landmark found — Accessibility > Landmark Structure 5. **[CRITICAL]** Soft 404: server returns HTTP 200 for non-existent pages — Accessibility > 404 Error Page --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 67 | | Accessibility | 100 | | Best Practices | 100 | | SEO | 91 | --- ## Security ### Security Headers (C — 60/100) *6 of 10 headers properly configured* - **[CRITICAL]** HSTS header is missing — Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year. - **[PASS]** X-Content-Type-Options is properly configured - **[PASS]** X-Frame-Options is properly configured - **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter. - **[PASS]** Permissions-Policy is set - **[PASS]** Content-Security-Policy is present - **[INFO]** Cross-Origin-Opener-Policy is set but not 'same-origin' - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (C — 60/100) *1 of 10 CSP checks passed* - **[INFO]** Raw CSP policy - **[WARNING]** default-src directive is missing — default-src provides a fallback for other directives. Set it to restrict default resource loading. - **[INFO]** No script-src or default-src to check for 'unsafe-inline' - **[INFO]** No script-src or default-src to check for 'unsafe-eval' - **[INFO]** No script-src or default-src to check for wildcard - **[PASS]** object-src falls back to default-src - **[WARNING]** base-uri directive is missing — Without base-uri, attackers can inject a tag to hijack relative URLs. Set it to 'self' or 'none'. - **[WARNING]** frame-ancestors directive is missing — frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'. - **[WARNING]** form-action directive is missing — form-action restricts where forms can submit data, preventing form hijacking. - **[INFO]** upgrade-insecure-requests is not set — This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 8 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[PASS]** HTTP/2 is negotiated - **[INFO]** OCSP stapling not enabled — Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server. - **[PASS]** Certificate is valid (expires in 69 days) - **[PASS]** Certificate chain has 3 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 65 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (B — 80/100) *1 cookies analyzed, 1 checks passed* - **[CRITICAL]** Cookie 'NID' is missing the Secure flag — Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception. - **[PASS]** Cookie 'NID' has the HttpOnly flag - **[WARNING]** Cookie 'NID' has no SameSite attribute — Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict. ### Cookie Hygiene (A+ — 100/100) *All 1 cookie(s) pass hygiene checks* - **[PASS]** All 1 cookie(s) pass hygiene checks ### WAF / Bot Protection (B — 75/100) *No WAF detected via response headers* - **[INFO]** No WAF detected — Response headers don't match any known WAF or bot-management product. Sites exposed to abuse (login, signup, payment) typically benefit from a WAF such as Cloudflare, Akamai, AWS WAF, or Imperva. ### security.txt (B — 70/100) *Vulnerability disclosure policy* - **[PASS]** security.txt found - **[WARNING]** security.txt: Missing required 'Contact' field - **[WARNING]** security.txt: Missing required 'Expires' field (RFC 9116) ### Cross-Origin Tab Safety (D — 60/100) *4 of 4 new-tab link(s) missing rel=noopener* - **[WARNING]** 4 link(s) open in a new tab without rel=noopener — Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners. ### CSP Inline-Style Readiness (B — 90/100) *1 inline style attribute(s) detected* - **[INFO]** 1 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 1 inline style(s) is low. Affected element types include: input. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win. ### Trusted Types (XSS Sink Hardening) (A+ — 100/100) *Trusted Types enforced for 'script'* - **[PASS]** Trusted Types enforced via require-trusted-types-for 'script' ### Bot Challenge Detection (A+ — 100/100) *Scan reached real page content (no bot-protection interstitial)* - **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page ### Soft-404 Detection (A+ — 100/100) *HTTP status is non-2xx -- soft-404 check is N/A* - **[PASS]** HTTP status is non-2xx -- soft-404 check is N/A ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (A+ — 100/100) *Page has no third-party scripts or stylesheets -- SRI not applicable* - **[PASS]** No third-party scripts or stylesheets to protect with SRI ### CORS Depth (A+ — 100/100) *No CORS response headers -- the resource is same-origin-only by browser default* - **[PASS]** No CORS response headers -- the resource is same-origin-only by browser default ### Permissions-Policy Granularity (F — 35/100) *0% high-risk feature coverage (0/10)* - **[WARNING]** Permissions-Policy covers 0/10 high-risk features (0%) — The Permissions-Policy header explicitly declares policies for 0/10 high-risk features. Covered: Not declared (default-allow): camera, microphone, geolocation, payment, usb, serial, midi, accelerometer, gyroscope, magnetometer The non-declared features fall back to their spec-default policy (usually `self`), which means an XSS-injected or compromised iframe could request them. For features the page genuinely doesn't use, declare `feature=()` to fully close them. ### Referrer-Policy Strictness (B — 75/100) *Referrer-Policy header not set -- browser default applies (modern: strict-origin-when-cross-origin; legacy browsers: no-referrer-when-downgrade)* - **[INFO]** Referrer-Policy header not set -- browser default applies — Without an explicit `Referrer-Policy` header, the browser falls back to its default policy. Modern browsers (Chrome 85+, Firefox 87+, Safari 15+) default to `strict-origin-when-cross-origin`, which is privacy-safe. Legacy browsers default to the leaky `no-referrer-when-downgrade`, which sends the full URL (including path + query) on cross-origin HTTPS-to-HTTPS requests. Set an explicit header to ensure consistent behavior: ``` Referrer-Policy: strict-origin-when-cross-origin ``` This matches the modern browser default and is privacy-safe without breaking referrer-based same-origin analytics. ### Source Map Exposure (A+ — 100/100) *Source-map probe didn't run on this scan* - **[PASS]** Source-map probe didn't run on this scan ### HTML Version Disclosure (A+ — 100/100) *No software-version disclosures in HTML* - **[PASS]** No software-version disclosures in HTML ### Open Redirect Surface (B — 90/100) *2 link(s) carry redirect-shaped query parameter(s)* - **[INFO]** 2 link(s) carry redirect-shaped query parameter(s) — Heuristic flag -- whether each endpoint actually permits an arbitrary redirect target depends on server-side validation. Audit the listed paths' redirect-target handling: the endpoint should either (a) restrict to a relative path, (b) restrict to an allowlisted host set, or (c) sign the target. Open redirects power phishing flows (the attacker's URL begins with your trusted domain) and bypass some SSRF-mitigation cookie scoping. Common parameter names flagged: redirect, redirect_uri, redirect_url, redirecturl, return, returnto, return_to, returnurl, return_url, next, nexturl, next_url, continue, goto, dest, destination, forward, target. ### Auth Security (A+ — 100/100) *Page is not a login form -- auth-security checks are N/A* - **[PASS]** Page does not appear to be a login form ### Subdomain Inventory Exposure (A+ — 100/100) *No risky subdomain names in certificate SANs* - **[PASS]** No risky subdomain names in certificate SANs --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[PASS]** security.txt is present — good practice - **[PASS]** No sensitive files exposed ### Email Security (F — 0/100) *no DMARC, no SPF* - **[WARNING]** No DMARC record found — Without DMARC, email receivers have no policy for handling authentication failures. Add a TXT record at _dmarc. starting with v=DMARC1. - **[WARNING]** No SPF record found — Without SPF (Sender Policy Framework), receivers can't tell which servers are authorized to send mail for your domain. Add