# BeaverCheck Audit Report — https://santander.com.br **Date:** May 25, 2026 **URL:** https://santander.com.br **Overall Grade:** C (77/100) **Report:** https://beavercheck.com/results/422ad65b-1bfe-413d-a712-fdb92e86d437 ## Top Findings 1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers 2. **[CRITICAL]** HSTS header is missing — Security > Security Headers 3. **[CRITICAL]** No Content-Security-Policy header found — Security > Content Security Policy 4. **[CRITICAL]** Scan returned a Akamai Bot Manager bot-protection interstitial, not the actual page — Security > Bot Challenge Detection 5. **[CRITICAL]** Missing attribute (WCAG 3.1.1) — Accessibility > Document Language --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 28 | | Accessibility | 74 | | Best Practices | 77 | | SEO | 100 | --- ## Security ### Security Headers (F — 10/100) *2 of 10 headers properly configured* - **[CRITICAL]** HSTS header is missing — Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year. - **[WARNING]** X-Content-Type-Options header is missing — This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'. - **[WARNING]** X-Frame-Options header is missing — This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN. - **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter. - **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features. - **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis. - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is not present - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (F — 0/100) *No enforcing CSP policy found* - **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 8 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[PASS]** OCSP stapling enabled - **[PASS]** Certificate is valid (expires in 79 days) - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 95 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *No cookies set — no cookie security risks* - **[PASS]** No cookies set — no cookie security risks ### Cookie Hygiene (A+ — 100/100) *No cookies set -- cookie-hygiene check is N/A* - **[PASS]** No cookies set ### WAF / Bot Protection (B — 75/100) *No WAF detected via response headers* - **[INFO]** No WAF detected — Response headers don't match any known WAF or bot-management product. Sites exposed to abuse (login, signup, payment) typically benefit from a WAF such as Cloudflare, Akamai, AWS WAF, or Imperva. ### security.txt (C — 60/100) *No security.txt file found* - **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field. ### Cross-Origin Tab Safety (A+ — 100/100) *No new-tab links found -- no tabnabbing surface* - **[PASS]** No new-tab links present ### CSP Inline-Style Readiness (A+ — 100/100) *No inline style attributes -- strict CSP is feasible* - **[PASS]** No inline style attributes detected ### Trusted Types (XSS Sink Hardening) (A+ — 100/100) *No CSP header -- Trusted Types check is N/A* - **[PASS]** No CSP header found -- Trusted Types check is N/A ### Bot Challenge Detection (F — 0/100) *Scan was blocked by Akamai Bot Manager -- the rest of this report does NOT reflect the real site* - **[CRITICAL]** Scan returned a Akamai Bot Manager bot-protection interstitial, not the actual page — The HTML captured by the scanner is a `Akamai Bot Manager` challenge / block page. The scanner's user-agent or IP was flagged as bot traffic and the real site content was never returned. Every other section in this report (security headers, accessibility, content, SEO, performance) was computed against the few KB of interstitial HTML rather than your actual page -- those findings are NOT meaningful for this URL. Detection signal: 'Access Denied' + Reference # + HTTP block + small body -- Akamai Bot Manager pattern Resolution paths: (1) allow-list BeaverCheck's worker IPs at the bot-protection layer, (2) configure a relaxed challenge for known scanner user-agents, or (3) accept that the public site is unscannable from third-party tools. Note that Cloudflare's "Bot Fight Mode" and "Super Bot Fight Mode" both block the scanner by default. ### Soft-404 Detection (A+ — 100/100) *HTTP status is non-2xx -- soft-404 check is N/A* - **[PASS]** HTTP status is non-2xx -- soft-404 check is N/A ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (A+ — 100/100) *Page has no third-party scripts or stylesheets -- SRI not applicable* - **[PASS]** No third-party scripts or stylesheets to protect with SRI ### CORS Depth (A+ — 100/100) *No CORS response headers -- the resource is same-origin-only by browser default* - **[PASS]** No CORS response headers -- the resource is same-origin-only by browser default ### Permissions-Policy Granularity (C — 60/100) *No Permissions-Policy header set -- powerful features (camera / microphone / geolocation / payment / USB) default to allow-on-same-origin* - **[WARNING]** Permissions-Policy header not set -- features default to allow-on-same-origin — Without a `Permissions-Policy` (or legacy `Feature-Policy`) header, every powerful browser feature defaults to its spec default policy (typically `self`). A third-party iframe injected via XSS or a misconfigured embed can still request access to the user's camera, microphone, geolocation, payment APIs, USB devices, etc. Explicitly deny features the page doesn't need: ``` Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=() ``` Features