# BeaverCheck Audit Report — https://ideasandoutcomes.com
**Date:** April 13, 2026
**URL:** https://ideasandoutcomes.com
**Overall Grade:** C (72/100)
**Report:** https://beavercheck.com/results/c8b6be2c-6c3d-491d-abd7-7a665a4b673d
## Top Findings
1. **[CRITICAL]** Content-Security-Policy header is missing — Security > Security Headers
2. **[CRITICAL]** HSTS header is missing — Security > Security Headers
3. **[CRITICAL]** No Content-Security-Policy header found — Security > Content Security Policy
4. **[WARNING]** Cross-Origin-Embedder-Policy header is missing — Security > Security Headers
5. **[WARNING]** Cross-Origin-Opener-Policy header is missing — Security > Security Headers
---
## Security
### Security Headers (D — 50/100)
*6 of 10 headers properly configured*
- **[CRITICAL]** HSTS header is missing — Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year.
- **[PASS]** X-Content-Type-Options is properly configured
- **[PASS]** X-Frame-Options is properly configured
- **[PASS]** Referrer-Policy is properly configured
- **[PASS]** Permissions-Policy is set
- **[CRITICAL]** Content-Security-Policy header is missing — CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.
- **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.
- **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
- **[PASS]** X-Powered-By header is not present
- **[PASS]** Server header is present without version info
### Content Security Policy (F — 0/100)
*No enforcing CSP policy found*
- **[CRITICAL]** No Content-Security-Policy header found — CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.
- **[INFO]** Content-Security-Policy-Report-Only is set but does not enforce — Report-Only logs violations but does not block them. Deploy an enforcing policy when ready.
### TLS & Certificates (A+ — 100/100)
*TLS 1.3, 7 checks passed*
- **[PASS]** TLS 1.3 is used
- **[PASS]** Strong cipher suite is used
- **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance.
- **[PASS]** Certificate is valid (expires in 58 days)
- **[PASS]** Certificate chain has 3 certificates
- **[PASS]** Certificate uses modern signature algorithm
- **[PASS]** Certificate covers 2 domain(s)
- **[PASS]** Certificate is issued by a trusted CA
### Cookie Security (A+ — 100/100)
*No cookies set — no cookie security risks*
- **[PASS]** No cookies set — no cookie security risks
---
## Advanced Security
### Subresource Integrity (A+ — 100/100)
*No external resources*
- **[PASS]** No external resources to protect
### JS Library Vulnerabilities (A+ — 100/100)
*No known vulnerabilities*
- **[PASS]** No known JavaScript library vulnerabilities detected
### Information Leakage (A+ — 100/100)
*No exposures*
- **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt.
- **[PASS]** No sensitive files exposed
### Email Security (D — 50/100)
*DMARC: none*
- **[WARNING]** DMARC policy is none — monitoring only — This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject.
### Permissions-Policy (A+ — 100/100)
*28 directives, 0 missing*
- **[PASS]** accelerometer=() — blocked for all origins
- **[PASS]** ambient-light-sensor=() — blocked for all origins
- **[INFO]** autoplay=(self "https://challenges.cloudflare.com")
- **[PASS]** bluetooth=() — blocked for all origins
- **[PASS]** browsing-topics=() — blocked for all origins
- **[PASS]** camera=() — blocked for all origins
- **[PASS]** display-capture=() — blocked for all origins
- **[PASS]** document-domain=() — blocked for all origins
- **[PASS]** encrypted-media=() — blocked for all origins
- **[INFO]** fullscreen=(self "https://challenges.cloudflare.com")
- **[PASS]** gamepad=() — blocked for all origins
- **[PASS]** geolocation=() — blocked for all origins
- **[PASS]** gyroscope=() — blocked for all origins
- **[PASS]** hid=() — blocked for all origins
- **[PASS]** idle-detection=() — blocked for all origins
- **[PASS]** local-fonts=() — blocked for all origins
- **[PASS]** magnetometer=() — blocked for all origins
- **[PASS]** microphone=() — blocked for all origins
- **[PASS]** midi=() — blocked for all origins
- **[PASS]** payment=() — blocked for all origins
- **[INFO]** picture-in-picture=(self "https://challenges.cloudflare.com")
- **[PASS]** publickey-credentials-get=() — blocked for all origins
- **[PASS]** screen-wake-lock=() — blocked for all origins
- **[PASS]** serial=() — blocked for all origins
- **[PASS]** speaker-selection=() — blocked for all origins
- **[PASS]** usb=() — blocked for all origins
- **[PASS]** web-share=() — blocked for all origins
- **[PASS]** xr-spatial-tracking=() — blocked for all origins
### CORS Configuration (B — 80/100)
*No CORS headers*
