# BeaverCheck Audit Report — https://uptimerobot.com **Date:** May 8, 2026 **URL:** https://uptimerobot.com **Overall Grade:** B (87/100) **Report:** https://beavercheck.com/results/73420e38-8e6e-45f7-9470-4aa5044f500d ## Top Findings 1. **[CRITICAL]** 1 link(s) with no accessible text — Accessibility > Link & Button Quality 2. **[WARNING]** is missing width/height — may cause layout shift — Performance > Image Optimization 3. **[WARNING]** 1 font preload(s) missing `crossorigin` -- font will be downloaded twice — Performance > Resource Hints 4. **[WARNING]** 1 software version(s) disclosed in HTML: Astro v5.16.15 — Security > HTML Version Disclosure 5. **[WARNING]** 2 link(s) open in a new tab without rel=noopener — Security > Cross-Origin Tab Safety --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 80 | | Accessibility | 96 | | Best Practices | 100 | | SEO | 92 | --- ## Security ### Security Headers (B — 80/100) *7 of 10 headers properly configured* - **[WARNING]** HSTS is missing includeSubDomains — Without includeSubDomains, subdomains can still be accessed over HTTP. - **[PASS]** X-Content-Type-Options is properly configured - **[PASS]** X-Frame-Options is properly configured - **[PASS]** Referrer-Policy is properly configured - **[PASS]** Permissions-Policy is set - **[PASS]** Content-Security-Policy is present - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (B — 70/100) *2 of 10 CSP checks passed* - **[INFO]** Raw CSP policy - **[WARNING]** default-src directive is missing — default-src provides a fallback for other directives. Set it to restrict default resource loading. - **[INFO]** No script-src or default-src to check for 'unsafe-inline' - **[INFO]** No script-src or default-src to check for 'unsafe-eval' - **[INFO]** No script-src or default-src to check for wildcard - **[PASS]** object-src falls back to default-src - **[WARNING]** base-uri directive is missing — Without base-uri, attackers can inject a tag to hijack relative URLs. Set it to 'self' or 'none'. - **[PASS]** frame-ancestors directive is set - **[WARNING]** form-action directive is missing — form-action restricts where forms can submit data, preventing form hijacking. - **[INFO]** upgrade-insecure-requests is not set — This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 8 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[PASS]** OCSP stapling enabled - **[PASS]** Certificate is valid (expires in 62 days) - **[PASS]** Certificate chain has 3 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 2 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 95/100) *1 cookies analyzed, 2 checks passed* - **[PASS]** Cookie 'ur_vid' has the Secure flag - **[WARNING]** Cookie 'ur_vid' is missing the HttpOnly flag — Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft. - **[PASS]** Cookie 'ur_vid' has SameSite=Lax ### WAF / Bot Protection (A — 90/100) *Cloudflare* - **[PASS]** Cloudflare detected — Detected via: cf-ray: 9f8bac5bddda7005-CDG ### security.txt (C — 60/100) *No security.txt file found* - **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field. ### Cross-Origin Tab Safety (C — 75/100) *2 of 14 new-tab link(s) missing rel=noopener* - **[WARNING]** 2 link(s) open in a new tab without rel=noopener — Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners. ### CSP Inline-Style Readiness (C — 75/100) *20 inline style attribute(s) detected* - **[WARNING]** 20 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 20 inline style(s) is moderate. Affected element types include: div, mask, input. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win. ### Trusted Types (XSS Sink Hardening) (B — 95/100) *Trusted Types not enabled* - **[INFO]** Trusted Types not enabled — Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode. ### Source Map Exposure (D — 60/100) *3 publicly-accessible source map(s) -- full source code leaked* - **[WARNING]** 3 publicly-accessible JavaScript source map(s) — Source maps (.js.map files) reveal the original source code -- variable names, comments, file structure, and sometimes secrets that were stripped from the bundled output. They're shipped to production by mistake almost universally; the standard fix is a build-tool config flag (Webpack: `devtool: false` or `'hidden-source-map'`; Vite: `build.sourcemap: false`; Next.js: `productionBrowserSourceMaps: false`). Once removed, audit your CDN/edge cache to evict any previously-cached .map URLs. Sample accessible URLs: https://uptimerobot.com/_astro/BaseLayout.astro_astro_type_script_index_0_lang.BVxzchVP.js.map, https://uptimerobot.com/_astro/GetQuoteModal.astro_astro_type_script_index_0_lang.cIsvtGIk.js.map, https://uptimerobot.com/_astro/page.Cyipsgv2.js.map. ### HTML Version Disclosure (C — 75/100) *1 software version(s) disclosed in HTML* - **[WARNING]** 1 software version(s) disclosed in HTML: Astro v5.16.15 — Each disclosed version enables direct CVE lookup -- an attacker who knows you run WordPress 6.4.2 (or whatever specific version) can search the CVE database for known exploits and target accordingly. Remove via your CMS config: WordPress (`remove_action('wp_head', 'wp_generator')`); Drupal (System / Reports / Status report -> Hide generator); Joomla (Global Configuration -> Hide generator); Hugo/Jekyll (delete or override the {{ .Site.Generator }} template hook). For HTML comments, audit your template files directly. ### Open Redirect Surface (A+ — 100/100) *No redirect-shaped query parameters in DOM links* - **[PASS]** No redirect-shaped query parameters in DOM links ### Subdomain Inventory Exposure (A+ — 100/100) *No risky subdomain names in certificate SANs* - **[PASS]** No risky subdomain names in certificate SANs --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *1 of 1 external resources have SRI* - **[PASS]** script from static.cloudflareinsights.com has SRI protection ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt. - **[PASS]** No sensitive files exposed ### Email Security (B — 80/100) *DMARC: quarantine, SPF: -all, DKIM* - **[PASS]** DMARC policy is quarantine — good protection - **[PASS]** SPF ends in -all (hard fail) — strongest setting - **[PASS]** DKIM configured (selectors: google, intercom) - **[INFO]** MTA-STS not configured — MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts. and a policy file at https://mta-sts./.well-known/mta-sts.txt. - **[INFO]** TLS-RPT not configured — TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.. - **[INFO]** BIMI not configured — BIMI (Brand Indicators for Message Identification) lets supporting clients (Gmail, Apple Mail, Yahoo) display your verified logo next to your messages. Optional but raises trust signals. Requires DMARC at p=quarantine or p=reject to be honored. ### Permissions-Policy (A+ — 95/100) *8 directives, 1 missing* - **[PASS]** geolocation=() — blocked for all origins - **[PASS]** midi=() — blocked for all origins - **[PASS]** microphone=() — blocked for all origins - **[PASS]** camera=() — blocked for all origins - **[PASS]** magnetometer=() — blocked for all origins - **[PASS]** gyroscope=() — blocked for all origins - **[INFO]** fullscreen=(self) - **[PASS]** payment=() — blocked for all origins - **[INFO]** usb not restricted — Consider adding usb=() to block usb access from embedded content. ### CORS Configuration (B — 80/100) *No CORS headers* - **[PASS]** No CORS headers present — secure default --- ## Performance ### Page Weight Budget (A+ — 100/100) *517 KB transferred, 38 requests* - **[PASS]** Page weighs 1.0 MB (517 KB transferred) - **[PASS]** 38 HTTP requests - **[INFO]** Estimated 0.11 g CO2 per page load ### Third-Party Impact (A+ — 100/100) *2% third-party, 0 ms blocking* - **[INFO]** Third-party code accounts for 2% of page weight (11.0 KiB of 517.1 KiB) - **[PASS]** Third-party blocking time is low (0 ms) ### Text Compression (A+ — 100/100) *All text resources are compressed* - **[PASS]** All text resources are compressed ### Image Optimization (B — 70/100) *16 images, 0 KB saveable* - **[WARNING]** is missing width/height — may cause layout shift — Set explicit width and height to prevent CLS. ### JS Execution Cost (C — 60/100) *1358ms total JS execution* - **[WARNING]** https://uptimerobot.com/_astro/page.Cyipsgv2.js: 485ms CPU time - **[WARNING]** Unattributable: 350ms CPU time - **[WARNING]** https://uptimerobot.com/: 265ms CPU time - **[INFO]** https://uptimerobot.com/_shared/v9/scripts.js: 189ms CPU time - **[INFO]** https://uptimerobot.com/_astro/carousels.Cac4_eZs....: 69ms CPU time - **[INFO]** Third-party scripts: 350ms (26% of total) ### Font Loading (A+ — 100/100) *4 fonts (186 KB)* - **[INFO]** 4 font(s) use font-display: swap (FOUT risk but functional) ### JS Bundles (A+ — 100/100) *10 scripts, 0 KB unused* ### Resource Caching (A+ — 100/100) *All resources properly cached* - **[PASS]** No caching issues found ### Critical Rendering Path (A+ — 100/100) *No render-blocking resources* - **[PASS]** No render-blocking resources detected ### Resource Hints (A — 85/100) *2 hints, 0 missing preconnects* - **[WARNING]** 1 font preload(s) missing `crossorigin` -- font will be downloaded twice — Fonts are always fetched as crossorigin=anonymous; a preload without the attribute creates a different cache key, so the browser refetches when the actual font request happens. Sample: /_shared/v9/fonts/plus-jakarta-sans-latin-wght-normal.woff2. Add `crossorigin` (or `crossorigin="anonymous"`) to each preload. - **[PASS]** Page uses 2 resource hint(s) ### HTTP/3 (QUIC) (A+ — 100/100) *HTTP/3 advertised via Alt-Svc* - **[PASS]** HTTP/3 (QUIC) is supported — First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss. ### Compression Algorithm (C — 70/100) *Main response served uncompressed* - **[INFO]** Main HTML response has no Content-Encoding (uncompressed) — The main HTML document is served without compression. The Text Compression section above lists the broader picture; for the main response specifically, even gzip would shave ~70-80% off most text payloads. ### LCP Image Preload (A+ — 100/100) *LCP preload audit not available* - **[PASS]** LCP image preload audit not available for this scan ### Main HTML Cache-Control (A+ — 100/100) *Main HTML uses no-store -- correct for sensitive/dynamic content* - **[PASS]** Main HTML uses no-store -- correct for sensitive/dynamic content ### Server-Timing Observability (A+ — 100/100) *4 Server-Timing entries advertised* - **[PASS]** Server-Timing header advertises 4 timing entries ### Page Weight Inventory (A+ — 100/100) *38 resources · 517 KB · 0 KB savings available* - **[PASS]** Within 1MB page-weight target - **[INFO]** 3 third-party resources (2% of weight) ### Render-Blocking Resources (A+ — 100/100) *No render-blocking resources detected* - **[PASS]** No render-blocking resources detected in ### Third-Party Resources (A+ — 100/100) *No third-party resources detected* --- ## Content Quality ### Links (A — 90/100) *195 links checked, 193 healthy, 2 broken* - **[WARNING]** 193 of 195 links are healthy - **[WARNING]** Broken link: https://o4505555361792000.ingest.us.sentry.io — Found in . Returns HTTP 404. - **[CRITICAL]** Broken link: https://uptimerobot.com/integrations/pagerduty-integratio... — Found in . Returns HTTP 404. ### Mixed Content (A+ — 100/100) *No mixed content detected — all resources use HTTPS.* - **[PASS]** No mixed content detected — all resources use HTTPS ### Open Graph (A+ — 100/100) *Open Graph tags are well configured for social sharing.* ### Structured Data (A — 90/100) *1 JSON-LD block(s) found — structured data is well configured.* - **[WARNING]** Missing required property "name" for Organization — The "name" property is required for the Organization schema type. - **[INFO]** Missing recommended property "url" for Organization — Adding "url" can improve how search engines display your content. - **[INFO]** Missing recommended property "logo" for Organization — Adding "logo" can improve how search engines display your content. - **[INFO]** Missing recommended property "sameAs" for Organization — Adding "sameAs" can improve how search engines display your content. ### Image Optimization (F — 40/100) *6 issues found across 34 images* - **[WARNING]** 2 images significantly larger than display size — Resizing to display dimensions could save approximately 248 KB. - **[WARNING]** 11 images missing explicit width/height — Images without dimensions cause layout shifts (CLS). Set explicit width and height attributes. - **[INFO]** 2 below-fold images missing loading="lazy" — Lazy loading defers below-fold images, reducing initial page weight. - **[INFO]** 5 of 34 images use legacy formats - **[WARNING]** 1 images missing alt