wikipedia.org website health report
Website health report
wikipedia.org scores 92/100
Excellent — only minor polish left. We found 14 issues; the weakest area is Security (86/100).
- 4 Medium
- 10 Low
- 31 Passed
Free expert review
Send this report to SuperSiteBros. An expert will look it over and email you with the highest-impact fixes — no obligation.
Free weekly monitoring
Weekly monitoring is built and ready, but outbound email from this server is not reliable yet (no SPF/DKIM/DMARC and no SMTP). Sign-ups stay closed until that is fixed — use the free expert review above in the meantime.
Matched SuperSiteBros services
Score history
Previous scans (2)
| Date (UTC) | Score | Grade | Security | Performance | SEO | Accessibility | Best practices |
|---|---|---|---|---|---|---|---|
| Oct 27, 2026 18:01 | 92 | A | 86 | 93 | 93 | 93 | 100 |
| Oct 27, 2026 17:34 | 92 | A | 86 | 98 | 88 | 91 | 100 |
Lighthouse speed test (mobile)
- Largest Contentful Paint
- 1.5 s
- Cumulative Layout Shift
- 0
- Total Blocking Time
- 280 ms
- First Contentful Paint
- 1.0 s
- Speed Index
- 1.4 s
Top opportunities
- Properly size images~0.1 s
Site crawl
- Pages crawled
- 1
- Broken links
- 0
- Redirect chains
- 0
- Missing titles
- 0
- Duplicate titles
- 0
- Missing descriptions
- 0
- Missing H1
- 0
- Thin pages
- 0
- Noindex pages
- 0
- Mixed content pages
- 0
Pages checked
| Page | Status | Title | Words | Issues |
|---|---|---|---|---|
| / | 200 | Wikipedia | 1298 | — |
Issues to fix on wikipedia.org
MediumForm fields without labelsAccessibility
1 of 12 form fields have no label.
Why it matters
Without a label, screen-reader users don’t know what to type, and placeholder text disappears as soon as people start typing.
How to fix it
Give every input a <label for="…">, or an aria-label if a visible label is impossible.
MediumHeavy JavaScript blocks the page (TBT)Performance
Total Blocking Time was 280 ms (good is 200 ms or less); long tasks like this usually mean slow interactions (INP).
Why it matters
Total Blocking Time adds up the long tasks that stop the browser responding to taps and clicks. It is the lab stand-in for Interaction to Next Paint (INP).
How to fix it
Remove unused scripts and third-party tags, defer non-critical JavaScript, and split large bundles.
MediumNo clickjacking protectionSecurity
Neither X-Frame-Options nor CSP frame-ancestors is set.
Why it matters
Without frame-ancestors (or X-Frame-Options), another site can load yours invisibly inside a frame and trick visitors into clicking buttons they can’t see.
How to fix it
Send `Content-Security-Policy: frame-ancestors 'self'` (modern) and/or `X-Frame-Options: SAMEORIGIN` (legacy browsers).
MediumNo XML sitemap foundSEO
Checked robots.txt, /sitemap.xml, /sitemap_index.xml and /wp-sitemap.xml.
Why it matters
A sitemap lists the pages you want indexed and when they changed, helping search engines find new and deep pages faster.
How to fix it
Generate an XML sitemap, reference it in robots.txt and submit it in Google Search Console and Bing Webmaster Tools.
LowButtons without readable namesAccessibility
1 button(s) have no accessible name.
Why it matters
Icon-only buttons with no label are announced as just “button”.
How to fix it
Add text, aria-label or a visually-hidden label to every button.
LowImages not in modern formatsPerformance
7 of 7 images are JPEG/PNG/GIF without a WebP/AVIF alternative.
Why it matters
WebP and AVIF are typically 25–50% smaller than JPEG/PNG at the same quality and are supported by all current browsers.
How to fix it
Serve WebP/AVIF (with <picture> fallbacks if you need them) or let an image CDN negotiate the format.
LowNo Content-Security-PolicySecurity
No Content-Security-Policy header.
Why it matters
A CSP limits which scripts, frames and other resources the browser will run, which makes cross-site scripting (XSS) and injected code far less damaging.
How to fix it
Start with a report-only policy, then enforce. A practical baseline: `default-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests`, adding the third-party hosts you actually use. Prefer nonces or hashes over 'unsafe-inline'.
LowX-Content-Type-Options missingSecurity
X-Content-Type-Options: nosniff is not set.
Why it matters
Without `nosniff`, some browsers guess a file’s type from its contents, which can turn an uploaded “image” into executable script.
How to fix it
Send `X-Content-Type-Options: nosniff` on all responses.
LowNo Referrer-PolicySecurity
No Referrer-Policy header.
Why it matters
Browsers default to a reasonable policy today, but setting one explicitly guarantees full URLs (which can contain tokens or search terms) aren’t leaked to other sites.
How to fix it
Send `Referrer-Policy: strict-origin-when-cross-origin`.
LowNo Permissions-PolicySecurity
No Permissions-Policy header.