the page legitimately uses can stay enabled with `feature=(self)`. ### Referrer-Policy Strictness (B — 75/100) *Referrer-Policy header not set -- browser default applies (modern: strict-origin-when-cross-origin; legacy browsers: no-referrer-when-downgrade)* - **[INFO]** Referrer-Policy header not set -- browser default applies — Without an explicit `Referrer-Policy` header, the browser falls back to its default policy. Modern browsers (Chrome 85+, Firefox 87+, Safari 15+) default to `strict-origin-when-cross-origin`, which is privacy-safe. Legacy browsers default to the leaky `no-referrer-when-downgrade`, which sends the full URL (including path + query) on cross-origin HTTPS-to-HTTPS requests. Set an explicit header to ensure consistent behavior: ``` Referrer-Policy: strict-origin-when-cross-origin ``` This matches the modern browser default and is privacy-safe without breaking referrer-based same-origin analytics. ### Source Map Exposure (A+ — 100/100) *Source-map probe didn't run on this scan* - **[PASS]** Source-map probe didn't run on this scan ### HTML Version Disclosure (A+ — 100/100) *No software-version disclosures in HTML* - **[PASS]** No software-version disclosures in HTML ### Open Redirect Surface (A+ — 100/100) *No redirect-shaped query parameters in DOM links* - **[PASS]** No redirect-shaped query parameters in DOM links ### Auth Security (A+ — 100/100) *Page is not a login form -- auth-security checks are N/A* - **[PASS]** Page does not appear to be a login form ### Subdomain Inventory Exposure (A+ — 100/100) *No risky subdomain names in certificate SANs* - **[PASS]** No risky subdomain names in certificate SANs --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt. - **[PASS]** No sensitive files exposed ### Email Security (B — 70/100) *DMARC: reject, SPF: -all* - **[PASS]** DMARC policy is reject — strongest protection - **[PASS]** SPF ends in -all (hard fail) — strongest setting - **[INFO]** No DKIM detected via common selectors — DKIM signs outbound mail to prove origin. We probed common selectors (default, google, selector1, etc.) without finding a record. If you use a non-standard selector, this is a false negative. - **[INFO]** MTA-STS not configured — MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts. and a policy file at https://mta-sts./.well-known/mta-sts.txt. - **[INFO]** TLS-RPT not configured — TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.. - **[INFO]** BIMI not configured — BIMI (Brand Indicators for Message Identification) lets supporting clients (Gmail, Apple Mail, Yahoo) display your verified logo next to your messages. Optional but raises trust signals. Requires DMARC at p=quarantine or p=reject to be honored. ### API Surface (A+ — 100/100) *No API specs or GraphQL introspection found (probed 11 candidate path(s))* - **[PASS]** No API specs or GraphQL introspection found (probed 11 path(s)) ### Permissions-Policy (D — 40/100) *No header set* - **[WARNING]** No Permissions-Policy header — Consider adding a Permissions-Policy header to restrict browser feature access from embedded content. ### CORS Configuration (B — 80/100) *No CORS headers* - **[PASS]** No CORS headers present — secure default --- ## Performance ### Page Weight Budget (F — 30/100) *2.9 MB transferred, 167 requests* - **[WARNING]** Page weighs 8.6 MB (2.9 MB transferred) - **[WARNING]** JavaScript is 2.1 MB — consider code splitting or lazy loading — Large JavaScript bundles delay interactivity. Split code by route or defer non-critical scripts. - **[INFO]** Fonts are 553 KB — consider subsetting or using system fonts — Subset fonts to include only used characters, or switch to system font stacks. - **[WARNING]** 167 HTTP requests — consider bundling or reducing — Each request adds latency. Bundle small files, use sprites, or eliminate unnecessary requests. - **[INFO]** Estimated 0.61 g CO2 per page load ### Third-Party Impact (D — 50/100) *100% third-party, 0 ms blocking* - **[WARNING]** Third-party code accounts for 100% of page weight (2.9 MiB of 2.9 MiB) - **[PASS]** Third-party blocking time is low (0 ms) ### Text Compression (A+ — 100/100) *All text resources are compressed* - **[PASS]** All text resources are compressed ### Image Optimization (C — 60/100) *62 images, 0 KB saveable* - **[WARNING]** https://www.santander.com.br/sites/WPC_CMS/imagem/... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** https://www.santander.com.br/sites/WPC_CMS/imagem/... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** https://www.santander.com.br/sites/WPC_CMS/imagem/... