# General housekeeping: the 14 checks Branding, trust and plumbing. Worth tidying; almost none of it changes whether you get found. Every check the site check runs in this group, with why it matters and what to do. All hundred: https://oftheard.in/docs/checks ### Compression medium · Barely affects AI search **Why it matters.** Uncompressed HTML makes every crawl slower and larger. It is a one-line server setting and it applies to every request a crawler makes. **What to do.** Enable gzip or brotli for text/html, text/css and application/javascript at your server or CDN. ### HSTS low · Barely affects AI search **Why it matters.** Strict-Transport-Security tells a browser never to try http:// for this host again, which removes the first insecure request of every visit rather than redirecting it. Its search effect is marginal — the redirect is what crawlers act on — but it is a one-line header and it closes the window the redirect leaves open. **What to do.** Send "Strict-Transport-Security: max-age=31536000; includeSubDomains" on HTTPS responses. Start with a shorter max-age if you are not certain every subdomain serves HTTPS, because this is not quickly reversible. *When it is not scored.* No Strict-Transport-Security header. Worth adding, and not scored — the HTTPS redirect above is what actually matters for crawling. ### app-ads.txt low · No effect on AI search **Why it matters.** The in-app counterpart to ads.txt. No search or AI effect. **What to do.** Only needed if you sell advertising inside a mobile app. *When it is not scored.* Not present — only needed if you sell in-app advertising. Not scored. ### security.txt medium · Barely affects AI search **Why it matters.** Not a ranking factor, but it is a cheap, standardised, machine-verifiable signal that a real organisation actively maintains this site. Trust signals compound into whether a model treats you as an authority worth quoting. **What to do.** Add /.well-known/security.txt per RFC 9116 with Contact and Expires fields. Expires is mandatory — without it the file is treated as stale. ### Apple App Site Association low · No effect on AI search **Why it matters.** Lets links to your site open your iOS app directly instead of bouncing through Safari. Only relevant if you ship a mobile app. **What to do.** Serve /.well-known/apple-app-site-association as application/json with NO file extension — the missing extension trips up most static hosts. *When it is not scored.* Not present — only needed if you ship an iOS app. Not scored. ### Android asset links low · No effect on AI search **Why it matters.** The Android equivalent of AASA — verifies your domain owns the app so links open natively. **What to do.** Serve /.well-known/assetlinks.json with your package name and signing certificate fingerprint. *When it is not scored.* Not present — only needed if you ship an Android app. Not scored. ### ads.txt low · No effect on AI search **Why it matters.** Declares which parties may sell your ad inventory, which stops spoofing. No effect whatsoever on search or AI visibility. **What to do.** Only needed if you sell advertising. Your ad network provides the exact lines. *When it is not scored.* Not present — only needed if you sell advertising. No search or AI effect. Not scored. ### favicon.ico high · Barely affects AI search **Why it matters.** Google fetches /favicon.ico from that exact path regardless of your tags, and answer engines increasingly show it beside your citation. Missing it means a blank grey square next to your brand in an AI answer, right where a competitor shows a logo. **What to do.** Place a multi-resolution .ico at the site root. Keep it there even if you also serve modern formats. ### favicon.svg low · No effect on AI search **Why it matters.** Scales cleanly on high-DPI displays and can adapt to dark mode via an embedded media query. Cosmetic, but it is the difference between a crisp mark and a blurry 16px bitmap. **What to do.** Add an SVG icon and reference it with . ### apple-touch-icon.png low · No effect on AI search **Why it matters.** Used when someone saves your site to an iOS home screen. Without it, iOS screenshots your page and uses that — almost always unreadable. **What to do.** Add a 180×180 PNG at /apple-touch-icon.png with no transparency. ### Web manifest low · No effect on AI search **Why it matters.** Enables install-to-homescreen and sets the browser theme colour on mobile. A mild mobile-quality signal and a prerequisite for any PWA behaviour. **What to do.** Add /site.webmanifest with name, short_name, 192px and 512px icons, and theme_color. ### /.well-known/ served high · Barely affects AI search **Why it matters.** Many hosts, CDNs and static site frameworks block dot-prefixed directories by default. If that is happening, every file you place in /.well-known/ silently returns 404 and you would never know without testing it in production. **What to do.** Explicitly allow /.well-known/ in your server or host config, then curl each path against production — not localhost. ### Legacy files low · No effect on AI search **Why it matters.** humans.txt is a credits file for the people who built the site. Pleasant, and read by nobody automated: no search engine or answer engine does anything with it. **What to do.** Nothing to do. Safe to delete if present. *When it is not scored.* Not present — fine, this has no search or AI value. ### Trackers and consent medium · Barely affects AI search **Why it matters.** Every analytics, advertising or chat script on a page is another company watching your visitors, and most of them set cookies the moment the page loads. India's DPDP Act expects a privacy notice wherever personal data is taken; the EU and UK expect to be asked before a non-essential cookie is set. A buyer's legal team reads this before a contract, and a consent wall that hides the page until somebody clicks hides it from a crawler too. **What to do.** Link a privacy policy from every page. Where a script sets cookies, hold it behind consent: Google's Consent Mode with analytics denied by default and one small notice, or a cookieless tool such as Plausible or Fathom that needs none.