Infrastructure - https://politico.com BeaverCheck Audit

D

CDN & Delivery

Action

No CDN detected

FIX

No CDN detected

A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them.

No CDN detected

Consider using a CDN to improve global delivery speed and reduce origin load.

C

IPv6 Readiness

Action

No IPv6 support

REVIEW

No IPv6 support

No IPv6 (AAAA) records found

IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.

No IPv6 Support

About 40% of internet users have IPv6. Consider adding AAAA records.

IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.

Why this matters

No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.

Source: Google IPv6 stats

B

URL Variants

www/non-www, trailing slash, HTTP→HTTPS

REVIEW

www/non-www, trailing slash, HTTP→HTTPS

Both www and non-www versions serve content

Got: Both variants return 200 Expected: One variant 301-redirects to the other

HTTP correctly 301-redirects to HTTPS

www / non-www

200https://www.politico.com/

200https://politico.com/

Inconsistent — duplicate content risk

HTTP → HTTPS

301http://politico.com/ → https://www.politico.com:443/

Consistent

B

TLS Certificate Expiry & Recommendations

318 days until leaf cert expires — 4 issues to address

REVIEW

Certificate validity

318

days left

0d 30d 60d 90d+

Recommended actions

Prefer TLS 1.3 — TLS 1.2 is acceptable but TLS 1.3 removes RSA key exchange and improves latency
Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
Enable DNSSEC on your domain for DNS spoofing protection
Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy

A+

DNS Records

3 A records, 25 ms lookup

PASS

3 A records, 25 ms lookup

Resolves to 3 IPv4 address(es)

Got: 54.208.93.205, 44.214.174.33, 18.214.109.120

No IPv6 (AAAA) records

4 nameserver(s) configured

Got: ns-1470.awsdns-55.org, ns-2040.awsdns-63.co.uk, ns-493.awsdns-61.com, ns-630.awsdns-14.net

1 mail exchanger(s) configured

CAA records not checked

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

SPF record present in TXT

DNS resolution time: 25 ms

Got: 25 ms

A	54.208.93.205, 44.214.174.33, 18.214.109.120
AAAA	—
CNAME	—
NS	ns-1470.awsdns-55.org, ns-2040.awsdns-63.co.uk, ns-493.awsdns-61.com, ns-630.awsdns-14.net
MX	0 politico-com.mail.protection.outlook.com
TXT	BSI216928894827 Validity-DomainVerification=PqU8+nGHDs4sIVWhKoz3CVCR6= _hbzwdh687hpsz72nv3jx4fy9jvk3uma adobe-idp-site-verification=4f750abf8795bb604b0e0dd686732d076d93803445050a2835a9... anthropic-domain-verification-jqrms9=cjC0vy6nOGhdoeuThGi2l2TtW atlassian-domain-verification=21oo0aGAb1lJW/vr5U9YLXn8jVLsyEElq0SBZePzrJ8O9qsN3p... atlassian-domain-verification=EnHue3UwYSfo4DXgk/Bvg3WcQ2JVjyt6zf38Dox2HOZXlTSpjt... google-site-verification=fqnZqZYyeQR7-coW6KwihGcoPvmnTs1tZrmWTjIc2os jamf-site-verification=gVTL5cDs9vNo5W39Yn9RGA k13qmwd1360v3nwct2ms3krfr60vkbq1 notion-domain-verification=Wsv21q4dYnipAODX3qfW5M1QQiejnCgGH9rRVEPAl0b openai-domain-verification=dv-w17OR4nutT72n8u24C9cNhID twilio-domain-verification=853b9bd6f621d45eb7ee7a6389e3a1cc SPF v=spf1 a include:_spf.salesforce.com include:spf.protection.outlook.com include:... wiz-domain-verification=43fab5c33d334c2e156e520ed9064288a3aadcf8f32d2ea1e2060391...
CAA	Lookup not available with standard resolver

