# BeaverCheck Audit Report — https://python.org **Date:** April 7, 2026 **URL:** https://python.org **Overall Grade:** D (63/100) **Report:** https://beavercheck.com/results/689a1596-ab8b-4193-8c06-bebe6240aae8 ## Top Findings 1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers 2. **[CRITICAL]** No Content-Security-Policy header found — Security > Content Security Policy 3. **[WARNING]** Cross-Origin-Embedder-Policy header is missing — Security > Security Headers 4. **[WARNING]** Cross-Origin-Opener-Policy header is missing — Security > Security Headers 5. **[WARNING]** DMARC policy is none — monitoring only — Security > Email Security --- ## Security ### Security Headers (F — 25/100) *2 of 10 headers properly configured* - **[WARNING]** HSTS is missing includeSubDomains — Without includeSubDomains, subdomains can still be accessed over HTTP. - **[WARNING]** X-Content-Type-Options header is missing — This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'. - **[WARNING]** X-Frame-Options header is missing — This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN. - **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter. - **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features. - **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis. - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info ### Content Security Policy (F — 0/100) *No enforcing CSP policy found* - **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 7 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[PASS]** Certificate is valid (expires in 313 days) - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 3 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *No cookies set — no cookie security risks* - **[PASS]** No cookies set — no cookie security risks --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt. - **[PASS]** No sensitive files exposed ### Email Security (D — 50/100) *DMARC: none* - **[WARNING]** DMARC policy is none — monitoring only — This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject. ### Permissions-Policy (D — 40/100) *No header set* - **[WARNING]** No Permissions-Policy header — Consider adding a Permissions-Policy header to restrict browser feature access from embedded content. ### CORS Configuration (B — 80/100) *No CORS headers* - **[PASS]** No CORS headers present — secure default --- ## Infrastructure ### DNS Records (A — 90/100) *4 A records, 279 ms lookup* - **[PASS]** Resolves to 4 IPv4 address(es) - **[PASS]** Has 4 IPv6 (AAAA) record(s) - **[PASS]** 4 nameserver(s) configured - **[PASS]** 1 mail exchanger(s) configured - **[INFO]** CAA records not checked — CAA record lookup requires a specialized DNS resolver. This check will be available in a future update. - **[PASS]** SPF record present in TXT - **[WARNING]** DNS resolution is slow (279 ms) — Slow DNS adds latency to every page load. Consider a faster DNS provider. ### Redirect Chain (A — 90/100) *1 redirect(s), 297 ms total* - **[PASS]** Single redirect - **[INFO]** WWW normalization redirect ### IPv6 Readiness (A+ — 100/100) *IPv6 reachable (1 ms)* - **[PASS]** IPv6 is configured and reachable at 2a04:4e42:200::223, 2a04:4e42:600::223, 2a04:4e42::223, 2a04:4e42:400::223 ### Crawlability (B — 80/100) *robots.txt present, no sitemap* - **[PASS]** robots.txt is present - **[INFO]** No sitemap.xml found — A sitemap helps search engines discover and index your pages more efficiently. - **[INFO]** robots.txt does not reference a sitemap — Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap. ### URL Variants (B — 75/100) *www/non-www, trailing slash, HTTP→HTTPS* - **[CRITICAL]** Both www and non-www versions serve content - **[PASS]** HTTP correctly 301-redirects to HTTPS ### Domain Intelligence (A+ — 100/100) *python.org — via Gandi SAS, 31 years, 5 months old* - **[PASS]** Domain registered until Mar 28, 2033 (7 years remaining) - **[INFO]** DNSSEC is not enabled — DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it. - **[PASS]** Registrar: Gandi SAS --- ## Compliance ### WCAG Compliance (A+ — 100/100) *No testable criteria* ### Cookie Consent & Privacy (B — 80/100) *No consent signals detected* - **[WARNING]** No privacy policy link detected — A privacy policy page is recommended for transparency and may be legally required. - **[INFO]** No terms of service link detected - **[INFO]** No cookie consent banner detected - **[INFO]** This is an automated check, not legal advice — BeaverCheck detects technical indicators of consent management. This does not constitute a legal compliance assessment. Consult a privacy professional for GDPR/CCPA compliance. ### Language & i18n (F — 5/100) *Missing * - **[WARNING]** attribute is missing — The lang attribute on is required for screen readers and WCAG 3.1.1 compliance. - **[INFO]** No Content-Language HTTP header - **[PASS]** Language signals are consistent ### Readability & Typography (A+ — 100/100) *Font sizes and tap targets checked* ### Viewport Configuration (F — 30/100) *No viewport meta tag* - **[CRITICAL]** No viewport meta tag found — Without a viewport meta tag, the page will not render correctly on mobile devices. --- ## Availability ### CDN & Delivery (D — 50/100) *No CDN detected* - **[WARNING]** No CDN detected — A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them. ### HTTP Caching (F — 30/100) *No cache headers* - **[WARNING]** No Cache-Control header found — Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers. --- ## UX ### 404 Error Page (A — 90/100) *HTTP 404, custom page* - **[PASS]** Correct 404 status code returned - **[PASS]** Custom styled 404 page - **[PASS]** Navigation links present on 404 page - **[PASS]** Homepage link present on 404 page - **[PASS]** Search form present on 404 page ### Favicon & Branding (F — 15/100) *1 icon(s) detected* - **[PASS]** favicon.ico present at site root - **[INFO]** No apple-touch-icon detected — iOS devices use this when users add your site to their home screen. Add . ### Web Manifest (D — 40/100) *Not found* - **[INFO]** No web manifest found — No manifest at standard paths (/manifest.json, /site.webmanifest). A manifest is optional but enables PWA features like home screen installation and standalone display. ### Dark Mode Support (D — 40/100) *No dark mode signals* - **[INFO]** No dark mode signals detected — Consider adding CSS with @media (prefers-color-scheme: dark) and . - **[INFO]** Detection limited to meta tags and inline styles — External CSS files may contain prefers-color-scheme rules not visible to this scan. ### Print Stylesheet (D — 40/100) *No print styles* - **[INFO]** No print-specific styles detected — When users print this page, they get the screen layout including navigation and non-essential elements. Add @media print rules to hide navigation and optimize layout for paper. ### Navigation UX (F — 0/100) *No navigation patterns* - **[INFO]** No breadcrumbs, search, or skip link detected — These navigation aids help users orient themselves and find content efficiently, especially on large sites. --- --- *Generated by [BeaverCheck](https://beavercheck.com) — https://beavercheck.com/results/689a1596-ab8b-4193-8c06-bebe6240aae8*