- **[PASS]** No CORS headers present — secure default
---
## Infrastructure
### DNS Records (A+ — 100/100)
*2 A records, 12 ms lookup*
- **[PASS]** Resolves to 2 IPv4 address(es)
- **[PASS]** Has 2 IPv6 (AAAA) record(s)
- **[PASS]** 2 nameserver(s) configured
- **[PASS]** 1 mail exchanger(s) configured
- **[INFO]** CAA records not checked — CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
- **[PASS]** SPF record present in TXT
- **[PASS]** DNS resolution time: 12 ms
### Redirect Chain (A+ — 100/100)
*No redirects — direct access*
- **[PASS]** No redirects — direct access
### IPv6 Readiness (A+ — 100/100)
*IPv6 reachable (1 ms)*
- **[PASS]** IPv6 is configured and reachable at 2606:4700:3034::6815:35d7, 2606:4700:3030::ac43:dadb
### Crawlability (A+ — 100/100)
*robots.txt present, sitemap with 348 URLs*
- **[PASS]** robots.txt is present
- **[PASS]** sitemap.xml is present
- **[PASS]** sitemap.xml is valid XML
- **[PASS]** sitemap.xml contains 348 entries
- **[PASS]** robots.txt references sitemap
### URL Variants (A+ — 100/100)
*www/non-www, trailing slash, HTTP→HTTPS*
- **[PASS]** www/non-www redirect configured correctly (preferred: non-www)
- **[PASS]** HTTP correctly 301-redirects to HTTPS
### Domain Intelligence (A+ — 100/100)
*ideasandoutcomes.com — via GoDaddy.com, LLC, 2 years, 5 months old*
- **[PASS]** Domain registered until Nov 22, 2026 (7 months remaining)
- **[INFO]** DNSSEC is not enabled — DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
- **[PASS]** Registrar: GoDaddy.com, LLC
---
## Compliance
### WCAG Compliance (A+ — 100/100)
*No testable criteria*
### Cookie Consent & Privacy (B — 80/100)
*No consent signals detected*
- **[WARNING]** No privacy policy link detected — A privacy policy page is recommended for transparency and may be legally required.
- **[INFO]** No terms of service link detected
- **[INFO]** No cookie consent banner detected
- **[INFO]** This is an automated check, not legal advice — BeaverCheck detects technical indicators of consent management. This does not constitute a legal compliance assessment. Consult a privacy professional for GDPR/CCPA compliance.
### Language & i18n (F — 5/100)
*Missing *
- **[WARNING]** attribute is missing — The lang attribute on is required for screen readers and WCAG 3.1.1 compliance.
- **[INFO]** No Content-Language HTTP header
- **[PASS]** Language signals are consistent
### Readability & Typography (A+ — 100/100)
*Font sizes and tap targets checked*
### Viewport Configuration (F — 30/100)
*No viewport meta tag*
- **[CRITICAL]** No viewport meta tag found — Without a viewport meta tag, the page will not render correctly on mobile devices.
---
## Availability
### CDN & Delivery (D — 50/100)
*No CDN detected*
- **[WARNING]** No CDN detected — A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them.
### HTTP Caching (F — 30/100)
*No cache headers*
- **[WARNING]** No Cache-Control header found — Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers.
---
## UX
### 404 Error Page (B — 80/100)
*HTTP 404, custom page*
- **[PASS]** Correct 404 status code returned
- **[PASS]** Custom styled 404 page
- **[PASS]** Navigation links present on 404 page
- **[PASS]** Homepage link present on 404 page
### Favicon & Branding (D — 50/100)
*3 icon(s) detected*
- **[PASS]** favicon.ico present at site root
- **[INFO]** No apple-touch-icon detected — iOS devices use this when users add your site to their home screen. Add .
- **[PASS]** Multiple icon sizes detected
### Web Manifest (B — 80/100)
*Valid manifest*
- **[PASS]** Name present: Ideas + Outcomes
- **[PASS]** 192x192 icon present
- **[PASS]** 512x512 icon present
- **[PASS]** Display mode: standalone
### Dark Mode Support (D — 40/100)
*No dark mode signals*
- **[INFO]** No dark mode signals detected — Consider adding CSS with @media (prefers-color-scheme: dark) and .
- **[INFO]** Detection limited to meta tags and inline styles — External CSS files may contain prefers-color-scheme rules not visible to this scan.
### Print Stylesheet (D — 40/100)
*No print styles*
- **[INFO]** No print-specific styles detected — When users print this page, they get the screen layout including navigation and non-essential elements. Add @media print rules to hide navigation and optimize layout for paper.
### Navigation UX (F — 0/100)
*No navigation patterns*
- **[INFO]** No breadcrumbs, search, or skip link detected — These navigation aids help users orient themselves and find content efficiently, especially on large sites.
---
---
*Generated by [BeaverCheck](https://beavercheck.com) — https://beavercheck.com/results/c8b6be2c-6c3d-491d-abd7-7a665a4b673d*