Resolved in 25 ms

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

A

Redirect Chain

1 redirect(s), 443 ms total

PASS

1 redirect(s), 443 ms total

Single redirect

Got: https://politico.com → https://www.politico.com:443/ (301)

WWW normalization redirect

https://politico.com

391 ms · HTTP/1.1

301

https://www.politico.com:443/

52 ms · HTTP/1.1 FINAL

#	URL	Status	Time	Protocol	Server
1	https://politico.com	301	391 ms	HTTP/1.1	awselb/2.0
2	https://www.politico.com:443/	200	52 ms	HTTP/1.1	cloudflare

See the visual redirect chain in the HTTP Probe tab →

A+

Crawlability

robots.txt present, sitemap with 233 URLs

PASS

robots.txt present, sitemap with 233 URLs

robots.txt is present

Got: 4990 bytes

sitemap.xml is present

sitemap.xml is valid XML

sitemap.xml contains 233 entries

Sitemap index with 233 child sitemaps

robots.txt references sitemap

robots.txt 200 OK

Size 4990 B Sitemaps referenced 5 User-agents bedrockbot, Diffbot, GPTBot, Kangaroo Bot, PerplexityBot, Googlebot-News, Datenbank Crawler, Echobot Bot, MyCentralAIScraperBot, SBIntuitionsBot, Andibot, Claude-SearchBot, omgili, bigsur.ai, EchoboxBot, iaskspider/2.0, ISSCyberRiskCrawler, MistralAI-User/1.0, YouBot, GoogleOther-Video, OAI-SearchBot, omgilibot, Thinkbot, YandexAdditional, aiHitBot, GoogleOther, Operator, QualifiedBot, TikTokSpider, *, Bytespider, Devin, Gemini-Deep-Research, GoogleAgent-Mariner, LinerBot, meta-externalagent, Meta-ExternalAgent, FriendlyCrawler, ImagesiftBot, Meta-ExternalFetcher, Perplexity-User, SemrushBot-OCOB, Sidetrade indexer bot, Webzio-Extended, YaK, Brightbot 1.0, CCBot, Claude-Web, CloudVertexBot, Cotoyogi, DuckAssistBot, Google-CloudVertexBot, ICC-Crawler, ChatGPT Agent, img2dataset, NovaAct, PanguBot, PetalBot, PhindBot, quillbot.com, Scrapy, AI2Bot, Ai2Bot-Dolma, Amazonbot, ChatGPT-User, FacebookBot, Timpibot, WARDBot, anthropic-ai, ClaudeBot, MistralAI-User, GoogleOther-Image, panscient.com, AddSearchBot, Applebot, Awario, Claude-User, cohere-training-data-crawler, FirecrawlAgent, Panscient, Poseidon Research Crawler, Google-Extended, QuillBot, SemrushBot-SWA, VelenPublicWebCrawler, wpbot, YandexAdditionalBot, Applebot-Extended, cohere-ai, Crawlspace, facebookexternalhit, Factset_spyderbot, meta-externalfetcher, netEstate Imprint Crawler Blocking No — crawling allowed

Sitemap: https://www.politico.com/sitemap.xml

Sitemap: https://www.politico.com/news-sitemap.xml

Sitemap: https://www.politico.com/2024-election/results/sitemap-2024-elections.xml

Sitemap: https://www.politico.com/liveupdates-sitemap-latest.xml

Sitemap: https://www.politico.com/liveupdates-sitemap-content.xml


User-agent: *

Disallow: /2step

Disallow: /campaigntrailnotused

Disallow: /CandidateRanking

Disallow: /candidates

Disallow: /CustomCompanionTest

Disallow: /debate

Disallow: /ryan

Disallow: /promotions

Disallow: /2014-election/results/mobile/iphone

Disallow: /2014-election/results/mobile/ipad

Disallow: /_preview

Disallow: /326home

Disallow: /327home

Disallow: /_styleguide

Disallow: /newsletters/politico-toplines

Disallow : /*?tab=most-read*
Disallow : /*?ml=*
Disallow : /*?hp=*
Disallow : /*?video=*
Disallow : /*?nid=*
Disallow : /*?cid=*
Disallow : /*?source=*
Disallow : /*?slide=*
Disallow : /*?category=*
Disallow : /*?p=*
Disallow : /*?print=*


