Site

Security headers 20% · CSP deep-dive 10% · Cookie security 5% · AI readiness 5% · PWA installability 5% · Privacy & trackers 5% · Email security 10% · DNS posture 10% · SEO & meta 10% · Performance 10% · Accessibility 10%. Link health is scanned separately — its live probes are too request-hungry for the composite.

Fix these first

9 to fix · 19 to review, across all eleven layers — most important first.

Fix

Cookie security Security headers →

Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
Fix

Text compression Performance →

Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
Fix

Script count Performance →

Audit and bundle; every tag is parse/compile/execute time on the main thread.
Fix

Web App Manifest linked PWA installability →

Add <link rel="manifest" href="/manifest.webmanifest"> to the <head>.
Fix

Manifest loads and parses PWA installability →

No manifest is linked, so there's nothing to load.
Fix

Install icons (192px & 512px) PWA installability →

No valid manifest, so no icons for the installed app.
Fix

App name PWA installability →

No valid manifest, so no app name to show on the install prompt.
Fix

App-like display mode PWA installability →

No valid manifest, so no display mode.
Fix

start_url set PWA installability →

No valid manifest, so no start_url.
Warn

Content-Security-Policy Security headers →

Drop 'unsafe-inline'/'unsafe-eval'; use nonces or hashes for scripts.
Warn

Permissions-Policy Security headers →

Permissions-Policy: geolocation=(), camera=(), microphone=()
Warn

Cache-Control sanity Security headers →

Cache-Control: no-store (for dynamic/personalized pages) or an explicit public, max-age=… for truly static ones

+ 16 more in the layer reports below.

Share it: save a snapshot — a permanent link, and Canopy re-runs all eleven layers nightly from then on.

Embed this badge

Markdown

[![Canopy site grade](https://canopystack.dev/badge?domain=stripe.com&type=site)](https://canopystack.dev/site?domain=stripe.com)

📋 Export as Markdown

Paste into a PR, issue, Slack, or client report — or download .md

## Canopy site report — stripe.com

**Grade B** · 84/100

| Layer | Grade | Score | Fails | Warns |
|---|---|---|---|---|
| security headers | B | 83/100 | 1 | 4 |
| CSP | A | 100/100 | 0 | 0 |
| cookies | B | 89/100 | 0 | 1 |
| AI readiness | B | 89/100 | 0 | 1 |
| PWA installability | F | 18/100 | 6 | 1 |
| privacy & trackers | A | 100/100 | 0 | 0 |
| email security | A | 92/100 | 0 | 3 |
| DNS posture | B | 78/100 | 0 | 2 |
| SEO & meta | A | 95/100 | 0 | 1 |
| performance | C | 69/100 | 2 | 4 |
| accessibility | A | 94/100 | 0 | 2 |

### Fix these first
- ❌ **Cookie security** (Security headers) — Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
- ❌ **Text compression** (Performance) — Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
- ❌ **Script count** (Performance) — Audit and bundle; every tag is parse/compile/execute time on the main thread.
- ❌ **Web App Manifest linked** (PWA installability) — Add <link rel="manifest" href="/manifest.webmanifest"> to the <head>.
- ❌ **Manifest loads and parses** (PWA installability) — No manifest is linked, so there's nothing to load.
- ❌ **Install icons (192px & 512px)** (PWA installability) — No valid manifest, so no icons for the installed app.
- ❌ **App name** (PWA installability) — No valid manifest, so no app name to show on the install prompt.
- ❌ **App-like display mode** (PWA installability) — No valid manifest, so no display mode.
- ❌ **start_url set** (PWA installability) — No valid manifest, so no start_url.
- ⚠️ **Content-Security-Policy** (Security headers) — Drop 'unsafe-inline'/'unsafe-eval'; use nonces or hashes for scripts.
- ⚠️ **Permissions-Policy** (Security headers) — Permissions-Policy: geolocation=(), camera=(), microphone=()
- ⚠️ **Cache-Control sanity** (Security headers) — Cache-Control: no-store (for dynamic/personalized pages) or an explicit public, max-age=… for truly static ones
- ⚠️ **Subresource Integrity** (Security headers) — Add integrity="sha384-…" (and crossorigin="anonymous") to third-party <script> and stylesheet tags; generate hashes at srihash.org.
- ⚠️ **DNSSEC** (DNS posture) — Enable DNSSEC at your DNS host and publish the DS record at your registrar (one toggle at most managed hosts).
- ⚠️ **IPv6 reachability** (DNS posture) — Publish an AAAA record (most CDNs and hosts give you IPv6 for free).

[Full report](https://canopystack.dev/site?domain=stripe.com) · graded by [Canopy](https://canopystack.dev)

Machine-readable: /api/site?domain=…

Canopy · Whole-site report · stripe.com · Mon, 10 Aug 2026 04:47 UTC · generated with Canopy — https://canopystack.dev