# BeaverCheck Audit Report — https://www.nokia.com **Date:** June 9, 2026 **URL:** https://www.nokia.com **Overall Grade:** C (78/100) **Report:** https://beavercheck.com/results/1f0f3e74-5c91-4843-a23f-d63a3b98fcec ## Top Findings 1. **[CRITICAL]** Cookie 'nok_ip_locale' is missing the Secure flag — Security > Cookie Security 2. **[CRITICAL]** Cookie 'nok_ip_region' is missing the Secure flag — Security > Cookie Security 3. **[CRITICAL]** Page weighs 23.8 MB (15.6 MB transferred) — Performance > Page Weight Budget 4. **[CRITICAL]** Scan returned a Akamai Bot Manager bot-protection interstitial, not the actual page — Security > Bot Challenge Detection 5. **[CRITICAL]** Missing attribute (WCAG 3.1.1) — Accessibility > Document Language --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 29 | | Accessibility | 90 | | Best Practices | 96 | | SEO | 100 | --- ## Security ### Security Headers (C — 55/100) *5 of 10 headers properly configured* - **[PASS]** Strict-Transport-Security is properly configured (consider adding preload) - **[PASS]** X-Content-Type-Options is properly configured - **[WARNING]** X-Frame-Options header is missing — This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN. - **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter. - **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features. - **[PASS]** Content-Security-Policy is present - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (B — 70/100) *2 of 10 CSP checks passed* - **[INFO]** Raw CSP policy - **[WARNING]** default-src directive is missing — default-src provides a fallback for other directives. Set it to restrict default resource loading. - **[INFO]** No script-src or default-src to check for 'unsafe-inline' - **[INFO]** No script-src or default-src to check for 'unsafe-eval' - **[INFO]** No script-src or default-src to check for wildcard - **[PASS]** object-src falls back to default-src - **[WARNING]** base-uri directive is missing — Without base-uri, attackers can inject a tag to hijack relative URLs. Set it to 'self' or 'none'. - **[PASS]** frame-ancestors directive is set - **[WARNING]** form-action directive is missing — form-action restricts where forms can submit data, preventing form hijacking. - **[INFO]** upgrade-insecure-requests is not set — This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content. ### TLS & Certificates (A — 90/100) *TLS 1.3, 8 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[PASS]** OCSP stapling enabled - **[PASS]** Certificate is valid (expires in 22 days) - **[WARNING]** Certificate expires soon (22 days remaining) — Renew the certificate before it expires to avoid browser warnings. - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 16 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (D — 50/100) *2 cookies analyzed, 0 checks passed* - **[CRITICAL]** Cookie 'nok_ip_locale' is missing the Secure flag — Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception. - **[WARNING]** Cookie 'nok_ip_locale' is missing the HttpOnly flag — Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft. - **[WARNING]** Cookie 'nok_ip_locale' has no SameSite attribute — Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict. - **[CRITICAL]** Cookie 'nok_ip_region' is missing the Secure flag — Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception. - **[WARNING]** Cookie 'nok_ip_region' is missing the HttpOnly flag — Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft. - **[WARNING]** Cookie 'nok_ip_region' has no SameSite attribute — Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict. ### Cookie Hygiene (A+ — 100/100) *All 2 cookie(s) pass hygiene checks* - **[PASS]** All 2 cookie(s) pass hygiene checks ### WAF / Bot Protection (A — 90/100) *Akamai* - **[PASS]** Akamai detected — Detected via: server: AkamaiGHost ### security.txt (C — 60/100) *No security.txt file found* - **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field. ### Cross-Origin Tab Safety (A+ — 100/100) *No new-tab links found -- no tabnabbing surface* - **[PASS]** No new-tab links present ### CSP Inline-Style Readiness (A+ — 100/100) *No inline style attributes -- strict CSP is feasible* - **[PASS]** No inline style attributes detected ### Trusted Types (XSS Sink Hardening) (B — 95/100) *Trusted Types not enabled* - **[INFO]** Trusted Types not enabled — Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode. ### Bot Challenge Detection (F — 0/100) *Scan was blocked by Akamai Bot Manager -- the