User-agent: Googlebot-News

Disallow: /sponsor-content

Disallow: /sponsored-content

Disallow: /magazine/sponsor-content

Disallow: /newsletters/politico-toplines


User-agent: AddSearchBot

Disallow: /


User-agent: AI2Bot

Disallow: /


User-agent: Ai2Bot-Dolma

Disallow: /


User-agent: aiHitBot

Disallow: /


User-agent: Amazonbot

Disallow: /


User-agent: Andibot

Disallow: /


User-agent: anthropic-ai

Disallow: /


User-agent: Applebot

Disallow: /


User-agent: Applebot-Extended

Disallow: /


User-agent: Awario

Disallow: /


User-agent: bedrockbot

Disallow: /


User-agent: bigsur.ai

Disallow: /


User-agent: Brightbot 1.0

Disallow: /


User-agent: Bytespider

Disallow: /


User-agent: CCBot

Disallow: /


User-agent: ChatGPT Agent

Disallow: /


User-agent: ChatGPT-User

Disallow: /


User-agent: Claude-SearchBot

Disallow: /


User-agent: Claude-User

Disallow: /


User-agent: Claude-Web

Disallow: /


User-agent: ClaudeBot

Disallow: /


User-agent: CloudVertexBot

Disallow: /


User-agent: cohere-ai

Disallow: /


User-agent: cohere-training-data-crawler

Disallow: /


User-agent: Cotoyogi

Disallow: /


User-agent: Crawlspace

Disallow: /


User-agent: Datenbank Crawler

Disallow: /


User-agent: Devin

Disallow: /


User-agent: Diffbot

Disallow: /


User-agent: DuckAssistBot

Disallow: /


User-agent: Echobot Bot

Disallow: /


User-agent: EchoboxBot

Disallow: /


User-agent: FacebookBot

Disallow: /


User-agent: facebookexternalhit

Disallow: /


User-agent: Factset_spyderbot

Disallow: /


User-agent: FirecrawlAgent

Disallow: /


User-agent: FriendlyCrawler

Disallow: /


User-agent: Gemini-Deep-Research

Disallow: /


User-agent: Google-CloudVertexBot

Disallow: /


User-agent: Google-Extended

Disallow: /


User-agent: GoogleAgent-Mariner

Disallow: /


User-agent: GoogleOther

Disallow: /


User-agent: GoogleOther-Image

Disallow: /


User-agent: GoogleOther-Video

Disallow: /


User-agent: GPTBot

Disallow: /


User-agent: iaskspider/2.0

Disallow: /


User-agent: ICC-Crawler

Disallow: /


User-agent: ImagesiftBot

Disallow: /


User-agent: img2dataset

Disallow: /


User-agent: ISSCyberRiskCrawler

Disallow: /


User-agent: Kangaroo Bot

Disallow: /


User-agent: LinerBot

Disallow: /


User-agent: meta-externalagent

Disallow: /


User-agent: Meta-ExternalAgent

Disallow: /


User-agent: meta-externalfetcher

Disallow: /


User-agent: Meta-ExternalFetcher

Disallow: /


User-agent: MistralAI-User

Disallow: /


User-agent: MistralAI-User/1.0

Disallow: /


User-agent: MyCentralAIScraperBot

Disallow: /


User-agent: netEstate Imprint Crawler

Disallow: /


User-agent: NovaAct

Disallow: /


User-agent: OAI-SearchBot

Disallow: /


User-agent: omgili

Disallow: /


User-agent: omgilibot

Disallow: /


User-agent: Operator

Disallow: /


User-agent: PanguBot

Disallow: /


User-agent: Panscient

Disallow: /


User-agent: panscient.com

Disallow: /


User-agent: Perplexity-User

Disallow: /


User-agent: PerplexityBot

Disallow: /


User-agent: PetalBot

Disallow: /


User-agent: PhindBot

Disallow: /


User-agent: Poseidon Research Crawler

Disallow: /


User-agent: QualifiedBot

