{"ok":true,"kind":"crawlcheck-rulebook","v":1,"generated_at":"2026-10-07T17:45:57.765Z","score_version":28,"schema":"https://crawlcheck.io/schemas/rulebook.json","counts":{"rules":77,"by_kind":{"scan":52,"answer_correlation":5,"capability_mismatch":6,"self_audit":12,"mcp_server":2},"by_family":{"site":8,"headers":4,"mostly_code":3,"machine_files":11,"robots":13,"delivery":8,"jsonld":3,"nap":2,"answers":5,"capabilities":6,"self_audit":12,"mcp":1,"watch":1},"revised":7,"scored":48},"scans_counted":3137,"severity_scale":[{"level":"info"},{"level":"low"},{"level":"medium"},{"level":"high"},{"level":"critical"}],"method":{"revisions":"A rule that changes what it reports gets a new revision; a record keeps the revision that decided it, and a replay uses that revision, never today's.","share":"Share of counted scans that carried the code at least once, the same numbers /data publishes. Self-scans and opted-out sites are never counted.","grade":"Each finding has a level from info to critical. Open findings at medium and above lower the letter grade; fix them first."},"rules":[{"code":"HSTS_PRELOAD_INELIGIBLE","kind":"scan","family":{"id":"headers","label":"Headers"},"title":"The HSTS header asks for browser preloading but does not qualify for it","meaning":"The header carries the `preload` token, which is a request to be compiled into the HTTPS-only list shipped inside browsers. That list only accepts a header with max-age of at least 31536000 (one year) AND includeSubDomains AND preload. As sent, the token is ignored: the site is declaring an intent it does not meet, and if it ever was on the list, this header is what gets it removed. The rest of the HSTS header still works.","severity":{"level":"low"},"scored":true,"measured_on":"every scan","revision":{"current":1,"revised_at":null},"fix":{"advice":"Either raise max-age to 31536000 and keep includeSubDomains so the preload token qualifies, or remove the preload token. As sent it does nothing.","effort":"config","endpoint":"https://crawlcheck.io/api/fix/hsts?domain={domain}"},"share_of_scans":{"pct":4.1,"scans":130,"of_scans":3137,"basis":"share of counted scans that carried it; the same numbers /data publishes"},"links":{"self":"https://crawlcheck.io/rules#HSTS_PRELOAD_INELIGIBLE","api":"https://crawlcheck.io/api/rules?code=HSTS_PRELOAD_INELIGIBLE","glossary":["https://crawlcheck.io/glossary/hsts","https://crawlcheck.io/glossary/hsts-preload-list"],"workflow":null,"lineage":"https://crawlcheck.io/docs/lineage-coverage","explain_template":"https://crawlcheck.io/api/explain?id={report_id}&code=HSTS_PRELOAD_INELIGIBLE"}}],"filter":{"code":"HSTS_PRELOAD_INELIGIBLE"}}