text — Alt text is essential for screen readers and SEO. Every meaningful image needs descriptive alt text. - **[INFO]** 1 image(s) rendered at a different aspect ratio than the source — The displayed dimensions distort the source -- CSS is forcing the image into a container at the wrong ratio, producing visible stretching or squashing. Either crop the source to match or use object-fit: cover (and accept the crop). Sample: https://uptimerobot.com/_astro/hewlett-logo.JXmeoVm4.svg. ### Autoplay Media (A+ — 100/100) *No autoplay media on the page* - **[PASS]** No autoplay media on the page --- ## Infrastructure ### DNS Records (A+ — 100/100) *3 A records, 30 ms lookup* - **[PASS]** Resolves to 3 IPv4 address(es) - **[PASS]** Has 3 IPv6 (AAAA) record(s) - **[PASS]** 2 nameserver(s) configured - **[PASS]** 1 mail exchanger(s) configured - **[PASS]** SPF record present in TXT - **[PASS]** DNS resolution time: 30 ms ### Subdomain Takeover (A+ — 100/100) *No subdomain takeover risk detected* - **[PASS]** No CNAME record present ### DNSSEC (C — 55/100) *Zone signed but parent has no DS record* - **[WARNING]** DNSSEC keys published but parent zone has no DS record — The zone publishes DNSKEY records but the registry has not been updated with the corresponding DS record. From a validating resolver's perspective the domain is unsigned. Submit the DS record to your registrar to complete the delegation. ### CAA Records (A — 90/100) *issue: comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com | issuewild: comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com* - **[PASS]** CAA issue tag present — authorized CA(s): comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com - **[INFO]** No CAA iodef tag — won't be notified of failed issuance attempts — Add `0 iodef "mailto:security@example.com"` to receive notifications when a CA refuses issuance because it doesn't match your CAA policy. Useful signal for detecting issuance attempts by unauthorized CAs. ### Reverse DNS (C — 60/100) *0/6 IPs match cert SAN* - **[INFO]** PTR lookup failed for 104.26.15.202: lookup 104.26.15.202: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue. - **[INFO]** PTR lookup failed for 172.67.71.214: lookup 172.67.71.214: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue. - **[INFO]** PTR lookup failed for 104.26.14.202: lookup 104.26.14.202: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue. - **[INFO]** PTR lookup failed for 2606:4700:20::681a:fca: lookup 2606:4700:20::681a:fca: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue. - **[INFO]** PTR lookup failed for 2606:4700:20::681a:eca: lookup 2606:4700:20::681a:eca: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue. - **[INFO]** PTR lookup failed for 2606:4700:20::ac43:47d6: lookup 2606:4700:20::ac43:47d6: no such host — No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue. ### Multi-Resolver DNS Speed (A+ — 100/100) *Mean 16ms across 3 resolvers (spread 26ms)* - **[PASS]** Quad9: 3ms - **[PASS]** Cloudflare: 17ms - **[PASS]** Google: 29ms ### Redirect Chain (A+ — 100/100) *No redirects — direct access* - **[PASS]** No redirects — direct access ### IPv6 Readiness (A+ — 100/100) *IPv6 reachable (16 ms)* - **[PASS]** IPv6 is configured and reachable at 2606:4700:20::681a:fca, 2606:4700:20::681a:eca, 2606:4700:20::ac43:47d6 ### Crawlability (A+ — 100/100) *robots.txt present, sitemap with 304 URLs* - **[PASS]** robots.txt is present - **[PASS]** sitemap.xml is present - **[PASS]** sitemap.xml is valid XML - **[PASS]** sitemap.xml contains 304 entries - **[PASS]** robots.txt references sitemap ### URL Variants (B — 75/100) *www/non-www, trailing slash, HTTP→HTTPS* - **[CRITICAL]** Both www and non-www versions serve content - **[PASS]** HTTP correctly 301-redirects to HTTPS ### Domain Intelligence (A+ — 100/100) *uptimerobot.com — via GoDaddy.com, LLC, 16 years, 7 months old* - **[PASS]** Domain registered until Jan 1, 2033 (6 years, 8 months remaining) - **[INFO]** DNSSEC is not enabled — DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it. - **[PASS]** Registrar: GoDaddy.com, LLC - **[WARNING]** Registrar lock is NOT enabled — The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers. --- ## Compliance ### WCAG Compliance (A+ — 100/100) *No testable criteria* ### Cookie Consent & Privacy (B — 80/100) *privacy policy found* - **[PASS]** Privacy policy link found - **[PASS]** Terms of service link found - **[INFO]** No cookie consent banner detected - **[CRITICAL]** 1 non-essential cookie(s) set without consent banner — Unrecognized (treated as non-essential): ur_vid - **[INFO]** This is an automated check, not legal advice — BeaverCheck detects technical indicators of consent management. This does not constitute a legal compliance assessment. Consult a privacy professional for GDPR/CCPA compliance. ### Language & i18n (A — 90/100) *Lang attribute present* - **[PASS]** attribute is present - **[PASS]** value is valid - **[INFO]** No Content-Language HTTP header - **[INFO]** Language signals are inconsistent — The attribute and Content-Language header should agree. ### Readability & Typography (A+ — 100/100) *Font sizes and tap targets checked* ### Viewport Configuration (A+ — 100/100) *Viewport properly configured* - **[PASS]** Viewport meta tag is present - **[PASS]** width=device-width is set - **[PASS]** User zooming is allowed ### Accessibility Statement (B — 70/100) *No accessibility statement detected* - **[WARNING]** No accessibility statement detected — Sites are increasingly expected to publish an accessibility statement. Required by EU Web Accessibility Directive 2016/2102 for public-sector bodies; recommended best practice elsewhere. Common URLs: /accessibility, /accessibility-statement, /a11y. ### GDPR Article 13 Disclosures (F — 25/100) *0 / 8 Art. 13 categories matched in homepage body* - **[WARNING]** GDPR Article 13 disclosure coverage: 0 / 8 categories — Scanned the homepage body text for GDPR Article 13 disclosures. Matched 0 of 8 categories: . Missing: Data Protection Officer contact (where applicable), Data retention period, Data subject rights (access, erasure, rectification, etc.), Identity / contact details of the data controller, International data transfers, Legal basis for processing, Recipients of personal data, Right to lodge a complaint with a supervisory authority. Note: this scan does not fetch the privacy policy sub-page; if Article 13 disclosures live there, they are not visible to this check. ### Third-Party Trackers (A+ — 95/100) *1 trackers detected* - **[INFO]** 1 third-party trackers detected — Found 1 analytics, 0 advertising, 0 marketing, 0 tag manager, 0 session-replay, 0 heatmap trackers. ### Cookie & Tracker Inventory (A+ — 100/100) *1 cookies · 1 trackers · 0 pre-consent* - **[INFO]** 1 cookie(s) could not be classified - **[INFO]** 1 third-party tracker(s) detected on page ### Tracking Pixel Inventory (A+ — 100/100) *No tracking pixels detected* - **[PASS]** No tracking pixels detected ### Browser Fingerprinting (A+ — 100/100) *No browser-fingerprinting libraries detected* - **[PASS]** No browser-fingerprinting libraries detected ### Cross-Site Cookies (SameSite=None) (A+ — 100/100) *No SameSite=None cookies -- no cross-site travel surface* - **[PASS]** No cookies opted in to cross-site travel (SameSite=None) ### Beacon Tracking (sendBeacon) (A+ — 100/100) *No navigator.sendBeacon usage detected in inline scripts* - **[PASS]** No navigator.sendBeacon usage detected in inline scripts --- ## Legal ### Legal Page Ecosystem (C — 55/100) *2 of 7 expected legal pages detected* - **[PASS]** Privacy Policy detected — Found at https://uptimerobot.com/privacy/?ref=footer. - **[PASS]** Terms of Service detected — Found at https://uptimerobot.com/terms/?ref=footer. - **[INFO]** Cookie Policy not detected — No link matching common Cookie Policy URL patterns or link text was found. Most websites are expected to have a Cookie Policy, especially those collecting user data. - **[INFO]** Accessibility Statement not detected — No link matching common Accessibility Statement URL patterns or link text was found. Most websites are expected to have a Accessibility Statement, especially those collecting user data. - **[INFO]** DMCA / Copyright Notice not detected — No link matching common DMCA / Copyright Notice URL patterns or link text was found. Most websites are expected to have a DMCA / Copyright Notice, especially those collecting