RoastMyOpsec

News

Organization JSON-LD vs WebSite JSON-LD for Public Sites

December 9, 2024

Organization JSON-LD vs WebSite JSON-LD for public sites is an entity-versus-origin decision: Organization describes the brand (name, logo, sameAs profiles), while WebSite describes this site (url, name, optional SearchAction). Put both on the homepage when they stay true to visible content. RoastMyOpsec does not score JSON-LD types as standalone Fs, and sameAs is a public claim, not a login.

The practical difference

Schema.org Organization is the legal or brand entity. Google’s organization structured data is how a knowledge panel may pick a logo. WebSite is the site as a creative work: its URL and sitename. SearchAction is the optional sitelinks search box pattern and must match a real public search URL.

Stuffing a personal cell number, a non-public office map, or an internal wiki into Organization is the OPSEC miss. sameAs should list profiles you actually control. WebSite.url should be the canonical public origin, not a staging host.

These types do not replace security.txt, ads.txt, or humans.txt. They are a graph for search and unfurlers.

How to choose based on what you shipped

Homepage: Organization + WebSite in one JSON-LD @graph or two script tags, matching the visible brand. Inner articles: Article (or nothing) plus breadcrumbs if the trail is visible. Skip SearchAction if you do not have a public on-site search that returns that URL pattern.

OptionWhen it winsWatch-outTakeaway
OrganizationYou want a brand entity and logo in the graphPrivate phones, internal addresses, fake sameAsThe company, not the URL
WebSiteYou want sitename and the origin documentedPointing url at stagingThis host as a work
SearchActionPublic on-site search really exists at that URLAdvertising a search that 404s or requires authOnly if the endpoint is public
NeitherA tiny page with no brand graph to maintainNot a security holeOptional for OPSEC

When WebSite JSON-LD still wins

WebSite still wins for sitename and a clean origin URL even when you skip a rich Organization. Organization still wins when you have a real logo and public profiles. Missing both is not a roast F. Conflicting names across JSON-LD, OG, and the visible header is a brand miss.

Common mistakes

The first mistake is putting a SearchAction URL that is not a public search.

The second mistake is listing sameAs profiles the brand does not control.

The third mistake is treating missing Organization JSON-LD as a security finding.

What a URL roast can prove

JSON-LD Organization, WebSite, breadcrumbs, Open Graph, and rel=me are not standalone Fs on RoastMyOpsec. The free roast covers security headers, TLS, cookies, .git/HEAD, .env, package.json signatures, and js-secrets. Keep the graph to public facts; confirm rich results in Search Console if you care about panels.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Do I need both Organization and WebSite?
They answer different questions. Many homepages ship both. Neither is required for a clean roast.
Is sameAs a verified identity proof?
No. It is a claim in public JSON-LD. Bidirectional rel=me is a different, still-public, handshake.
Does RoastMyOpsec parse JSON-LD?
Not as a scored check. Missing or messy structured data is not a free-pack F.

Sources

Related guides