SEO tags, sitemap and legal pages

The mistake it removes

The single most repetitive hand-written work in the audit (9/20 sites). DD keeps failing sites on the same two mechanical things: placeholders shipping in canonical URLs, and no privacy/terms on a site that takes money.

What is already handled

Each of these was checked by running the code, not by reading it.

• JSON-LD is escaped for script context: a business_name containing '</script><script>alert(1)</script>' round-trips as DATA — verified with the real payload, asserting the block still parses as JSON and still contains exactly one script element.

What the audit found

Named rather than summarized. The reasoning behind each one ships inside the block, so it travels with the code instead of living on a page you have to trust.

• Generated privacy/terms are a baseline, not legal advice minor · Legal & compliance pages
• check_placeholders scans text files only minor · Correctness

What you still have to do

A copied file cannot own your secrets, your host or your legal obligations. This is the part the block deliberately does not claim.

• Serve the generated sitemap.xml and robots.txt at your domain root, and set base_url to the real origin. The generator writes correct files; whether a crawler can fetch them at the expected path is a hosting decision it cannot make.
• Wire `--check` into your build or CI so it can fail a deploy. Unrun, it fails nothing, and shipping launch placeholders in canonical URLs is the exact failure it exists to stop.
• Have the generated privacy and terms reviewed for your business and jurisdiction, and keep them in step with what the site actually collects. They are a baseline written from your config, not legal advice.
• aggregateRating is emitted only when both rating and review_count exist; inventing review counts violates Google's policy.

What lands in your project

What you supply

• business_name — required — refuses to generate without it
• base_url — required, absolute — a relative og:image silently shows no preview
• address/email/phone/rating/review_count — optional — JSON-LD only includes what's real

Licensed MIT. It is a starting point, not a finished product.

Questions

Is SEO tags, sitemap and legal pages audited?

Yes. A full due-diligence audit was run on 2026-07-17 and the verdict was a pass.

What do I still have to do myself?

Serve the generated sitemap.xml and robots.txt at your domain root, and set base_url to the real origin. The generator writes correct files; whether a crawler can fetch them at the expected path is a hosting decision it cannot make.

How do I get this code?

Download the Playground, start a new app, and tick “People should find it on Google, and it needs privacy/terms pages”. The block is written into your project as ordinary source you can read and edit.