Skip to content Hivex tools · Website Free · No account
Hivex / Tools / HTTP header checker / https://en.wikipedia.org/ Headers of en.wikipedia.org. Every response header a web address sends, with the security headers checked and explained.
Hivex index
Short names, still free to register.
Starting something new? Explore short, brandable .si names with confirmed or likely-free status, then check live before registering.
Browse free names What response headers are. Before any page content, a server sends headers: the status, the content type, how long browsers may cache the page, and rules the browser must follow. They are invisible on the page but decide a lot about speed and safety.
The security headers. Strict-Transport-Security (HSTS): browsers use https:// only, even when someone types http://.Content-Security-Policy: where scripts, styles and frames may come from, which stops most injected scripts.X-Content-Type-Options: nosniff: browsers trust the declared file type instead of guessing.X-Frame-Options or CSP frame-ancestors: who may show the page inside a frame, against clickjacking.Referrer-Policy and Permissions-Policy: what the page shares with other sites, and which device features embedded content may ask for.Where to set them. Headers are set by the server, the hosting platform or a CDN in front of it: a config file, a dashboard rule, or the framework's settings. Add them one at a time and check the site after each, starting with nosniff and HSTS, which rarely break anything.
Questions people ask. What are HTTP response headers? Information a server sends before a page: the status, the content type, caching rules, and security rules the browser must follow.
Which security headers should a website send? Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, a framing rule (X-Frame-Options or frame-ancestors), Referrer-Policy and Permissions-Policy.
How do I check the headers of a website? Type the address. The checker follows any redirects and shows every header of the final page, with the security headers checked.
How do I add security headers? In your server, hosting platform or CDN settings. Add them one at a time and test the site after each.
From code, or an AI assistant. More Website tools Redirect checker Every hop of a URL, and all four forms of the address. Security headers checker A grade for HSTS, CSP, framing and cookies, with fixes. SSL checker Trust, expiry, the chain and TLS versions of any site. Open Graph checker How a link looks when shared, with the tags checked. Is it down? Down for everyone or just you, and where it fails. robots.txt tester Google, Bing and AI crawlers: allowed or blocked, and why. Sitemap checker Limits, dates and hosts checked, a sample requested live. Who hosts this website Web host, CDN, DNS host, mail provider and registrar. Tech stack checker CMS, framework, hosting and trackers of any site. Domain checker Is a name free to register? Checked live on any extension. All free tools Partners
Domains worth owning.
Checked live · No account needed · Premium sales with AtomPay protection
© 2026 hivex.si. Availability changes all the time, so confirm at the registrar before you pay. Not affiliated with ARNES or register.si. Some domain and product links earn Hivex a commission, at no extra cost to you.
https://en.wikipedia.org/wiki/Main_Page
Checked 08:29:01 UTC · Fetched from Hivex's servers
Status 200 OK
Server mw-web.eqiad.main-dccb7c848-jlg2r
Security headers 3 of 6
Content type text/html Check: No Permissions-Policy. Embedded content may ask for the camera, microphone or location.Check: Framing is not restricted: any site can embed this page in a frame, which clickjacking relies on.Note: Followed one redirect to https://en.wikipedia.org/wiki/Main_Page; these are its headers.Note: No Referrer-Policy. The browser default applies (usually strict-origin-when-cross-origin), which is acceptable.Good: HSTS is set.Good: Content Security Policy is set.Good: X-Content-Type-Options is set.Response headers of https://en.wikipedia.org/wiki/Main_Page Header Value accept-ch accept-ranges bytes age 6686 cache-control
How it got there 01 301 Moved Permanently https://en.wikipedia.org/ → https://en.wikipedia.org/wiki/Main_Page 78 ms 02 200 OK https://en.wikipedia.org/wiki/Main_Page 72 ms private, s-maxage=0, max-age=0, must-revalidate, no-transform
content-security-policy script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikisource.org *.mediawiki.org wikimedia.org *.unpkg.com cdnjs.cloudflare.com raw.githubusercontent.com
content-type text/html; charset=UTF-8
date Mon, 26 Oct 2026 06:37:35 GMT
last-modified Mon, 26 Oct 2026 06:37:33 GMT
nel { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.
report-to { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.
reporting-endpoints csp-report-to-endpoint='/w/api.
server mw-web.
server-timing cache;
strict-transport-security max-age=106384710; includeSubDomains; preload
vary Accept-Encoding,
x-cache cp1100 miss, cp1100 hit/8870
x-client-ip 2a09:bac5:aa74:28dc::412:33
x-content-type-options nosniff
x-request-id 6e8c47ba-b5c7-4b22-b13c-ac46219baf85
*.
code.jquery.com
cdn.mathjax.org
use.typekit.net
fonts.cdnfonts.com
use.fontawesome.com
i.ytimg.com
rsms.me
doi.org
localhost
https://localhost:*
http://localhost:*
wss://localhost:*
ws://localhost:*
*.
