# BeaverCheck Audit Report — https://beavercheck.com **Date:** April 16, 2026 **URL:** https://beavercheck.com **Overall Grade:** C (75/100) **Report:** https://beavercheck.com/results/d3d27d63-a98c-40f8-b1ea-8e9647b1f4f8 ## Top Findings 1. **[CRITICAL]** No viewport meta tag found — Compliance > Viewport Configuration 2. **[WARNING]** DNS resolution is slow (308 ms) — Infrastructure > DNS Records 3. **[WARNING]** Registrar lock is NOT enabled — Infrastructure > Domain Intelligence 4. **[WARNING]** attribute is missing — Compliance > Language & i18n 5. **[WARNING]** No privacy policy link detected — Compliance > Cookie Consent & Privacy --- ## Security ### Security Headers (A+ — 100/100) *10 of 10 headers properly configured* - **[PASS]** Strict-Transport-Security is properly configured - **[PASS]** X-Content-Type-Options is properly configured - **[PASS]** X-Frame-Options is properly configured - **[PASS]** Referrer-Policy is properly configured - **[PASS]** Permissions-Policy is set - **[PASS]** Content-Security-Policy is present - **[PASS]** Cross-Origin-Opener-Policy is properly configured - **[PASS]** Cross-Origin-Embedder-Policy is set - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info ### Content Security Policy (A+ — 100/100) *9 of 10 CSP checks passed* - **[INFO]** Raw CSP policy - **[PASS]** default-src directive is set - **[PASS]** No 'unsafe-inline' in script source - **[PASS]** No 'unsafe-eval' in script source - **[PASS]** No wildcard in script source - **[PASS]** object-src falls back to default-src - **[PASS]** base-uri is properly restricted - **[PASS]** frame-ancestors directive is set - **[PASS]** form-action directive is set - **[PASS]** upgrade-insecure-requests is enabled ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 7 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[PASS]** Certificate is valid (expires in 74 days) - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 2 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *2 cookies analyzed, 6 checks passed* - **[PASS]** Cookie 'bc_csrf' has the Secure flag - **[PASS]** Cookie 'bc_csrf' has the HttpOnly flag - **[PASS]** Cookie 'bc_csrf' has SameSite=Lax - **[PASS]** Cookie 'bc_csrf' has the Secure flag - **[PASS]** Cookie 'bc_csrf' has the HttpOnly flag - **[PASS]** Cookie 'bc_csrf' has SameSite=Lax --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[INFO]** No security.txt found — Consider adding a security.txt at /.well-known/security.txt. - **[PASS]** No sensitive files exposed ### Email Security (A+ — 100/100) *DMARC: reject* - **[PASS]** DMARC policy is reject — strongest protection ### Permissions-Policy (B — 80/100) *4 directives, 2 missing* - **[PASS]** camera=() — blocked for all origins - **[PASS]** microphone=() — blocked for all origins - **[PASS]** geolocation=() — blocked for all origins - **[PASS]** interest-cohort=() — blocked for all origins - **[INFO]** payment not restricted — Consider adding payment=() to block payment access from embedded content. - **[INFO]** usb not restricted — Consider adding usb=() to block usb access from embedded content. ### CORS Configuration (B — 80/100) *No CORS headers* - **[PASS]** No CORS headers present — secure default --- ## Infrastructure ### DNS Records (A — 85/100) *1 A records, 308 ms lookup* - **[PASS]** Resolves to 1 IPv4 address(es) - **[INFO]** Single A record — no DNS redundancy — Multiple A records provide failover if one server goes down. - **[INFO]** No IPv6 (AAAA) records - **[PASS]** 2 nameserver(s) configured - **[PASS]** 1 mail exchanger(s) configured - **[INFO]** CAA records not checked — CAA record lookup requires a specialized DNS resolver. This check will be available in a future update. - **[PASS]** SPF record present in TXT - **[WARNING]** DNS resolution is slow (308 ms) — Slow DNS adds latency to every page load. Consider a faster DNS provider. ### Redirect Chain (A+ — 100/100) *No redirects — direct access* - **[PASS]** No redirects — direct access ### IPv6 Readiness (C — 60/100) *No IPv6 support* - **[INFO]** No IPv6 (AAAA) records found — IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity. ### Crawlability (A+ — 100/100) *robots.txt present, sitemap with 2718 