Webmaster resource directory — Webmaster Helper

Specifications and core documentation

The primary sources. When a blog post and one of these disagree, these win.

MDN Web Docs developer.mozilla.org
The reference for HTML, CSS, JavaScript and HTTP. The HTTP headers index is the fastest way to settle an argument about what a header actually does.
HTTP on MDN developer.mozilla.org
Status codes, headers, caching, CORS and content negotiation, each with the spec text alongside the practical explanation.
web.dev web.dev
Google’s guidance on performance, Core Web Vitals and modern patterns. Treat it as well-informed advice from a search engine, not neutral ground.
WHATWG HTML Standard html.spec.whatwg.org
The living HTML specification. Dense, but definitive on parsing behaviour and what element nesting is actually legal.
W3C Technical Reports w3.org
Index of W3C specifications, including WCAG, ARIA and the CSS modules.
RFC Editor rfc-editor.org
The HTTP, DNS, TLS and email RFCs. RFC 9110 replaced the old 723x series for HTTP semantics; 9112 covers HTTP/1.1 messaging.
Schema.org schema.org
The vocabulary behind structured data. Start from the type you need and read its required and recommended properties.
Can I use caniuse.com
Browser support tables backed by usage data. Check here before shipping a CSS or JS feature you read about this week.
WCAG 2.2 w3.org
The accessibility success criteria themselves. The Understanding documents linked from each criterion are more readable than the criterion.

Search engines, official

What the crawlers themselves document. Start here before any third-party SEO claim.

Google Search Central developers.google.com
Documentation, the crawling and indexing guides, and the structured data reference. The authoritative source on what Google supports.
Google Search Console search.google.com
Your own impressions, queries, indexing status and Core Web Vitals from real users. Nothing a scanner tells you replaces this — verify your property first.
Rich Results Test search.google.com
Checks whether Google can parse your structured data and which rich result it qualifies for. Use it on the live URL, not a paste.
Schema Markup Validator validator.schema.org
Validates schema.org markup generally, without Google’s rich-result filter. Use this when your type is valid but not eligible for a rich result.
Bing Webmaster Tools bing.com
Bing’s equivalent of Search Console, and increasingly relevant because several AI answer engines are built on its index.
robots.txt specification developers.google.com
How Google actually parses robots.txt, including the precedence rules that trip people up. RFC 9309 standardised the format.
Sitemaps protocol sitemaps.org
The XML sitemap format, the 50,000-URL and 50 MB limits, and sitemap index files.
IndexNow indexnow.org
A push protocol for telling Bing, Yandex and others that a URL changed, instead of waiting to be crawled. Google does not participate.

Performance measurement

Lab tools model a load; field data records real ones. You need both, and they will disagree.

PageSpeed Insights pagespeed.web.dev
Runs Lighthouse and, if your URL has enough traffic, shows real Chrome user data beside it. The field numbers are the ones that count for ranking.
WebPageTest webpagetest.org
The deepest free test available: real devices, chosen locations, connection throttling, filmstrips and full waterfalls. Start here when you need to know why, not just how slow.
Lighthouse developer.chrome.com
Built into Chrome DevTools and scriptable via CLI or CI. Audits performance, accessibility, SEO and best practices in one pass.
Chrome UX Report developer.chrome.com
The public dataset behind the field numbers, queryable by origin or URL. Good for comparing yourself against competitors honestly.
HTTP Archive httparchive.org
Millions of sites crawled monthly, with trend reports. Useful for answering "is 2 MB normal?" with data rather than instinct.
Core Web Vitals web.dev
Definitions and thresholds for LCP, CLS and INP, which replaced FID in 2024. Read the thresholds before optimising for them.
Squoosh squoosh.app
Browser-based image compression with a live side-by-side comparison. Fastest way to see what AVIF buys you on your own images.

Security and TLS

Headers, certificates and configuration. Most of this is a one-line change you only make once.

