{
    "url": "https://www.wikipedia.org",
    "score": 6,
    "summary": {
        "missing": 11,
        "warnings": 0,
        "notices": 1
    },
    "caches": [
        "Website",
        "Browser"
    ],
    "headers": {
        "content-length": {
            "value": "126",
            "findings": [
                {
                    "severity": "info",
                    "message": "The size of the message body, in bytes."
                }
            ]
        },
        "content-type": {
            "value": "text/plain",
            "findings": [
                {
                    "severity": "info",
                    "message": "The type of the message body, specified as a <a href=\"https://en.wikipedia.org/wiki/Media_type\">MIME type</a>."
                }
            ]
        },
        "x-request-id": {
            "value": "b133fd0c-0716-4482-b1b5-84b87a51e330",
            "findings": [
                {
                    "severity": "info",
                    "message": "A unique identifier for the HTTP request. This can be useful for tracking a request through complex systems or for debugging purposes."
                }
            ]
        },
        "server": {
            "value": "haproxy",
            "findings": [
                {
                    "severity": "info",
                    "message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
                },
                {
                    "severity": "notice",
                    "message": "Consider removing or minimizing the <code>Server</code> header. Even without a version number, it reveals the server software, which aids reconnaissance."
                }
            ]
        },
        "x-cache": {
            "value": "cp1114 int",
            "findings": [
                {
                    "severity": "info",
                    "message": "Indicates whether the page was served from a cache. Common values: <code>HIT</code> (served from cache), <code>MISS</code> (fetched from origin)."
                }
            ]
        },
        "x-cache-status": {
            "value": "int-tls",
            "findings": [
                {
                    "severity": "info",
                    "message": "Indicates how the caching system processed this request."
                }
            ]
        },
        "x-analytics": {
            "value": "",
            "findings": [
                {
                    "severity": "info",
                    "message": "A custom header used to pass analytics metadata, often seen on Wikimedia sites."
                }
            ]
        }
    },
    "missing": {
        "strict-transport-security": {
            "message": "Add a <code>Strict-Transport-Security</code> header. The <code>Strict-Transport-Security</code> header or <i>HSTS</i> header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication."
        },
        "content-security-policy": {
            "message": "Add a <code>Content-Security-Policy</code> header. The <code>Content-Security-Policy</code> header helps browsers prevent cross site scripting (XSS) and data injection attacks."
        },
        "referrer-policy": {
            "message": "Add a <code>Referrer-Policy</code> header. When a visitor navigates from one page to another, browsers often pass along <em>referrer information</em>. The <code>Referrer-Policy</code> header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the <i>path</i> or <i>query string</i> and passed onto an external destination."
        },
        "permissions-policy": {
            "message": "Add a <code>Permissions-Policy</code> header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
        },
        "cross-origin-embedder-policy": {
            "message": "Add a <code>Cross-Origin-Embedder-Policy</code> header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with <code>Cross-Origin-Opener-Policy</code>, it enables cross-origin isolation and access to <code>SharedArrayBuffer</code>."
        },
        "cross-origin-opener-policy": {
            "message": "Add a <code>Cross-Origin-Opener-Policy</code> header. It prevents other sites from retaining a <code>window</code> reference to this page when opened via <code>window.open()</code> or navigation, blocking script-based attacks through shared browsing contexts."
        },
        "cross-origin-resource-policy": {
            "message": "Add a <code>Cross-Origin-Resource-Policy</code> header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
        },
        "x-frame-options": {
            "message": "Add a <code>X-Frame-Options</code> header. The <code>X-Frame-Options</code> header prevents this URL from being embedded in an <code>iframe</code>. This protects against clickjacking attacks. Alternatively, set a <code>Content-Security-Policy</code> header with a <code>frame-ancestors</code> directive."
        },
        "x-content-type-options": {
            "message": "Add an <code>X-Content-Type-Options: nosniff</code> header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities."
        },
        "x-permitted-cross-domain-policies": {
            "message": "Add a <code>X-Permitted-Cross-Domain-Policies</code> header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
        },
        "content-encoding": {
            "message": "No <code>Content-Encoding</code> header found. Enable compression such as <code>gzip</code> or <code>br</code> (Brotli) to reduce transfer sizes. Brotli typically achieves 15–20% better compression than gzip and is supported by all modern browsers."
        }
    }
}