rest of this report does NOT reflect the real site* - **[CRITICAL]** Scan returned a Akamai Bot Manager bot-protection interstitial, not the actual page — The HTML captured by the scanner is a `Akamai Bot Manager` challenge / block page. The scanner's user-agent or IP was flagged as bot traffic and the real site content was never returned. Every other section in this report (security headers, accessibility, content, SEO, performance) was computed against the few KB of interstitial HTML rather than your actual page -- those findings are NOT meaningful for this URL. Detection signal: 'Access Denied' + Reference # + HTTP block + small body -- Akamai Bot Manager pattern Resolution paths: (1) allow-list BeaverCheck's worker IPs at the bot-protection layer, (2) configure a relaxed challenge for known scanner user-agents, or (3) accept that the public site is unscannable from third-party tools. Note that Cloudflare's "Bot Fight Mode" and "Super Bot Fight Mode" both block the scanner by default. ### Soft-404 Detection (A+ — 100/100) *HTTP status is non-2xx -- soft-404 check is N/A* - **[PASS]** HTTP status is non-2xx -- soft-404 check is N/A ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (A+ — 100/100) *Page has no third-party scripts or stylesheets -- SRI not applicable* - **[PASS]** No third-party scripts or stylesheets to protect with SRI ### CORS Depth (A — 85/100) *1 CORS depth signal(s) detected* - **[WARNING]** CORS response missing `Vary: Origin` header -- cache poisoning risk — The server's CORS response varies by request Origin (Allow-Origin is not `*`), but the response doesn't include `Vary: Origin`. Without `Vary: Origin`, downstream caches (CDN edges, corporate proxies, browser HTTP cache) will cache the CORS response and serve it to clients sending a DIFFERENT Origin. Effect: a cached `Access-Control-Allow-Origin: https://app.example.com` response gets served to a fetch from `https://attacker.example.com`, the browser allows the cross-origin read, and the attacker reads the response. Add `Vary: Origin` whenever Allow-Origin is content-negotiated. ### Permissions-Policy Granularity (C — 60/100) *No Permissions-Policy header set -- powerful features (camera / microphone / geolocation / payment / USB) default to allow-on-same-origin* - **[WARNING]** Permissions-Policy header not set -- features default to allow-on-same-origin — Without a `Permissions-Policy` (or legacy `Feature-Policy`) header, every powerful browser feature defaults to its spec default policy (typically `self`). A third-party iframe injected via XSS or a misconfigured embed can still request access to the user's camera, microphone, geolocation, payment APIs, USB devices, etc. Explicitly deny features the page doesn't need: ``` Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=() ``` Features the page legitimately uses can stay enabled with `feature=(self)`. ### Referrer-Policy Strictness (B — 75/100) *Referrer-Policy header not set -- browser default applies (modern: strict-origin-when-cross-origin; legacy browsers: no-referrer-when-downgrade)* - **[INFO]** Referrer-Policy header not set -- browser default applies — Without an explicit `Referrer-Policy` header, the browser falls back to its default policy. Modern browsers (Chrome 85+, Firefox 87+, Safari 15+) default to `strict-origin-when-cross-origin`, which is privacy-safe. Legacy browsers default to the leaky `no-referrer-when-downgrade`, which sends the full URL (including path + query) on cross-origin HTTPS-to-HTTPS requests. Set an explicit header to ensure consistent behavior: ``` Referrer-Policy: strict-origin-when-cross-origin ``` This matches the modern browser default and is privacy-safe without breaking referrer-based same-origin analytics. ### Source Map Exposure (A+ — 100/100) *Source-map probe didn't run on this scan* - **[PASS]** Source-map probe didn't run on this scan ### HTML Version Disclosure (A+ — 100/100) *No software-version disclosures in HTML* - **[PASS]** No software-version disclosures in HTML ### Open Redirect Surface (A+ — 100/100) *No redirect-shaped query parameters in DOM links* - **[PASS]** No redirect-shaped query parameters in DOM links ### Auth Security (A+ — 100/100) *Page is not a login form -- auth-security checks are N/A* - **[PASS]** Page does not appear to be a login form ### Subdomain Inventory Exposure (C — 75/100) *3 risky subdomain name(s) in certificate SANs* - **[WARNING]** 3 risky subdomain name(s) advertised in certificate SANs — These