a TXT record at the apex starting with v=spf1, ending in -all. - **[INFO]** No DKIM detected via common selectors — DKIM signs outbound mail to prove origin. We probed common selectors (default, google, selector1, etc.) without finding a record. If you use a non-standard selector, this is a false negative. - **[INFO]** MTA-STS not configured — MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts. and a policy file at https://mta-sts./.well-known/mta-sts.txt. - **[INFO]** TLS-RPT not configured — TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.. - **[INFO]** BIMI not configured — BIMI (Brand Indicators for Message Identification) lets supporting clients (Gmail, Apple Mail, Yahoo) display your verified logo next to your messages. Optional but raises trust signals. Requires DMARC at p=quarantine or p=reject to be honored. ### API Surface (A+ — 100/100) *No API specs or GraphQL introspection found (probed 11 candidate path(s))* - **[PASS]** No API specs or GraphQL introspection found (probed 11 path(s)) ### Permissions-Policy (C — 60/100) *9 directives, 5 missing* - **[INFO]** ch-ua-arch=* - **[INFO]** ch-ua-bitness=* - **[INFO]** ch-ua-full-version=* - **[INFO]** ch-ua-full-version-list=* - **[INFO]** ch-ua-model=* - **[INFO]** ch-ua-wow64=* - **[INFO]** ch-ua-form-factors=* - **[INFO]** ch-ua-platform=* - **[INFO]** ch-ua-platform-version=* - **[INFO]** camera not restricted — Consider adding camera=() to block camera access from embedded content. - **[INFO]** microphone not restricted — Consider adding microphone=() to block microphone access from embedded content. - **[INFO]** geolocation not restricted — Consider adding geolocation=() to block geolocation access from embedded content. - **[INFO]** payment not restricted — Consider adding payment=() to block payment access from embedded content. - **[INFO]** usb not restricted — Consider adding usb=() to block usb access from embedded content. ### CORS Configuration (B — 80/100) *No CORS headers* - **[PASS]** No CORS headers present — secure default --- ## Performance ### Page Weight Budget (A — 92/100) *804 KB transferred, 25 requests* - **[PASS]** Page weighs 3.2 MB (804 KB transferred) - **[WARNING]** JavaScript is 563 KB — consider code splitting or lazy loading — Large JavaScript bundles delay interactivity. Split code by route or defer non-critical scripts. - **[PASS]** 25 HTTP requests - **[INFO]** Estimated 0.16 g CO2 per page load ### Third-Party Impact (D — 50/100) *100% third-party, 0 ms blocking* - **[WARNING]** Third-party code accounts for 100% of page weight (800.3 KiB of 803.6 KiB) - **[PASS]** Third-party blocking time is low (0 ms) ### Text Compression (A+ — 100/100) *All text resources are compressed* - **[PASS]** All text resources are compressed ### Image Optimization (A — 90/100) *3 images, 0 KB saveable* - **[PASS]** All images are well-optimized ### JS Execution Cost (D — 40/100) *2544ms total JS execution* - **[WARNING]** https://www.gstatic.com/_/mss/boq-identity/_/js/k=...: 1285ms CPU time - **[WARNING]** https://accounts.google.com/v3/signin/identifier?c...: 522ms CPU time - **[WARNING]** https://www.gstatic.com/_/mss/boq-identity/_/js/k=...: 375ms CPU time - **[WARNING]** Unattributable: 258ms CPU time - **[INFO]** https://www.gstatic.com/_/mss/boq-identity/_/js/k=...: 104ms CPU time - **[WARNING]** Third-party scripts: 2286ms (90% of total) ### Font Loading (A+ — 100/100) *1 fonts (54 KB)* - **[INFO]** 1 font(s) use font-display: swap (FOUT risk but functional) ### JS Bundles (D — 40/100) *11 scripts, 365 KB unused* - **[WARNING]** https://www.gstatic.com/_/mss/boq-identity/_/js/k=...: 213 KB unused (73%) — Consider code splitting or tree shaking to reduce unused code. - **[WARNING]** https://www.gstatic.com/_/mss/boq-identity/_/js/k=...: 152 KB unused (64%) — Consider code splitting or tree shaking to reduce unused code. - **[INFO]** Total unused JavaScript: 365 KB ### Resource Caching (A+ — 100/100) *All resources properly