# BeaverCheck Audit Report — https://stocktostove.com **Date:** September 11, 2026 **URL:** https://stocktostove.com **Overall Grade:** B (88/100) **Report:** https://beavercheck.com/results/044c50b2-03ec-47e3-b651-554cfa8fddff ## Top Findings 1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers 2. **[CRITICAL]** HSTS header is missing — Security > Security Headers 3. **[WARNING]** 1 software version(s) disclosed in HTML: Astro v7.2.2 — Security > HTML Version Disclosure 4. **[WARNING]** Compressed response missing `Vary` header — Performance > Server Response Intelligence 5. **[WARNING]** Cross-Origin-Embedder-Policy header is missing — Security > Security Headers --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 70 | | Accessibility | 96 | | Best Practices | 100 | | SEO | 100 | --- ## Security ### Security Headers (D — 50/100) *6 of 10 headers properly configured* - **[CRITICAL]** HSTS header is missing — Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year. - **[PASS]** X-Content-Type-Options is properly configured - **[PASS]** X-Frame-Options is properly configured - **[PASS]** Referrer-Policy is properly configured - **[PASS]** Permissions-Policy is set - **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis. - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (F — 0/100) *No enforcing CSP policy found* - **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 8 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[PASS]** HTTP/2 is negotiated - **[INFO]** OCSP stapling not enabled — Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server. - **[PASS]** Certificate is valid (expires in 80 days) - **[PASS]** Certificate chain has 3 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 3 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *No cookies set — no cookie security risks* - **[PASS]** No cookies set — no cookie security risks ### Cookie Hygiene (A+ — 100/100) *No cookies set -- cookie-hygiene check is N/A* - **[PASS]** No cookies set ### WAF / Bot Protection (A — 90/100) *Cloudflare* - **[PASS]** Cloudflare detected — Detected via: cf-ray: a39741d0ff0ff98d-EWR ### security.txt (C — 60/100) *No security.txt file found* - **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field. ### Cross-Origin Tab Safety (A+ — 100/100) *No new-tab links found -- no tabnabbing surface* - **[PASS]** No new-tab links present ### CSP Inline-Style Readiness (B — 90/100) *8 inline style attribute(s) detected* - **[INFO]** 8 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 8 inline style(s) is low. Affected element types include: figure, div. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win. ### Trusted Types (XSS Sink Hardening) (A+ — 100/100) *No CSP header -- Trusted Types check is N/A* - **[PASS]** No CSP header found -- Trusted Types check is N/A ### Bot Challenge Detection (A+ — 100/100) *Scan reached real page content (no bot-protection interstitial)* - **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page ### Soft-404 Detection (A+ — 100/100) *No soft-404 patterns detected in page title or headings* - **[PASS]** No soft-404 patterns detected in page title or headings ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (B — 70/100) *50% SRI adoption (1/2 third-party resources)* - **[INFO]** SRI adoption: 1/2 third-party resources protected (50%) — Of 2 third-party `