Skip to content
https://beavercheck.com

Security

· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.
SCORE
92
GRADE
A
FIX
1
REVIEW
2
PASS
9
INFO
0
Checks
12
9 PASS 2 REVIEW 1 FIX
D
security.txt
Action
No /.well-known/security.txt published
FIX

security.txt

No security.txt found at /.well-known/security.txt

B
Permissions-Policy
4 directives, 2 missing
REVIEW
4 directives, 2 missing
Info::
camera=() — blocked for all origins
Info::
microphone=() — blocked for all origins
Info::
geolocation=() — blocked for all origins
Info::
interest-cohort=() — blocked for all origins
Info::
payment not restricted
Consider adding payment=() to block payment access from embedded content.
Info::
usb not restricted
Consider adding usb=() to block usb access from embedded content.

Raw Header

camera=() microphone=() geolocation=() interest-cohort=()

Feature Permissions

Blocked Self Only Unrestricted Not Set
camera Blocked
microphone Blocked
geolocation Blocked
interest-cohort Blocked
payment Not Set
usb Not Set
B
CORS Configuration
No CORS headers
REVIEW
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
A+
Security Headers
10 of 10 headers properly configured
PASS
10 of 10 headers properly configured
Info::
Strict-Transport-Security is properly configured
Got: max-age=63072000; includeSubDomains; preload
Info::
X-Content-Type-Options is properly configured
Got: nosniff
Info::
X-Frame-Options is properly configured
Got: DENY
Info::
Referrer-Policy is properly configured
Got: strict-origin-when-cross-origin
Info::
Permissions-Policy is set
Got: camera=(), microphone=(), geolocation=(), interest-cohort=()
Info::
Content-Security-Policy is present
Got: default-src 'self'; script-src 'self' 'nonce-nHk2LdeItqV1RZjG9L/Ltw==' 'sha256-H…
Info::
Cross-Origin-Opener-Policy is properly configured
Got: same-origin
Info::
Cross-Origin-Embedder-Policy is set
Got: credentialless
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: nginx
A+
Content Security Policy
9 of 10 CSP checks passed
PASS
9 of 10 CSP checks passed
Info::
Raw CSP policy
Got: default-src 'self'; script-src 'self' 'nonce-nHk2LdeItqV1RZjG9L/Ltw==' 'sha256-HEEHOpXHE8BTh9dRb9M7PatEeATDO5ZEGlSwTknAV7k='; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data: https:; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
Info::
default-src directive is set
Got: default-src 'self'
Info::
No 'unsafe-inline' in script source
Info::
No 'unsafe-eval' in script source
Info::
No wildcard in script source
Info::
object-src falls back to default-src
Info::
base-uri is properly restricted
Got: base-uri 'self'
Info::
frame-ancestors directive is set
Got: frame-ancestors 'none'
Info::
form-action directive is set
Got: form-action 'self'
Info::
upgrade-insecure-requests is enabled

Parsed Policy

default-src 'self'
script-src 'self''nonce-nHk2LdeItqV1RZjG9L/Ltw==''sha256-HEEHOpXHE8BTh9dRb9M7PatEeATDO5ZEGlSwTknAV7k='
style-src 'self''unsafe-inline'
font-src 'self'
img-src 'self'data:https:
connect-src 'self'
base-uri 'self'
form-action 'self'
frame-ancestors 'none'
upgrade-insecure-requests
A+
TLS & Certificates
TLS 1.3, 7 checks passed
PASS
TLS 1.3, 7 checks passed
Info::
TLS 1.3 is used
Got: TLS 1.3
Info::
Strong cipher suite is used
Got: TLS_CHACHA20_POLY1305_SHA256
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 56 days)
Got: 2026-06-30T07:28:52Z
Info::
Certificate chain has 2 certificates
Info::
Certificate uses modern signature algorithm
Got: ECDSA-SHA384
Info::
Certificate covers 2 domain(s)
Got: beavercheck.com, www.beavercheck.com
Info::
Certificate is issued by a trusted CA
Got: CN=E8,O=Let's Encrypt,C=US

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection
Protocol
TLS 1.3
Cipher Suite
TLS_CHACHA20_POLY1305_SHA256
HTTP Version
HTTP/1.1

Certificate Chain

Leaf Certificate
Subject CN=beavercheck.comIssuer CN=E8,O=Let's Encrypt,C=USValid 2026-04-01T07:28:53Z → 2026-06-30T07:28:52ZExpires in 56 days SANs beavercheck.com, www.beavercheck.comSignature ECDSA-SHA384Serial 6bdf96c8e1e79333d5967c7efe425d5dd35
Intermediate (CA Certificate)
Subject CN=E8,O=Let's Encrypt,C=USIssuer CN=ISRG Root X1,O=Internet Security Research Group,C=USValid 2024-03-13T00:00:00Z → 2027-03-12T23:59:59ZExpires in 312 days Signature SHA256-RSASerial 63959363c24e7082715918bfc3d7ed56
A+
Cookie Security
1 cookies analyzed, 3 checks passed
PASS
1 cookies analyzed, 3 checks passed
Info::
Cookie 'bc_csrf' has the Secure flag
Info::
Cookie 'bc_csrf' has the HttpOnly flag
Info::
Cookie 'bc_csrf' has SameSite=Lax
1 cookies analyzed
NameSecureHttpOnlySameSiteSizeIssues
bc_csrf✓✓Lax39 B—
A+
Subresource Integrity
No external resources
PASS
No external resources
Info::
No external resources to protect
SRI Coverage No external resources — SRI not applicable
A+
JS Library Vulnerabilities
No known vulnerabilities
PASS
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+
Information Leakage
No exposures
PASS
No exposures
Info::
No security.txt found
Consider adding a security.txt at /.well-known/security.txt.
Info::
No sensitive files exposed

No sensitive files exposed — all paths returned 404.

PathStatusCategoryRisk
/.git/HEAD✓ Not foundVersion Control—
/.git/config✓ Not foundVersion Control—
/.svn/entries✓ Not foundVersion Control—
/.env✓ Not foundConfiguration—
/.env.local✓ Not foundConfiguration—
/.env.production✓ Not foundConfiguration—
/wp-config.php✓ Not foundConfiguration—
/.htaccess✓ Not foundConfiguration—
/phpinfo.php✓ Not foundDebug—
/server-status✓ Not foundDebug—
/server-info✓ Not foundDebug—
/.well-known/security.txt✓ Not foundSecurity Policy—
A+
Email Security
DMARC: reject
PASS
DMARC: reject
Info::
DMARC policy is reject — strongest protection
DMARC
Policy reject — strongest protection Record v=DMARC1;p=reject;pct=100;rua=info@beavercheck.com;
A
Transport Security
HTTP/3, HSTS, and TLS version analysis
PASS
HTTP/3, HSTS, and TLS version analysis
Info::
HTTP/3 (QUIC) not advertised
HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
Info::
HSTS enabled (includeSubDomains, preload)
Info::
HSTS preload enabled
Info::
TLS 1.3 in use (fastest handshake, 1-RTT)
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback