# BeaverCheck Audit Report — https://e621.net
**Date:** May 10, 2026
**URL:** https://e621.net
**Overall Grade:** B (87/100)
**Report:** https://beavercheck.com/results/51b3d314-67ed-483b-9cd0-0dd19cabd0ac
## Top Findings
1. **[WARNING]** Cross-Origin-Embedder-Policy header is missing — Security > Security Headers
2. **[WARNING]** Cross-Origin-Opener-Policy header is missing — Security > Security Headers
3. **[WARNING]** HSTS max-age is too short (0s, should be ≥ 31536000s) — Security > Security Headers
4. **[WARNING]** No Permissions-Policy header — Security > Permissions-Policy
5. **[WARNING]** Permissions-Policy header is missing — Security > Security Headers
---
## Lighthouse Scores
| Category | Score |
|----------|-------|
| Performance | 85 |
| Accessibility | 96 |
| Best Practices | 96 |
| SEO | 92 |
---
## Security
### Security Headers (C — 65/100)
*6 of 10 headers properly configured*
- **[WARNING]** HSTS max-age is too short (0s, should be ≥ 31536000s) — A short max-age leaves a window for downgrade attacks. Set max-age to at least 31536000 (1 year).
- **[PASS]** X-Content-Type-Options is properly configured
- **[PASS]** X-Frame-Options is properly configured
- **[PASS]** Referrer-Policy is properly configured
- **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
- **[PASS]** Content-Security-Policy is present
- **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
- **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
- **[PASS]** X-Powered-By header is not present
- **[PASS]** Server header is present without version info
- **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload).
### Content Security Policy (A — 85/100)
*6 of 10 CSP checks passed*
- **[INFO]** Raw CSP policy
- **[PASS]** default-src directive is set
- **[PASS]** No 'unsafe-inline' in script source
- **[PASS]** No 'unsafe-eval' in script source
- **[PASS]** No wildcard in script source
- **[WARNING]** object-src allows plugin content — Set object-src to 'none' to prevent Flash/Java plugin exploits.
- **[WARNING]** base-uri directive is missing — Without base-uri, attackers can inject a tag to hijack relative URLs. Set it to 'self' or 'none'.
- **[PASS]** frame-ancestors directive is set
- **[PASS]** form-action directive is set
- **[INFO]** upgrade-insecure-requests is not set — This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content.
### TLS & Certificates (A+ — 100/100)
*TLS 1.3, 8 checks passed*
- **[PASS]** TLS 1.3 is used
- **[PASS]** Strong cipher suite is used
- **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance.
- **[PASS]** OCSP stapling enabled
- **[PASS]** Certificate is valid (expires in 55 days)
- **[PASS]** Certificate chain has 3 certificates
- **[PASS]** Certificate uses modern signature algorithm
- **[PASS]** Certificate covers 2 domain(s)
- **[PASS]** Certificate is issued by a trusted CA
### Cookie Security (A+ — 100/100)
*1 cookies analyzed, 3 checks passed*
- **[PASS]** Cookie '_danbooru_session' has the Secure flag
- **[PASS]** Cookie '_danbooru_session' has the HttpOnly flag
- **[PASS]** Cookie '_danbooru_session' has SameSite=Lax
### Cookie Hygiene (A+ — 100/100)
*All 1 cookie(s) pass hygiene checks*
- **[PASS]** All 1 cookie(s) pass hygiene checks
### WAF / Bot Protection (A — 90/100)
*Cloudflare*
- **[PASS]** Cloudflare detected — Detected via: cf-ray: 9f9990e218ef7879-CDG
### security.txt (C — 60/100)
*No security.txt file found*
- **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field.
### Cross-Origin Tab Safety (A+ — 100/100)
*No new-tab links found -- no tabnabbing surface*
- **[PASS]** No new-tab links present
### CSP Inline-Style Readiness (B — 90/100)
*3 inline style attribute(s) detected*
- **[INFO]** 3 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 3 inline style(s) is low. Affected element types include: body, div, ul. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win.
### Trusted Types (XSS Sink Hardening) (B — 95/100)
*Trusted Types not enabled*
- **[INFO]** Trusted Types not enabled — Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode.
### Bot Challenge Detection (A+ — 100/100)
*Scan reached real page content (no bot-protection interstitial)*
- **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page
### Soft-404 Detection (A+ — 100/100)
*No soft-404 patterns detected in page title or headings*
- **[PASS]** No soft-404 patterns detected in page title or headings
### Empty Page Detection (A+ — 100/100)
*Page has substantive body text and no placeholder / template-leak signals*
- **[PASS]** Page has substantive body text and no placeholder / template-leak signals
### Geo-Restriction Detection (A+ — 100/100)
*No geo-restriction signals detected -- scan reached the page from an allowed region*
- **[PASS]** No geo-restriction detected
### Maintenance Mode Detection (A+ — 100/100)
*No maintenance-mode signals detected -- scan reached a normal page*
- **[PASS]** No maintenance-mode signals detected
### Subresource Integrity Adoption (A+ — 100/100)
*Page has no third-party scripts or stylesheets -- SRI not applicable*
- **[PASS]** No third-party scripts or stylesheets to protect with SRI
### CORS Depth (A — 90/100)
*1 CORS depth signal(s) detected*
- **[INFO]** CORS allows any origin (`Access-Control-Allow-Origin: *`) — Any website can fetch this URL via JavaScript and read the response body. Acceptable for genuinely public APIs (e.g. CDN-served static assets). Risky if the URL returns user-specific or session-derived data, since other origins can scrape it via the user's browser without needing credentials. Narrow Allow-Origin to a specific origin allow-list when the response is sensitive.
### Permissions-Policy Granularity (C — 60/100)
*No Permissions-Policy header set -- powerful features (camera / microphone / geolocation / payment / USB) default to allow-on-same-origin*
- **[WARNING]** Permissions-Policy header not set -- features default to allow-on-same-origin — Without a `Permissions-Policy` (or legacy `Feature-Policy`) header, every powerful browser feature defaults to its spec default policy (typically `self`). A third-party iframe injected via XSS or a misconfigured embed can still request access to the user's camera, microphone, geolocation, payment APIs, USB devices, etc. Explicitly deny features the page doesn't need:
```
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=()
```
Features the page legitimately uses can stay enabled with `feature=(self)`.
### Referrer-Policy Strictness (A+ — 100/100)
*Referrer-Policy is `strict-origin-when-cross-origin` (modern default -- full URL same-origin, origin-only cross-origin)*
- **[PASS]** Referrer-Policy: `strict-origin-when-cross-origin` -- modern default -- full URL same-origin, origin-only cross-origin — The modern browser default (Chrome 85+, Firefox 87+, Safari 15+). Full URL Referer on same-origin; origin only on cross-origin; no Referer on HTTPS-to-HTTP downgrade. Privacy-safe and breaks no analytics. The recommended explicit value.
### Source Map Exposure (A+ — 100/100)
*No source maps accessible (probed 3 candidate URL(s))*
- **[PASS]** No source maps accessible across 3 probed candidate(s)
### HTML Version Disclosure (A+ — 100/100)
*No software-version disclosures in HTML*
- **[PASS]** No software-version disclosures in HTML
### Open Redirect Surface (A+ — 100/100)
*No redirect-shaped query parameters in DOM links*
- **[PASS]** No redirect-shaped query parameters in DOM links
### Auth Security (A+ — 100/100)
*Page is not a login form -- auth-security checks are N/A*
- **[PASS]** Page does not appear to be a login form
### Subdomain Inventory Exposure (A+ — 100/100)
*No risky subdomain names in certificate SANs*
- **[PASS]** No risky subdomain names in certificate SANs
---
## Advanced Security
### Subresource Integrity (A+ — 100/100)
*No external resources*
- **[PASS]** No external resources to protect
### JS Library Vulnerabilities (A+ — 100/100)
*No known vulnerabilities*
- **[PASS]** No known JavaScript library vulnerabilities detected
### Information Leakage (A+ — 100/100)
*No exposures*
- **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt.
