/ / d / nytimes.com

nytimes.com

58 / 100

overall · band: medium

scanned2026-04-26 23:19:33Z

methodv0.1 — 2026-04-25

verdicts27 pass 4 warn 32 fail 23 n/a

rescanwrites a fresh score to the registry

Site facts

Snapshot date: 2026-04-26
Factors scored: 63 / 86
Composite score: 58/100
Method version: v0.1 — 2026-04-25

Security· 61/100

#	Factor	Verdict	Score	Evidence
4	Security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-Content-Type-Options)	pass	90	security_headers_score=90, missing=Referrer-Policy
5	SSL certificate validity & expiration window	n/a	—	Scoring not yet implemented
6	WordPress REST API user enumeration exposure	pass	100	exposed=false
7	Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)	pass	100	total_checked=6
22	DNSSEC validation	fail	0	ds_present=false, ad_bit=false
23	CAA records	fail	0	records=\# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d\|\# 20 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d\|\# 22 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 74 72 75 73 74 2e 63 6f 6d\|\# 19 00 05 69 73 73 75 65 61 77 73 74 72 75 7…
26	HSTS preload list inclusion	pass	100	hsts_header=max-age=63072000; includeSubDomains; preload, preload_status=preloaded
27	TLS minimum version & cipher suite quality	n/a	—	Scoring not yet implemented
28	Subdomain takeover surface	pass	100	findings={"subdomain":"www.nytimes.com","cname":"www.prd.map.nytimes.com.","dangling":false}\|{"subdomain":"api.nytimes.com","cname":"api-apigee.xovr.nyt.net.","dangling":false}\|{"subdomain":"app.nytimes.com","cname":"nytimes.map.fastly.net.","dangli…
29	Spam / phishing blocklist presence	fail	0	listed=true, response_code=0, answers=127.255.255.254

Performance· 52/100

#	Factor	Verdict	Score	Evidence
8	Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)	n/a	—	Scoring not yet implemented
9	HTTP/2 support	n/a	—	Scoring not yet implemented
10	Compression (Brotli / gzip)	pass	80	perf_compression=gzip
30	HTTP/3 support	fail	0	supports_h3=false
31	IPv6 support	fail	0	aaaa_count=0
32	Image optimization (WebP/AVIF)	n/a	—	Scoring not yet implemented
33	Desktop PageSpeed score	n/a	—	Scoring not yet implemented
34	Core Web Vitals from CrUX (Real User Monitoring)	n/a	—	Scoring not yet implemented
35	Lazy loading on below-fold images	n/a	—	Scoring not yet implemented
36	Font loading strategy (FOUT/FOIT/swap)	n/a	—	Scoring not yet implemented
37	Total homepage byte weight	pass	100	html_bytes=512000, subresource_bytes=0, total_bytes=512000, total_kb=500, sampled=3, total_refs=3
38	Largest unused JavaScript bundle	pass	80	deferred_scripts=5, sample=/vi-assets/static-assets/adslot-85f75cbf48b1162ebdbb.js\|https://static01.nyt.com/video-static/betamax/player-CKCxHe9J.js\|https://static01.nyt.com/video-static/betamax/cover-0.2.40-DtYyWQLl.js\|https://static01.nyt.com/video…

SEO· 33/100

#	Factor	Verdict	Score	Evidence
11	Title, meta description, OG, Twitter cards, canonical	pass	80	title=true, description=true, og=true, twitter=false, canonical=true
12	Schema.org structured data presence	n/a	—	Scoring not yet implemented
13	H1 tag presence	fail	0	h1_count=0
14	Sitemap.xml + robots.txt presence	warn	50	has_robots_txt=true, has_sitemap=false
39	Schema.org type validity (parsed JSON-LD)	n/a	—	Scoring not yet implemented
40	Breadcrumb schema	fail	0	present=false
41	FAQ / HowTo schema (where applicable)	n/a	—	n/a — not_applicable
42	hreflang for multi-language sites	fail	0	html_lang=en, languages_seen=en\|es, alternates=0
43	Internal link depth (clicks from homepage to deepest content)	pass	100	max_depth=1, pages_fetched=50, pages_seen=214, capped_at=50
61	Better Business Bureau accreditation	fail	0	no_link_on_site

AI-readiness· 16/100

#	Factor	Verdict	Score	Evidence
15	llms.txt presence	fail	0	has_llms_txt=false
16	AI crawler robots.txt directives	fail	40	robots_ai_blocked_count=12, blocked_names=GPTBot (OpenAI)\|ChatGPT-User (OpenAI browsing)\|ClaudeBot (Anthropic)\|anthropic-ai (older Anthropic)\|Google-Extended (Gemini training)\|PerplexityBot\|Bytespider (ByteDance/TikTok)\|Meta-ExternalAgent\|CCBot (Com…
44	AI plugin manifest (.well-known/ai-plugin.json)	fail	0	status=404
45	JSON-LD richness score for LLMs	fail	25	org_complete=false, has_address=false, has_contact_point=false, has_same_as=true, has_content_type=false, breakdown={"coreOrg":0,"contact":0,"sameAs":25,"contentType":0}

