# BeaverCheck Audit Report — https://Galeria.de
**Date:** May 10, 2026
**URL:** https://Galeria.de
**Overall Grade:** B (81/100)
**Report:** https://beavercheck.com/results/08c37cde-4f6d-405f-bbd6-ba5c2fb45eef
## Top Findings
1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers
2. **[CRITICAL]** No Content-Security-Policy header found — Security > Content Security Policy
3. **[CRITICAL]** Page body has only 164 chars of text -- likely empty / placeholder — Security > Empty Page Detection
4. **[CRITICAL]** Scan returned a Cloudflare bot-protection interstitial, not the actual page — Security > Bot Challenge Detection
5. **[CRITICAL]** Missing attribute (WCAG 3.1.1) — Accessibility > Document Language
---
## Lighthouse Scores
| Category | Score |
|----------|-------|
| Performance | 89 |
| Accessibility | 78 |
| Best Practices | 96 |
| SEO | 90 |
---
## Security
### Security Headers (B — 75/100)
*8 of 10 headers properly configured*
- **[WARNING]** HSTS max-age is too short (15552000s, should be ≥ 31536000s) — A short max-age leaves a window for downgrade attacks. Set max-age to at least 31536000 (1 year).
- **[PASS]** X-Content-Type-Options is properly configured
- **[PASS]** X-Frame-Options is properly configured
- **[PASS]** Referrer-Policy is properly configured
- **[PASS]** Permissions-Policy is set
- **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.
- **[PASS]** Cross-Origin-Opener-Policy is properly configured
- **[PASS]** Cross-Origin-Embedder-Policy is set
- **[PASS]** X-Powered-By header is not present
- **[PASS]** Server header is present without version info
- **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload).
### Content Security Policy (F — 0/100)
*No enforcing CSP policy found*
- **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.
### TLS & Certificates (A+ — 100/100)
*TLS 1.3, 8 checks passed*
- **[PASS]** TLS 1.3 is used
- **[PASS]** Strong cipher suite is used
- **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance.
- **[PASS]** OCSP stapling enabled
- **[PASS]** Certificate is valid (expires in 306 days)
- **[PASS]** Certificate chain has 4 certificates
- **[PASS]** Certificate uses modern signature algorithm
- **[PASS]** Certificate covers 2 domain(s)
- **[PASS]** Certificate is issued by a trusted CA
### Cookie Security (A+ — 95/100)
*1 cookies analyzed, 2 checks passed*
- **[PASS]** Cookie '__cf_bm' has the Secure flag
- **[PASS]** Cookie '__cf_bm' has the HttpOnly flag
- **[WARNING]** Cookie '__cf_bm' has no SameSite attribute — Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.
### Cookie Hygiene (A+ — 100/100)
*All 1 cookie(s) pass hygiene checks*
- **[PASS]** All 1 cookie(s) pass hygiene checks
### WAF / Bot Protection (A — 90/100)
*Cloudflare WAF (active mitigation)*
- **[PASS]** Cloudflare WAF (active mitigation) detected — Detected via: cf-ray: 9f98fb327aa6d477-CDG; cf-mitigated: challenge
### security.txt (C — 60/100)
*No security.txt file found*
- **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field.
### Cross-Origin Tab Safety (A+ — 100/100)
*No new-tab links found -- no tabnabbing surface*
- **[PASS]** No new-tab links present
### CSP Inline-Style Readiness (B — 90/100)
*2 inline style attribute(s) detected*
- **[INFO]** 2 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 2 inline style(s) is low. Affected element types include: div. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win.
### Trusted Types (XSS Sink Hardening) (A+ — 100/100)
*No CSP header -- Trusted Types check is N/A*
- **[PASS]** No CSP header found -- Trusted Types check is N/A
### Bot Challenge Detection (F — 0/100)
*Scan was blocked by Cloudflare -- the rest of this report does NOT reflect the real site*
- **[CRITICAL]** Scan returned a Cloudflare bot-protection interstitial, not the actual page — The HTML captured by the scanner is a `Cloudflare` challenge / block page. The scanner's user-agent or IP was flagged as bot traffic and the real site content was never returned. Every other section in this report (security headers, accessibility, content, SEO, performance) was computed against the few KB of interstitial HTML rather than your actual page -- those findings are NOT meaningful for this URL.
Detection signal: Just a moment... -- Cloudflare interactive challenge
Resolution paths: (1) allow-list BeaverCheck's worker IPs at the bot-protection layer, (2) configure a relaxed challenge for known scanner user-agents, or (3) accept that the public site is unscannable from third-party tools. Note that Cloudflare's "Bot Fight Mode" and "Super Bot Fight Mode" both block the scanner by default.
### Soft-404 Detection (A+ — 100/100)
*HTTP status is non-2xx -- soft-404 check is N/A*
- **[PASS]** HTTP status is non-2xx -- soft-404 check is N/A
### Empty Page Detection (F — 0/100)
*1 empty-page signal(s) detected -- page may be a placeholder or have content-rendering bugs*
- **[CRITICAL]** Page body has only 164 chars of text -- likely empty / placeholder — After HTML stripping, the page body contains 164 characters of text content. Below 200 chars almost always means: (1) the page is a placeholder that was never filled in, (2) JavaScript was supposed to render content but failed, (3) the page is a redirect / interstitial / wrapper that should have a real status code other than 200, or (4) it's a legitimately small page like a single-form login (in which case this finding is a false positive that confirms 'minimal content' is intentional).
Review the page in a browser. If content is missing, the most common root cause is a JS-rendering pipeline that needs prerendering or server-side rendering for crawlers / scanners to capture content.
### Geo-Restriction Detection (A+ — 100/100)
*No geo-restriction signals detected -- scan reached the page from an allowed region*
- **[PASS]** No geo-restriction detected
### Maintenance Mode Detection (A+ — 100/100)
*No maintenance-mode signals detected -- scan reached a normal page*
- **[PASS]** No maintenance-mode signals detected
### Subresource Integrity Adoption (F — 30/100)
*0% SRI adoption (0/1 third-party resources)*
- **[WARNING]** SRI adoption: 0/1 third-party resources protected (0%) — Of 1 third-party `