- **[PASS]** No sensitive files exposed
### Email Security (C — 60/100)
*DMARC: quarantine, SPF: -all*
- **[PASS]** DMARC policy is quarantine — good protection
- **[PASS]** SPF ends in -all (hard fail) — strongest setting
- **[INFO]** No DKIM detected via common selectors — DKIM signs outbound mail to prove origin. We probed common selectors (default, google, selector1, etc.) without finding a record. If you use a non-standard selector, this is a false negative.
- **[INFO]** MTA-STS not configured — MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts. and a policy file at https://mta-sts./.well-known/mta-sts.txt.
- **[INFO]** TLS-RPT not configured — TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls..
- **[INFO]** BIMI not configured — BIMI (Brand Indicators for Message Identification) lets supporting clients (Gmail, Apple Mail, Yahoo) display your verified logo next to your messages. Optional but raises trust signals. Requires DMARC at p=quarantine or p=reject to be honored.
### API Surface (A+ — 100/100)
*No API specs or GraphQL introspection found (probed 11 candidate path(s))*
- **[PASS]** No API specs or GraphQL introspection found (probed 11 path(s))
### Permissions-Policy (D — 40/100)
*No header set*
- **[WARNING]** No Permissions-Policy header — Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.
### CORS Configuration (C — 60/100)
*Origin: **
- **[INFO]** Access-Control-Allow-Origin: * — unrestricted — Any website can read this resource's response. Appropriate for public APIs but not for user-specific content.
- **[INFO]** Origin reflection not testable with a single request — Some servers reflect the request Origin header. This requires manual testing with a crafted Origin header.
---
## Performance
### Page Weight Budget (A+ — 100/100)
*395 KB transferred, 35 requests*
- **[PASS]** Page weighs 758 KB (395 KB transferred)
- **[PASS]** 35 HTTP requests
- **[INFO]** Estimated 0.08 g CO2 per page load
### Third-Party Impact (A — 85/100)
*29% third-party, 0 ms blocking*
- **[INFO]** Third-party code accounts for 29% of page weight (113.1 KiB of 394.5 KiB)
- **[PASS]** Third-party blocking time is low (0 ms)
### Text Compression (A+ — 100/100)
*All text resources are compressed*
- **[PASS]** All text resources are compressed
### Image Optimization (C — 60/100)
*6 images, 0 KB saveable*
- **[WARNING]** https://e621.net/images/counter/2.png is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS.
- **[WARNING]** https://e621.net/images/counter/5.png is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS.
- **[WARNING]** https://e621.net/images/counter/6.png is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS.
- **[WARNING]** https://e621.net/images/counter/1.png is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS.
### JS Execution Cost (B — 80/100)
*665ms total JS execution*
- **[WARNING]** https://e621.net/: 356ms CPU time
- **[INFO]** Unattributable: 180ms CPU time
- **[INFO]** https://e621.net/vite/assets/jquery-CocJsJE4.js: 129ms CPU time
- **[INFO]** Third-party scripts: 180ms (27% of total)
### Font Loading (A+ — 100/100)
*2 fonts (132 KB)*
- **[INFO]** 2 font(s) use font-display: swap (FOUT risk but functional)
### JS Bundles (A+ — 100/100)
*19 scripts, 0 KB unused*
### Resource Caching (A+ — 100/100)
*All resources properly cached*
- **[PASS]** No caching issues found
### Critical Rendering Path (A+ — 100/100)
*No render-blocking resources*
- **[PASS]** No render-blocking resources detected
### Resource Hints (A+ — 100/100)
*No optimization needed*
- **[PASS]** No resource hint issues
### HTTP/3 (QUIC) (B — 75/100)
*HTTP/3 not advertised*
- **[INFO]** HTTP/3 (QUIC) is not advertised — HTTP/3 isn't advertised via Alt-Svc and the worker didn't negotiate h3. HTTP/3 reduces handshake latency (1-RTT instead of 2-3 RTTs) and is more resilient on lossy connections. Most modern CDNs (Cloudflare, Fastly, AWS CloudFront, Google Cloud CDN) support HTTP/3 with a single config switch -- consider enabling for mobile-heavy workloads.
