# BeaverCheck Audit Report — https://grubhub.com **Date:** April 22, 2026 **URL:** https://grubhub.com **Overall Grade:** C (70/100) **Report:** https://beavercheck.com/results/2fdcfdec-c00d-4f3e-90b2-32ca68948bd2 ## Top Findings 1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers 2. **[CRITICAL]** No Content-Security-Policy header found — Security > Content Security Policy 3. **[CRITICAL]** Soft 404: server returns HTTP 200 for non-existent pages — Accessibility > 404 Error Page 4. **[WARNING]** 8 third-party resources (98% of weight) — Performance > Page Weight Inventory 5. **[WARNING]** Cross-Origin-Embedder-Policy header is missing — Security > Security Headers --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 81 | | Accessibility | 58 | | Best Practices | 73 | | SEO | 83 | --- ## Security ### Security Headers (F — 25/100) *2 of 10 headers properly configured* - **[WARNING]** HSTS is missing includeSubDomains — Without includeSubDomains, subdomains can still be accessed over HTTP. - **[WARNING]** X-Content-Type-Options header is missing — This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'. - **[WARNING]** X-Frame-Options header is missing — This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN. - **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter. - **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features. - **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis. - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info ### Content Security Policy (F — 0/100) *No enforcing CSP policy found* - **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 7 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[PASS]** Certificate is valid (expires in 215 days) - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 2 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *No cookies set — no cookie security risks* - **[PASS]** No cookies set — no cookie security risks --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[PASS]** security.txt is present — good practice - **[PASS]** No sensitive files exposed ### Email Security (A+ — 100/100) *DMARC: reject* - **[PASS]** DMARC policy is reject — strongest protection ### Permissions-Policy (D — 40/100) *No header set* - **[WARNING]** No Permissions-Policy header — Consider adding a Permissions-Policy header to restrict browser feature access from embedded content. ### CORS Configuration (C — 60/100) *Origin: ** - **[INFO]** Access-Control-Allow-Origin: * — unrestricted — Any website can read this resource's response. Appropriate for public APIs but not for user-specific content. - **[INFO]** Origin reflection not testable with a single request — Some servers reflect the request Origin header. This requires manual testing with a crafted Origin header. --- ## Performance ### Page Weight Budget (A+ — 100/100) *194 KB transferred, 9 requests* - **[PASS]** Page weighs 292 KB (194 KB transferred) - **[PASS]** 9 HTTP requests - **[INFO]** Estimated 0.04 g CO2 per page load ### Third-Party Impact (D — 50/100) *98% third-party, 0 ms blocking* - **[WARNING]** Third-party code accounts for 98% of page weight (191.2 KiB of 194.2 KiB) - **[PASS]** Third-party blocking time is low (0 ms) ### Text Compression (A+ — 100/100) *All text resources are compressed* - **[PASS]** All text resources are compressed ### Image Optimization (A — 90/100) *2 images, 0 KB saveable* - **[WARNING]** https://gh-prod-umami-grubhub.s3-website-us-east-1... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. ### JS Execution Cost (A+ — 100/100) *89ms total JS execution* - **[INFO]** Unattributable: 89ms CPU time - **[WARNING]** Third-party scripts: 89ms (100% of total) ### Font Loading (A+ — 100/100) *3 fonts (159 KB)* - **[INFO]** 3 font(s) use font-display: swap (FOUT risk but functional) ### JS Bundles (A+ — 100/100) *No JavaScript* - **[PASS]** No JavaScript bundles ### Resource Caching (A+ — 100/100) *All resources properly cached* - **[PASS]** No caching issues found ### Critical Rendering Path (A+ — 100/100) *No render-blocking resources* - **[PASS]** No render-blocking resources detected ### Resource Hints (A+ — 100/100) *No optimization needed* - **[PASS]** No