Audit Result

UUID: 01a02072-94e2-7129-9ce7-d0473f80409c

Share on X Recheck Back to history
www.doubao.com

https://www.doubao.com/security/doubao-region-ban?source=1

Scanned 2 weeks ago

69
Fair Score
39 total checks
Passed
17
Warnings
20
Errors
2

Meta Information

  • Title Tag Warning

    Found 2 characters. Keep title between 30 and 60 characters.

    Fix: Add a unique <title> tag describing the main page intent in 30-60 characters.

  • Meta Description Pass

    Found 106 characters. Good snippet length.

  • Canonical URL Warning

    Canonical link not found.

    Fix: Add <link rel="canonical" href="https://example.com/page"> to avoid duplicate URL ambiguity.

  • Favicon Pass

    Favicon found and reachable: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/favicon/new-doubao/64x64.png (HTTP 200).

    Favicon
  • Viewport Meta Pass

    Viewport configured: width=device-width,initial-scale=1,shrink-to-fit=no,viewport-fit=cover,minimum-scale=1,maximum-scale=1,user-scalable=no

  • HTML Lang Warning

    No lang attribute on the <html> element.

    Fix: Set <html lang="en"> (or the correct locale) for accessibility and search engines.

Content Structure

  • H1 Tag Error

    No H1 heading found.

    Fix: Use a single, descriptive <h1> that states the primary purpose of the page.

  • Heading Hierarchy Pass

    Valid heading flow across 0 headings.

  • Image Alt Text Error

    1 of 1 images are missing alt text.

    Fix: Add meaningful alt attributes to all informative images for accessibility and image SEO.

Technical Optimization

  • HTTPS Pass

    Page is served over HTTPS.

  • HSTS & HTTPS Redirect Warning

    2 HTTPS hardening issues detected.

    • • Missing Strict-Transport-Security header.
    • • Could not probe the HTTP version of this page.

    Fix: Set Strict-Transport-Security with a long max-age, add includeSubDomains, and redirect all HTTP requests to HTTPS.

  • Security Headers Warning

    Missing: strict-transport-security, x-frame-options, x-content-type-options, referrer-policy.

    Full HTTP headers (19)
    • • cache-control: no-cache
    • • content-encoding: br
    • • content-security-policy: report-to slardar-endpoint; upgrade-insecure-requests ; report-uri https://mon.zijieapi.com/monitor_browser/collect/batch/security/?bid=flow_web;
    • • content-security-policy-report-only: report-to slardar-endpoint; upgrade-insecure-requests ; frame-ancestors 'self' *.toutiao.com *.douyin.com *.bytedance.com *.bytedance.net tcs.jiyunhudong.com aup.jijixiangshangabc.com chrome-extension://dbjibobgilijgolhjdcbdebjhejelffo chrome-extension://molcibnmfbjmmfbefjfcafdeabfniobi chrome-extension://capohkkfagimodmlpnahjoijgooocdjhd chrome-extension://mijalhmcgaaaggjfhkliffkanfhimhch chrome-extension://obkcimipmjdkghadnfcjojepocldeggd chrome-extension://epjhdbhhoeemcbbbgkimcfndcbjapdaa safari-web-extension: *.doubao.com *.larkoffice.com *.feishu.cn *.larksuite.com *.feishu-pre.net *.feishu-pre.cn *.larksuite-pre.com *.larksuite.us *.larksuite-pre.us *.larkenterprise.com *.larkenterprise-pre.com; script-src 'nonce-bcdfc186301cef9934849f69f7496f8a-argus' blob: data: 'self' 'unsafe-eval' 'report-sample' 'strict-dynamic' 'unsafe-inline' https:; base-uri 'self'; object-src 'self'; frame-src 'self' *.toutiao.com *.douyin.com *.bytedance.com *.bytedance.net tcs.jiyunhudong.com aup.jijixiangshangabc.com *.doubao.com; report-uri https://mon.zijieapi.com/monitor_browser/collect/batch/security/?bid=flow_web;
    • • content-type: text/html; charset=utf-8
    • • date: Thu, 20 Aug 2026 18:32:46 GMT
    • • reporting-endpoints: slardar-endpoint="https://mon.zijieapi.com/monitor_browser/collect/batch/security/?bid=flow_web"
    • • server: volc-dcdn
    • • server-timing: inner; dur=30, cdn-cache;desc=MISS, origin;dur=129, edge;dur=289, cdn-cache;desc=MISS, cdn-cache;desc=MISS
    • • vary: Accept-Encoding
    • • via: n172-186-134.gdguangzhou-mp01.Creative,n172-207-152.HK-HKG1.Creative,n107-155-001-247.oversea-US-LAX7.Creative
    • • x-dsa-origin-status: 200
    • • x-dsa-trace-id: 1787250766ba37dbe48493d749b140e654b066a97b
    • • x-ggw-config-version: 13522163
    • • x-request-ip: 5.161.96.221
    • • x-tt-logid: 20260821023246FAA4C11DFFAA88FF943E
    • • x-tt-trace-host: 0126a012bf2ba0dcedd9d10879e3ccf5f994d50ce77e80fd7bb11137be14d34fa76ff5a039541b8cb0b4665d846156a49a1c8f8b2521fa72ff794360eae7982128af8b268ca79468269171d51fbe4c72441796f7cb5ed4d5ebf7b8f8b2c8102fadff5b40b6ece1d71b4f4e8ea5e9dd62b9e4bda7dfeedec6b15287a1410e4e7fa5b740991a69ddc38c3a0c252fbd74a64f
    • • x-tt-trace-id: 00-260821023246FAA4C11DFFAA88FF943E-26067B1C89E47365-00
    • • x-tt-trace-tag: id=5

