T Themerella
Website Report

nyt-sudoku.net Website Report

Final URL: https://nyt-sudoku.net/

Scanned at 7/12/2026, 3:31:19 AM UTC · HTTP status 200

Themerella Score 86 / 100

Strong. A solid public-site baseline. Close the priority fixes to protect the score.

86 /100
Start with top fixes Monitor this site
Export & more
Run a fresh scan Download Markdown Download JSON Download CSV White-label / PDF
Tech detected 5
SEO issues 0
Performance issues 0
Accessibility issues 0
Security issues 6
Redirects 0
Channels 8

Coverage: This saved score reflects the public signals captured by this scan. Optional rendered-DOM, axe-core, and Lighthouse evidence is documented under “How this scan was produced.”

Top fixes

What to fix first

0/6 fixed

  1. Add Strict-Transport-Security after confirming the full site works over HTTPS.

    Security · high · security.missing_hsts_header · View fix guide

  2. Add a CSP header at the CDN or server layer and test third-party scripts.

    Security · high · security.missing_csp_header · View fix guide

  3. Add X-Frame-Options: SAMEORIGIN or use frame-ancestors in CSP.

    Security · medium · security.missing_x_frame_options_header · View fix guide

  4. Add X-Content-Type-Options: nosniff.

    Security · medium · security.missing_x_content_type_options_header

  5. Add Referrer-Policy: strict-origin-when-cross-origin.

    Security · low · security.missing_referrer_policy_header · View fix guide

  6. Restrict browser features that the site does not use.

    Security · low · security.missing_permissions_policy_header
Score breakdown
Seo 20/20
Security 1/15
Performance 20/20
Tech Clarity 15/15
Accessibility 20/20
Maintainability 10/10
Technology Stack

Detected technologies with evidence

Analytics

Google Analytics 4 high 82% evidence score

Sources: html

  • htmlg-white

CMS

WordPress high 91% evidence score

Sources: html · resources

Theme, plugin, or version hints may expose maintenance and attack-surface details.

  • htmlwp-content
  • resources/wp-content/

CSS / UI

Tailwind CSS low 40% evidence score

Sources: html

  • htmlclass="fixed inset-x-3 bottom-3 z-[80] mx-auto max-w-3xl rounded-[8px] border border-[#c9c1b0] bg-[#fffdf7] p-4 text-[#171717] shadow-

Frontend Framework

Next.js high 99% evidence score

Sources: html · resources · headers

  • html/_next/static
  • resources/_next/static
  • headersnext-router

Hosting / CDN

Cloudflare high 91% evidence score

Sources: headers · resources

  • headerscf-cache-status
  • resourcescloudflareinsights.com
External context

Domain intelligence via SiteJSON

Optional external enrichment — popularity, traffic, and DNS signals that complement the first-party scan. Fetched on demand from an external provider; it is not part of the live scan.

WordPress / CMS Details

WordPress theme not exposed

Themes
No theme slug found
Plugins
No plugin paths found
REST API hint
Not detected
Generator
Not exposed
Version hints
No obvious version hints
ThemeRella/Boo signals
No legacy signal found
Redirect Chain

No redirect chain

Final URL: https://nyt-sudoku.net/

That usually means the input URL resolved directly without HTTP hop cleanup.

SEO / GEO

Title
NYT Sudoku - Free Online Daily and Unlimited Sudoku
Description
Play daily Easy, Medium, and Hard Sudoku plus unlimited generated practice on a fast browser Sudoku board.
Canonical
https://nyt-sudoku.net/
Robots meta
index, follow
H1
NYT Sudoku
Structured data
WebSite, Game,WebApplication, FAQPage
Robots.txt
OK (200)
Sitemap
OK (200)

Performance Signals

Initial fetch
834ms
HTML size
173KB
Resources
125 total · 14 scripts · 3 CSS · 39 images
Lazy images
72

This MVP uses fast static performance signals. Enable Lighthouse CLI to add lab performance, SEO, accessibility, and best-practices scores.

On-demand performance intelligence is disabled for this runtime. When enabled with a Google API key, it loads separately from the main scan.