Why it matters
Permissions-Policy switches off powerful browser features (camera, microphone, geolocation, payment…) that your site doesn’t use, so injected or third-party code can’t use them either.
How to fix it
Send e.g. `Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()`, allowing only what you need.
LowCookies without Secure / HttpOnly / SameSiteSecurity
4 cookie(s) set on the homepage lack security flags.
Why it matters
Cookies missing these flags can be sent over plain HTTP, read by injected JavaScript, or sent along with cross-site requests (CSRF).
How to fix it
Set `Secure` and `SameSite=Lax` (or Strict) on all cookies, and `HttpOnly` on any cookie JavaScript doesn’t need to read.
Details
- WMF-Last-Access (missing SameSite)
- WMF-Last-Access-Global (missing SameSite)
- GeoIP (missing SameSite, HttpOnly)
- NetworkProbeLimit (missing HttpOnly)
LowTitle is very shortSEO
“Wikipedia” is 9 characters.
Why it matters
A very short title wastes space in search results that could explain what the page offers.
How to fix it
Expand it to roughly 30–60 characters: main topic first, brand last.
LowNo canonical URLSEO
No canonical link tag found.
Why it matters
Without a canonical tag, URL variations (tracking parameters, trailing slashes, http/https) can be indexed as duplicates and split ranking signals.
How to fix it
Add `<link rel="canonical" href="…">` with the preferred absolute URL.
LowNo structured dataSEO
No JSON-LD or microdata found.
Why it matters
Structured data (schema.org JSON-LD) helps search engines understand your organisation, articles, products or FAQs and can unlock rich results.
How to fix it
Add JSON-LD for your organisation/website, plus the type that fits each page (Article, Product, LocalBusiness…). Check it with Google’s Rich Results Test.
InfoBrotli compression not offeredPerformance
The server answered a Brotli-capable request with gzip.
Why it matters
Gzip is fine, but Brotli typically makes text files another 15–20% smaller and is supported by every modern browser.
How to fix it
Enable Brotli on the server (nginx brotli module, Apache mod_brotli) or let your CDN handle it.
No issues match these filters.
Passed checks (31)
- Valid SSL certificate — Trusted certificate for www.wikipedia.org, valid until 2027-01-02 (67 days left), issued by Let's Encrypt.
- HTTP redirects to HTTPS — http://www.wikipedia.org/ → https://www.wikipedia.org/ (301).
- HSTS enabled — Strict-Transport-Security: max-age=106384710; includeSubDomains; preload
- HSTS preload-ready header — max-age ≥ 1 year with includeSubDomains and preload.
- No mixed content — Every resource referenced in the HTML uses https://.
- Fast server response — Time to first byte 0.13s.
- Text compression enabled — Content-Encoding: gzip
- HTTP/2 supported — Served over HTTP/2.
- Lean HTML — The HTML document is 119.6 KB.
- Few render-blocking resources — 0 blocking script(s), 0 stylesheet(s).
- Off-screen images are lazy-loaded
- Static files are cacheable — 2 sampled CSS/JS files have long cache lifetimes.
- Page loads successfully — HTTP 200 after 1 redirect(s).
- Page is indexable — No noindex directive in meta robots or X-Robots-Tag.
- Good meta description — 130 characters.
- One clear H1 — “Wikipedia The Free Encyclopedia”
- Mobile viewport set — initial-scale=1,user-scalable=yes
- Open Graph tags present — og:title, og:description and og:image are set.
- robots.txt allows crawling — 34 rule group(s).
- Missing pages return 404 — A made-up URL returned 404.
- One preferred hostname — wikipedia.org redirects (301) to the preferred version.
- Page language declared — lang="en"
- All images have alt attributes — 7 images checked.
- Logical heading structure — 8 headings in order.
- Standards-mode HTML5 document — Doctype and charset are declared.
- security.txt published — /.well-known/security.txt has a Contact field.
- SPF record present — v=spf1 include:_cidrs.wikimedia.org ~all
- DMARC policy enforced — v=DMARC1; p=reject; rua=mailto:dmarc-rua@wikimedia.org;
- CAA records restrict certificate issuance — iodef mailto:dns-admin@wikimedia.org; issue letsencrypt.org; issue pki.goog
- Reachable over IPv6 — www.wikipedia.org has an AAAA record.
- No broken links found — Checked 1 page(s) and 20 linked URL(s).
Site facts
- Final URL
- https://www.wikipedia.org/
- HTTP status
- 200
- Server response (TTFB)
- 132 ms
- Protocol
- HTTP/2
- Compression
- gzip
- HTML size
- 119.6 KB
- DOM elements
- 1195
- Words on page
- 1298
- Certificate
- Valid, 67 days left (Let's Encrypt)
- Email DNS
- SPF ✓ · DMARC ✓ · CAA ✓ · IPv6 ✓
- Server
- mw-web.codfw.main-6d6b8b4f9b-l9kcf
Want these fixed for you?
SuperSiteBros care plans take care of security hardening, speed, updates and monitoring so your grade stays high.
See care plans