### Compression Algorithm (C — 70/100)
*Main response served uncompressed*
- **[INFO]** Main HTML response has no Content-Encoding (uncompressed) — The main HTML document is served without compression. The Text Compression section above lists the broader picture; for the main response specifically, even gzip would shave ~70-80% off most text payloads.
### LCP Image Preload (A+ — 100/100)
*LCP preload audit not available*
- **[PASS]** LCP image preload audit not available for this scan
### Main HTML Cache-Control (A+ — 100/100)
*Main HTML max-age=0 (≤ 5min) is appropriate*
- **[PASS]** Main HTML max-age=0 (≤ 5min) is appropriate
### Server-Timing Observability (B — 85/100)
*No Server-Timing header found*
- **[INFO]** No Server-Timing header found — Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge.
### Server Response Intelligence (A+ — 95/100)
*1 server-response signal(s) detected*
- **[INFO]** No `ETag` or `Last-Modified` -- conditional GET not supported — Without either header, browsers can't issue conditional GETs and refresh always re-downloads the full response body even when nothing changed. Add `ETag: ""` (or `Last-Modified: `) on cacheable responses; the server returns 304 Not Modified when the client's cached copy is still valid, saving bandwidth.
### Page Weight Inventory (A+ — 95/100)
*35 resources · 395 KB · 0 KB savings available*
- **[PASS]** Within 1MB page-weight target
- **[INFO]** 3 third-party resources (29% of weight)
### Render-Blocking Resources (A+ — 100/100)
*No render-blocking resources detected*
- **[PASS]** No render-blocking resources detected in
### Third-Party Resources (A+ — 100/100)
*No third-party resources detected*
### JavaScript Blocking (A+ — 100/100)
*No render-blocking JS or document.write usage detected*
- **[PASS]** No JavaScript blocking issues detected
### CSS Performance Depth (A+ — 100/100)
*No CSS performance depth issues detected*
- **[PASS]** No CSS performance depth issues detected
---
## Content Quality
### Links (F — 40/100)
*65 links checked, 40 healthy, 25 broken*
- **[CRITICAL]** 40 of 65 links are healthy
- **[WARNING]** Broken link: https://e621.net/safari-pinned-tab.svg — Found in . Get "https://e621.net/safari-pinned-tab.svg": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/pools/gallery — Found in . Get "https://e621.net/pools/gallery": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/post_sets — Found in . Get "https://e621.net/post_sets": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/tags — Found in . Get "https://e621.net/tags": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/blips — Found in . Get "https://e621.net/blips": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/comments — Found in . Get "https://e621.net/comments": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/forum_topics — Found in . Get "https://e621.net/forum_topics": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/session/new?url=%2F — Found in . Get "https://e621.net/session/new?url=%2F": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/static/theme — Found in . Get "https://e621.net/static/theme": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/wiki_pages?title=help%3Ahome — Found in . Get "https://e621.net/wiki_pages?title=help%3Ahome": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/help — Found in . Get "https://e621.net/help": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/static/site_map — Found in . Get "https://e621.net/static/site_map": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/posts?tags=order%3Ahot — Found in . Get "https://e621.net/posts?tags=order%3Ahot": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/posts?tags=jessabelle%27s_father_%28happ... — Found in . Get "https://e621.net/posts?tags=jessabelle%27s_father_%28happyroadkill%29": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/posts?tags=evlampyshka — Found in . Returns HTTP 503.
- **[CRITICAL]** Broken link: https://e621.net/posts?tags=happyroadkill — Found in . Returns HTTP 503.
- **[CRITICAL]** Broken link: https://e621.net/posts?tags=einin — Found in . Returns HTTP 503.
