Missing Copyright Or Licence Header

ID

html.header_comment

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Resource

Documentation

Language

Html

Tags

best-practice, documentation

Description

Reports a page whose header comments do not carry the project’s copyright or licence notice.

The header region is everything before the first tag opens, so the notice may sit either above or below the <!DOCTYPE> — both forms are common and both are accepted. Several comments may precede the markup (a generator banner, then the notice); the pattern is searched across all of them, so their order does not matter. A notice first written inside <body> is page content, not a header, and does not count.

What counts as a header is a project decision, so the notice is supplied as a regular expression in the headerPattern property. It ships matching either of the two notices in common use — an SPDX identifier, or a dated Copyright (c) 2026 line — so the rule enforces something out of the box. A project that writes its notice any other way replaces the pattern with its own.

Setting the property empty turns the rule off. Requiring a licence header in markup is, in the end, an organisational policy choice, and a rule that fires once per page would bury a project that has decided otherwise; the empty pattern is the escape hatch for that project.

Rationale

A page with no header leaves its ownership and its redistribution terms undeclared. Source files travel on their own: they get vendored into another repository, copied into a snippet, pasted into an issue, or shipped inside a container image. Once separated from the repository’s LICENSE file, an unheaded file carries no evidence of the terms it was released under.

That has concrete consequences. Licence-compliance scans and SPDX inventories read per-file notices, so an unheaded file shows up as unknown-licence and blocks the release. Contributors cannot tell whether a template is safe to reuse. And in a project that mixes licences — a vendored third-party theme, a dual-licensed component — the absence of a header is genuinely ambiguous rather than merely untidy.

<!DOCTYPE html>
<html lang="en">
<head><title>Priced plans</title></head>
<body><p>Plans</p></body>
</html>

Remediation

Add the project’s notice as a comment in the page’s header region.

<!--
  Copyright 2026 Example Corp.
  SPDX-License-Identifier: Apache-2.0
-->
<!DOCTYPE html>
<html lang="en">
<head><title>Priced plans</title></head>
<body><p>Plans</p></body>
</html>

Note that an HTML comment is served to the browser, unlike a header in a compiled language. Keep it short — a copyright line and an SPDX identifier — and let the LICENSE file carry the full text. A build step that strips comments from production output is a normal way to keep the notice in the source without shipping it.

Adding headers across an existing project is mechanical and worth automating: reuse, addlicense and similar tools insert the block in place.

Configuration

Property Default Description

headerPattern

SPDX-License-Identifier|Copyright \(c\) [0-9]{4}

Regular expression searched inside the page’s header comments. The default accepts either of the two notices in common use. Replace it with the notice the project enforces; set it empty to turn the rule off.

© 2026 Xygeni. All rights reserved