# BeaverCheck Audit Report — https://svoyaaptechka.ru **Date:** May 23, 2026 **URL:** https://svoyaaptechka.ru **Overall Grade:** B (84/100) **Report:** https://beavercheck.com/results/e962dd87-5e08-4ff0-94fe-2436fa682232 ## Top Findings 1. **[CRITICAL]** 9 button(s) with no accessible text — Accessibility > Link & Button Quality 2. **[WARNING]** 1 font preload(s) missing `crossorigin` -- font will be downloaded twice — Performance > Resource Hints 3. **[WARNING]** 116 inline style attribute(s) detected — Security > CSP Inline-Style Readiness 4. **[WARNING]** 6 link(s) open in a new tab without rel=noopener — Security > Cross-Origin Tab Safety 5. **[WARNING]** 6 render-blocking stylesheet(s) -- recommended: <=3 — Performance > CSS Performance Depth --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 74 | | Accessibility | 90 | | Best Practices | 85 | | SEO | 92 | --- ## Security ### Security Headers (B — 70/100) *6 of 10 headers properly configured* - **[PASS]** Strict-Transport-Security is properly configured - **[PASS]** X-Content-Type-Options is properly configured - **[PASS]** X-Frame-Options is properly configured - **[PASS]** Referrer-Policy is properly configured - **[WARNING]** Permissions-Policy header is missing — Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features. - **[PASS]** Content-Security-Policy is present - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[PASS]** X-Powered-By header is not present - **[WARNING]** Server header reveals version information — The Server header discloses the software version, aiding attackers in targeting known vulnerabilities. Remove the version number. - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (A — 90/100) *8 of 11 CSP checks passed* - **[INFO]** Raw CSP policy - **[PASS]** default-src directive is set - **[PASS]** No 'unsafe-inline' in script source - **[PASS]** No 'unsafe-eval' in script source - **[PASS]** No wildcard in script source - **[PASS]** object-src is set to 'none' - **[PASS]** base-uri is properly restricted - **[WARNING]** frame-ancestors directive is missing — frame-ancestors controls who can embed your page, preventing clickjacking. Set it to 'self' or 'none'. - **[PASS]** form-action directive is set - **[PASS]** upgrade-insecure-requests is enabled - **[INFO]** Content-Security-Policy-Report-Only is also set — A report-only policy is active alongside the enforcing policy for monitoring. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 7 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[INFO]** OCSP stapling not enabled — Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server. - **[PASS]** Certificate is valid (expires in 88 days) - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 2 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 95/100) *2 cookies analyzed, 5 checks passed* - **[PASS]** Cookie 'PHPSESSID' has the Secure flag - **[PASS]** Cookie 'PHPSESSID' has the HttpOnly flag - **[PASS]** Cookie 'PHPSESSID' has SameSite=Lax - **[PASS]** Cookie 'city' has the Secure flag - **[WARNING]** Cookie 'city' is missing the HttpOnly flag — Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft. - **[PASS]** Cookie 'city' has SameSite=Lax ### Cookie Hygiene (A+ — 100/100) *All 2 cookie(s) pass hygiene checks* - **[PASS]** All 2 cookie(s) pass hygiene checks ### WAF / Bot Protection (B — 75/100) *No WAF detected via response headers* - **[INFO]** No WAF detected — Response headers don't match any known WAF or bot-management product. Sites exposed to abuse (login, signup, payment) typically benefit from a WAF such as Cloudflare, Akamai, AWS WAF, or Imperva. ### security.txt (A+ — 100/100) *Vulnerability disclosure policy* - **[PASS]** security.txt found ### Cross-Origin Tab Safety (D — 60/100) *6 of 11 new-tab link(s) missing rel=noopener* - **[WARNING]** 6 link(s) open in a new tab without rel=noopener — Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners. ### CSP Inline-Style Readiness (D — 60/100) *116 inline style attribute(s) detected* - **[WARNING]** 116 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 116 inline style(s) is high. Affected element types include: a, div, svg, button, span. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win. ### Trusted Types (XSS Sink Hardening) (B — 95/100) *Trusted Types not enabled* - **[INFO]** Trusted Types not enabled — Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode. ### Bot Challenge Detection (A+ — 100/100) *Scan reached real page content (no bot-protection interstitial)* - **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page ### Soft-404 Detection (A+ — 100/100) *No soft-404 patterns detected in page title or headings* - **[PASS]** No soft-404 patterns detected in page title or headings ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (A+ — 100/100) *Page has no third-party scripts or stylesheets -- SRI not applicable* - **[PASS]** No third-party scripts or stylesheets to protect with SRI ### CORS Depth (A+ — 100/100) *No CORS response headers -- the resource is same-origin-only by browser default* - **[PASS]** No CORS response headers -- the resource is same-origin-only by browser default ### Permissions-Policy Granularity (C — 60/100) *No Permissions-Policy header set -- powerful features (camera / microphone / geolocation / payment / USB) default to allow-on-same-origin* - **[WARNING]** Permissions-Policy header not set -- features default to allow-on-same-origin — Without a `Permissions-Policy` (or legacy `Feature-Policy`) header, every powerful browser feature defaults to its spec default policy (typically `self`). A third-party iframe injected via XSS or a misconfigured embed can still request access to the user's camera, microphone, geolocation, payment APIs, USB devices, etc. Explicitly deny features the page doesn't need: ``` Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=() ``` Features the page legitimately uses can stay enabled with `feature=(self)`. ### Referrer-Policy Strictness (A+ — 100/100) *Referrer-Policy is `strict-origin-when-cross-origin` (modern default -- full URL same-origin, origin-only cross-origin)* - **[PASS]** Referrer-Policy: `strict-origin-when-cross-origin` -- modern default -- full URL same-origin, origin-only cross-origin — The modern browser default (Chrome 85+, Firefox 87+, Safari 15+). Full URL Referer on same-origin; origin only on cross-origin; no Referer on HTTPS-to-HTTP downgrade. Privacy-safe and breaks no analytics. The recommended explicit value. ### Source Map Exposure (A+ — 100/100) *No source maps accessible (probed 10 candidate URL(s))* - **[PASS]** No source maps accessible across 10 probed candidate(s) ### HTML Version Disclosure (A+ — 100/100) *No software-version disclosures in HTML* - **[PASS]** No software-version disclosures in HTML ### Open Redirect Surface (A+ — 100/100) *No redirect-shaped query parameters in DOM links* - **[PASS]** No redirect-shaped query parameters in DOM links ### Auth Security (A+ — 100/100) *Page is not a login form -- auth-security checks are N/A* - **[PASS]** Page does not appear to be a login form ### Subdomain Inventory Exposure (A+ — 100/100) *No risky subdomain names in certificate SANs* - **[PASS]** No risky subdomain names in certificate SANs --- ## Advanced Security ### Subresource Integrity (A+ — 100/100) *No external resources* - **[PASS]** No external resources to protect ### JS Library Vulnerabilities (A+ — 100/100) *No known vulnerabilities* - **[PASS]** No known JavaScript library vulnerabilities detected ### Information Leakage (A+ — 100/100) *No exposures* - **[PASS]** security.txt is present — good practice - **[PASS]** No sensitive files exposed ### Email Security (F — 0/100) *no DMARC, no SPF* - **[WARNING]** No DMARC record found — Without DMARC, email receivers have no policy for handling authentication failures. Add a TXT record at _dmarc. starting with v=DMARC1. - **[WARNING]** No SPF record found — Without SPF (Sender Policy Framework), receivers can't tell which servers are authorized to send mail for your domain. Add a TXT record at the apex starting with v=spf1, ending in -all. - **[INFO]** No DKIM detected via common selectors — DKIM signs outbound mail to prove origin. We probed common selectors (default, google, selector1, etc.) without finding a record. If you use a non-standard selector, this is a false negative. - **[INFO]** MTA-STS not configured — MTA-STS forces inbound mail to use TLS, preventing downgrade attacks. Requires both a TXT record at _mta-sts. and a policy file at https://mta-sts./.well-known/mta-sts.txt. - **[INFO]** TLS-RPT not configured — TLS-RPT (RFC 8460) lets MTAs report TLS-handshake failures, so you can detect and fix MTA-STS misconfigurations. Add a TXT record at _smtp._tls.. - **[INFO]** BIMI not configured — BIMI (Brand Indicators for Message Identification) lets supporting clients (Gmail, Apple Mail, Yahoo) display your verified logo next to your messages. Optional but raises trust signals. Requires DMARC at p=quarantine or p=reject to be honored. ### API Surface (A+ — 100/100) *No API specs or GraphQL introspection found (probed 11 candidate path(s))* - **[PASS]** No API specs or GraphQL introspection found (probed 11 path(s)) ### Permissions-Policy (D — 40/100) *No header set* - **[WARNING]** No Permissions-Policy header — Consider adding a Permissions-Policy header to restrict browser feature access from embedded content. ### CORS Configuration (B — 