Accessibility

Images
73 total · 0 missing alt
Forms
0 inputs · 0 labels
Buttons
110 total · 0 may lack names
Headings
68 heading tags
Viewport
Present

This is a fast static accessibility scan. Enable Playwright + axe-core for automated rendered-page audits.

Security Headers

HSTS
Missing
Content-Security-Policy
Missing
X-Frame-Options
Missing
X-Content-Type-Options
Missing
Referrer-Policy
Missing
Permissions-Policy
Missing
Cookies
0 set-cookie header(s), 0 flag issue(s)
TLS certificate
TLSv1.3 · CN=WE1, O=Google Trust Services · expires Aug 18 14:47:22 2026 GMT (37 day(s))
TLS SANs
nyt-sudoku.net

Missing headers usually mean CDN, reverse-proxy, or framework config still needs a hardening pass.

All Issues

Detailed issue list

Showing all 6 issues

Missing HSTS headerSecurity · high

HSTS was not found in the response headers.

Fix: Add Strict-Transport-Security after confirming the full site works over HTTPS.

security.missing_hsts_header · Open fix guide

Missing Content-Security-Policy headerSecurity · high

Content-Security-Policy was not found in the response headers.

Fix: Add a CSP header at the CDN or server layer and test third-party scripts.

security.missing_csp_header · Open fix guide

Missing X-Frame-Options headerSecurity · medium

X-Frame-Options was not found in the response headers.

Fix: Add X-Frame-Options: SAMEORIGIN or use frame-ancestors in CSP.

security.missing_x_frame_options_header · Open fix guide

Missing X-Content-Type-Options headerSecurity · medium

X-Content-Type-Options was not found in the response headers.

Fix: Add X-Content-Type-Options: nosniff.

security.missing_x_content_type_options_header

Missing Referrer-Policy headerSecurity · low

Referrer-Policy was not found in the response headers.

Fix: Add Referrer-Policy: strict-origin-when-cross-origin.

security.missing_referrer_policy_header · Open fix guide

Missing Permissions-Policy headerSecurity · low

Permissions-Policy was not found in the response headers.

Fix: Restrict browser features that the site does not use.

security.missing_permissions_policy_header

How this scan was producedCoverage, optional runtime layers, cache, and detection evidence
Scan coverage

What this report used

Static fetch
Used · HTML, headers, metadata, robots.txt, and sitemap.xml
Rendered DOM
Disabled · Set ENABLE_PLAYWRIGHT=1 to enable rendered DOM scanning.
axe-core
Disabled · Set ENABLE_AXE=1 to enable axe-core accessibility audits.
Lighthouse
Disabled · Set ENABLE_LIGHTHOUSE=1 to enable Lighthouse CLI audits.

This was a fast static scan of the public HTML, headers, robots.txt, and sitemap. Deeper rendered-DOM, lab (Lighthouse), and axe-core checks are optional and off for this report — so any empty section below reflects that boundary, not a clean bill of health.

Runtime capability

Optional layers and cache

Deep scan mode
static-only · optional layers disabled
Playwright
Disabled
axe-core
Disabled
Lighthouse
Disabled
Repeat scan cache
Enabled · 10 min TTL · exact input URL
Detection Method

Multi-signal scan, not logo guessing.

Themerella uses a self-owned static scanner that combines HTML, resources, headers, metadata, CSS-class hints, robots.txt, and sitemap.xml. Enable Playwright to add rendered DOM, runtime globals, dynamic network responses, axe, and Lighthouse.

HTML
173KB · 15 external scripts · 3 JSON-LD blocks
Resource URLs
125 total · 14 scripts · 3 CSS · 39 images
Headers
16 headers · 2 identity hints · 0 security headers
CSS classes
398 class attributes · Tailwind-like 205 · Elementor 0
Playwright
Not used for this scan
axe-core
Not used for this scan
Lighthouse
Not used for this scan

Detection cautions

  • Many external resource hosts were detected. Third-party detections may reflect embedded widgets rather than owned platform choices.