Privacy· 55/100

#	Factor	Verdict	Score	Evidence
46	Cookie banner presence + CMP detection	warn	50	banner_detected=true
47	Privacy policy page presence	pass	100	found=true, href=https://help.nytimes.com/hc/en-us/articles/10940941449492-The-New-York-Times-Company-Privacy-Policy, text=Privacy Policy
48	Terms of service page presence	pass	100	found=true, href=https://help.nytimes.com/hc/en-us/articles/115014893428-Terms-of-Service, text=Terms of Service
49	Third-party tracker count	pass	80	count=3, hosts=g1.nyt.com\|static01.nyt.com\|vp.nyt.com
50	CCPA "Do Not Sell or Share My Personal Information" link	fail	0	found=false
51	Cookie scan — actual cookies set on first load	fail	0	count=7, names=nyt-a\|nyt-gdpr\|nyt-purr\|nyt-geo\|datadome\|nyt-s-present\|nyt-traceid, with_cmp=false

Accessibility· 0/100

#	Factor	Verdict	Score	Evidence
52	Accessibility statement page	fail	0	found=false
53	axe-core / WAVE accessibility scan	n/a	—	Scoring not yet implemented
54	Image alt text coverage	n/a	—	Scoring not yet implemented
55	Heading hierarchy validity	n/a	—	Scoring not yet implemented
56	Color contrast (WCAG AA)	n/a	—	Scoring not yet implemented
57	ARIA labels presence and validity	n/a	—	Scoring not yet implemented
58	Skip-to-content link	n/a	—	Scoring not yet implemented

Brand presence· 30/100

#	Factor	Verdict	Score	Evidence
17	Domain age (RDAP / WHOIS)	pass	100	domain_age_years=32.3
18	Wayback Machine site age & last snapshot	n/a	—	Scoring not yet implemented
19	Google Business Profile presence + rating	pass	80	found=true, rating=3.8, review_count=225
20	News mentions in last 30 days	pass	85	news_mentions_count=20
21	Wikipedia entity	pass	100	found=true, title=Nytimes, url=https://en.wikipedia.org/wiki/Nytimes
59	Yelp presence + rating + review count	fail	0	no_link_on_site
60	Trustpilot presence + rating	fail	0	no_link_on_site
62	LinkedIn Company Page (presence + employee count + follower count)	fail	0	no_link_on_site
63	Bing Places	n/a	—	n/a — no_public_url_convention
64	Apple Maps presence (Apple Business Connect)	fail	0	no_link_on_site
65	Facebook Page presence	fail	0	no_link_on_site
66	Instagram presence (link from site → IG profile)	fail	0	no_link_on_site
67	Web App Manifest (manifest.json)	n/a	—	Scoring not yet implemented
68	Service Worker / PWA capability	n/a	—	Scoring not yet implemented
69	Analytics tools detected	fail	0	count=0
70	Payment processors detected	n/a	—	n/a — no_payment_detected
71	Marketing automation tools detected	fail	0	count=0
72	Customer support tools detected	fail	0	count=0
73	Tag manager presence	warn	50	count=0
74	Ad networks detected	warn	70	tools=DoubleClick\|Google AdSense, count=2
83	Visible contact form on site	fail	0	detected=false, count=0

Email health· 63/100

#	Factor	Verdict	Score	Evidence
1	DMARC enforcement	pass	100	present=true, policy=reject
2	DKIM signing	pass	100	present=true, selector=google, source=doh_probe
3	SPF record present and valid	pass	100	present=true, raw="v=spf1 include:nytimes.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:_spf.e.sparkpost.com include:amazonses.com ~all", qualifier=softfail
24	MTA-STS & TLS-RPT	fail	0	policy_ok=false
25	BIMI + VMC	fail	0	no_bimi
75	Branded domain email address (vs free Gmail/Yahoo)	pass	100	branded=true, provider=google
76	Email provider class (Workspace / 365 / Zoho / self-hosted / shared)	pass	100	provider=google
77	DMARC aggregate reporting enabled (rua=)	pass	100	has_dmarc_reporting=true, audit_flag=true, derived_from_raw=true, source=derived_from_raw, dmarc_raw="v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email,mailto:dmarc.report@nytimes.com"
78	Free-email exposure on contact page (gmail/yahoo/outlook visible)	pass	100	Scored
79	Newsletter signup form detected	fail	0	detected=false
80	Email Service Provider (ESP) detected	fail	0	Scored
81	Transactional email provider detected (from SPF includes)	pass	100	providers=Amazon SES
82	SPF lookup count (10-limit deliverability check)	pass	100	lookups=5, limit=10
84	Mailto: direct contact link present	fail	0	Scored
85	Email forwarding service detected (improvmx, forwardemail, etc.)	pass	100	hosts=aspmx.l.google.com\|alt3.aspmx.l.google.com\|alt4.aspmx.l.google.com\|alt1.aspmx.l.google.com\|alt2.aspmx.l.google.com, provider=Google Workspace, kind=branded
86	Lead magnet / signup incentive detected (free download, ebook, etc.)	fail	0	detected=false

Scores are computed under method v0.1 — 2026-04-25. See the methodology for the full factor list and per-factor specifications.