audit report

Mailchimp

warn

scanned 2026-04-16 23:36:58 utc permalink · /audit/mailchimp

Mailchimp loaded 7 third-party domain(s), of which 2 are privacy-sensitive. 2 warn finding(s): No HSTS header; No privacy policy found. Privacy-sensitive vendors observed: Google Tag Manager, Optimizely.

findings

warn
No HSTS header

The response did not include a Strict-Transport-Security header. Users on a compromised network could be downgraded to plaintext HTTP.
how we detected this →
warn
No privacy policy found

stackpeek could not discover a privacy policy for this page. This is unusual for anything serving real users.
how we detected this →

note

Google Tag Manager loaded (tag_manager)

Observed 4 time(s) on the page.


            inline: dataLayer = [{ 'entryId': '66SJ9gsMD48tKLRxFYda2s' }];
inline: window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} // Default ad_storage to '
inline: // Define dataLayer and the gtag function. window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(

how we detected this →

note

Optimizely loaded (ab_testing)

Observed 2 time(s) on the page.


            script src: https://cdn.optimizely.com/js/8896740779.js
link preconnect: https://cdn.optimizely.com

how we detected this →

note
No Content-Security-Policy header

A CSP header restricts what scripts the page can load. Its absence isn't a policy mismatch but is worth noting in a transparency report.
how we detected this →

third parties observed

vendor	domain	category	hits	disclosure
Google Tag Manager	googletagmanager.com	tag_manager	4	not named
Optimizely	optimizely.com	ab_testing	2	not named
Bugsnag	bugsnag.com	error_tracking	1	not named
Google	google.com	other	2	not named
cookielaw.org	cookielaw.org	other	3	not named
eep.io	eep.io	other	1	not named
intuit.com	intuit.com	other	7	not named

policy claims

No privacy policy could be located on this site.

response headers

hsts: no
csp: no
server: istio-envoy

run this yourself

Every audit on this site is reproducible. Install stackpeek and run the same check against https://mailchimp.com from your own machine — the tool is MIT-licensed and runs locally.

pip install stackpeek
stackpeek audit https://mailchimp.com

source on GitHub · methodology · cli docs

provenance

This audit was generated by running stackpeek against https://mailchimp.com from a public IP, using only HTTP GET and standard browser headers. The findings compare the observed HTML against the policy discovery results (no policy document was located) using the public methodology. Re-scans append new findings at new permalinks and never overwrite the historical record.