a host exposes. Served as a Linkset (RFC 9264) JSON document, discoverable via the api-catalog link relation.
      https://specification.website/spec/well-known/api-catalog/
- [ ] **/.well-known/webfinger** _(optional)_ — WebFinger (RFC 7033) resolves an account identifier such as acct:user@example.com to a set of links. The Fediverse uses it to discover ActivityPub actors.
      https://specification.website/spec/well-known/webfinger/
- [ ] **/.well-known/apple-app-site-association** _(optional)_ — A JSON file that tells iOS, iPadOS and macOS which Apple apps may handle which URLs on your domain. Required for Universal Links and several other Apple features.
      https://specification.website/spec/well-known/apple-app-site-association/
- [ ] **/.well-known/assetlinks.json** _(optional)_ — Android's Digital Asset Links file proves that an Android app and a web domain are owned by the same entity. It powers App Links and Smart Lock for Passwords.
      https://specification.website/spec/well-known/assetlinks-json/
- [ ] **/.well-known/nodeinfo** _(optional)_ — A discovery URI for federated platforms. It returns links to NodeInfo documents that describe the software, version and basic statistics of a server.
      https://specification.website/spec/well-known/nodeinfo/
- [ ] **/.well-known/traffic-advice** _(optional)_ — A JSON file that tells private prefetch proxies — most notably Chrome's — whether to send prefetch traffic to your origin, and at what fraction. Optional opt-out / throttle mechanism, provisionally registered with IANA.
      https://specification.website/spec/well-known/traffic-advice/