# Share a Nikto Scan Report — Web Server Findings on a Link

Canonical: https://commareports.com/share-nikto-report
Published: 2026-09-01

> Nikto's -Format htm writes a self-contained report. Publish it to Comma so each scan has a URL, each finding can be triaged in a thread, and every re-scan appends a revision.

# Share a Nikto scan report

Nikto's output is famously long and famously repetitive, and both of
those are arguments for putting it somewhere durable rather than
somewhere temporary. Two hundred lines of which maybe six matter, and
the knowledge of which six lives in one person's head.

That knowledge is the expensive part. A scan takes minutes to re-run; the
triage takes an afternoon and gets thrown away every time.

## Publish it

```bash
nikto -h "$TARGET" -Format htm -o nikto.html || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html nikto.html \
        --arg title "Nikto — $TARGET — $(date +%F)" \
        '{title: $title, html: $html}')"
```

One report id per target host. `PATCH` keeps the URL and appends a
revision, so the triage notes from the last scan are still sitting on
the findings when the next one lands.

Use a [scoped token](/docs/api-tokens) with `reports:write` only, and
keep the report **private or team-visible** — see the
[sharing model](/docs/sharing).

## Only scan what you are authorized to scan

Nikto sends thousands of active requests and will show up in the
target's access logs as exactly what it is. Own the host, or hold
written authorization for it. Publishing results does not create
permission to produce them.

## What the URL changes

- **Triage survives the scan.** Pin the reasoning to the finding once;
  it is there on every later revision. See
  [commenting on HTML](/comment-on-html).
- **Diffs instead of re-reads.** Revision-to-revision comparison finds
  the new line in a wall of identical ones.
- **A report a client can open.** Consultancies ship the link — with
  [a password](/password-protect-html-report) — instead of a PDF nobody
  can reply to inline.

## Limits

- **HTML body: 5 MB.** A long scan of a large site can approach it; scan
  per host and keep a report per host.
- **Scripts run, sandboxed**: `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Create your first report →](https://commareports.com/)**

### Related

- [ZAP reports](/share-zap-report) — the deeper web scan
- [testssl.sh](/share-testssl-report) · [Nmap](/share-nmap-report)
- [Security scan reports](/share-security-scan-report) · [Share with a client](/share-html-file-with-client)