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. - **[WARNING]** https://www.santander.com.br/sites/WPC_CMS/imagem/... is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. ### JS Execution Cost (F — 20/100) *13390ms total JS execution* - **[WARNING]** https://www.santander.com.br/mfe-cookies/polyfills...: 3479ms CPU time - **[WARNING]** https://www.santander.com.br/: 1829ms CPU time - **[WARNING]** Unattributable: 1508ms CPU time - **[WARNING]** https://www.santander.com.br/OdEmAYiOktnI/gjY8e_/D...: 987ms CPU time - **[WARNING]** https://www.googletagmanager.com/gtm.js?id=GTM-KMF...: 784ms CPU time - **[WARNING]** Third-party scripts: 11882ms (89% of total) ### Font Loading (A+ — 100/100) *13 fonts (553 KB)* - **[INFO]** 13 font(s) use font-display: swap (FOUT risk but functional) ### JS Bundles (F — 20/100) *41 scripts, 631 KB unused* - **[WARNING]** https://www.googletagmanager.com/gtm.js?id=GTM-NQW...: 71 KB unused (63%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.santander.com.br/mfe-home-header/main....: 66 KB unused (23%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.googletagmanager.com/gtag/js?id=G-Y4V2...: 63 KB unused (37%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.googletagmanager.com/gtag/destination?...: 61 KB unused (47%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.googletagmanager.com/gtm.js?id=GTM-KMF...: 58 KB unused (27%) — Consider code splitting or tree shaking to reduce unused code. - **[INFO]** Total unused JavaScript: 631 KB ### Resource Caching (A+ — 100/100) *All resources properly cached* - **[PASS]** No caching issues found ### Critical Rendering Path (A+ — 100/100) *No render-blocking resources* - **[PASS]** No render-blocking resources detected ### Resource Hints (A+ — 100/100) *No optimization needed* - **[PASS]** No resource hint issues ### HTTP/3 (QUIC) (B — 75/100) *HTTP/3 not advertised* - **[INFO]** HTTP/3 (QUIC) is not advertised — HTTP/3 isn't advertised via Alt-Svc and the worker didn't negotiate h3. HTTP/3 reduces handshake latency (1-RTT instead of 2-3 RTTs) and is more resilient on lossy connections. Most modern CDNs (Cloudflare, Fastly, AWS CloudFront, Google Cloud CDN) support HTTP/3 with a single config switch -- consider enabling for mobile-heavy workloads. ### Compression Algorithm (C — 70/100) *Main response served uncompressed* - **[INFO]** Main HTML response has no Content-Encoding (uncompressed) — The main HTML document is served without compression. The Text Compression section above lists the broader picture; for the main response specifically, even gzip would shave ~70-80% off most text payloads. ### LCP Image Preload (A+ — 100/100) *LCP preload audit not available* - **[PASS]** LCP image preload audit not available for this scan ### Main HTML Cache-Control (B — 80/100) *No Cache-Control header on main HTML response* - **[INFO]** Main HTML response has no Cache-Control header — Without an explicit Cache-Control, browsers fall back to heuristic caching (~10% of Last-Modified age). Set `Cache-Control: no-cache` or `max-age=300` for HTML to control freshness explicitly -- prevents stale auth state and SPA shell drift. ### Server-Timing Observability (B — 85/100) *No Server-Timing header found* - **[INFO]** No Server-Timing header found — Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge. ### Server Response Intelligence (A+ — 95/100) *1 server-response signal(s) detected* - **[INFO]** No `ETag` or `Last-Modified` -- conditional GET not supported — Without either header, browsers can't issue conditional GETs and refresh always re-downloads the full response body even when nothing changed. Add `ETag: ""` (or `Last-Modified: `) on cacheable responses; the server returns 304 Not Modified when the client's cached copy is still valid, saving bandwidth. ### Page Weight Inventory (F — 30/100) *167 resources · 2.9 MB · 631 KB savings available* - **[WARNING]** Page weight 2.9 MB exceeds 1 MB target by 1.9 MB - **[INFO]** ~631 KB of savings available - **[WARNING]** 166 third-party resources (100% of weight) - **[INFO]** 2 resources over 200KB ### Render-Blocking Resources (A+ — 100/100) *No render-blocking resources detected* - **[PASS]** No render-blocking resources detected in ### Third-Party Resources (A+ — 100/100) *No third-party resources detected* ### JavaScript Blocking (A — 90/100) *1 JS blocking issue(s) detected* - **[WARNING]** Total JS execution time is 13.4 s -- over the 3.5s budget — Total JavaScript execution (parse + compile + run) across all scripts exceeds 3.5 seconds. On low-end devices that becomes 7-15+ seconds and shows up directly in TBT and INP. Reduce by: tree-shaking unused dependencies, code-splitting (dynamic `import()`), removing or deferring third-party tracking, and replacing heavy frameworks where they're not needed. ### CSS Performance Depth (A+ — 100/100) *No CSS performance depth issues detected* - **[PASS]** No CSS performance depth issues detected --- ## Content Quality ### Links (A+ — 100/100) *No links to check.* - **[PASS]** No links found on the page ### Mixed Content (A+ — 100/100) *No mixed content detected — all resources use HTTPS.* - **[PASS]** No mixed content detected — all resources use HTTPS ### Open Graph (F — 0/100) *No Open Graph tags found — social sharing previews will be generic.* - **[WARNING]** No Open Graph meta tags found — Without og:title, og:description, and og:image, social media platforms will generate a generic preview when your page is shared. ### Open Graph / Twitter Card Depth (A+ — 100/100) *No OG image or Twitter card set -- depth check is N/A (presence covered by Open Graph section)* - **[PASS]** No OG image / Twitter card to evaluate ### Structured Data (C — 40/100) *No structured data (JSON-LD) found.* - **[INFO]** No structured data (JSON-LD) found — Adding structured data helps search engines understand your content and can enable rich results. ### Rich Results Eligibility (C — 75/100) *No JSON-LD found -- no rich-result eligibility* - **[INFO]** No JSON-LD structured data on the page — No `