# BeaverCheck Audit Report — https://MYMOONOVA.COM
**Date:** April 20, 2026
**URL:** https://MYMOONOVA.COM
**Overall Grade:** D (60/100)
**Report:** https://beavercheck.com/results/28daf8c0-4fa3-47c4-84d0-8906c9fa224d
## Top Findings
1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers
2. **[CRITICAL]** No Content-Security-Policy header found — Security > Content Security Policy
3. **[CRITICAL]** No favicon or icon links detected — Accessibility > Favicon & Branding
4. **[WARNING]** Cross-Origin-Embedder-Policy header is missing — Security > Security Headers
5. **[WARNING]** Cross-Origin-Opener-Policy header is missing — Security > Security Headers
---
## Security
### Security Headers (D — 50/100)
*5 of 10 headers properly configured*
- **[PASS]** Strict-Transport-Security is properly configured (consider adding preload)
- **[PASS]** X-Content-Type-Options is properly configured
- **[PASS]** X-Frame-Options is properly configured
- **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.
- **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
- **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.
- **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
- **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
- **[PASS]** X-Powered-By header is not present
- **[PASS]** Server header is present without version info
### Content Security Policy (F — 0/100)
*No enforcing CSP policy found*
- **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.
### TLS & Certificates (A+ — 100/100)
*TLS 1.3, 7 checks passed*
- **[PASS]** TLS 1.3 is used
- **[PASS]** Strong cipher suite is used
- **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance.
- **[PASS]** Certificate is valid (expires in 45 days)
- **[PASS]** Certificate chain has 2 certificates
- **[PASS]** Certificate uses modern signature algorithm
- **[PASS]** Certificate covers 3 domain(s)
- **[PASS]** Certificate is issued by a trusted CA
### Cookie Security (A+ — 100/100)
*1 cookies analyzed, 3 checks passed*
- **[PASS]** Cookie 'MYMOONOVA_SESSID' has the Secure flag
- **[PASS]** Cookie 'MYMOONOVA_SESSID' has the HttpOnly flag
- **[PASS]** Cookie 'MYMOONOVA_SESSID' has SameSite=Lax
---
## Advanced Security
### Subresource Integrity (A+ — 100/100)
*No external resources*
- **[PASS]** No external resources to protect
### JS Library Vulnerabilities (A+ — 100/100)
*No known vulnerabilities*
- **[PASS]** No known JavaScript library vulnerabilities detected
### Information Leakage (A+ — 100/100)
*No exposures*
- **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt.
- **[PASS]** No sensitive files exposed
### Email Security (D — 50/100)
*DMARC: none*
- **[WARNING]** DMARC policy is none — monitoring only — This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject.
### Permissions-Policy (D — 40/100)
*No header set*
- **[WARNING]** No Permissions-Policy header — Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.
### CORS Configuration (B — 80/100)
*No CORS headers*
- **[PASS]** No CORS headers present — secure default
---
## Infrastructure
### DNS Records (A+ — 95/100)
*1 A records, 45 ms lookup*
- **[PASS]** Resolves to 1 IPv4 address(es)
- **[INFO]** Single A record — no DNS redundancy — Multiple A records provide failover if one server goes down.
- **[INFO]** No IPv6 (AAAA) records
- **[PASS]** 2 nameserver(s) configured
- **[PASS]** 1 mail exchanger(s) configured
- **[INFO]** CAA records not checked — CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
- **[PASS]** SPF record present in TXT
- **[PASS]** DNS resolution time: 45 ms
### Redirect Chain (A+ — 100/100)
*No redirects — direct access*
- **[PASS]** No redirects — direct access
### IPv6 Readiness (C — 60/100)
*No IPv6 support*
- **[INFO]** No IPv6 (AAAA) records found — IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
### Crawlability (A+ — 100/100)
*robots.txt present, sitemap with 66 URLs*
- **[PASS]** robots.txt is present
- **[PASS]** sitemap.xml is present
- **[PASS]** sitemap.xml is valid XML
- **[PASS]** sitemap.xml contains 66 entries
- **[PASS]** robots.txt references sitemap
### URL Variants (D — 50/100)
*www/non-www, trailing slash, HTTP→HTTPS*
- **[CRITICAL]** Both www and non-www versions serve content
- **[CRITICAL]** HTTP version does not redirect to HTTPS
### Domain Intelligence (B — 70/100)
*MYMOONOVA.COM — via Scaleway SAS, 11 months old, hosted on O2SWITCH, FR*
- **[CRITICAL]** Domain expires in 29 days — This domain expires on May 20, 2026. Domains that expire accidentally cause complete website downtime. Enable auto-renewal or renew manually now.
