Website check
wikipedia.org
In plain English
Overall, this passive check gives wikipedia.org a B (78/100). The findings are mostly missing security headers and cookie settings, with one medium-severity gap: the site has no Content Security Policy, which is the main tool for limiting which scripts can run on a page. The most important fix is to add a Content Security Policy first, then the smaller header and cookie settings. Visitors do not need to be alarmed by this result; it describes hardening that could be improved, not an active break-in or known compromise.
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
Cookies without a SameSite setting
Without SameSite, some browsers send these cookies along with requests started by other sites, which helps cross-site request forgery.
How to fix: Add SameSite=Lax (or Strict) to cookies. Use SameSite=None only together with Secure, and only when truly needed.
Cookies: WMF-Last-Access, WMF-Last-Access-Global, GeoIP
Page can be framed by other sites
Another site could load this page in a hidden frame and trick visitors into clicking things (clickjacking).
How to fix: Send X-Frame-Options: DENY (or SAMEORIGIN), or add a frame-ancestors rule to the Content Security Policy.
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
Server software version is visible
The Server header shows the exact software version, which helps attackers match the site to known flaws.
How to fix: Hide the version, for example server_tokens off in nginx or ServerTokens Prod in Apache.
Server: ATS/9.2.15
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up wikipedia.org and connecting over HTTPS
- 03Connected over HTTPS: www.wikipedia.org answered 200 after 1 redirect
- 04Certificate from Let's Encrypt, valid 72 more days (TLSv1.3)
- 05Read the security headers: HSTS set; missing CSP, X-Frame-Options, nosniff, Referrer-Policy
- 06Checked 5 cookies for Secure, HttpOnly and SameSite
- 07No PHP version given away
- 08Found 0 script sources from other sites
- 09Plain http:// redirects to HTTPS
- 10Old TLS 1.0/1.1: refused
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 78/100, grade B. Writing it up in plain English
Technical details (25)
- ip
- 198.35.26.224
- caa
- 0 issue "letsencrypt.org", 0 issue "pki.goog", 0 iodef "mailto:dns-admin@wikimedia.org"
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- Let's Encrypt
- tls subject
- *.wikipedia.org
- tls validTo
- 2027-01-02T18:34:50.000Z
- tls daysLeft
- 72
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:_cidrs.wikimedia.org ~all
- email apex
- wikipedia.org
- email dmarc
- v=DMARC1; p=reject; rua=mailto:dmarc-rua@wikimedia.org;
- status
- 200
- cookies
- WMF-Last-Access, WMF-Last-Access-Global, GeoIP, NetworkProbeLimit, WMF-Uniq
- headers server
- ATS/9.2.15
- headers strict-transport-security
- max-age=106384710; includeSubDomains; preload
- finalUrl
- https://www.wikipedia.org/
- requests
- 5
- timingMs
- 357
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.