Site

Security headers 20% · CSP deep-dive 10% · Cookie security 5% · AI readiness 5% · PWA installability 5% · Privacy & trackers 5% · Email security 10% · DNS posture 10% · SEO & meta 10% · Performance 10% · Accessibility 10%. Link health is scanned separately — its live probes are too request-hungry for the composite.

Fix these first

21 to fix · 25 to review, across all eleven layers — most important first.

Fix

Content-Security-Policy Security headers →

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'none'
Fix

X-Content-Type-Options Security headers →

X-Content-Type-Options: nosniff
Fix

Clickjacking protection Security headers →

Content-Security-Policy: frame-ancestors 'none' (or X-Frame-Options: DENY)
Fix

Referrer-Policy Security headers →

Referrer-Policy: strict-origin-when-cross-origin
Fix

Cookie security Security headers →

Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
Fix

Policy present and enforced CSP deep-dive →

Start with: Content-Security-Policy: default-src 'self'; then loosen per resource type. See /reference.
Build a hardened Content-Security-Policy in Canopy's CSP builder →
Fix

Inline scripts blocked CSP deep-dive →

Replace 'unsafe-inline' with per-response nonces or sha256 hashes; add 'strict-dynamic' for modern browsers.
Fix

Script sources restricted CSP deep-dive →

Add script-src 'self' (plus any CDNs you use), or at minimum a default-src fallback.
Fix

eval() blocked CSP deep-dive →

Remove 'unsafe-eval'; most libraries that need it offer CSP-safe builds.
Fix

No scheme-wide script sources CSP deep-dive →

Pin script-src to the specific origins you actually load from.
Fix

Text compression Performance →

Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
Fix

Plugin content disabled (object-src) CSP deep-dive →

Add object-src 'none' — nothing modern needs plugin content.

+ 34 more in the layer reports below.

Share it: save a snapshot — a permanent link, and Canopy re-runs all eleven layers nightly from then on.

Embed this badge

Markdown

[![Canopy site grade](https://canopystack.dev/badge?domain=wikipedia.org&type=site)](https://canopystack.dev/site?domain=wikipedia.org)

📋 Export as Markdown

Paste into a PR, issue, Slack, or client report — or download .md

## Canopy site report — wikipedia.org

**Grade C** · 64/100

| Layer | Grade | Score | Fails | Warns |
|---|---|---|---|---|
| security headers | D | 48/100 | 5 | 2 |
| CSP | F | 0/100 | 9 | 0 |
| cookies | B | 80/100 | 0 | 2 |
| AI readiness | B | 76/100 | 0 | 2 |
| PWA installability | F | 18/100 | 6 | 1 |
| privacy & trackers | A | 97/100 | 0 | 1 |
| email security | B | 81/100 | 0 | 4 |
| DNS posture | B | 85/100 | 0 | 1 |
| SEO & meta | B | 89/100 | 0 | 3 |
| performance | B | 77/100 | 1 | 4 |
| accessibility | B | 79/100 | 0 | 5 |

### Fix these first
- ❌ **Content-Security-Policy** (Security headers) — Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'none'
- ❌ **X-Content-Type-Options** (Security headers) — X-Content-Type-Options: nosniff
- ❌ **Clickjacking protection** (Security headers) — Content-Security-Policy: frame-ancestors 'none' (or X-Frame-Options: DENY)
- ❌ **Referrer-Policy** (Security headers) — Referrer-Policy: strict-origin-when-cross-origin
- ❌ **Cookie security** (Security headers) — Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
- ❌ **Policy present and enforced** (CSP deep-dive) — Start with: Content-Security-Policy: default-src 'self'; then loosen per resource type. See /reference. — [Build a hardened Content-Security-Policy in Canopy's CSP builder](https://canopystack.dev/csp-builder)
- ❌ **Inline scripts blocked** (CSP deep-dive) — Replace 'unsafe-inline' with per-response nonces or sha256 hashes; add 'strict-dynamic' for modern browsers.
- ❌ **Script sources restricted** (CSP deep-dive) — Add script-src 'self' (plus any CDNs you use), or at minimum a default-src fallback.
- ❌ **eval() blocked** (CSP deep-dive) — Remove 'unsafe-eval'; most libraries that need it offer CSP-safe builds.
- ❌ **No scheme-wide script sources** (CSP deep-dive) — Pin script-src to the specific origins you actually load from.
- ❌ **Text compression** (Performance) — Enable gzip or brotli for text responses — most servers and CDNs are one directive away.
- ❌ **Plugin content disabled (object-src)** (CSP deep-dive) — Add object-src 'none' — nothing modern needs plugin content.
- ❌ **base-uri locked down** (CSP deep-dive) — Add base-uri 'self' (or 'none').
- ❌ **Form submissions restricted (form-action)** (CSP deep-dive) — Add form-action 'self' (or the specific endpoints your forms post to).
- ❌ **Framing controlled (frame-ancestors)** (CSP deep-dive) — Add frame-ancestors 'self' (or 'none') — it supersedes X-Frame-Options and supports allowlists.

[Full report](https://canopystack.dev/site?domain=wikipedia.org) · graded by [Canopy](https://canopystack.dev)

Machine-readable: /api/site?domain=…

Canopy · Whole-site report · wikipedia.org · Mon, 10 Aug 2026 04:48 UTC · generated with Canopy — https://canopystack.dev