v0.0.176

Nine new audit rules: crawl/rendered-signal-mismatch (a canonical, noindex, title or H1 that JavaScript changes after load), crawl/indexable-search-results (internal search pages open to indexing), links/click-depth (indexable pages too many clicks from the homepage), content/duplicate-content (indexable pages with identical body text), i18n/hreflang-targets (hreflang links that point at the wrong place), analytics/duplicate-tags (the same analytics tag installed twice), url/session-ids (session IDs in URLs), security/password-form-get (password forms sent by GET) and a11y/svg-img-alt (SVG images with no accessible name). Two things change for existing audits: each site's first audit after the upgrade re-collects its page signals once, and health scores can shift by a point or so because the new rules add passes and findings.

Added

• New rule url/session-ids: a page URL or an internal link carrying a session ID (PHPSESSID, jsessionid in the query or as a ;jsessionid= path parameter, sid, sessionid, session_id, ASPSESSIONID*, CFID with CFTOKEN) is a warning, with the value masked. The value must look generated, by name class: PHPSESSID, jsessionid, session_id and ASPSESSIONID* flag any value of 8 or more characters that is not all digits or an all-lowercase hyphenated phrase, while sid and sessionid need 16 or more characters with a letter and a digit and no hyphenated word pair.
• content/duplicate-content reports indexable pages that share identical body text. Pages are grouped by a hash of their rendered body text (titles and markup are not part of it), and each group of two or more pages that do not resolve to one canonical is reported once, largest first, with every URL. Noindex pages, redirects, error responses, pagination pages, localised versions that list each other as hreflang alternates and pages under 100 words are left out and counted in the details. A group whose URLs differ only by tracking parameters, trailing slash or letter case is flagged as a URL form problem. Exact matches only. (#1690)
• New rule i18n/hreflang-targets: hreflang links that point at the wrong place. It judges each hreflang target the crawl already fetched, with no extra requests: a redirect (warning, with the final URL), a 4xx or 5xx (error, with the status), a noindex page or one whose canonical is another URL (warning, with the reason), and a target that has hreflang links but none back to the source page (error, each pair once). Targets the crawl did not fetch are counted as not checked, and a site with no hreflang links gets a skipped result. (#1686)
• New rule analytics/duplicate-tags: warns when one page installs the same Google Analytics 4 measurement ID, Google Tag Manager container or analytics site ID more than once, which counts every visit twice (#1691).
• New rule links/click-depth lists indexable pages more than 3 clicks from the homepage by shortest link path, deepest first with each depth. The threshold is the maxDepth rule option, a crawl stopped at its page cap says depths are a lower bound, and pages with no link path are left to links/orphan-pages. Advisory weight.
• crawl/indexable-search-results reports internal search result pages that search engines can index. A /search path with a query, a search parameter (s, q, query, search, keyword) on a page that shows results, or a URL matching the site's WebSite SearchAction target counts as a search result. Pages with noindex, a robots.txt Disallow or a canonical to a non-search page are not listed. The finding says how many were found and how many are indexable, and names both fixes. (#1696)
• New rule security/password-form-get: a form with a password field that submits by GET (an explicit method="get", a form with an action and no method, or a GET formmethod on a submit button) is an error. A form with no method and no action, which is how a React, Vue or Svelte login form looks in the DOM, is a warning (it falls back to GET only if its script fails; method="post" removes the risk), and one submitted by an inline handler with no action is reported as not determined. The action a finding shows has its query, fragment and credentials removed.
• New rule a11y/svg-img-alt: an inline <svg role="img"> with no accessible name (no direct <title>, aria-label or resolving aria-labelledby) is an error. Hidden svgs and clickable ones a11y/aria-labels already reports are left out.
• crawl/rendered-signal-mismatch flags a canonical, noindex, title or H1 that JavaScript changes after load. It compares the raw HTML with the cloud render of the same page and reports four checks: canonical-mismatch and noindex-mismatch fail, title-modified and h1-modified warn, each showing the raw and the rendered value. A canonical that differs only by trailing slash, host case, default port or fragment is the same canonical. noindex is read from every robots and googlebot meta tag, so a second tag a script appends counts, and a canonical the script adds that is the page's own URL is a warning rather than an error. It reads the render ax/content-without-js already reads, so it adds no credit charge beyond the page's audit, and it reports one skipped check, never a pass, on a browser-rendered crawl or when there is no render result. (#1684)