This question already has an answer here:

After scaning web page with Nikto I have results that is "The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack."

How to verify if that result isn't false positive? In proxy I don't see any Content-Encoding: deflate header.

Is it a good solution to always disable deflate encoding?

marked as duplicate by Steffen Ullrich, forest, Tobi Nary, Rory Alsop Apr 1 '18 at 9:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.