- **[INFO]** DNSSEC is not enabled — DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
- **[PASS]** Registrar: Scaleway SAS
- **[WARNING]** Registrar lock is NOT enabled — The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
- **[PASS]** Hosting: O2SWITCH, FR
---
## Compliance
### WCAG Compliance (A+ — 100/100)
*No testable criteria*
### Cookie Consent & Privacy (B — 80/100)
*No consent signals detected*
- **[WARNING]** No privacy policy link detected — A privacy policy page is recommended for transparency and may be legally required.
- **[INFO]** No terms of service link detected
- **[INFO]** No cookie consent banner detected
- **[PASS]** 1 cookie(s) set on initial load (functional)
- **[INFO]** This is an automated check, not legal advice — BeaverCheck detects technical indicators of consent management. This does not constitute a legal compliance assessment. Consult a privacy professional for GDPR/CCPA compliance.
### Language & i18n (F — 5/100)
*Missing *
- **[WARNING]** attribute is missing — The lang attribute on is required for screen readers and WCAG 3.1.1 compliance.
- **[INFO]** No Content-Language HTTP header
- **[PASS]** Language signals are consistent
### Readability & Typography (A+ — 100/100)
*Font sizes and tap targets checked*
### Viewport Configuration (F — 30/100)
*No viewport meta tag*
- **[CRITICAL]** No viewport meta tag found — Without a viewport meta tag, the page will not render correctly on mobile devices.
---
## Availability
### CDN & Delivery (D — 50/100)
*No CDN detected*
- **[WARNING]** No CDN detected — A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them.
### HTTP Caching (F — 30/100)
*No cache headers*
- **[WARNING]** No Cache-Control header found — Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers.
---
## UX
### 404 Error Page (F — 35/100)
*HTTP 404, bare page*
- **[PASS]** Correct 404 status code returned
- **[WARNING]** Bare server default 404 page — The 404 page has no custom styling. Users hitting a broken link see a generic error with no way to navigate back. Add a custom 404 page with your site navigation and a search bar.
### Favicon & Branding (F — 0/100)
*No icons detected*
- **[WARNING]** No favicon.ico at site root — Some older browsers, bookmark tools, and RSS readers look for /favicon.ico. Add one as a fallback.
- **[INFO]** No apple-touch-icon detected — iOS devices use this when users add your site to their home screen. Add .
- **[CRITICAL]** No favicon or icon links detected — Your site will show the browser's generic page icon in tabs, bookmarks, and home screens.
### Web Manifest (D — 40/100)
*Not found*
- **[INFO]** No web manifest found — No manifest at standard paths (/manifest.json, /site.webmanifest). A manifest is optional but enables PWA features like home screen installation and standalone display.
### Dark Mode Support (D — 40/100)
*No dark mode signals*
- **[INFO]** No dark mode signals detected — Consider adding CSS with @media (prefers-color-scheme: dark) and .
- **[INFO]** Detection limited to meta tags and inline styles — External CSS files may contain prefers-color-scheme rules not visible to this scan.
### Print Stylesheet (D — 40/100)
*No print styles*
- **[INFO]** No print-specific styles detected — When users print this page, they get the screen layout including navigation and non-essential elements. Add @media print rules to hide navigation and optimize layout for paper.
### Navigation UX (F — 0/100)
*No navigation patterns*
- **[INFO]** No breadcrumbs, search, or skip link detected — These navigation aids help users orient themselves and find content efficiently, especially on large sites.
---
---
*Generated by [BeaverCheck](https://beavercheck.com) — https://beavercheck.com/results/28daf8c0-4fa3-47c4-84d0-8906c9fa224d*