URLs* - **[PASS]** robots.txt is present - **[PASS]** sitemap.xml is present - **[PASS]** sitemap.xml is valid XML - **[PASS]** sitemap.xml contains 2718 entries - **[PASS]** robots.txt references sitemap ### URL Variants (A+ — 100/100) *www/non-www, trailing slash, HTTP→HTTPS* - **[PASS]** www/non-www redirect configured correctly (preferred: non-www) - **[PASS]** HTTP correctly 301-redirects to HTTPS ### Domain Intelligence (A+ — 100/100) *beavercheck.com — via OVH sas, 24 days old, hosted on OVH* - **[PASS]** Domain registered until Mar 23, 2027 (11 months remaining) - **[INFO]** Domain is only 24 days old — Newly registered domains may face SEO trust challenges. Search engines generally give more authority to older domains. This is informational — not a problem to fix. - **[PASS]** DNSSEC is enabled - **[PASS]** Registrar: OVH sas - **[WARNING]** Registrar lock is NOT enabled — The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers. - **[PASS]** Hosting: OVH --- ## Compliance ### WCAG Compliance (A+ — 100/100) *No testable criteria* ### Cookie Consent & Privacy (B — 80/100) *No consent signals detected* - **[WARNING]** No privacy policy link detected — A privacy policy page is recommended for transparency and may be legally required. - **[INFO]** No terms of service link detected - **[INFO]** No cookie consent banner detected - **[PASS]** 2 cookie(s) set on initial load (functional) - **[INFO]** This is an automated check, not legal advice — BeaverCheck detects technical indicators of consent management. This does not constitute a legal compliance assessment. Consult a privacy professional for GDPR/CCPA compliance. ### Language & i18n (F — 10/100) *Missing * - **[WARNING]** attribute is missing — The lang attribute on is required for screen readers and WCAG 3.1.1 compliance. - **[PASS]** Content-Language header is set - **[INFO]** Language signals are inconsistent — The attribute and Content-Language header should agree. ### Readability & Typography (A+ — 100/100) *Font sizes and tap targets checked* ### Viewport Configuration (F — 30/100) *No viewport meta tag* - **[CRITICAL]** No viewport meta tag found — Without a viewport meta tag, the page will not render correctly on mobile devices. --- ## Availability ### CDN & Delivery (D — 50/100) *No CDN detected* - **[WARNING]** No CDN detected — A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them. ### HTTP Caching (F — 30/100) *No cache headers* - **[WARNING]** No Cache-Control header found — Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers. --- ## UX ### 404 Error Page (B — 80/100) *HTTP 404, custom page* - **[PASS]** Correct 404 status code returned - **[PASS]** Custom styled 404 page - **[PASS]** Navigation links present on 404 page - **[PASS]** Homepage link present on 404 page ### Favicon & Branding (F — 15/100) *1 icon(s) detected* - **[PASS]** favicon.ico present at site root - **[INFO]** No apple-touch-icon detected — iOS devices use this when users add your site to their home screen. Add . ### Web Manifest (D — 40/100) *Not found* - **[INFO]** No web manifest found — No manifest at standard paths (/manifest.json, /site.webmanifest). A manifest is optional but enables PWA features like home screen installation and standalone display. ### Dark Mode Support (D — 40/100) *No dark mode signals* - **[INFO]** No dark mode signals detected — Consider adding CSS with @media (prefers-color-scheme: dark) and . - **[INFO]** Detection limited to meta tags and inline styles — External CSS files may contain prefers-color-scheme rules not visible to this scan. ### Print Stylesheet (D — 40/100) *No print styles* - **[INFO]** No print-specific styles detected — When users print this page, they get the screen layout including navigation and non-essential elements. Add @media print rules to hide navigation and optimize layout for paper. ### Navigation UX (F — 0/100) *No navigation patterns* - **[INFO]** No breadcrumbs, search, or skip link detected — These navigation aids help users orient themselves and find content efficiently, especially on large sites. --- --- *Generated by [BeaverCheck](https://beavercheck.com) — https://beavercheck.com/results/d3d27d63-a98c-40f8-b1ea-8e9647b1f4f8*