- **[CRITICAL]** Broken link: https://e621.net/posts?tags=ferux — Found in . Get "https://e621.net/posts?tags=ferux": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/news_updates — Found in . Get "https://e621.net/news_updates": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/static/takedown — Found in . Get "https://e621.net/static/takedown": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/static/contact — Found in . Get "https://e621.net/static/contact": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/help/advertising — Found in . Get "https://e621.net/help/advertising": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/terms_of_use — Found in . Get "https://e621.net/terms_of_use": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/static/privacy — Found in . Get "https://e621.net/static/privacy": context deadline exceeded
- **[CRITICAL]** Broken link: https://e621.net/static/code_of_conduct — Found in . Get "https://e621.net/static/code_of_conduct": context deadline exceeded
### Mixed Content (A+ — 100/100)
*No mixed content detected — all resources use HTTPS.*
- **[PASS]** No mixed content detected — all resources use HTTPS
### Open Graph (A — 95/100)
*Open Graph tags are well configured for social sharing.*
- **[INFO]** og:title is short (4 characters) — Ideal length is 25–60 characters for social sharing previews.
- **[INFO]** og:description is short (4 characters) — Ideal length is 55–200 characters for social sharing previews.
- **[INFO]** Missing og:site_name — The og:site_name tag displays the website name in social previews.
### Open Graph / Twitter Card Depth (A+ — 100/100)
*OG image dimensions and Twitter card configuration look healthy*
- **[PASS]** OG/Twitter Card depth is clean -- dimensions, card type, and inheritance all valid
### Structured Data (A — 90/100)
*2 JSON-LD block(s) found — structured data is well configured.*
- **[WARNING]** Missing required property "name" for WebSite — The "name" property is required for the WebSite schema type.
- **[INFO]** Missing recommended property "description" for WebSite — Adding "description" can improve how search engines display your content.
- **[INFO]** Missing recommended property "description" for WebSite — Adding "description" can improve how search engines display your content.
- **[INFO]** Missing recommended property "potentialAction" for WebSite — Adding "potentialAction" can improve how search engines display your content.
- **[PASS]** 2 JSON-LD blocks found
### Rich Results Eligibility (A+ — 100/100)
*2 JSON-LD block(s) declaring 1 schema type(s)*
- **[PASS]** SiteLinks Search Box markup detected — The page declares a `WebSite` schema with a `potentialAction` of `SearchAction`. This makes the homepage eligible for Google's in-SERP search box -- a high-visibility SERP feature for branded queries.
- **[PASS]** 1 rich-result schema type(s) declared — Inventory of structured-data types on the page (each may unlock a different SERP feature):
WebSite (×2)
Search engines decide whether to render rich results based on content quality + page-level signals; declaring the schema is necessary but not sufficient.
### Image Optimization (D — 65/100)
*3 issues found across 7 images*
- **[WARNING]** 7 images missing explicit width/height — Images without dimensions cause layout shifts (CLS). Set explicit width and height attributes.
- **[INFO]** 7 below-fold images missing loading="lazy" — Lazy loading defers below-fold images, reducing initial page weight.
- **[WARNING]** All 7 images use legacy formats (JPEG/PNG/GIF) — WebP offers 25-35% smaller files than JPEG. Use with for modern format support.
### Autoplay Media (A+ — 100/100)
*No autoplay media on the page*
- **[PASS]** No autoplay media on the page
---
## Infrastructure
### DNS Records (A+ — 100/100)
*2 A records, 31 ms lookup*
- **[PASS]** Resolves to 2 IPv4 address(es)
- **[PASS]** Has 2 IPv6 (AAAA) record(s)
- **[PASS]** 2 nameserver(s) configured
- **[PASS]** 5 mail exchanger(s) configured
- **[PASS]** SPF record present in TXT
- **[PASS]** DNS resolution time: 31 ms
### Subdomain Takeover (A+ — 100/100)
*No subdomain takeover risk detected*
- **[PASS]** No CNAME record present
### DNSSEC (A+ — 100/100)
*Signed and validating*
- **[PASS]** DNSSEC fully signed and chain validates (ECDSAP256SHA256)
### CAA Records (B — 80/100)
*No CAA records (any CA may issue certificates)*
- **[INFO]** No CAA records published — Without CAA records, any publicly-trusted CA can issue certificates for this domain. Adding a CAA record (`yourdomain. IN CAA 0 issue "letsencrypt.org"`) restricts issuance to CAs you authorize. Required by CAB Forum baseline since 2017; the default of 'any CA' is widely supported but is the broader attack surface for issuance fraud.
