Today I learned about Trusted Types: specification.website/spec/securit... Which looks like a great way to prevent XSS in many cases. There are so many specifications like this I didn't know about before building this site...

Trusted Types · Website Spec

Trusted Types make the browser reject plain strings at DOM injection sinks like innerHTML, demanding a vetted typed value instead. Switched on with two CSP directives, it neutralises a whole class of ...

specification.website

PSA: I’ve been shipping new specs almost daily: specification.website/changelog/ I have an agent running daily that proposes new pages as new stuff becomes baseline across browsers etc. I’d suggest setting up a routine to check your websites against the changed spec regularly.

Changelog · Website Spec

What changed in The Website Specification — new topics, status changes, and removals, newest first.

specification.website

Last week, Google introduced Open Knowledge Format (OKF). This week, it introduced Agentic Resource Discovery (ARD). You'd think one would point to the other. You'd be wrong. It could though, with a simple fix, which I've proposed: joost.blog/okf-ard/

Composing OKF and ARD on specification.website · Joost.blog

Two standards landed in a week, both partly Google, neither aware of the other. OKF packages knowledge; ARD finds it. I composed both and filed the gaps.

joost.blog

This week I shipped an MCP so AI agents could read my new specification .website. Also this week, one of my hosts shipped a CAPTCHA on another of my sites. To keep the agents out. Only one of us is reading the room. joost.blog/block-the-ab...

Block the abuse, not the future · Joost.blog

Anti-AI CAPTCHAs treat every agent as an attacker. They break legitimate automation, punish paying customers, and bet against the way the web is going.

joost.blog

Launching specification.website. A platform-agnostic spec of what a good website does: SEO, accessibility, security, agent-readiness, performance, privacy, i18n. Every claim cites a source. Ships with a checklist, llms.txt, MCP server, and Agent Skill. Free. Open Source.

The Website Specification

A platform-agnostic, full specification of the technical features a good website should have. Built in the open under an MIT licence.

specification.website

I spent over a year on FAIR (the federated WordPress alternative). The lesson: Open Source First in procurement isn't enough without funding the commons it depends on. Why I'm signing the SUSE letter to the EU, and what's missing from it: joost.blog/open-source-...

Open Source First is right, but not enough. · Joost.blog

Open Source First is the right EU procurement principle. Funding the commons it depends on is the other half. What FAIR taught me about the supply side.

joost.blog

I recently built a bot tracking dashboard for my blog. Then when I looked at it today, I realized that it was reporting "visitors" that my (Plausible) analytics was not showing me... Which led me to think: what is a visitor, these days? joost.blog/what-is-a-vi...

What's a visitor in the age of AI? · Joost.blog

In the 24 hours before I started writing this post, Plausible told me joost.blog had 254 visitors. My server logs told me 536 fetches over the same window came from on-demand AI bots like ChatGPT-User...

joost.blog

FAQ schema died twice from spam. The second time was last Wednesday. The fix is a new schema .org type: FAQSection. I filed it. joost.blog/faq-schema-c...

FAQ schema died twice. The fix is FAQSection. · Joost.blog

Google killed FAQ rich results on May 7, 2026. The lesson isn't that schema is dead. It's that GEO is starting the same cycle in AI search.

joost.blog

Vol. XV: the 15th version of my blog since June 2004 (following pretty quickly after the previous one). I got rid of the AI-generated post images, picked Klim's Domaine and Pitch fonts to do the work instead, and built proper plumbing for longer writing. joost.blog/vol-xv/

Vol. XV: out with the AI slop · Joost.blog

Why I redesigned joost.blog: getting rid of AI-generated post imagery, building the plumbing for longer pieces, and the typography rabbit hole that landed on Klim's Domaine and Pitch.

joost.blog

WordPress 7.0 ships with AI, without real-time collaboration. The right call, just five weeks too late. The same answer was visible on March 31, when the cycle was extended for RTC. 7.0 could have shipped on its original April 9 date with the much needed AI features.

One of our portfolio companies asked me for help on a domain migration, and when I sent them my input, I realized I had never written about this, even though I've spoken about this a lot. So, here it is, my guide to how to do SEO domain migrations: joost.blog/seo-domain-m...

The missing guide to SEO domain migrations · Joost.blog

Domain migrations are asymmetric bets: the upside has a ceiling, the downside doesn't. Here is how to plan, prepare, and execute one without losing what you already have.

joost.blog

My blog scored 25/100 on @Cloudflare's isitagentready .com. A few hours later: 83. Wrote up the full stack: markdown content negotiation, Content Signals, Link headers, an API catalog, MCP, WebMCP. Plus where the scoring gets it wrong. joost.blog/agent-ready/

Is Your Site Agent-Ready?

Scan your website to see if it's ready for AI agents. Check for llms.txt, MCP, agent skills, and other agent-friendly standards.

isitagentready.com

Open source won on cost for 30 years. AI is making that argument irrelevant. The now even more important case is agency: software you can inspect, fork, host, and migrate without permission from a vendor, or government. 1/2

I posted about self-updating skills. I had searched and not found a better method, but asked for input. And I got it! So now, the updated version of my post tells you how to make your skills update easily: joost.blog/self-updatin...