*.
*.
*.
yastatic.net
ya.ru
radically.github.io
cdn.sammdot.ca
cdn.fontshare.com
viaf.org
publicai-proxy.
iiif.archive.org
api.flickr.com
live.staticflickr.com
api.anthropic.com
api.openai.com
api.publicai.co
catalogo.pusc.it
parsifal.urbe.it
opac.sbn.it
overpass-api.de
api.openrouteservice.org
archive.org
*.
*.
*.
registry.ipe.wiki
analytics.ipe.wiki
qlever.dev
app.goacoustic.com
wikipedia-archive.
api.inaturalist.org
inaturalist-open-data.
validator.w3.org
db.onlinewebfonts.com
fontlibrary.org
'unsafe-inline'
auth.wikimedia.org;
default-src
'self'
data:
blob:
upload.wikimedia.org
thumb.wikimedia.org
https://commons.
meta.wikimedia.org
*.
*.
*.
*.
*.
*.
*.
wikisource.org
*.
*.
*.
*.
*.
mediawiki.org
wikimedia.org
*.
*.
*.
wss://*.
*.
unpkg.com
cdnjs.cloudflare.com
raw.githubusercontent.com
*.
code.jquery.com
cdn.mathjax.org
use.typekit.net
fonts.cdnfonts.com
use.fontawesome.com
i.ytimg.com
rsms.me
doi.org
localhost
https://localhost:*
http://localhost:*
wss://localhost:*
ws://localhost:*
*.
*.
*.
*.
yastatic.net
ya.ru
radically.github.io
cdn.sammdot.ca
cdn.fontshare.com
viaf.org
publicai-proxy.
iiif.archive.org
api.flickr.com
live.staticflickr.com
api.anthropic.com
api.openai.com
api.publicai.co
catalogo.pusc.it
parsifal.urbe.it
opac.sbn.it
overpass-api.de
api.openrouteservice.org
archive.org
*.
*.
*.
registry.ipe.wiki
analytics.ipe.wiki
qlever.dev
app.goacoustic.com
wikipedia-archive.
api.inaturalist.org
inaturalist-open-data.
validator.w3.org
db.onlinewebfonts.com
fontlibrary.org
en.wikibooks.org
en.wikinews.org
en.wikiquote.org
en.wikisource.org
en.wikiversity.org
en.wikivoyage.org
en.wiktionary.org
www.mediawiki.org
commons.wikimedia.org
foundation.wikimedia.org
incubator.wikimedia.org
species.wikimedia.org
wikimania.wikimedia.org
www.wikidata.org
www.wikifunctions.org
auth.wikimedia.org;
style-src
'self'
data:
blob:
upload.wikimedia.org
thumb.wikimedia.org
https://commons.
meta.wikimedia.org
*.
*.
*.
*.
*.
*.
*.
wikisource.org
*.
*.
*.
*.
*.
mediawiki.org
wikimedia.org
*.
*.
*.
wss://*.
*.
unpkg.com
cdnjs.cloudflare.com
raw.githubusercontent.com
*.
code.jquery.com
cdn.mathjax.org
use.typekit.net
fonts.cdnfonts.com
use.fontawesome.com
i.ytimg.com
rsms.me
doi.org
localhost
https://localhost:*
http://localhost:*
wss://localhost:*
ws://localhost:*
*.
*.
*.
*.
yastatic.net
ya.ru
radically.github.io
cdn.sammdot.ca
cdn.fontshare.com
viaf.org
publicai-proxy.
iiif.archive.org
api.flickr.com
live.staticflickr.com
api.anthropic.com
api.openai.com
api.publicai.co
catalogo.pusc.it
parsifal.urbe.it
opac.sbn.it
overpass-api.de
api.openrouteservice.org
archive.org
*.
*.
*.
registry.ipe.wiki
analytics.ipe.wiki
qlever.dev
app.goacoustic.com
wikipedia-archive.
api.inaturalist.org
inaturalist-open-data.
validator.w3.org
db.onlinewebfonts.com
fontlibrary.org
'unsafe-inline';
object-src
'none';
report-uri
/w/api.
report-to
csp-report-to-endpoint