I lost at rule 35 (out of 36) because I overfed Paul.
Some tips I gathered:
9. Use XXXV, as the chemical symbols contained in (V,VII) add up 152, which is already very close to 200 for rule 18;
10. Refresh the captcha so that it only includes lowercase letters, you'll need numbers later and they can't add up to more than 25 according to rule 5;
14. Pray for having a country with a short name, whose first letter isn't also a chemical element and that includes common letters (curse you Zimbabwe);
15. I think 4 is a leap year...
17. Put Paul at the start or the end of your password;
19. You can bold the whole string to meet the condition, but beware of rule 26. Also, before meeting the condition, copy-paste your password elsewhere;
20. Just select the fire and some more characters and delete them, then fill the gap from your copy-pasted password;
22. Use "i am loved" (all lowercase, cf. rule 18) as you'll need to sacrifice two letters for rule 25, but you will already use 'o' for youtu.be, 'v' for XXXV, 'e' for youtu.be, and probably 'l' and 'd' in your captcha, URL (cf. rule 24) or color (cf. rule 28). Also, it's the shorter word of the three, and for rules 32 and 33 it's simpler to add padding symbols than to remove mandatory characters to control the length of the password;
23. Try to have between 2 and 6 max worms at any time, it should give you enough time to think without overfeeding Paul. 9 worms will definitely kill Paul (maybe less, but 6 should be safe);
24. On Chrome, you can use the "YouTube Time Filter" extension to find videos of the correct timelength. On YouTube, type a very generic request (like "game", "car", or even just "p"), open the filters and choose "Video" (to filter out shorts) as well as a length range (to reduce client-side filtering) then in the YouTube Time Filter insert a length range one second before and one second after the required range (the game has a one second leniency). Then scroll and scroll. Of course, once you find a suitable video, strip any superfluous parameter from its length, and make sure that the video id doesn't include any uppercase 'M', 'D', 'C', 'X' (because those roman numerals don't multiply to 35, cf. rule 9) and preferably no 'V' or 'I' (because of rules 9 and 18). It's hard, but with a bit of patience, it doable. Also use the short URL (youtu.be, not youtube.com) and trim the "https://www.", you don't need them;
25. If you applied those tips correctly and you were lucky on the captcha and the country, you should be able to strip the letters 'w' and 'z' at the very least. Other letters if you were very lucky (maybe try to choose another month for rule 6 if it can make you unuse a letter, or maybe you should have used "i am enough" ?);
26. Just put the whole string in italics;
28. Refresh until you have a color without numbers (or 0 at most), for rule 5;
32. It's better to have 123 characters than 97 (cf. rule 5);
33. Sorry, I meant 113. Other probable candidates, depending on your current password length are: 101, 103, 113, 131, 151, 211, 223, 233, 311 and 313. Other numbers are fine too, but it's up to you to see if you can have them depending on your URL and chess move. Maybe include 8 padding symbols at the end of the password, in prevision to rule 35. Know that the length will vary when you feed Paul, but the length should usually be correct;
34. Just skip this one, really;
35. Unfortunately, I didn't pass that one as I overfed Paul, but I think it would be easier to play around midnight, ideally at 00:00:00, because you know, rule 5. But make sure to write it at 23:59 and change the police size to 0px before midnight, so every rule can be met at midnight. Not sure if the seconds are needed or not, since I didn't pass it.