'humble' (HTTP Headers Analyzer)
https://github.com/rfc-st/humble | v.2025-07-11


[0. Info]
Date : 2025/07/11 - 17:49:20 URL : https://en.wikipedia.org
File : humble_https_en.wikipedia.org_20250711_174921_en.html [1. Enabled HTTP Security Headers]
Cache-Control: private, s-maxage=0, max-age=0, must-revalidate, no-transform
Content-Type: text/html; charset=UTF-8
(*) Nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
Report-To: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
Server-Timing: cache;desc="hit-front", host;desc="cp6012"
Set-Cookie: WMF-DP=17a;Path=/;HttpOnly;secure;Expires=Sat, 12 Jul 2025 00:00:00 GMT, WMF-Uniq=GGE7vxZEYV8DIOJYUebFqwItAAEBAFvdMnaNq-fvvxIHpL89kwuxcH7TaVY6KG9P;Domain=.wikipedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sat, 11 Jul 2026 00:00:00 GMT
Strict-Transport-Security: max-age=106384710; includeSubDomains; preload
X-Content-Type-Options: nosniff
[2. Missing HTTP Security Headers]
Clear-Site-Data Clears browsing data (cookies, storage, cache) associated with the requesting website. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data
Cross-Origin-Embedder-Policy Prevents documents and workers from loading non-same-origin requests unless allowed. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Cross-Origin-Opener-Policy Prevent other websites from gaining arbitrary window references to a page. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy
Cross-Origin-Resource-Policy Protect servers against certain cross-origin or cross-site embedding of the returned source. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)
Content-Security-Policy Detect and mitigate Cross Site Scripting (XSS) and data injection attacks, among others. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
(*) Permissions-Policy Previously called "Feature-Policy", allow and deny the use of browser features. Ref: https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/
Referrer-Policy Controls how much referrer information should be included with requests. Ref: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
X-Permitted-Cross-Domain-Policies Limit which data external resources (e.g. Adobe Flash/PDF documents), can access on the domain. Ref: https://owasp.org/www-project-secure-headers/#div-headers
X-Frame-Options Prevents clickjacking attacks, limiting sources of embedded content. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
[3. Fingerprint HTTP Response Headers]
These headers can expose IPs, hostnames, software or their versions: Server (Generic HTTP Server/Content Delivery Network) Value: 'mw-web.eqiad.main-74fdfd557b-2wn9z' [4. Deprecated HTTP Response Headers/Protocols and Insecure Values]
The following headers/protocols are deprecated or their values may be considered unsafe: Cache-Control (Recommended Values) Enable 'no-cache' and 'no-store' if there are sensitive data in the URL analyzed. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
Report-To (Deprecated Header) This header is deprecated. Use instead "Reporting-Endpoints". Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Report-To
Server-Timing (Potentially Unsafe Header) This header should not expose sensitive application or infrastructure information. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server-Timing
Vary (Potentially Unsafe Header) The values of this header may expose others, facilitating attacks if user input is accepted. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary
Ref: https://www.yeswehack.com/fr/learn-bug-bounty/http-header-exploitation
[5. Empty HTTP Response Headers Values]
Empty HTTP headers (and are therefore considered disabled): Accept-Ch [6. Browser Compatibility for Enabled HTTP Security Headers]
Cache-Control: https://caniuse.com/?search=Cache-Control
Content-Type: https://caniuse.com/?search=Content-Type
NEL: https://caniuse.com/?search=NEL
Report-To: https://caniuse.com/?search=Report-To
Server-Timing: https://caniuse.com/?search=Server-Timing
Set-Cookie: https://caniuse.com/?search=Set-Cookie
Strict-Transport-Security: https://caniuse.com/?search=Strict-Transport-Security
Vary: https://caniuse.com/?search=Vary
X-Content-Type-Options: https://caniuse.com/?search=X-Content-Type-Options
[7. Analysis Results]
Done in 0.24 seconds! (changes with respect to the last analysis in parentheses) Enabled headers: 8 (First Analysis) Missing headers: 9 (First Analysis) Fingerprint headers: 1 (First Analysis) Deprecated/Insecure headers: 4 (First Analysis) Empty headers: 1 (First Analysis) Findings to review: 15 (First Analysis) Analysis Grade: D (Review 'Deprecated/Insecure headers') '(*)' meaning: Experimental HTTP response directive or header '(*)' ref: https://mdn.io/Experimental_deprecated_obsolete