v0.0.139

A TLS certificate rule, one-page site detection, in-page About and Contact recognition, report hosts that can serve published reports from their own domain, and free audits that render 2 pages at once.

Added

• New rule security/tls-certificate reads the TLS certificate of the audited site's host and its www or apex counterpart, one handshake each, and reports its expiry (a warning inside 30 days, an error inside 7, set by warn_days and error_days under [rule_options."security/tls-certificate"]), whether it covers the hostname, whether it has a complete chain to a trusted root, whether it is self-signed, and whether an RSA key is under 2048 bits. The counterpart exists only for a registrable domain and its www. name, on the same port; other subdomains have none. Every handshake is checked like the crawl's own hosts: the name is resolved once, a link-local or cloud metadata answer is never contacted, the counterpart of a public site must resolve to a public address, and the connection goes to the address that was checked. With --offline only the audited host is contacted. A host the rule cannot read is reported as not checked with the reason, never as a pass, including behind an HTTP proxy from the environment, and local or private-network hosts are skipped. When a page fetch fails on a TLS error, the failure now names the cause one handshake found, such as an expiry date or a missing intermediate, waiting at most 3 seconds per host. See TLS certificate. squirrelscan/squirrelscan#712
• crawl/single-page-site. When the whole site is one page with sections, the audit now says what that means for search: one URL to rank or cite, one title and one description, and #sections that cannot be indexed on their own. It fires only on a complete crawl that fetched exactly one HTML page, has at most one in-scope sitemap URL, no link to another path on the site, and three or more links to ids on the page, and lists up to ten section ids. It is informational and never changes the health score or a category score. When it fires, the editor's summary request carries coverage.singlePageSite and coverage.sectionCount. See crawl/single-page-site.
• Report hosts can serve published reports from their own domain. renderHtml takes reportUrl (the og:url, og:image, agent .md/.json links and a <link rel="canonical">) and techIconBaseUrl (where technology logos load from), and reportInlineScripts() lists the HTML report's inline scripts so a host can pin them with a hash-based Content-Security-Policy. Reports from the CLI are unchanged (squirrelscan/repo#3182).

Changed

• Free audits render 2 pages at once, up from 1. One page at a time made a scheduled free audit's crawl take about 3 minutes, against about 50 seconds before render width became per plan. Pro (5) and Team (10) are unchanged.

Fixed

• eeat/about-page and eeat/contact-page recognise an in-page About or Contact section on a single-page site: an element whose id matches the page slugs (#about, #contact, localised ones) and a same-page link to it. No more "No About page found" on a one-page site that has both. An About section needs 200 words to pass; a Contact section needs a mailto: or tel: link or a form. A real /about or /contact page still takes precedence. See eeat/about-page (#1208).

Docs

• The SEO rules page counts 26 structured data rules. The card still said 25 after schema/expected-type was added.