Hivex tools · WebsiteFree · No account

Security headers of en.wikipedia.org/wiki/Main_Page.

A grade for a site's security headers, every point explained, and the line to add for each one that is missing or weak.

Trygithub.com hivex.si example.com

D

Security headers · 47 of 100

https://en.wikipedia.org/wiki/Main_Page

Hivex's own weighting of OWASP's recommendations; every point is explained below.

https://en.wikipedia.org/wiki/Main_Page

Checked 10:07:34 UTC · Fetched from Hivex's servers

Problem: Content-Security-Policy: Set, but 'unsafe-inline' lets inline scripts run, which defeats most of the policy; 'unsafe-eval' allows eval(); no base-uri, so an injected <base> tag could redirect relative links.
Problem: Framing (X-Frame-Options or frame-ancestors): Any site can embed the page in a frame and trick clicks on it.
Check: server name the software or version behind the site; removing them costs nothing.
Check: 5 cookies lack protective flags (see below).

Header by header

What it sends, and what to send

Strict-Transport-Security
Good · 25/25
max-age=106384710; includeSubDomains; preload
Set for at least a year, subdomains included. It is on the browsers' HSTS preload list.
Content-Security-Policy
Missing · 10/25
- script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org mediawiki.org wikimedia.org *.wmflabs.org *.wmcloud.org *.toolforge.org wss://*.toolforge.org *.jsdelivr.net unpkg.com cdnjs.cloudflare.com raw.githubusercontent.com *.github.com code.jquery.com cdn.mathjax.org use.typekit.net fonts.cdnfonts.com use.fontawesome.com i.ytimg.com rsms.me doi.org localhost https://localhost:* http://localhost:* wss://localhost:* ws://localhost:* *.google.com *.gstatic.com *.googleapis.com *.translate.yandex.net yastatic.net ya.ru radically.github.io cdn.sammdot.ca cdn.fontshare.com viaf.org publicai-proxy.alaexis.workers.dev iiif.archive.org api.flickr.com live.staticflickr.com api.anthropic.com api.openai.com api.publicai.co catalogo.pusc.it parsifal.urbe.it opac.sbn.it overpass-api.de api.openrouteservice.org archive.org *.openstreetmap.org *.waymarkedtrails.org *.thunderforest.com registry.ipe.wiki analytics.ipe.wiki qlever.dev app.goacoustic.com wikipedia-archive.ourworldindata.org api.inaturalist.org inaturalist-open-data.s3.amazonaws.com validator.w3.org db.onlinewebfonts.com fontlibrary.org 'unsafe-inline' auth.wikimedia.org

6 cookies set

Names and flags only, never values

Cookie	Secure	HttpOnly	SameSite
WMF-Last-Accessno SameSite: browsers fall back to Lax.	Yes	Yes	None set
WMF-Last-Access-Globalno SameSite: browsers fall back to Lax.	Yes	Yes	None set
WMF-DPno SameSite: browsers fall back to Lax.	Yes	Yes	None set
GeoIPno HttpOnly: page scripts can read it; no SameSite: browsers fall back to Lax.

Headers that give the software away

OWASP lists these for removal

servermw-web.eqiad.main-dccb7c848-jlg2r

Looking up…

Hivex index

Short names, still free to register.

Starting something new? Explore short, brandable .si names with confirmed or likely-free status, then check live before registering.

Browse free names

What each header protects.

Strict-Transport-Security: browsers only use HTTPS for the site, so a network attacker cannot downgrade it. A year or more, with includeSubDomains.
Content-Security-Policy: where scripts, styles and frames may come from. The strongest single defence against injected scripts, if it avoids 'unsafe-inline'.
X-Frame-Options or frame-ancestors: stops other sites from framing the page to trick clicks.
X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy: smaller holes closed.

Cookies.

A session cookie should carry Secure (HTTPS only), HttpOnly (out of reach of page scripts) and SameSite (not sent on most cross-site requests). The prefix __Host- pins a cookie to one host. Hivex reads only each cookie's name and flags, never its value.

Adding the headers.

They are set by the web server, the hosting platform or a CDN in front of it. Add one at a time and test, starting with nosniff and HSTS. Build the Content Security Policy in report-only mode first (Content-Security-Policy-Report-Only), watch what it would block, then switch it on.

Questions people ask.

Which security headers should every website send?

Strict-Transport-Security, a Content-Security-Policy, X-Content-Type-Options: nosniff, a framing rule (X-Frame-Options or frame-ancestors) and a Referrer-Policy; Permissions-Policy and Cross-Origin-Opener-Policy add more.

How is the grade worked out?

Each check earns points (HSTS and the Content Security Policy count most), headers that reveal the software cost a few, and the total maps to a letter. It is Hivex's own weighting of OWASP's recommendations; every point is shown.

What is HSTS preload?

A list built into browsers of sites that are only ever opened over HTTPS, even on the first visit. A site joins at hstspreload.org once its HSTS header has max-age of a year or more, includeSubDomains and preload.

Why is 'unsafe-inline' a problem in a Content Security Policy?

It lets any inline script run, so an attacker who injects a script tag gets it executed and the policy stops almost nothing. Use nonces or hashes for the inline scripts you need.

Should I still send X-XSS-Protection?

No. Current browsers removed the filter it controlled. Set it to 0 or leave it out, and rely on a Content Security Policy.

From code, or an AI assistant.

Hivex's free JSON API and MCP server check domains, DNS and registration records from your own code or from AI assistants that speak MCP. No key needed.

The API guide The MCP server OpenAPI schema

More Website tools

All free tools

Sources

By Hivex. Updated 10 October 2026. Addresses are fetched live from Hivex's servers; page contents are never read or stored.