The Boring HTML Foundations That Still Break Real Sites: Doctype, Lang, Charset, Viewport, and Favicon
Why small HTML foundation signals still matter in production, and how to fix them before they cause strange breakage.
Read articleTechnical guidance from real scan results.
Protocol correctness, machine-readable files, DNS, and platform hygiene.
Redirect Chain Too Long — Multiple Hops Before the Real Page Loads
Learn how Scavo measures redirect hops, why chains slow users and crawlers down, and how to flatten protocol, host, and legacy URL redirects into cleaner routes.
Open guide404 Page Returns Wrong HTTP Status Code
When a deleted or broken URL returns HTTP 200, search engines index it as a real page — polluting your index with dead content and wasting crawl budget. This is called a "soft 404" and Google specifically warns against it. Your 404 page should return a proper 404 status code while still showing a helpful message to users.
Open guideAnalytics Not Installed or Not Firing
Without analytics, every business decision about your website becomes a guess. You can't see which pages convert, where users drop off, which channels drive traffic, or whether changes improve performance. This is the foundation of data-driven optimization — if it's missing, you're flying blind.
Open guideCMS or Server Version Exposed in Headers
When attackers can see you're running WordPress 6.3 or Apache 2.4.51, they can check public CVE databases for known exploits specific to your exact version. Removing version disclosure is simple server hardening — it doesn't fix vulnerabilities, but it removes the signpost that tells attackers exactly where to look.
Open guideCharacter Encoding (UTF-8) Not Declared
Without a declared charset, browsers use heuristics to guess the encoding. This frequently garbles accented characters (é becomes é), em dashes, curly quotes, and any non-ASCII text. For multilingual sites, this is catastrophic. The fix is one meta tag: <meta charset="UTF-8"> before any other content in the head.
Open guideDNS A Record IP Address Changed
DNS A record changes redirect your traffic to a different server. This is expected during hosting migrations, but an unexpected change could mean your domain has been compromised or your hosting provider changed infrastructure without notice. Monitor A record changes to catch problems before users experience downtime or are redirected to malicious servers.
Open guideDomain Registration Expiring Soon
A lapsed domain takes your entire site offline instantly, and recovery can take days even after renewal due to DNS propagation. Worse, expired domains are actively targeted by squatters and spammers who register them within hours. Your search rankings, email delivery, and brand reputation all depend on keeping your domain active. Set auto-renewal and monitor expiry dates.
Open guideEmail Authentication Missing — SPF, DKIM, or DMARC Not Set
Only 18% of the top 10 million domains publish a valid DMARC record, and just 4% enforce a reject policy (Valimail, 2024). Fully authenticated senders are 2.7x more likely to reach the inbox than unauthenticated ones. Meanwhile, an estimated 3.4 billion phishing emails are sent daily, with domain spoofing as the primary vector. Without SPF, DKIM, and DMARC, anyone can send emails that appear to come from your domain.
Open guideFavicon Missing — No Browser Tab Icon
A favicon appears in browser tabs, bookmarks, browser history, and Google's search results. Without one, your site looks unfinished and is harder for users to find among open tabs. It's also a trust signal — professional sites have favicons, and their absence can make visitors question legitimacy.
Open guideHTML Doctype Missing — Browser Rendering in Quirks Mode
Without <!DOCTYPE html> at the top of your HTML, browsers enter "quirks mode" — applying legacy rendering rules from the IE5 era that break modern CSS features like box-sizing, flexbox behaviour, and font rendering. This causes layouts to look different across browsers and makes debugging CSS issues significantly harder.
Open guidehumans.txt Not Found
humans.txt is an optional file that lists who built the site, what technologies were used, and contact information. It's not critical for SEO or functionality, but it's a small transparency signal that helps security researchers reach you, gives credit to your team, and shows you care about web standards.
Open guideHTML Lang Attribute Missing
Screen readers use the lang attribute to select the correct pronunciation engine — without it, they apply default language rules that mispronounce words and ignore language-specific grammar. Browser translation tools also rely on lang to detect when to offer translation. It's a single attribute on the html element that takes 5 seconds to add.
Open guideViewport Meta Tag Missing — Mobile Rendering Broken
Without a viewport meta tag, mobile browsers assume your page is designed for desktop and zoom out to fit the full width on a small screen. Everything becomes unreadably small. This is a single line of HTML (meta name="viewport" content="width=device-width, initial-scale=1") that every mobile-friendly site needs.
Open guideContent Overflows Viewport on Mobile — Horizontal Scroll
Horizontal scrolling on mobile is one of the strongest negative UX signals. Users expect vertical-only scrolling, and content that overflows the viewport looks broken. Common causes: fixed-width elements, unresponsive images, tables without scroll wrappers, or absolute-positioned elements that extend beyond the screen edge.
Open guideDNS Nameserver Changed — Possible Unauthorized Modification
Nameserver changes control where your domain's traffic is routed. An unauthorized change means someone can intercept all your traffic, email, and subdomains. If you didn't initiate this change, investigate immediately — check your domain registrar account for unauthorized access. Legitimate causes include hosting migrations or CDN changes.
Open guiderobots.txt Missing, Invalid, or Misconfigured
A missing robots.txt means search engines crawl everything — including admin pages, staging content, and duplicate URL parameters. A misconfigured one can accidentally block your entire site from indexing. Nearly 38% of indexed websites now include AI-specific restrictions in robots.txt (EngageCoders, 2024), making it also your primary control point for AI crawler access.
Open guide