    Fix: Add the missing security headers at your reverse proxy or application layer.

  • CSP Quality Warning

    3 CSP hardening issues detected.

    • • CSP is missing object-src 'none'.
    • • CSP is missing a base-uri restriction.
    • • CSP is missing frame-ancestors protection.
    • • Content-Security-Policy: report-to slardar-endpoint; upgrade-insecure-requests ; report-uri https://mon.zijieapi.com/monitor_browser/collect/batch/security/?bid=flow_web;

    Fix: Tighten Content-Security-Policy by removing unsafe directives and adding object-src, base-uri, and frame-ancestors restrictions.

  • Cookie Security Pass

    No first-party cookies were set during the initial page load.

  • Server Version Disclosure Pass

    Server response headers do not expose version tokens.

  • Cloudflare Proxy Warning

    Domain does not appear to be behind Cloudflare.

  • Perceived Load Time Warning

    Loaded in 2.60s (perceived).

    Fix: Reduce payload size, cache static assets, and remove non-critical JS from initial load.

  • Render Blocking Resources Warning

    3 scripts and 6 styles may block rendering.

    • • script: https://lf3-short.ibytedapm.com/slardar/fe/sdk-web/browser.1.16.6.cn.js?bid=flow_web&globalName=inlineSlardarInstance
    • • script: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/rc-client-security/web/stable/1.0.1.20-alpha.08/bdms.js
    • • script: https://lf3-short.ibytedapm.com/slardar/fe/sdk-web/plugins/common-monitors.1.16.6.js
    • • style: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/doubao/web/static/css/80624.8b67112d.css
    • • style: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/doubao/web/static/css/66694.9df2fa41.css
    • • style: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/doubao/web/static/css/37415.c4670248.css
    • • style: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/doubao/web/static/css/83764.6b5acea3.css
    • • style: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/doubao/web/static/css/security.522b9ff7.css
    • • style: https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/doubao/web/static/css/async/security_doubao-region-ban/page.484de1a3.css

    Fix: Defer non-critical scripts and inline critical CSS to improve first paint speed.

  • Compression Warning

    8 text resources look uncompressed.

    • • https://www.doubao.com/ttwid/check/ (application/json)
    • • https://www.doubao.com/ttwid/register/ (application/json)
    • • https://www.doubao.com/passport/account/info/v2/?pc_version=3.32.58&version_code=20800&language=zh&device_platform=web&aid=497858&real_aid=497858&pkg_type=release_version&use-olympus-account=1&region=&sys_region=&account_sdk_source=web&sdk_version=2.2.10&doubao_from=inject_html&a_bogus=Yfsnk7UEYpARcdMbuKazCnoRALC%2FrPujylTOSw1RyKTdLhFbN%2Fl5ONtvbxKQ4h8UISkswe37MDl%2FbExcpWvs3A9kKmpvSKTfyuOAIg0oZqqpazJsDNSiCL0FuwsYlR4Ll59tiAv5As076dQl9HViAQ5aS5FERQYpbNpjd%2Fz9HjW03M8zE1BRtnvgcH-z-Gn6mtzWHJY%3D (application/json; charset=utf-8)
    • • https://www.doubao.com/samantha/user/setting/get?version_code=20800&language=en-US&device_platform=web&doubao_device_platform=web&aid=497858&real_aid=497858&pkg_type=release_version&device_id=&pc_version=3.32.58&doubao_pc_version=3.32.58&region=&sys_region=&samantha_web=1&web_platform=browser&use-olympus-account=1&web_tab_id=6d2ec87e-f401-4641-8604-88298f1e8c55&a_bogus=Oy4RhwtyENQnOdMbmKahCaq5N6mMNBWjDzToRE2R7oTYLZFYqQlCOGDvrNK5sZWUnbkTwe37ZDWMbxDPNW51VlrkqmpvSktW6YOVI8sohqqpa0vsEHywCumFuwBbl5sLaQ9Ui1v5Is076d5l9N50Ap-Ge5zjmQbpbqB6dZuy7jAUpF8zL3Bbtcf2bH-uB-x6%2FtifHZj%3D (application/json; charset=utf-8)
    • • https://mcs.doubao.com/webid (application/json; charset=utf-8)
    • • https://mcs.doubao.com/list (application/json; charset=utf-8)
    • • https://mcs.doubao.com/tobid (application/json; charset=utf-8)
    • • https://mssdk.bytedance.com/web/report?msToken=&X-Bogus=DFSzswROQDaEcSTSC3/8MDPPCOmh (text/plain; charset=utf-8)

