# BeaverCheck Audit Report — https://tradingview.com **Date:** October 24, 2026 **URL:** https://tradingview.com **Overall Grade:** B (83/100) **Report:** https://beavercheck.com/results/6c59030f-8f5e-467a-b0ca-93668238e39b ## Top Findings 1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers 2. **[CRITICAL]** Page weighs 21.2 MB (12.8 MB transferred) — Performance > Page Weight Budget 3. **[CRITICAL]** 11 image-only link(s) without alt text — Accessibility > Link & Button Quality 4. **[CRITICAL]** 48 button(s) with no accessible text — Accessibility > Link & Button Quality 5. **[CRITICAL]** 60 link(s) with no accessible text — Accessibility > Link & Button Quality --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 27 | | Accessibility | 88 | | Best Practices | 77 | | SEO | 85 | --- ## Security ### Security Headers (F — 30/100) *3 of 10 headers properly configured* - **[PASS]** HSTS is enabled with preload - **[WARNING]** X-Content-Type-Options header is missing — This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'. - **[WARNING]** X-Frame-Options header is missing — This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN. - **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter. - **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features. - **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis. - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info - **[PASS]** Domain is in the Chrome HSTS preload list (status: preloaded) ### Content Security Policy (F — 0/100) *No enforcing CSP policy found* - **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 9 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[PASS]** HTTP/2 is negotiated - **[PASS]** OCSP stapling enabled - **[PASS]** Certificate is valid (expires in 78 days) - **[PASS]** Certificate chain has 3 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 2 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *No cookies set — no cookie security risks* - **[PASS]** No cookies set — no cookie security risks ### Cookie Hygiene (A+ — 100/100) *No cookies set -- cookie-hygiene check is N/A* - **[PASS]** No cookies set ### WAF / Bot Protection (B — 75/100) *No WAF detected via response headers* - **[INFO]** No WAF detected — Response headers don't match any known WAF or bot-management product. Sites exposed to abuse (login, signup, payment) typically benefit from a WAF such as Cloudflare, Akamai, AWS WAF, or Imperva. ### security.txt (A — 85/100) *Vulnerability disclosure policy* - **[PASS]** security.txt found - **[WARNING]** security.txt: Missing required 'Expires' field (RFC 9116) ### Cross-Origin Tab Safety (D — 60/100) *18 of 18 new-tab link(s) missing rel=noopener* - **[WARNING]** 18 link(s) open in a new tab without rel=noopener — Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners. ### CSP Inline-Style Readiness (A+ — 100/100) *No inline style attributes -- strict CSP is feasible* - **[PASS]** No inline style attributes detected ### Trusted Types (XSS Sink Hardening) (A+ — 100/100) *No CSP header -- Trusted Types check is N/A* - **[PASS]** No CSP header found -- Trusted Types check is N/A ### Bot Challenge Detection (A+ — 100/100) *Scan reached real page content (no bot-protection interstitial)* - **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page ### Soft-404 Detection (A+ — 100/100) *HTTP status is non-2xx -- soft-404 check is N/A* - **[PASS]** HTTP status is non-2xx -- soft-404 check is N/A ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (F — 30/100) *0% SRI adoption (0/252 third-party resources)* - **[WARNING]** SRI adoption: 0/252 third-party resources protected (0%) — Of 252 third-party `