Safety
Speculation Rules vs dns-prefetch for Marketing Sites
December 10, 2025
Speculation Rules vs dns-prefetch for marketing sites is how aggressively the browser prepares the next hop. dns-prefetch (and preconnect) resolve or warm a host. Speculation Rules (JSON in a script type or a Speculation-Rules header) can prefetch or prerender listed URLs. Prerender is not a DNS hint: supporting browsers may load the document with cookies and run work as if the user already clicked. Do not list /account, /checkout, or /reset?token= . Referrer-Policy still applies to hinted navigations. RoastMyOpsec does not score Speculation Rules, dns-prefetch, or HTTP 103. It does not prerender your site. Missing speculation is not an OPSEC F.
The practical difference
dns-prefetch leaks that a hostname exists to the resolver slightly earlier. prerender can leak the full page fetch — and any first-party cookies the browser would send — to that URL before the click. prefetch is in between: it may fetch without fully running the page, still without listing secrets in the URL.
HTTP 103 Early Hints is a CDN-speed cousin for Link preload. Speculation Rules are document or header policy for navigations. See Early Hints vs CSP.
How to choose what to speculate
Public article-to-article and homepage-to-pricing: prefetch or prerender if the URLs are cacheable and cookie-boring. Logged-in app shells: skip prerender. Tokenized links: never. eagerness conservative unless you measured the privacy trade.
| Hint | What it does | Cookie / token risk | Takeaway |
|---|---|---|---|
| dns-prefetch / preconnect | Warm DNS or TLS to a host | Hostname leak, not the path | See dns-prefetch vs Referrer-Policy |
| prefetch (speculation) | Fetch a document early | URL and cookies on that GET | Public pages only |
| prerender | Nearly run the next page | Highest — treat like a visit | No auth, no tokens in the URL |
| 103 Link preload | Subresources before HTML | URLs in the Link header | See Early Hints vs CSP |
What the roast can prove
Absence of Speculation-Rules is not a finding. A public HTML page that speculates /reset?token= is a product bug you should catch in review — the roast does not parse the JSON. Pair with tokens in URLs and Referrer-Policy.
Common mistakes
The first mistake is prerendering every internal path including /admin.
The second mistake is listing signed CloudFront URLs in speculation rules.
The third mistake is treating speculation as a security header checklist item.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does prerender bypass SameSite cookies?
- No. It is still a navigation-class fetch from the user's browser. The risk is fetching a sensitive URL earlier than the click, not skipping cookie rules.
- Should brochure sites enable Speculation Rules?
- Only for public next-clicks you would be fine fetching immediately. Missing them is not a roast F.
- Does RoastMyOpsec score Speculation Rules?
- No. It does not prerender pages or parse speculation JSON.