Disallow: /


User-agent: QuillBot

Disallow: /


User-agent: quillbot.com

Disallow: /


User-agent: SBIntuitionsBot

Disallow: /


User-agent: Scrapy

Disallow: /


User-agent: SemrushBot-OCOB

Disallow: /


User-agent: SemrushBot-SWA

Disallow: /


User-agent: Sidetrade indexer bot

Disallow: /


User-agent: Thinkbot

Disallow: /


User-agent: TikTokSpider

Disallow: /


User-agent: Timpibot

Disallow: /


User-agent: VelenPublicWebCrawler

Disallow: /


User-agent: WARDBot

Disallow: /


User-agent: Webzio-Extended

Disallow: /


User-agent: wpbot

Disallow: /


User-agent: YaK

Disallow: /


User-agent: YandexAdditional

Disallow: /


User-agent: YandexAdditionalBot

Disallow: /


User-agent: YouBot

Disallow: /

sitemap.xml 200 OK

Type Sitemap Index URLs 233 entries Valid XML Yes

Child Sitemaps:

A+

Domain Intelligence

politico.com — via Register.com - Network Solutions, LLC, 27 years, 11 months old, hosted on AWS

PASS

politico.com — via Register.com - Network Solutions, LLC, 27 years, 11 months old, hosted on AWS

Domain registered until Sep 17, 2026 (4 months remaining)

DNSSEC is not enabled

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Registrar: Register.com - Network Solutions, LLC

Registrar lock is NOT enabled

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Hosting: AWS

Got: AS14618

Domain expiry

64 days

September 17, 2026

SSL certificate

318 days

Issued by Amazon

Domain age

27 years, 11 months

Registered September 18, 1998

DNSSEC

Not enabled

Protects against DNS spoofing

Hosting

AWS

ASN AS14618

18.214.109.120

Registrar

Register.com - Network Solutions, LLC

Unlocked 4 NS records

Expiry timeline

Today

+1 year

Domain expiry SSL expiry Danger zone (≤30 days)

Recommended actions

Renew the domain or enable auto-renewal to prevent accidental expiry
Enable DNSSEC to protect visitors from DNS spoofing
Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers

Registrar Register.com - Network Solutions, LLC

Created September 18, 1998 (27 years, 11 months ago)

Expires September 17, 2026 (4 months)

Last Updated September 18, 2025

Name Servers ns-1470.awsdns-55.org, ns-2040.awsdns-63.co.uk, ns-493.awsdns-61.com, ns-630.awsdns-14.net

DNSSEC Not enabled

Hosting

IP Address 18.214.109.120

ASN AS14618 (AMAZON-AES - Amazon.com, Inc., US)

Provider AWS

Data source: rdap (1.0s)

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Why this matters

Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.

Learn more ▾

DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.

Source: ICANN / RFC 4033

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Why this matters

Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.

Learn more ▾

Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.

Source: ICANN / domain-security best practice

A+

HTTP Probe Timing

Total 381 ms — DNS, TCP, TLS, TTFB, content transfer breakdown

PASS

DNS Lookup

5 ms

TCP Connect

93 ms

TLS Handshake

189 ms

Time to First Byte

381 ms

Total Time

382 ms

Connection waterfall

DNS Lookup 5 ms TCP Connect 93 ms TLS Handshake 189 ms Server Processing 94 ms Content Transfer 0 ms