SSL Labs Server Test ssllabs.com
The definitive TLS audit: protocols, cipher order, chain issues, and per-client handshake simulation. Slow but thorough; grades below A are worth reading in full.
Mozilla HTTP Observatory developer.mozilla.org
Scores your response headers and explains each one. A fast way to find the headers you are missing.
Mozilla SSL Configuration Generator ssl-config.mozilla.org
Produces a correct, current TLS block for nginx, Apache, Caddy, HAProxy and more. Copy the Intermediate profile unless you know you need Old.
Security Headers securityheaders.com
A quick graded summary of the headers on a URL, with links to the specs for each.
OWASP Secure Headers Project owasp.org
What each security header does, the recommended value, and what breaks when you set it too tightly.
CSP Evaluator csp-evaluator.withgoogle.com
Paste a Content-Security-Policy and it points out the bypasses. Most hand-written policies fail here the first time.
Let’s Encrypt documentation letsencrypt.org
Free automated certificates. Read the rate limits page before scripting issuance, and the challenge types page before choosing DNS-01.
crt.sh crt.sh
Searchable Certificate Transparency logs. Shows every certificate ever issued for your domain — including ones you did not order.
testssl.sh testssl.sh
Command-line TLS testing you can run against an internal host that a public scanner cannot reach.
internet.nl internet.nl
Tests IPv6, DNSSEC, TLS and mail authentication together, with plain-language explanations of each failure.

DNS and domains

Where outages come from, and the hardest layer to debug from inside your own network.

DNS Lookup Tools dnslookuptools.com
Live DNS record lookups, WHOIS over port 43, delegation tracing and TLS inspection, all over the wire protocol rather than a JSON API. A sister site to this one.
DNSViz dnsviz.net
Visualises the full delegation and DNSSEC chain for a zone. The clearest way to see where a DNSSEC validation failure actually occurs.
Zonemaster zonemaster.net
A thorough, standards-based zone health check run by IIS and AFNIC. Catches delegation and consistency faults other tools miss.
ICANN Lookup lookup.icann.org
Registration data straight from ICANN rather than a reseller’s branded WHOIS page.
IANA Root Zone Database iana.org
Every TLD, its sponsor and its WHOIS server. The starting point for any registry question.
DNS Checker dnschecker.org
Queries resolvers worldwide at once, which is what you want when checking whether a change has propagated.
MXToolbox mxtoolbox.com
Mail-focused DNS lookups plus blacklist checks. The blacklist report is the fastest answer to "why is our mail bouncing?".
Cloudflare Radar radar.cloudflare.com
Internet-wide traffic, outage and protocol-adoption data. Useful for confirming that a problem is not yours.

Email authentication

SPF, DKIM and DMARC are DNS records, which makes them a webmaster problem whether you want them or not.

DMARC.org dmarc.org
The specification and the deployment overview. Read the phased rollout advice before setting p=reject.
Learn DMARC learndmarc.com
Send a message to it and watch SPF, DKIM and DMARC evaluated step by step against your real records. The best way to understand alignment.
Mail Tester mail-tester.com
Scores a real message you send it, covering authentication, content and blacklisting. Ten free checks a day.
Google Postmaster Tools postmaster.google.com
Your domain’s reputation, spam rate and authentication success as Gmail sees it. Required reading if you send any volume.
dmarcian dmarcian.com
DMARC aggregate report parsing plus a solid set of free record inspectors and a well-written knowledge base.

Servers and infrastructure

Configuration references and the operational tools that go with them.

nginx documentation nginx.org
The official module reference. The directive index is the only reliable way to settle inheritance questions — location-block behaviour in particular.
Apache HTTP Server docs httpd.apache.org
Complete directive reference including mod_rewrite, mod_headers and mod_deflate, with the rewrite guide worth reading before you write a rule.
Caddy documentation caddyserver.com
A web server that obtains and renews TLS certificates automatically. Often the shortest route from zero to correct HTTPS.
DigitalOcean tutorials digitalocean.com
Consistently accurate, version-pinned Linux and web-stack guides. Check the Ubuntu version in the title before following along.
Arch Wiki wiki.archlinux.org
The best Linux documentation on the internet, and almost all of it applies to any distribution once you account for package names.
systemd manual pages freedesktop.org
Unit file, timer and journal reference. systemd.timer plus systemd.time replaces most of what you used cron for.
crontab.guru crontab.guru
Explains a cron expression in English as you type it. Verify every schedule here before it goes live.
explainshell explainshell.com
Breaks a shell command into its flags with the matching man page text. Invaluable before you paste a command you found online.
tldr pages tldr.sh
Community examples for command-line tools — the five invocations you actually use, instead of the full man page.
Nginx config generator digitalocean.com
Builds a full nginx configuration from checkboxes, with sane TLS, caching and security defaults.
UptimeRobot uptimerobot.com
Free external monitoring. Any check from outside your own network beats a cron job on the same box that goes down with it.
Fail2ban github.com
Bans hosts that fail authentication repeatedly. Add your own address to ignoreip before you lock yourself out — everyone does it once.
GoAccess goaccess.io
A real-time log analyser that runs in a terminal or renders an HTML report. The honest answer to what is actually hitting your server.