### Reverse DNS (C — 60/100)
*0/4 IPs match cert SAN*
- **[INFO]** PTR lookup failed for 172.66.160.235: lookup 172.66.160.235: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
- **[INFO]** PTR lookup failed for 104.20.31.112: lookup 104.20.31.112: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
- **[INFO]** PTR lookup failed for 2606:4700:10::ac42:a0eb: lookup 2606:4700:10::ac42:a0eb: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
- **[INFO]** PTR lookup failed for 2606:4700:10::6814:1f70: lookup 2606:4700:10::6814:1f70: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.
### Multi-Resolver DNS Speed (A+ — 100/100)
*Mean 15ms across 3 resolvers (spread 28ms)*
- **[PASS]** Quad9: 0ms
- **[PASS]** Cloudflare: 17ms
- **[PASS]** Google: 28ms
### Redirect Chain (A+ — 100/100)
*No redirects — direct access*
- **[PASS]** No redirects — direct access
### IPv6 Readiness (A+ — 100/100)
*IPv6 reachable (17 ms)*
- **[PASS]** IPv6 is configured and reachable at 2606:4700:10::ac42:a0eb, 2606:4700:10::6814:1f70
### Crawlability (B — 80/100)
*robots.txt present, no sitemap*
- **[PASS]** robots.txt is present
- **[INFO]** No sitemap.xml found — A sitemap helps search engines discover and index your pages more efficiently.
- **[INFO]** robots.txt does not reference a sitemap — Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.
### URL Variants (A+ — 100/100)
*www/non-www, trailing slash, HTTP→HTTPS*
- **[PASS]** www/non-www redirect configured correctly (preferred: non-www)
- **[PASS]** HTTP correctly 301-redirects to HTTPS
### Domain Intelligence (A — 90/100)
*e621.net — via NameCheap, Inc., 20 years old*
- **[WARNING]** Domain expires in 83 days — Consider enabling auto-renewal to prevent accidental expiration.
- **[PASS]** DNSSEC is enabled
- **[PASS]** Registrar: NameCheap, Inc.
- **[WARNING]** Registrar lock is NOT enabled — The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
---
## Compliance
### WCAG Compliance (A+ — 100/100)
*No testable criteria*
### Cookie Consent & Privacy (B — 80/100)
*privacy policy found*
- **[PASS]** Privacy policy link found
- **[PASS]** Terms of service link found
- **[INFO]** No cookie consent banner detected
- **[CRITICAL]** 1 non-essential cookie(s) set without consent banner — Unrecognized (treated as non-essential): _danbooru_session
- **[INFO]** This is an automated check, not legal advice — BeaverCheck detects technical indicators of consent management. This does not constitute a legal compliance assessment. Consult a privacy professional for GDPR/CCPA compliance.
### Consent UX Depth (A+ — 100/100)
*No consent-UX depth issues detected*
- **[PASS]** No consent-UX depth issues detected
### Tracker Inventory (A+ — 100/100)
*No known trackers detected on this page*
- **[PASS]** No known trackers detected on this page
### Language & i18n (A — 90/100)
*Lang attribute present*
- **[PASS]** attribute is present
- **[PASS]** value is valid
- **[INFO]** No Content-Language HTTP header
- **[INFO]** Language signals are inconsistent — The attribute and Content-Language header should agree.
