News
Organization JSON-LD vs WebSite JSON-LD for Public Sites
December 9, 2024
Organization JSON-LD vs WebSite JSON-LD for public sites is an entity-versus-origin decision: Organization describes the brand (name, logo, sameAs profiles), while WebSite describes this site (url, name, optional SearchAction). Put both on the homepage when they stay true to visible content. RoastMyOpsec does not score JSON-LD types as standalone Fs, and sameAs is a public claim, not a login.
The practical difference
Schema.org Organization is the legal or brand entity. Google’s organization structured data is how a knowledge panel may pick a logo. WebSite is the site as a creative work: its URL and sitename. SearchAction is the optional sitelinks search box pattern and must match a real public search URL.
Stuffing a personal cell number, a non-public office map, or an internal wiki into Organization is the OPSEC miss. sameAs should list profiles you actually control. WebSite.url should be the canonical public origin, not a staging host.
These types do not replace security.txt, ads.txt, or humans.txt. They are a graph for search and unfurlers.
How to choose based on what you shipped
Homepage: Organization + WebSite in one JSON-LD @graph or two script tags, matching the visible brand. Inner articles: Article (or nothing) plus breadcrumbs if the trail is visible. Skip SearchAction if you do not have a public on-site search that returns that URL pattern.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| Organization | You want a brand entity and logo in the graph | Private phones, internal addresses, fake sameAs | The company, not the URL |
| WebSite | You want sitename and the origin documented | Pointing url at staging | This host as a work |
| SearchAction | Public on-site search really exists at that URL | Advertising a search that 404s or requires auth | Only if the endpoint is public |
| Neither | A tiny page with no brand graph to maintain | Not a security hole | Optional for OPSEC |
When WebSite JSON-LD still wins
WebSite still wins for sitename and a clean origin URL even when you skip a rich Organization. Organization still wins when you have a real logo and public profiles. Missing both is not a roast F. Conflicting names across JSON-LD, OG, and the visible header is a brand miss.
Common mistakes
The first mistake is putting a SearchAction URL that is not a public search.
The second mistake is listing sameAs profiles the brand does not control.
The third mistake is treating missing Organization JSON-LD as a security finding.
What a URL roast can prove
JSON-LD Organization, WebSite, breadcrumbs, Open Graph, and rel=me are not standalone Fs on RoastMyOpsec. The free roast covers security headers, TLS, cookies, .git/HEAD, .env, package.json signatures, and js-secrets. Keep the graph to public facts; confirm rich results in Search Console if you care about panels.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do I need both Organization and WebSite?
- They answer different questions. Many homepages ship both. Neither is required for a clean roast.
- Is sameAs a verified identity proof?
- No. It is a claim in public JSON-LD. Bidirectional rel=me is a different, still-public, handshake.
- Does RoastMyOpsec parse JSON-LD?
- Not as a scored check. Missing or messy structured data is not a free-pack F.