cached* - **[PASS]** No caching issues found ### Critical Rendering Path (A+ — 100/100) *No render-blocking resources* - **[PASS]** No render-blocking resources detected ### Resource Hints (A+ — 100/100) *1 hints, 0 missing preconnects* - **[PASS]** Page uses 1 resource hint(s) ### HTTP/3 (QUIC) (A+ — 100/100) *HTTP/3 advertised via Alt-Svc* - **[PASS]** HTTP/3 (QUIC) is supported — First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss. ### Compression Algorithm (C — 70/100) *Main response served uncompressed* - **[INFO]** Main HTML response has no Content-Encoding (uncompressed) — The main HTML document is served without compression. The Text Compression section above lists the broader picture; for the main response specifically, even gzip would shave ~70-80% off most text payloads. ### LCP Image Preload (A+ — 100/100) *LCP preload audit not available* - **[PASS]** LCP image preload audit not available for this scan ### Main HTML Cache-Control (A+ — 100/100) *Main HTML uses no-store -- correct for sensitive/dynamic content* - **[PASS]** Main HTML uses no-store -- correct for sensitive/dynamic content ### Server-Timing Observability (B — 85/100) *No Server-Timing header found* - **[INFO]** No Server-Timing header found — Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge. ### Server Response Intelligence (A+ — 95/100) *2 server-response signal(s) detected* - **[PASS]** `Vary` header declared: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site — The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class). - **[INFO]** No `ETag` or `Last-Modified` -- conditional GET not supported — Without either header, browsers can't issue conditional GETs and refresh always re-downloads the full response body even when nothing changed. Add `ETag: ""` (or `Last-Modified: `) on cacheable responses; the server returns 304 Not Modified when the client's cached copy is still valid, saving bandwidth. ### Page Weight Inventory (B — 80/100) *25 resources · 804 KB · 365 KB savings available* - **[PASS]** Within 1MB page-weight target - **[INFO]** ~365 KB of savings available - **[WARNING]** 24 third-party resources (100% of weight) - **[INFO]** 2 resources over 200KB ### Render-Blocking Resources (A+ — 100/100) *No render-blocking resources detected* - **[PASS]** No render-blocking resources detected in ### Third-Party Resources (A+ — 100/100) *No third-party resources detected* ### JavaScript Blocking (A+ — 100/100) *No render-blocking JS or document.write usage detected* - **[PASS]** No JavaScript blocking issues detected ### CSS Performance Depth (A+ — 100/100) *No CSS performance depth issues detected* - **[PASS]** No CSS performance depth issues detected --- ## Content Quality ### Links (A — 93/100) *9 links checked, 7 healthy, 1 broken* - **[WARNING]** 7 of 9 links are healthy - **[WARNING]** Broken link: https://www.gstatic.com — Found in . Returns HTTP 404. - **[INFO]** Long redirect chain: https://support.google.com/accounts?hl=en-US&p=... (3 hops) ### Mixed Content (A+ — 100/100) *No mixed content detected — all resources use HTTPS.* - **[PASS]** No mixed content detected — all resources use HTTPS ### Open Graph (F — 0/100) *No Open Graph tags found — social sharing previews will be generic.* - **[WARNING]** No Open Graph meta tags found — Without og:title, og:description, and og:image, social media platforms will generate a generic preview when your page is shared. ### Open Graph / Twitter Card Depth (A+ — 100/100) *No OG image or Twitter card set -- depth check is N/A (presence covered by Open Graph section)* - **[PASS]** No OG image / Twitter card to evaluate ### Structured Data (C — 40/100) *No structured data (JSON-LD) found.* - **[INFO]** No structured data (JSON-LD) found — Adding structured data helps search engines understand your content and can enable rich results. ### Rich Results Eligibility (C — 75/100) *No JSON-LD found -- no rich-result eligibility* - **[INFO]** No JSON-LD structured data on the page — No `