resource hint issues ### Page Weight Inventory (A — 85/100) *9 resources · 194 KB · 0 KB savings available* - **[PASS]** Within 1MB page-weight target - **[WARNING]** 8 third-party resources (98% of weight) --- ## Infrastructure ### DNS Records (A — 85/100) *1 A records, 273 ms lookup* - **[PASS]** Resolves to 1 IPv4 address(es) - **[INFO]** Single A record — no DNS redundancy — Multiple A records provide failover if one server goes down. - **[INFO]** No IPv6 (AAAA) records - **[PASS]** 8 nameserver(s) configured - **[PASS]** 7 mail exchanger(s) configured - **[INFO]** CAA records not checked — CAA record lookup requires a specialized DNS resolver. This check will be available in a future update. - **[PASS]** SPF record present in TXT - **[WARNING]** DNS resolution is slow (273 ms) — Slow DNS adds latency to every page load. Consider a faster DNS provider. ### Redirect Chain (A+ — 100/100) *No redirects — direct access* - **[PASS]** No redirects — direct access ### IPv6 Readiness (C — 60/100) *No IPv6 support* - **[INFO]** No IPv6 (AAAA) records found — IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity. ### Crawlability (C — 65/100) *robots.txt present, sitemap with 0 URLs* - **[PASS]** robots.txt is present - **[PASS]** sitemap.xml is present - **[WARNING]** sitemap.xml contains invalid XML — Search engines may not be able to parse the sitemap. Fix XML validation errors. - **[WARNING]** sitemap.xml is empty — no URLs found — An empty sitemap provides no value. Add entries for your pages. - **[INFO]** robots.txt does not reference a sitemap — Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap. ### URL Variants (D — 50/100) *www/non-www, trailing slash, HTTP→HTTPS* - **[CRITICAL]** Both www and non-www versions serve content - **[CRITICAL]** HTTP version does not redirect to HTTPS ### Domain Intelligence (A+ — 100/100) *grubhub.com — via GoDaddy Corporate Domains, LLC, 23 years, 9 months old, hosted on Fastly* - **[PASS]** Domain registered until Nov 6, 2029 (3 years, 7 months remaining) - **[INFO]** DNSSEC is not enabled — DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it. - **[PASS]** Registrar: GoDaddy Corporate Domains, LLC - **[WARNING]** Registrar lock is NOT enabled — The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers. - **[PASS]** Hosting: Fastly --- ## Compliance ### WCAG Compliance (A+ — 100/100) *No testable criteria* ### Cookie Consent & Privacy (B — 80/100) *No consent signals detected* - **[WARNING]** No privacy policy link detected — A privacy policy page is recommended for transparency and may be legally required. - **[INFO]** No terms of service link detected - **[INFO]** No cookie consent banner detected - **[INFO]** This is an automated check, not legal advice — BeaverCheck detects technical indicators of consent management. This does not constitute a legal compliance assessment. Consult a privacy professional for GDPR/CCPA compliance. ### Language & i18n (F — 5/100) *Missing * - **[WARNING]** attribute is missing — The lang attribute on is required for screen readers and WCAG 3.1.1 compliance. - **[INFO]** No Content-Language HTTP header - **[PASS]** Language signals are consistent ### Readability & Typography (A+ — 100/100) *Font sizes and tap targets checked* ### Viewport Configuration (F — 30/100) *No viewport meta tag* - **[CRITICAL]** No viewport meta tag found — Without a viewport meta tag, the page will not render correctly on mobile devices. ### Third-Party Trackers (C — 55/100) *3 trackers detected* - **[INFO]** 3 third-party trackers detected — Found 3 analytics, 0 advertising, 0 marketing, 0 tag manager trackers. - **[WARNING]** Trackers detected but no cookie policy found — This page loads 3 trackers but no cookie policy was detected. GDPR requires disclosure when using tracking cookies. - **[WARNING]** Trackers detected but no privacy policy found — Most data protection regulations require a privacy policy when collecting user data via trackers. ### Cookie & Tracker Inventory (A+ — 100/100) *0 cookies · 3 trackers · 0 pre-consent* - **[INFO]** 3 third-party tracker(s) detected on page --- ## Availability ### CDN & Delivery (A+ — 100/100) *Fastly (HIT)* - **[PASS]** Site