Site

Security headers 20% · CSP deep-dive 10% · Cookie security 5% · AI readiness 5% · PWA installability 5% · Privacy & trackers 5% · Email security 10% · DNS posture 10% · SEO & meta 10% · Performance 10% · Accessibility 10%. Link health is scanned separately — its live probes are too request-hungry for the composite.

Fix these first

2 to fix · 21 to review, across all eleven layers — most important first.

Fix

Cookie security Security headers →

Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
Fix

Text compression Performance →

Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
Warn

Content-Security-Policy Security headers →

Drop 'unsafe-inline'/'unsafe-eval'; use nonces or hashes for scripts.
Warn

Permissions-Policy Security headers →

Permissions-Policy: geolocation=(), camera=(), microphone=()
Warn

Cross-Origin-Opener-Policy Security headers →

Cross-Origin-Opener-Policy: same-origin
Warn

Subresource Integrity Security headers →

Add integrity="sha384-…" (and crossorigin="anonymous") to third-party <script> and stylesheet tags; generate hashes at srihash.org.
Warn

DNSSEC DNS posture →

Enable DNSSEC at your DNS host and publish the DS record at your registrar (one toggle at most managed hosts).
Warn

IPv6 reachability DNS posture →

Publish an AAAA record (most CDNs and hosts give you IPv6 for free).
Warn

Meta description SEO & meta →

Rewrite to 50–160 characters.
Warn

Third-party origins Performance →

Self-host what you can (fonts, scripts); preconnect to the few that must remain.
Warn

MTA-STS Email security →

TXT _mta-sts : "v=STSv1; id=2026081001", plus a policy file at https://mta-sts.github.com/.well-known/mta-sts.txt with mode: enforce.
Warn

H1 heading SEO & meta →

Use exactly one <h1> stating what the page is about.

+ 11 more in the layer reports below.

Site grade history (2)

Mon, 10 Aug 2026 04:00:24 UTC	B	88/100	auto scan
Sun, 09 Aug 2026 10:53:16 UTC	B	88/100	auto scan

Share it: save a snapshot — a permanent link, and Canopy re-runs all eleven layers nightly from then on.

Embed this badge

Markdown

[![Canopy site grade](https://canopystack.dev/badge?domain=github.com&type=site)](https://canopystack.dev/site?domain=github.com)

📋 Export as Markdown

Paste into a PR, issue, Slack, or client report — or download .md

## Canopy site report — github.com

**Grade B** · 88/100

| Layer | Grade | Score | Fails | Warns |
|---|---|---|---|---|
| security headers | B | 83/100 | 1 | 4 |
| CSP | A | 100/100 | 0 | 0 |
| cookies | B | 84/100 | 0 | 2 |
| AI readiness | B | 89/100 | 0 | 1 |
| PWA installability | A | 95/100 | 0 | 1 |
| privacy & trackers | A | 100/100 | 0 | 0 |
| email security | A | 92/100 | 0 | 3 |
| DNS posture | B | 78/100 | 0 | 2 |
| SEO & meta | B | 82/100 | 0 | 4 |
| performance | B | 79/100 | 1 | 3 |
| accessibility | A | 96/100 | 0 | 1 |

### Fix these first
- ❌ **Cookie security** (Security headers) — Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
- ❌ **Text compression** (Performance) — Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
- ⚠️ **Content-Security-Policy** (Security headers) — Drop 'unsafe-inline'/'unsafe-eval'; use nonces or hashes for scripts.
- ⚠️ **Permissions-Policy** (Security headers) — Permissions-Policy: geolocation=(), camera=(), microphone=()
- ⚠️ **Cross-Origin-Opener-Policy** (Security headers) — Cross-Origin-Opener-Policy: same-origin
- ⚠️ **Subresource Integrity** (Security headers) — Add integrity="sha384-…" (and crossorigin="anonymous") to third-party <script> and stylesheet tags; generate hashes at srihash.org.
- ⚠️ **DNSSEC** (DNS posture) — Enable DNSSEC at your DNS host and publish the DS record at your registrar (one toggle at most managed hosts).
- ⚠️ **IPv6 reachability** (DNS posture) — Publish an AAAA record (most CDNs and hosts give you IPv6 for free).
- ⚠️ **Meta description** (SEO & meta) — Rewrite to 50–160 characters.
- ⚠️ **Third-party origins** (Performance) — Self-host what you can (fonts, scripts); preconnect to the few that must remain.
- ⚠️ **MTA-STS** (Email security) — TXT _mta-sts : "v=STSv1; id=2026081001", plus a policy file at https://mta-sts.github.com/.well-known/mta-sts.txt with mode: enforce.
- ⚠️ **H1 heading** (SEO & meta) — Use exactly one <h1> stating what the page is about.
- ⚠️ **Structured data** (SEO & meta) — Add JSON-LD, e.g. <script type="application/ld+json">{"@context":"https://schema.org","@type":"Organization","name":"…","url":"…"}</script> — [Generate valid JSON-LD in Canopy's schema builder](https://canopystack.dev/schema)
- ⚠️ **HTML document weight** (Performance) — Move data out of inline JSON blobs, paginate long lists, defer non-critical markup.
- ⚠️ **Heading structure** (Accessibility) — Use exactly one <h1>, then nest <h2>–<h6> without skipping levels.

[Full report](https://canopystack.dev/site?domain=github.com) · graded by [Canopy](https://canopystack.dev)

Machine-readable: /api/site?domain=…

Canopy · Whole-site report · github.com · Mon, 10 Aug 2026 04:41 UTC · generated with Canopy — https://canopystack.dev