80/100) *No CORS headers* - **[PASS]** No CORS headers present — secure default --- ## Performance ### Page Weight Budget (B — 75/100) *1.4 MB transferred, 51 requests* - **[PASS]** Page weighs 1.9 MB (1.4 MB transferred) - **[INFO]** 51 HTTP requests - **[INFO]** Estimated 0.29 g CO2 per page load ### Third-Party Impact (A+ — 100/100) *No third-party resources* - **[PASS]** No third-party resources detected ### Text Compression (A+ — 100/100) *All text resources are compressed* - **[PASS]** All text resources are compressed ### Image Optimization (B — 75/100) *18 images, 0 KB saveable* - **[PASS]** All images are well-optimized ### JS Execution Cost (D — 40/100) *2742ms total JS execution* - **[WARNING]** https://svoyaaptechka.ru/: 2286ms CPU time - **[WARNING]** Unattributable: 281ms CPU time - **[INFO]** https://svoyaaptechka.ru/new/assets/js/farma-v3.mi...: 174ms CPU time ### Font Loading (A+ — 100/100) *4 fonts (119 KB)* - **[INFO]** 4 font(s) use font-display: swap (FOUT risk but functional) ### JS Bundles (A+ — 100/100) *14 scripts, 0 KB unused* ### Resource Caching (A+ — 100/100) *All resources properly cached* - **[PASS]** No caching issues found ### Critical Rendering Path (A+ — 100/100) *No render-blocking resources* - **[PASS]** No render-blocking resources detected ### Resource Hints (A — 85/100) *2 hints, 0 missing preconnects* - **[WARNING]** 1 font preload(s) missing `crossorigin` -- font will be downloaded twice — Fonts are always fetched as crossorigin=anonymous; a preload without the attribute creates a different cache key, so the browser refetches when the actual font request happens. Sample: /new/assets/fonts/commissioner-cyrillic.woff2. Add `crossorigin` (or `crossorigin="anonymous"`) to each preload. - **[PASS]** Page uses 2 resource hint(s) ### HTTP/3 (QUIC) (B — 75/100) *HTTP/3 not advertised* - **[INFO]** HTTP/3 (QUIC) is not advertised — HTTP/3 isn't advertised via Alt-Svc and the worker didn't negotiate h3. HTTP/3 reduces handshake latency (1-RTT instead of 2-3 RTTs) and is more resilient on lossy connections. Most modern CDNs (Cloudflare, Fastly, AWS CloudFront, Google Cloud CDN) support HTTP/3 with a single config switch -- consider enabling for mobile-heavy workloads. ### Compression Algorithm (B — 80/100) *Main response uses gzip; brotli would be ~20% smaller* - **[INFO]** Main HTML response uses gzip (brotli would be ~20% smaller) — All current browsers support brotli. Most CDNs (Cloudflare, Fastly, AWS CloudFront, Vercel, Netlify) can switch from gzip to brotli with a single config flag. Origin servers (nginx, Apache) need a brotli module compiled in -- nginx-brotli or Apache mod_brotli. ### LCP Image Preload (A+ — 100/100) *LCP preload audit not available* - **[PASS]** LCP image preload audit not available for this scan ### Main HTML Cache-Control (A+ — 100/100) *Main HTML uses no-store -- correct for sensitive/dynamic content* - **[PASS]** Main HTML uses no-store -- correct for sensitive/dynamic content ### Server-Timing Observability (B — 85/100) *No Server-Timing header found* - **[INFO]** No Server-Timing header found — Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge. ### Server Response Intelligence (A+ — 95/100) *2 server-response signal(s) detected* - **[PASS]** `Vary` header declared: Accept-Encoding — The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class). - **[INFO]** No `ETag` or `Last-Modified` -- conditional GET not supported — Without either header, browsers can't issue conditional GETs and refresh always re-downloads the full response body even when nothing changed. Add `ETag: ""` (or `Last-Modified: `) on cacheable responses; the server returns 304 Not Modified when the client's cached copy is still valid, saving bandwidth. ### Page Weight Inventory (B — 70/100) *51 resources · 1.4 MB · 0 KB savings available* - **[WARNING]** Page weight 1.4 MB exceeds 1 MB target by 380 KB - **[INFO]** 1 third-party resources (0% of weight) ### Render-Blocking Resources (A+ — 100/100) *No render-blocking resources detected* - **[PASS]** No render-blocking resources detected in ### Third-Party Resources (A+ — 100/100) *No third-party resources detected* ### JavaScript Blocking (A+ — 100/100) *No render-blocking JS or document.write usage detected* - **[PASS]** No JavaScript blocking issues detected ### CSS Performance Depth (A — 88/100) *1 CSS depth issue(s) detected* - **[WARNING]** 6 render-blocking stylesheet(s) -- recommended: <=3 — Each `` without a non-blocking `media` attribute holds up the first paint. Browsers download all of them before painting any content. Consolidate into 1-2 critical-path stylesheets; defer non-critical CSS via `` or via the loadCSS pattern; inline above-the-fold CSS in `