### Hreflang Configuration (A+ — 100/100)
*No hreflang tags on this page*
- **[PASS]** No hreflang tags found (single-language site)
### Internationalization Extras (A+ — 100/100)
*No additional i18n signals detected*
- **[PASS]** No additional i18n signals detected
### Readability & Typography (A+ — 100/100)
*Font sizes and tap targets checked*
### Viewport Configuration (A+ — 100/100)
*Viewport properly configured*
- **[PASS]** Viewport meta tag is present
- **[PASS]** width=device-width is set
- **[PASS]** User zooming is allowed
### Accessibility Statement (B — 70/100)
*No accessibility statement detected*
- **[WARNING]** No accessibility statement detected — Sites are increasingly expected to publish an accessibility statement. Required by EU Web Accessibility Directive 2016/2102 for public-sector bodies; recommended best practice elsewhere. Common URLs: /accessibility, /accessibility-statement, /a11y.
### GDPR Article 13 Disclosures (F — 12/100)
*1 / 8 Art. 13 categories matched in homepage body*
- **[WARNING]** GDPR Article 13 disclosure coverage: 1 / 8 categories — Scanned the homepage body text for GDPR Article 13 disclosures. Matched 1 of 8 categories: Recipients of personal data. Missing: Data Protection Officer contact (where applicable), Data retention period, Data subject rights (access, erasure, rectification, etc.), Identity / contact details of the data controller, International data transfers, Legal basis for processing, Right to lodge a complaint with a supervisory authority. Note: this scan does not fetch the privacy policy sub-page; if Article 13 disclosures live there, they are not visible to this check.
### Third-Party Trackers (A+ — 95/100)
*1 trackers detected*
- **[INFO]** 1 third-party trackers detected — Found 1 analytics, 0 advertising, 0 marketing, 0 tag manager, 0 session-replay, 0 heatmap trackers.
### Cookie & Tracker Inventory (A+ — 100/100)
*1 cookies · 1 trackers · 0 pre-consent*
- **[INFO]** 1 cookie(s) could not be classified
- **[INFO]** 1 third-party tracker(s) detected on page
### Tracking Pixel Inventory (A+ — 100/100)
*No tracking pixels detected*
- **[PASS]** No tracking pixels detected
### Browser Fingerprinting (A+ — 100/100)
*No browser-fingerprinting libraries detected*
- **[PASS]** No browser-fingerprinting libraries detected
### Cross-Site Cookies (SameSite=None) (A+ — 100/100)
*No SameSite=None cookies -- no cross-site travel surface*
- **[PASS]** No cookies opted in to cross-site travel (SameSite=None)
### Beacon Tracking (sendBeacon) (A+ — 100/100)
*No navigator.sendBeacon usage detected in inline scripts*
- **[PASS]** No navigator.sendBeacon usage detected in inline scripts
---
## Legal
### Legal Page Ecosystem (C — 60/100)
*2 of 7 expected legal pages detected*
- **[PASS]** Privacy Policy detected — Found at /static/privacy, linked from footer.
- **[PASS]** Terms of Service detected — Found at /terms_of_use, linked from footer.
- **[INFO]** Cookie Policy not detected — No link matching common Cookie Policy URL patterns or link text was found. Most websites are expected to have a Cookie Policy, especially those collecting user data.
- **[INFO]** Accessibility Statement not detected — No link matching common Accessibility Statement URL patterns or link text was found. Most websites are expected to have a Accessibility Statement, especially those collecting user data.
- **[INFO]** DMCA / Copyright Notice not detected — No link matching common DMCA / Copyright Notice URL patterns or link text was found. Most websites are expected to have a DMCA / Copyright Notice, especially those collecting user data.
- **[INFO]** Refund / Returns Policy not detected — No link matching common Refund / Returns Policy URL patterns or link text was found. Most websites are expected to have a Refund / Returns Policy, especially those collecting user data.
- **[INFO]** Acceptable Use Policy not detected — No link matching common Acceptable Use Policy URL patterns or link text was found. Most websites are expected to have a Acceptable Use Policy, especially those collecting user data.