names are publicly visible via Certificate Transparency logs (crt.sh, censys.io) -- any attacker can enumerate them in seconds. Operators are often unaware that internal/staging/admin endpoints are inadvertently advertised this way. Mitigation: use a wildcard cert that doesn't enumerate, issue per-environment certs without non-prod SANs on the prod cert, or move internal services to private DNS off the public cert. --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt. - **[PASS]** No sensitive files exposed ### Email Security (F — 0/100) *no DMARC, no SPF* - **[WARNING]** No DMARC record found — Without DMARC, email receivers have no policy for handling authentication failures. Add a TXT record at _dmarc. starting with v=DMARC1. - **[WARNING]** No SPF record found — Without SPF (Sender Policy Framework), receivers can't tell which servers are authorized to send mail for your domain. Add a TXT record at the apex starting with v=spf1, ending in -all. - **[INFO]** No DKIM detected via common selectors — DKIM signs outbound mail to prove origin. We probed common selectors (default, google, selector1, etc.) without finding a record. If you use a non-standard selector, this is a false negative. - **[INFO]** MTA-STS not configured — MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts. and a policy file at https://mta-sts./.well-known/mta-sts.txt. - **[INFO]** TLS-RPT not configured — TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.. - **[INFO]** BIMI not configured — BIMI (Brand Indicators for Message Identification) lets supporting clients (Gmail, Apple Mail, Yahoo) display your verified logo next to your messages. Optional but raises trust signals. Requires DMARC at p=quarantine or p=reject to be honored. ### API Surface (A+ — 100/100) *No API specs or GraphQL introspection found (probed 11 candidate path(s))* - **[PASS]** No API specs or GraphQL introspection found (probed 11 path(s)) ### Permissions-Policy (D — 40/100) *No header set* - **[WARNING]** No Permissions-Policy header — Consider adding a Permissions-Policy header to restrict browser feature access from embedded content. ### CORS Configuration (A — 90/100) *Origin: *.nokia.com* - **[PASS]** CORS restricted to specific origin(s) - **[INFO]** Origin reflection not testable with a single request — Some servers reflect the request Origin header. This requires manual testing with a crafted Origin header. --- ## Performance ### Page Weight Budget (F — 0/100) *15.6 MB transferred, 99 requests* - **[CRITICAL]** Page weighs 23.8 MB (15.6 MB transferred) - **[WARNING]** JavaScript is 713 KB — consider code splitting or lazy loading — Large JavaScript bundles delay interactivity. Split code by route or defer non-critical scripts. - **[INFO]** CSS is 434 KB — consider purging unused styles — Remove unused CSS rules with tools like PurgeCSS to reduce stylesheet size. - **[INFO]** Fonts are 243 KB — consider subsetting or using system fonts — Subset fonts to include only used characters, or switch to system font stacks. - **[INFO]** 99 HTTP requests - **[INFO]** Estimated 3.3 g CO2 per page load ### Third-Party Impact (A+ — 100/100) *4% third-party, 0 ms blocking* - **[INFO]** Third-party code accounts for 4% of page weight (656.1 KiB of 15.6 MiB) - **[PASS]** Third-party blocking time is low (0 ms) ### Text Compression (A+ — 100/100) *All text resources are compressed* - **[PASS]** All text resources are compressed ### Image Optimization (B — 75/100) *24 images, 0 KB saveable* - **[PASS]** All images are well-optimized ### JS Execution Cost (F — 20/100) *15360ms total JS execution* - **[WARNING]** https://www.nokia.com/: 6100ms CPU time - **[WARNING]** Unattributable: 2410ms CPU time - **[WARNING]** https://www.nokia.com/sites/default/files/js/js_9s...: 1118ms CPU time - **[WARNING]** https://www.googletagmanager.com/gtm.js?id=GTM-543...: 953ms CPU time - **[WARNING]** https://www.googletagmanager.com/gtag/js?id=G-BEY8...: 703ms CPU time - **[INFO]** Third-party scripts: 4508ms (29% of total) ### Font Loading (A+ — 100/100) *7 fonts (243 KB)* - **[INFO]** 7 font(s) use font-display: swap (FOUT risk but functional) ### JS Bundles (C — 60/100) *32 scripts, 231 KB unused* - **[WARNING]** https://cdn.cookielaw.org/scripttemplates/202507.1...: 75 KB unused (63%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.googletagmanager.com/gtag/js?id=G-D6GE...: 66 KB unused (39%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.googletagmanager.com/gtag/js?id=G-BEY8...: 