Site

Security headers 20% · CSP deep-dive 10% · Cookie security 5% · AI readiness 5% · PWA installability 5% · Privacy & trackers 5% · Email security 10% · DNS posture 10% · SEO & meta 10% · Performance 10% · Accessibility 10%. Link health is scanned separately — its live probes are too request-hungry for the composite.

Fix these first

14 to fix · 26 to review, across all eleven layers — most important first.

Fix

Referrer-Policy Security headers →

Referrer-Policy: strict-origin-when-cross-origin
Fix

Cookie security Security headers →

Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
Fix

Inline scripts blocked CSP deep-dive →

Replace 'unsafe-inline' with per-response nonces or sha256 hashes; add 'strict-dynamic' for modern browsers.
Fix

No scheme-wide script sources CSP deep-dive →

Pin script-src to the specific origins you actually load from.
Fix

Text compression Performance →

Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
Fix

Image dimensions (layout shift) Performance →

Give every <img> width and height attributes (CSS can still make them responsive).
Fix

Links & buttons named Accessibility →

Add visible text, or aria-label="Close" (etc.) to icon-only controls.
Fix

Web App Manifest linked PWA installability →

Add <link rel="manifest" href="/manifest.webmanifest"> to the <head>.
Fix

Cross-site advertising trackers Privacy & trackers →

These require explicit opt-in consent in the EU/UK. Gate them behind a consent banner, or remove them if you're not running paid campaigns.
Fix

Manifest loads and parses PWA installability →

No manifest is linked, so there's nothing to load.
Fix

Install icons (192px & 512px) PWA installability →

No valid manifest, so no icons for the installed app.
Fix

App name PWA installability →

No valid manifest, so no app name to show on the install prompt.

+ 28 more in the layer reports below.

Share it: save a snapshot — a permanent link, and Canopy re-runs all eleven layers nightly from then on.

Embed this badge

Markdown

[![Canopy site grade](https://canopystack.dev/badge?domain=nytimes.com&type=site)](https://canopystack.dev/site?domain=nytimes.com)

📋 Export as Markdown

Paste into a PR, issue, Slack, or client report — or download .md

## Canopy site report — nytimes.com

**Grade C** · 73/100

| Layer | Grade | Score | Fails | Warns |
|---|---|---|---|---|
| security headers | C | 74/100 | 2 | 3 |
| CSP | C | 60/100 | 2 | 3 |
| cookies | C | 68/100 | 0 | 3 |
| AI readiness | B | 81/100 | 0 | 2 |
| PWA installability | F | 18/100 | 6 | 1 |
| privacy & trackers | D | 49/100 | 1 | 3 |
| email security | A | 92/100 | 0 | 3 |
| DNS posture | B | 78/100 | 0 | 2 |
| SEO & meta | A | 93/100 | 0 | 1 |
| performance | C | 63/100 | 2 | 5 |
| accessibility | A | 92/100 | 1 | 0 |

### Fix these first
- ❌ **Referrer-Policy** (Security headers) — Referrer-Policy: strict-origin-when-cross-origin
- ❌ **Cookie security** (Security headers) — Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
- ❌ **Inline scripts blocked** (CSP deep-dive) — Replace 'unsafe-inline' with per-response nonces or sha256 hashes; add 'strict-dynamic' for modern browsers.
- ❌ **No scheme-wide script sources** (CSP deep-dive) — Pin script-src to the specific origins you actually load from.
- ❌ **Text compression** (Performance) — Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
- ❌ **Image dimensions (layout shift)** (Performance) — Give every <img> width and height attributes (CSS can still make them responsive).
- ❌ **Links & buttons named** (Accessibility) — Add visible text, or aria-label="Close" (etc.) to icon-only controls.
- ❌ **Web App Manifest linked** (PWA installability) — Add <link rel="manifest" href="/manifest.webmanifest"> to the <head>.
- ❌ **Cross-site advertising trackers** (Privacy & trackers) — These require explicit opt-in consent in the EU/UK. Gate them behind a consent banner, or remove them if you're not running paid campaigns.
- ❌ **Manifest loads and parses** (PWA installability) — No manifest is linked, so there's nothing to load.
- ❌ **Install icons (192px & 512px)** (PWA installability) — No valid manifest, so no icons for the installed app.
- ❌ **App name** (PWA installability) — No valid manifest, so no app name to show on the install prompt.
- ❌ **App-like display mode** (PWA installability) — No valid manifest, so no display mode.
- ❌ **start_url set** (PWA installability) — No valid manifest, so no start_url.
- ⚠️ **Content-Security-Policy** (Security headers) — Drop 'unsafe-inline'/'unsafe-eval'; use nonces or hashes for scripts.

[Full report](https://canopystack.dev/site?domain=nytimes.com) · graded by [Canopy](https://canopystack.dev)

Machine-readable: /api/site?domain=…

Canopy · Whole-site report · nytimes.com · Mon, 10 Aug 2026 04:48 UTC · generated with Canopy — https://canopystack.dev