user data. - **[INFO]** Refund / Returns Policy not detected — No link matching common Refund / Returns Policy URL patterns or link text was found. Most websites are expected to have a Refund / Returns Policy, especially those collecting user data. - **[INFO]** Acceptable Use Policy not detected — No link matching common Acceptable Use Policy URL patterns or link text was found. Most websites are expected to have a Acceptable Use Policy, especially those collecting user data. ### Copyright Notice (C — 55/100) *No copyright notice detected* - **[INFO]** No copyright notice detected — No copyright notice detected in the page content. While not legally required in most jurisdictions (copyright exists automatically), a notice is standard practice and signals site ownership. ### Regulatory Indicators *2 regulatory indicator(s) detected* - **[INFO]** This is a technical scan, not a legal assessment — BeaverCheck detects technical indicators that may suggest regulatory relevance. This is not a compliance audit and should not be relied upon for legal decisions. Consult qualified legal counsel for compliance assessments. - **[INFO]** GDPR indicators detected (strong confidence) — Indicators suggesting GDPR may be relevant: Text mentions: gdpr; Privacy policy page found. EU General Data Protection Regulation — governs collection and processing of personal data of EU residents. - **[INFO]** CCPA indicators detected (weak confidence) — Indicators suggesting CCPA may be relevant: Text mentions: ccpa. California Consumer Privacy Act — gives California residents rights over their personal data. ### Third-Party Data Sharing *0 third-party service(s) detected* - **[INFO]** Data inventory for transparency purposes — This inventory identifies third-party services that receive data from your site visitors. Under regulations like GDPR (Article 30), maintaining records of data processing activities is commonly considered a best practice. This automated scan provides a starting point — it may not capture all data flows. - **[INFO]** No recognized third-party data-sharing services detected — This page does not appear to load external tracking, analytics, or advertising scripts. ### Compliance Badges (A — 90/100) *3 compliance badge(s) detected* - **[PASS]** SOC 2 badge detected — Found via body text: 'soc 2'. Note: the presence of a badge does not verify the certification is current or valid. - **[PASS]** GDPR Certified badge detected — Found via body text: 'gdpr compliant'. Note: the presence of a badge does not verify the certification is current or valid. - **[PASS]** TRUSTe / TrustArc badge detected — Found via body text: 'truste'. Note: the presence of a badge does not verify the certification is current or valid. --- ## Availability ### CDN & Delivery (A — 85/100) *Cloudflare (DYNAMIC)* - **[PASS]** Site is served via Cloudflare CDN (edge: CDG) - **[INFO]** CDN cache status: DYNAMIC ### HTTP Caching (D — 40/100) *no-store (uncacheable)* - **[INFO]** Cache-Control: no-store prevents all caching — Intentional for dynamic content, but increases server load for every page view. - **[INFO]** No ETag or Last-Modified header — Conditional requests (304 Not Modified) are not possible without validators. ### Operational Status Page (A+ — 100/100) *Status page detected via status subdomain* - **[PASS]** Status page link found: https://status.uptimerobot.com/ ### Transport Security (A+ — 100/100) *HTTP/3, HSTS, and TLS version analysis* - **[PASS]** HTTP/3 (QUIC) supported — The server advertises HTTP/3 via Alt-Svc for faster connections on mobile networks. - **[PASS]** HSTS enabled (preload) - **[INFO]** HSTS missing includeSubDomains — Without includeSubDomains, HSTS only protects the exact domain. - **[PASS]** HSTS preload enabled - **[PASS]** TLS 1.3 in use (fastest handshake, 1-RTT) ### Health Check Endpoint (A+ — 100/100) *Health endpoint at https://uptimerobot.com/status (HTTP 200)* - **[PASS]** Public health endpoint at https://uptimerobot.com/status ### CDN Cache Observability (A+ — 100/100) *Cache state: DYNAMIC* - **[PASS]** CDN cache state observable via 1 header(s) --- ## Accessibility ### Landmark Structure (A — 85/100) *4 landmarks* - **[PASS]**
landmark present - **[PASS]** 1