nytimes.com
Measuring…
nytimes.com
Scanned:
88/ 100
Score by axis
- Security88
- SEO88
- Reputation100
Watch this site's security
We'll email you if its security slips — a new vulnerability, an expiring certificate, a blacklisting. No account needed.
Security alerts only — nothing else, and no email unless something is wrong. Unsubscribe anytime.
Want more than security alerts?
Coming soonMonitor — daily re-scans across all five axes, instant alerts on new and cert expiry, Telegram & web push, and full history.
Fix what matters first
- 1Core Web Vitals (PageSpeed)+5
Improve Core Web Vitals — see the PageSpeed Insights report for specifics.
- 2+1
- 3SPF email anti-spoofing+1
Add an TXT record (v=spf1 …) so others can't spoof email from your domain.
- 4DMARC email anti-spoofing+1
Add a TXT record at _dmarc (v=DMARC1; p=…) to control spoofed-email handling.
- 5Meta description+1
Aim for a meta description of about 50–160 characters.
Recommendations are ranked by their impact on your score.
All checks
Security
88/ 100- Pass
HTTPS & HTTP→HTTPS redirect
HTTPS available; HTTP redirects to HTTPS
- Pass
TLS certificate validity
Valid; expires in 68 days
expires 2026-09-13 · Thawte TLS RSA CA G1 - Pass
HSTS (Strict-Transport-Security)
Present
max-age=63072000; includeSubDomains; preload - Pass
Content-Security-Policy
Present
- Warn
Core security headers
Missing: X-Frame-Options, Referrer-Policy
Add the missing headers: X-Frame-Options, Referrer-Policy.
- Pass
Mixed content (HTTP on HTTPS)
No insecure (http://) subresources
- Warn
SPF email anti-spoofing
No record
Add an TXT record (v=spf1 …) so others can't spoof email from your domain.
- Warn
DMARC email anti-spoofing
No record
Add a TXT record at _dmarc (v=DMARC1; p=…) to control spoofed-email handling.
- Pass
Vulnerable front-end libraries
No known-vulnerable libraries detected
Performance
81/ 100- Pass
Time to First Byte
146 ms
- Pass
Text compression
Enabled (gzip)
- Pass
HTTP/2 or HTTP/3
HTTP/2.0
- Pass
Cache-Control
s-maxage=30,no-cache
- Warn
Core Web Vitals (PageSpeed)
perf 0/100, 1471ms, 0.17 (field)
Improve Core Web Vitals — see the PageSpeed Insights report for specifics.
SEO
88/ 100- Pass
Page title
The New York Times - Breaking News, US News, World News and Videos
- Warn
Meta description
267 characters
Live news, investigations, opinion, photos and video by the journalists of The New York Times from more than 150 countries around the world. Subscribe for coverage of U.S. and international news, poli…Aim for a meta description of about 50–160 characters.
- Pass
- Pass
- Pass
- Pass
Single H1
1 H1 tag(s)
New York Times - Top Stories - Warn
Image alt text
26/45 images have alt (58%)
Add alt text to the remaining images.
- Pass
Structured data (JSON-LD)
present
WebSite, ImageObject, SearchAction, EntryPoint, ItemList, ListItem
Infrastructure
90/ 100- Pass
CMS detection
WordPress
- Pass
Web server
envoy
- Pass
CDN detection
Fastly
- Pass
TLS version
TLS 1.3
- Warn
IPv6 (AAAA record)
No AAAA record
Add an AAAA record to serve visitors over IPv6.
Reputation
100/ 100- Pass
Domain blacklist status
Not on major blocklists
checked: Spamhaus DBL, SURBL - Pass
Domain age
Registered 1994-01-18 (~395 months)
- Pass
Domain expiry
Expires in 195 days
2027-01-19
Go deeper
This scan is passive. An attacker won't be.
The free scan reads what your site shows everyone. A Deep Audit does what an attacker does — it actively probes your verified site for what's really exposed.
This free scan (passive)
- Security score
- Known-CVE counts
- Security headers
- TLS & certificate
- Blacklist & Safe Browsing
Deep Audit — active scan of your verified site
- Per-CVE breakdown: IDs, severity, exploit availability, fix version
- Exposed files (.git, .env, backups)
- Directory listing
- Open admin panels
- Open ports
- Subdomain exposure
- Prioritized fix plan
- Full PDF report
What we can't check without your permission
These need active probing of your site: exposed .git/.env/backups, open admin panels, open ports, forgotten subdomains. Verify your domain and we'll show you what an attacker would find.
How it works
- Verify your domain — a file or DNS record, about 2 minutes.
- We actively scan it — a few minutes; we email you when it's ready.
- Get your full report + PDF.
The deep scan is live and free while we're in beta. Verify your domain and run it now.
Active checks run only on a domain you've verified as yours, with your consent. We detect — never exploit. Free in beta; $39 one-time after launch, no subscription — and early adopters keep the deep scan free.
Run a free deep scanShare this report
Get the badge
Embed this badge on your website — it links back to this full report.
<a href="https://chkweb.com/report/nytimes.com"><img src="https://chkweb.com/badge/nytimes.com.svg" alt="Website security checked by CheckWeb" /></a>