No scripts. No trackers. No bloat. The 2026 Edition.
A conformance standard for websites, and a checker that tests any page against it. HTML and CSS only: no JavaScript, no third-party requests, no cookies, no autoplay, and a limit on page weight.
Most pages are documents. Documents do not need a framework, a bundler, and forty npm packages. They need markup and a stylesheet.
A page with no scripts, no third-party requests, and no cookies has nothing to put in a cookie banner. Nothing runs in your browser. Nothing about your visit is sent to anyone except the site you chose to visit. Nothing is stored in your browser to recognise you next time. Nothing plays unless you press play.
This is the point of the spec: conformance gives visitors a guarantee of privacy. The guarantee is limited but real - the site itself still sees your requests, as every server does - and it can be checked. Every rule is testable from outside, so the guarantee does not rest on trusting a privacy policy: anyone can run the checker against any page and confirm how it behaves.
Faults come in two classes. A major fails the page: JavaScript in any form, a request to a third party, a cookie, a page over 2 MB, autoplaying media. Minor faults accumulate: missing alt text, web fonts, a page over 512 KB, more than twenty requests, missing HTML basics. No majors and no minors is grade A. Grades A–C pass; D and F fail. The report lists exactly which rule failed and where. The whole spec fits on one page.
The checker is a small command-line tool, open source on GitHub. Point it at a live site, or at a local directory before you deploy. It follows same-site links only and never fetches third-party resources; their presence alone is the fault. It exits nonzero on a fail, so a CI step can block any deploy that adds a script, a cookie, or a third-party request.
$ web10 https://example.com/ --spider
$ web10 ./public --spider --format html -o report.htmlWe ran the test over twenty famous front pages. One scored an A. Several well-known minimalist sites failed because of their own analytics scripts. The full results.
A passing site may display the year-stamped badge: a static image you host yourself, linked to this site. We do not offer a live, centrally-served badge. An embedded image served from our domain would let us log every visitor to every badged page, and the point of the spec is that nobody can do that. Badge rules and artwork.
Can I use JavaScript? No.
But my site really needs...
Here is how to do it without.
What about just a little analytics? A third-party analytics script
is two major faults. It is how Low-tech Magazine got an F.
What do I do about my cookie banner? Delete it. There are no
cookies or third-party requests left to ask consent for.
Is this just nostalgia? No. The point is privacy and speed. The
retro look is a side effect.