    Fix: Enable Brotli or Gzip compression for HTML, CSS, JS, and JSON responses.

  • Robots.txt Pass

    Found robots.txt (200).

  • Sitemap File Pass

    Found sitemap (200) at https://www.doubao.com/sitemap.xml.

  • Crawl Directives Warning

    No robots meta tag defined.

    Fix: Add <meta name="robots" content="index,follow"> (or the intended directive) in <head>.

Accessibility Basics

  • Form Labels Pass

    All 0 controls are labeled.

  • Landmarks Warning

    Missing landmarks: header, nav, main, footer.

    Fix: Use semantic regions (<header>, <nav>, <main>, <footer>) for navigation and assistive tech.

  • Tap Target Size Warning

    2 interactive elements appear smaller than 48px.

    • • button.flex.shrink-0 (Open Dola) - 91x44px
    • • button.flex.shrink-0 (Log In) - 91x44px

    Fix: Increase target size to at least 48x48 CSS pixels for touch interactions.

Social & Rich Results

  • Open Graph Basics Pass

    Core Open Graph tags are present.

  • Open Graph Image Warning

    og:image is missing.

    Fix: Add <meta property="og:image" content="https://..."> with a high-quality share image.

  • Twitter Card Warning

    twitter:card is missing.

    Fix: Add <meta name="twitter:card" content="summary_large_image"> for better previews on X.

  • Structured Data Warning

    No JSON-LD schema scripts found.

    Fix: Add JSON-LD structured data matching your page type (Organization, Article, Product, etc.).

  • PWA Metadata Warning

    Manifest or Apple touch icon is missing.

    Fix: Link your web app manifest and apple-touch-icon for improved install/share experiences.

  • Open Graph/Twitter Quality Warning

    3 social preview quality issues detected.

    • • ISSUE: og:title should typically be between 10 and 70 characters.
    • • ISSUE: Use an absolute URL for og:image or twitter:image.
    • • ISSUE: twitter:card is missing.
    • • GUIDELINE: Optimal og:title length: 40-60 characters (acceptable: 10-70).
    • • GUIDELINE: Optimal og:description length: 110-160 characters (acceptable: 50-200).
    • • GUIDELINE: Optimal preview image size: 1200x630 pixels.
    • • GUIDELINE: Optimal preview image aspect ratio: 1.91:1.
    • • GUIDELINE: Optimal preview image file size: under 5 MB.
    • • GUIDELINE: Recommended twitter:card: summary_large_image.

    Fix: Use absolute OG/Twitter URLs, keep metadata lengths in recommended ranges, and provide a preview image near 1200x630 under 5MB.

Links Analysis

Performance & Runtime

  • Core Web Vitals: LCP Warning

    Largest Contentful Paint: 3.46s.

    Fix: Improve LCP by optimizing above-the-fold media, reducing server latency, and inlining critical CSS.

  • Core Web Vitals: CLS Pass

    Cumulative Layout Shift: 0.000.

  • Main Thread Blocking (TBT) Pass

    Total Blocking Time estimate: 184ms.

  • Broken Assets Pass

    No failed CSS/JS/image/font/media requests detected.

  • JavaScript Runtime Errors Warning

    2 JavaScript runtime issues detected.

    • • The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy. [https://www.doubao.com/security/doubao-region-ban?source=1:1]
    • • WebSocket connection to 'wss://www.doubao.com/security/Create%20WebSocket' failed: Error during WebSocket handshake: Unexpected response code: 404 [https://lf-flow-web-cdn.doubao.com/obj/flow-doubao/rc-client-security/c-webmssdk/1.0.0.43/webmssdk.es5.js:2]

    Fix: Fix JS files returning 404/failed requests and resolve the listed runtime exceptions.