Riskcovery fixture sites

Each site below is a test fixture for Riskcovery's checks. It is deliberately broken in the way its line says.

• server-rendered: A complete server-rendered site: the baseline
• javascript-only: Every page rendered by script, with no content in the initial HTML
• broken-metadata: Missing, duplicate, and truncated titles, descriptions, canonicals, and headings
• invalid-json-ld: JSON-LD that does not parse, contradicts the page, or names a wrong type
• keyboard-traps: A dialog that traps focus, invisible focus, and controls the keyboard cannot reach
• vague-ctas: Calls to action that say nothing, hidden pricing, and a twelve-field form
• broken-previews: Missing, unsupported, relative, and tiny preview images, and mismatched share URLs
• redirect-loops: Redirect loops, a self-redirect, a redirect chain, an off-site redirect, and a broken link
• robots-restrictions: robots.txt rules, AI crawler blocks, meta robots, and an X-Robots-Tag header
• request-policy: A page that POSTs from script, opens a WebSocket, registers a service worker, and redirects to a private address
• site-verification: A host that proves its control by a DNS TXT record, a meta tag, and a well-known file

Riskcovery fixture site. Every name and figure here is invented for testing.