Accessibility

Overlaps heavily with SEO: the same structure that assistive technology needs is the structure crawlers read.

WAVE wave.webaim.org
Annotates a page in place with its accessibility errors. The fastest way to see contrast and structure problems in context.
axe DevTools deque.com
The rules engine behind most automated accessibility testing, available as a browser extension and a CI library.
WebAIM Contrast Checker webaim.org
Checks a foreground and background pair against WCAG AA and AAA. 4.5:1 for body text, 3:1 for large text and UI components.
ARIA Authoring Practices Guide w3.org
Keyboard and ARIA patterns for real components. Read the pattern before you build a custom dropdown.
Pa11y pa11y.org
Command-line and CI accessibility testing, so a regression fails the build instead of reaching production.

Validators and inspectors

Cheap checks that catch the errors a browser silently recovers from.

W3C Markup Validation Service validator.w3.org
Finds unclosed tags, duplicate IDs and invalid nesting. Browsers forgive these; parsers and crawlers do not always agree on how.
W3C CSS Validator jigsaw.w3.org
Catches typos and unsupported properties. Expect warnings about vendor prefixes — those are fine.
W3C Link Checker validator.w3.org
Crawls a page and reports broken and redirected links. Slow, so point it at one section at a time.
JSON-LD Playground json-ld.org
Expands and flattens JSON-LD so you can see what a consumer actually reads from your markup.
Wayback Machine web.archive.org
Historical snapshots. The only way to recover a page you deleted without a backup, and the quickest way to prove what a URL used to say.

Analytics and measurement

Know what people do on the site before you change it.

Google Analytics help support.google.com
GA4 documentation. Budget real time for the event-based model if you are coming from Universal Analytics — almost nothing maps directly.
Matomo matomo.org
Self-hostable analytics that keeps the data on your own server, with full visitor logs. The usual answer when GA is not acceptable.
Plausible plausible.io
Lightweight, cookie-free analytics with a script under 1 KB. Open source and self-hostable.
Umami umami.is
Open-source, privacy-focused analytics designed to be self-hosted on a small server.
Looker Studio lookerstudio.google.com
Free dashboards over Search Console, GA4 and your own data. Reporting without exporting spreadsheets by hand.

Reading and communities

Where the field argues things out. Useful for context, not for authority.

Server Fault serverfault.com
Stack Exchange for system and network administration. Search before asking; the nginx and DNS answers are deep.
Stack Overflow stackoverflow.com
Still the largest archive of specific, answered programming problems. Check answer dates — accepted answers age badly.
Smashing Magazine smashingmagazine.com
Long, well-edited articles on front-end, performance and accessibility practice.
CSS-Tricks css-tricks.com
The Almanac is a reliable CSS property reference, and the archive covers layout problems you are about to hit.
A List Apart alistapart.com
Two decades of writing about web standards and craft. Slower, more considered, frequently still correct.
Search Engine Roundtable seroundtable.com
Daily coverage of search industry changes and Google statements, with the sources linked.
Search Engine Land searchengineland.com
Broader search and marketing news, including algorithm-update coverage.
Ahrefs blog ahrefs.com
Data-led SEO studies from a crawler with its own index. Vendor-published, so read the methodology.
Moz blog moz.com
The Whiteboard Friday archive is a good conceptual grounding in how search works.
Cloudflare developer docs developers.cloudflare.com
Even without using Cloudflare, the explanations of caching, TLS modes and DNS behaviour are among the clearest available.

How this list is maintained

Everything here is either a primary source or a tool that has been around long enough to be worth learning. Nothing on this page is a paid placement and there are no affiliate links. Outbound links are marked rel="noopener external", and if one has rotted, it is a bug worth reporting.