65 KB unused (42%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.nokia.com/sites/default/files/external...: 24 KB unused (66%) — Consider code splitting or tree shaking to reduce unused code. - **[INFO]** Total unused JavaScript: 231 KB ### Resource Caching (A+ — 100/100) *All resources properly cached* - **[PASS]** No caching issues found ### Critical Rendering Path (A+ — 100/100) *No render-blocking resources* - **[PASS]** No render-blocking resources detected ### Resource Hints (A+ — 100/100) *No optimization needed* - **[PASS]** No resource hint issues ### HTTP/3 (QUIC) (A+ — 100/100) *HTTP/3 advertised via Alt-Svc* - **[PASS]** HTTP/3 (QUIC) is supported — First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss. ### Compression Algorithm (C — 70/100) *Main response served uncompressed* - **[INFO]** Main HTML response has no Content-Encoding (uncompressed) — The main HTML document is served without compression. The Text Compression section above lists the broader picture; for the main response specifically, even gzip would shave ~70-80% off most text payloads. ### LCP Image Preload (A+ — 100/100) *LCP preload audit not available* - **[PASS]** LCP image preload audit not available for this scan ### Main HTML Cache-Control (B — 80/100) *No Cache-Control header on main HTML response* - **[INFO]** Main HTML response has no Cache-Control header — Without an explicit Cache-Control, browsers fall back to heuristic caching (~10% of Last-Modified age). Set `Cache-Control: no-cache` or `max-age=300` for HTML to control freshness explicitly -- prevents stale auth state and SPA shell drift. ### Server-Timing Observability (A+ — 100/100) *3 Server-Timing entries advertised* - **[PASS]** Server-Timing header advertises 3 timing entries ### Server Response Intelligence (A+ — 95/100) *1 server-response signal(s) detected* - **[INFO]** No `ETag` or `Last-Modified` -- conditional GET not supported — Without either header, browsers can't issue conditional GETs and refresh always re-downloads the full response body even when nothing changed. Add `ETag: ""` (or `Last-Modified: `) on cacheable responses; the server returns 304 Not Modified when the client's cached copy is still valid, saving bandwidth. ### Page Weight Inventory (C — 55/100) *99 resources · 15.6 MB · 231 KB savings available* - **[WARNING]** Page weight 15.6 MB exceeds 1 MB target by 14.6 MB - **[INFO]** ~231 KB of savings available - **[INFO]** 56 third-party resources (4% of weight) - **[INFO]** 3 resources over 200KB ### Render-Blocking Resources (A+ — 100/100) *No render-blocking resources detected* - **[PASS]** No render-blocking resources detected in ### Third-Party Resources (A+ — 100/100) *No third-party resources detected* ### JavaScript Blocking (A — 90/100) *1 JS blocking issue(s) detected* - **[WARNING]** Total JS execution time is 15.4 s -- over the 3.5s budget — Total JavaScript execution (parse + compile + run) across all scripts exceeds 3.5 seconds. On low-end devices that becomes 7-15+ seconds and shows up directly in TBT and INP. Reduce by: tree-shaking unused dependencies, code-splitting (dynamic `import()`), removing or deferring third-party tracking, and replacing heavy frameworks where they're not needed. ### CSS Performance Depth (A+ — 100/100) *No CSS performance depth issues detected* - **[PASS]** No CSS performance depth issues detected --- ## Content Quality ### Links (A+ — 100/100) *No links to check.* - **[PASS]** No links found on the page ### Mixed Content (A+ — 100/100) *No mixed content detected — all resources use HTTPS.* - **[PASS]** No mixed content detected — all resources use HTTPS ### Open Graph (F — 0/100) *No Open Graph tags found — social sharing previews will be generic.* - **[WARNING]** No Open Graph meta tags found — Without og:title, og:description, and og:image, social media platforms will generate a generic preview when your page is shared. ### Open Graph / Twitter Card Depth (A+ — 100/100) *No OG image or Twitter card set -- depth check is N/A (presence covered by Open Graph section)* - **[PASS]** No OG image / Twitter card to evaluate ### Structured Data (C — 40/100) *No structured data (JSON-LD) found.* - **[INFO]** No structured data (JSON-LD) found — Adding structured data helps search engines understand your content and can enable rich results. ### Rich Results Eligibility (C — 75/100) *No JSON-LD found -- no rich-result eligibility* - **[INFO]** No JSON-LD structured data on the page — No `