### Copyright Notice (B — 80/100)
*© 2025 Dragon Fruit Ventures LLC*
- **[INFO]** Copyright year is 2025 (1 year(s) behind) — Copyright year is 2025 — 1 year(s) behind. While copyright protection doesn't depend on the year being current, an outdated notice may suggest the site is not actively maintained. Update to © 2026 or use a range like © 2025–2026.
- **[PASS]** Copyright holder: Dragon Fruit Ventures LLC
### Regulatory Indicators
*2 regulatory indicator(s) detected*
- **[INFO]** This is a technical scan, not a legal assessment — BeaverCheck detects technical indicators that may suggest regulatory relevance. This is not a compliance audit and should not be relied upon for legal decisions. Consult qualified legal counsel for compliance assessments.
- **[INFO]** GDPR indicators detected (moderate confidence) — Indicators suggesting GDPR may be relevant: Privacy policy page found. EU General Data Protection Regulation — governs collection and processing of personal data of EU residents.
- **[INFO]** HIPAA indicators detected (weak confidence) — Indicators suggesting HIPAA may be relevant: Text mentions: phi. Health Insurance Portability and Accountability Act — protects sensitive patient health information.
### Third-Party Data Sharing
*0 third-party service(s) detected*
- **[INFO]** Data inventory for transparency purposes — This inventory identifies third-party services that receive data from your site visitors. Under regulations like GDPR (Article 30), maintaining records of data processing activities is commonly considered a best practice. This automated scan provides a starting point — it may not capture all data flows.
- **[INFO]** No recognized third-party data-sharing services detected — This page does not appear to load external tracking, analytics, or advertising scripts.
### Compliance Badges (C — 55/100)
*0 compliance badge(s) detected*
- **[INFO]** No compliance badges detected — No recognized compliance certification badges or seals were found. This is common — many sites do not display compliance badges.
---
## Availability
### CDN & Delivery (A — 85/100)
*Cloudflare (DYNAMIC)*
- **[PASS]** Site is served via Cloudflare CDN (edge: CDG)
- **[INFO]** CDN cache status: DYNAMIC
### HTTP Caching (B — 70/100)
*max-age=0, private, must-revalidate*
- **[PASS]** Cache-Control header is set
- **[INFO]** No ETag or Last-Modified header — Conditional requests (304 Not Modified) are not possible without validators.
### Operational Status Page (B — 80/100)
*No status page link detected*
- **[INFO]** No operational status page link detected — Status pages communicate planned maintenance and incidents to users -- a hallmark of operationally-mature services. Most SaaS teams publish one via Atlassian Statuspage, Instatus, BetterUptime, or a self-hosted Cachet. Smaller sites legitimately don't need one; flagged as Info, not a failure.
### Transport Security (B — 75/100)
*HTTP/3, HSTS, and TLS version analysis*
- **[INFO]** HTTP/3 (QUIC) not advertised — HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.
- **[WARNING]** HSTS max-age is short: 0 days — HSTS max-age should be at least 1 year (31536000 seconds).
- **[PASS]** TLS 1.3 in use (fastest handshake, 1-RTT)
### Health Check Endpoint (B — 80/100)
*No conventional health endpoint found*
- **[INFO]** No conventional health endpoint found — Health endpoints (/health, /healthz, /status, /ping, /api/health) let uptime monitors, load balancers, and orchestration systems (Kubernetes, ECS, Fly.io) verify the service is alive. Marketing sites and small services often skip them legitimately; flagged as Info, not a failure. Probe results: /api/health: connection error, /health: connection error, /healthz: connection error, /ping: connection error, /status: connection error.
### CDN Cache Observability (A+ — 100/100)
*Cache state: DYNAMIC*
- **[PASS]** CDN cache state observable via 1 header(s)
---
## Accessibility
### Landmark Structure (B — 75/100)
*2 landmarks*
- **[PASS]** landmark present
- **[PASS]** 1