How I made my skills update themselves · Joost.blog

Skills install as loose folders with no package manager. Here's the pattern I landed on after publishing a first attempt and getting corrected on LinkedIn.

joost.blog

Agent skills ship as loose folders. No npm, no registry. You have no way to tell users they're running a stale copy. I taught each of mine to check itself and install its own update, at the moment you invoke it. joost.blog/self-updatin...

How I made my skills update themselves · Joost.blog

Skills install as loose folders with no package manager. Here's a pattern that makes each skill check for updates — and install them — when you invoke it.

joost.blog

When The SEO framework tweeted about the usage of llms.txt and that being a reason not to implement it, I had to write a post: joost.blog/standards-do...

Standards don't prove themselves | Joost.blog

The SEO Framework analyzed 180,000 AI bot requests and found zero llms.txt lookups. Their conclusion: not worth implementing. That conclusion reveals a misunderstanding of how web standards work, and ...

joost.blog

In 2008, I wrote WordPress SEO: the definitive guide. It became one of the most-linked SEO articles on the internet and laid the groundwork for what eventually became Yoast SEO. 1/3

I've been arguing the open web needs machine-readable architecture. So I built a piece of it. seo-graph: a schema .org JSON-LD graph engine. Pure TypeScript, MIT-licensed. Powers four sites and a CMS plugin. Built in one session with @ClaudeAI. 1/2

Anil Dash (@anildash) is right: the open web is in its endgame. But defense alone won't fix it. The indie web is mostly gone. The winners already paywalled their way out. And the AI deals go to who has distribution, not who has content. So.. 1/2

I built Yoast SEO. I ran my blog on WordPress for years. Then yesterday I moved it to static HTML. Everything that matters, SEO, search, schema, is still there. What I dropped was the overhead. Do you actually need a CMS? For quite some sites: no. joost.blog/do-you-need-...

Do you need a CMS? | Joost.blog

For twenty years, wanting a website meant needing a CMS. That's no longer true. The real question people ask now is simpler: how do I get my content on the web?

joost.blog

Been productive today at #CFHack2026, working on the FAIR for TYPO3 project, already got a PR merged in AspireCloud. Also reviewed the TYPO3 Extension Repository and wrote a bunch of design & UX suggestions for it: typo3-redesign.pages.dev #CFHack is such a great start to #Cloudfest!

"It's good to start your exercises with a little stretching." So we've completed a stretch goal before the main goal. We created a proposal for a redesign of the @typo3.com extension pages. Find it at typo3-redesign.pages.dev #CloudFest #CFHack #FAIRxTYPO3

I found myself needing to get Obsidian doc from my Openclaw agent, and not wanting to search for the doc it created or updated for me. So... I created a solution, https links to your Obsidian vault: joost.blog/obsidian-age...

Share Obsidian links that actually work everywhere

Create links to your Obsidian documents that your agent can share with you on WhatsApp, Telegram or elsewhere.

joost.blog

AI will confidently sign off on anything. The question is whether you will too. joost.blog/healthy-doubt/

Why healthy doubt beats AI confidence theater

AI will confidently sign off on anything. The question is whether you will too. I’m a member of my old high school’s “AI council”. My kids go there now, so I have both my own experience and my kids’ t...

joost.blog

I've been working on a fun idea; OpenClaw is cool, but i wanted to take some of those autonomous ideas and apply them to a web app. So... I wrote an autonomous feedback agent: joost.blog/autonomous-f...

Building an Autonomous Feedback Agent

What if your users could submit a bug report and have a pull request ready for review before you’ve even seen the ticket? That’s what we built for Rondo Club, a sports club management app. It’s a full...

joost.blog

When @cloudflare.social introduced Markdown for Agents today, I was grinning. I'd been building the exact same thing, but for #WordPress, with almost exactly the same approach - this one works even if you're not on Cloudflare: joost.blog/markdown-alt...

Great minds think alike? My WordPress take on Markdown for Agents

Cloudflare introduced markdown for agents today, something I'd been working on too, here's my WordPress approach to it.

joost.blog

When WordPress launched its plugin and theme directories about two decades ago, it was a brilliant idea. Centralizing distribution made it easy for site owners to find and install new features. But the web it was built for doesn’t exist anymore. 1/3

Over the last few days, we've seen a good discussion about what #WordPress needs to be relevant in the current age. I think it boils down to two things: we need good, capable *and empowered* product and marketing teams. progressplanner.com/wordpress-pr...

Should WordPress have a product and a marketing team?

WordPress struggles with positioning and product direction. Joost argues it’s time for real product and marketing teams, instead of requiring developers to do it.

progressplanner.com

88, but then I went and searched for the ones I didn't know and learned a new thing or 26 as i really didn't know most of them 😅️

Stef Walter@stephaniewalter.bsky.social · 11mo ago

How many HTML tags can you remember? No cheating! By Paul Foster codepen.io/plfstr/full/...

Might be time to find the best open source alternative for SubStack and *own your own subscribers and content*. This will inevitably lead to higher prices, and probably to more barriers to getting your data out too…

TechCrunch@techcrunch.com · last yr.

Substack raises $100M from Chernin Group, Andreessen Horowitz, Skims CEO and more