Security checks — sorted by severity
Security Headers
None of the 5 recommended security headers are present (missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy). This exposes the application to clickjacking, MIME-sniffing, and other client-side attacks.
None of the 5 recommended security headers are present (missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy). This exposes the application to clickjacking, MIME-sniffing, and other client-side attacks.
MTA-STS & TLS Reporting
Issues: No MTA-STS configured — email in transit is vulnerable to TLS downgrade attacks. Sending servers cannot verify that your mail server requires TLS; No TLSRPT record — TLS delivery failures won't be reported to domain owner.
Issues: No MTA-STS configured — email in transit is vulnerable to TLS downgrade attacks. Sending servers cannot verify that your mail server requires TLS; No TLSRPT record — TLS delivery failures won't be reported to domain owner.
DNS Configuration
Strengths: 3 nameservers configured (ns0.wikimedia.org., ns1.wikimedia.org., ns2.wikimedia.org.); 2 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.
Strengths: 3 nameservers configured (ns0.wikimedia.org., ns1.wikimedia.org., ns2.wikimedia.org.); 2 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.
DMARC / Email Security
Strengths: DMARC policy set to reject (strongest); SPF record present with soft-fail (~all). Issues: No DKIM records found for common selectors (domain may use custom selectors — this is not a confirmed gap).
Strengths: DMARC policy set to reject (strongest); SPF record present with soft-fail (~all). Issues: No DKIM records found for common selectors (domain may use custom selectors — this is not a confirmed gap).
MX Records & Mail Provider
Strengths: Mail handled by mx-in2001.wikimedia.org; 2 MX record(s) configured; Multiple MX records provide redundancy; All MX records share the same priority (10) — round-robin load balancing (no primary/backup distinction).
Strengths: Mail handled by mx-in2001.wikimedia.org; 2 MX record(s) configured; Multiple MX records provide redundancy; All MX records share the same priority (10) — round-robin load balancing (no primary/backup distinction).
DNS CAA Records
Strengths: CAA records configured (4 record(s)); Authorized CAs: pki.goog, digicert.com, letsencrypt.org; Violation reporting (iodef) configured.
Strengths: CAA records configured (4 record(s)); Authorized CAs: pki.goog, digicert.com, letsencrypt.org; Violation reporting (iodef) configured.
TLS Configuration
TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
TLS Protocol Support
Strengths: TLS 1.3 supported; TLS 1.2 supported; TLS 1.3 supported (strongest). Protocol support: TLS 1.3: Yes, TLS 1.2: Yes, TLS 1.1: No, TLS 1.0: No.
Strengths: TLS 1.3 supported; TLS 1.2 supported; TLS 1.3 supported (strongest). Protocol support: TLS 1.3: Yes, TLS 1.2: Yes, TLS 1.1: No, TLS 1.0: No.
Cookie Security
Strengths: 1 cookie(s) analyzed; All cookies have Secure flag; All cookies have HttpOnly flag; All cookies have SameSite attribute.
Strengths: 1 cookie(s) analyzed; All cookies have Secure flag; All cookies have HttpOnly flag; All cookies have SameSite attribute.
HSTS Header
HSTS enabled: max-age=106384710s (1231 days) with includeSubDomains and preload. Meets best-practice configuration.
HSTS enabled: max-age=106384710s (1231 days) with includeSubDomains and preload. Meets best-practice configuration.
Known Breaches
No known breaches found in public disclosure databases.
No known breaches found in public disclosure databases.
security.txt (RFC 9116)
Strengths: security.txt found with 5 field(s); Contact: mailto:[email protected]; Expires in 1076 days (2029-03-31T09:00:00.000Z); Disclosure policy: https://www.mediawiki.org/wiki/Reporting_security_bugs; Preferred languages: en; Acknowledgments/hall-of-fame link included. Issues: Not PGP signed (recommended for authenticity).
Strengths: security.txt found with 5 field(s); Contact: mailto:[email protected]; Expires in 1076 days (2029-03-31T09:00:00.000Z); Disclosure policy: https://www.mediawiki.org/wiki/Reporting_security_bugs; Preferred languages: en; Acknowledgments/hall-of-fame link included. Issues: Not PGP signed (recommended for authenticity).
CVE Exposure
Detected technologies: ATS/9.2.13. No high or critical CVEs found for detected versions.
Detected technologies: ATS/9.2.13. No high or critical CVEs found for detected versions.
Certificate Hygiene
Strengths: Certificate valid, 78 days remaining; Issued by Let's Encrypt. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.
Strengths: Certificate valid, 78 days remaining; Issued by Let's Encrypt. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.
Recommended actions
1+ items
Steps to improve wikipedia.org's security grade, ranked by impact.
1
Add missing security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy)
5 of 5 recommended security headers are missing on wikipedia.org: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy. These headers protect against clickjacking, MIME-sniffing, and unauthorized browser feature access. Adding them is a server configuration change with no application code changes required.
PCI-DSS 4.0Req 6.4.1
Security headers are required application controls
OWASPSecure Headers
Recommended baseline for web applications
How to fix this
1
Add a Content-Security-Policy header. Safe starting value (works with Google Fonts and inline styles/scripts): default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; script-src 'self' 'unsafe-inline'; upgrade-insecure-requests. Test your site after adding it, then tighten over time by removing 'unsafe-inline'.
2
Add: X-Content-Type-Options: nosniff
3
Add: X-Frame-Options: SAMEORIGIN (use DENY only if you never embed your pages in iframes)
4
Add: Referrer-Policy: strict-origin-when-cross-origin
5
Add: Permissions-Policy: camera=(), microphone=(), geolocation=()
6
Verify with: curl -sI https://wikipedia.org | grep -iE 'content-security|x-frame|x-content|referrer|permissions'
See all 2 remaining recommendations
Enter your work email to unlock the full action plan.
No spam. We only send security-related updates.
Report unlocked.
AI Summary
What this means
wikipedia.org scored 80/100, demonstrating a strong security posture. Minor improvements are noted below.
Critical gaps in: Security Headers. Positive signals: MX Records & Mail Provider, DNS CAA Records, TLS Protocol Support all passed.
3 action items identified, including 0 critical. The issues are configuration gaps, not architectural problems. A focused remediation effort of 2–5 days could address all findings.
How wikipedia.org compares
Grade distribution across 2678 companies we've scanned. wikipedia.org scores better than 64% of them.
88
A+
28
A
194
A-
200
B+
75
B
376
B-
137
C+
117
C
347
C-
123
D+
96
D
265
D-
632
F
wikipedia.org — Grade B- (80/100)
2678 companies scanned
At a glance
Key data points from the scan.
TLS Version
TLSv1.3
TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
DMARC Policy
p=reject
Strengths: DMARC policy set to reject (strongest); SPF record present with soft-fail (~all). Issues: No DKIM records found for common selectors (domain may use custom selectors — this is not a confirmed gap).
SPF Record
Present
v=spf1 include:_cidrs.wikimedia.org ~all
Security Headers
0/5 present
Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
HSTS
Enabled
HSTS enabled: max-age=106384710s (1231 days) with includeSubDomains and preload. Meets best-practice configuration.
SSL Certificate
Valid
Strengths: Certificate valid, 78 days remaining; Issued by Let's Encrypt. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.
DNSSEC
Not enabled
Strengths: 3 nameservers configured (ns0.wikimedia.org., ns1.wikimedia.org., ns2.wikimedia.org.); 2 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.
Similar companies
Other domains with comparable security profiles.