is served via Fastly CDN - **[PASS]** CDN cache status: HIT ### HTTP Caching (F — 30/100) *No cache headers* - **[WARNING]** No Cache-Control header found — Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers. ### Transport Security (A — 90/100) *HTTP/3, HSTS, and TLS version analysis* - **[INFO]** HTTP/3 (QUIC) not advertised — HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it. - **[PASS]** HSTS enabled (base policy) - **[INFO]** HSTS missing includeSubDomains — Without includeSubDomains, HSTS only protects the exact domain. - **[PASS]** TLS 1.3 in use (fastest handshake, 1-RTT) --- ## UX ### 404 Error Page (F — 20/100) *Soft 404 detected* - **[CRITICAL]** Soft 404: server returns HTTP 200 for non-existent pages — The server returns HTTP 200 for a path that does not exist. Search engines will index these pages, diluting your real content. Configure your server to return a proper 404 status code for missing pages. ### Favicon & Branding (F — 15/100) *1 icon(s) detected* - **[PASS]** favicon.ico present at site root - **[INFO]** No apple-touch-icon detected — iOS devices use this when users add your site to their home screen. Add . ### Web Manifest (F — 30/100) *Invalid JSON* - **[WARNING]** Manifest contains invalid JSON — Manifest at https://grubhub.com/manifest.json contains invalid JSON. Browsers cannot parse it. ### Dark Mode Support (D — 40/100) *No dark mode signals* - **[INFO]** No dark mode signals detected — Consider adding CSS with @media (prefers-color-scheme: dark) and . - **[INFO]** Detection limited to meta tags and inline styles — External CSS files may contain prefers-color-scheme rules not visible to this scan. ### Print Stylesheet (D — 40/100) *No print styles* - **[INFO]** No print-specific styles detected — When users print this page, they get the screen layout including navigation and non-essential elements. Add @media print rules to hide navigation and optimize layout for paper. ### Navigation UX (F — 0/100) *No navigation patterns* - **[INFO]** No breadcrumbs, search, or skip link detected — These navigation aids help users orient themselves and find content efficiently, especially on large sites. --- ## Sustainability ### CO2 Per Page Load (A+ — 100/100) *0.04g CO2 per view* - **[PASS]** 0.04g CO2 per page view — This page transfers 0.2 MB, producing an estimated 0.04g of CO2 per visit using the Sustainable Web Design model (v4). Breakdown: data center 0.00g, network 0.01g, end-user device 0.03g. - **[INFO]** At 10,000 monthly views: 5.4 kg CO2/year — With 10,000 page views per month, this page would generate approximately 5.4 kg of CO2 annually — equivalent to charging 673 smartphones. - **[PASS]** Green hosting reduces data center emissions ### Green Hosting (A — 85/100) *Green (cdn)* - **[PASS]** Fastly CDN uses renewable energy — Since most traffic is served through the CDN, the majority of data transfer energy is renewable. - **[INFO]** Fastly: 100% renewable energy for edge network - **[INFO]** Green hosting status based on known provider commitments — Green hosting detection uses a curated database of provider renewable energy commitments. This is not a real-time verification. For authoritative checks, visit thegreenwebfoundation.org. ### Repeat Visit Weight (A+ — 100/100) *98% cached* - **[PASS]** 98% reduction on repeat visits — Returning visitors download only 3 KB (vs 194 KB first visit). 8 of 9 resources are served from browser cache, saving 0.04g CO2 per repeat visit. - **[INFO]** Repeat visit: 0.00g CO2 (first visit: 0.04g) ### Carbon Budget (A+ — 100/100) *10th percentile* - **[PASS]** 0.04g CO2 — below the sustainability target of 0.50g — Cleaner than an estimated 90% of websites analyzed. This page meets the Web Sustainability Guidelines target. - **[INFO]** Estimated 10th percentile — Compared to: top 10% = 0.20g, target = 0.50g, median = 0.60g per page view. ### Transfer Efficiency (A+ — 100/100) *100% efficient* - **[PASS]** Transfer efficiency: 100% — Only 0 KB of potential savings identified. Your page is well-optimized for size. --- --- *Generated by [BeaverCheck](https://beavercheck.com) — https://beavercheck.com/results/2fdcfdec-c00d-4f3e-90b2-32ca68948bd2*