Emoji not displayed correctly

Nothing extremely important - I just noticed it when looking at @scotthelme’s website

HTTPie:

lenovouser@ntos ~> http https://scotthelme.co.uk/
HTTP/1.1 200 OK
Cache-Control: public, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: default-src 'none'; script-src 'self' cdnjs.cloudflare.com code.jquery.com scotthelme.disqus.com a.disquscdn.com www.google-analytics.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com; style-src 'self' a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com; img-src 'self' data: www.gravatar.com www.google-analytics.com links.services.disqus.com referrer.disqus.com a.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com cdn.ampproject.org amp.cloudflare.com; child-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; frame-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; connect-src 'self' links.services.disqus.com; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.io/r/default/csp/enforce
Content-Security-Policy-Report-Only: default-src 'nonce-t5slRAfVLPIw0JeOc7ftbn3b2d0Hgmx6' 'strict-dynamic'; img-src *; child-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; frame-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; connect-src 'self' links.services.disqus.com; font-src cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self'; report-uri https://scotthelme.report-uri.io/r/default/csp/reportOnly
Content-Type: text/html; charset=utf-8
Date: Sun, 09 Jul 2017 18:31:37 GMT
Public-Key-Pins: pin-sha256="9dNiZZueNZmyaf3pTkXxDgOzLkjKvI+Nza0ACF5IDwg="; pin-sha256="X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg="; pin-sha256="V+J+7lHvE6X0pqGKVqLtxuvk+0f+xowyr3obtq8tbSw="; pin-sha256="9lBW+k9EF6yyG9413/fPiHhQy5Ok4UI5sBpBTuOaa/U="; pin-sha256="ipMu2Xu72A086/35thucbjLfrPaSjuw4HIjSWsxqkb8="; pin-sha256="+5JdLySIa9rS6xJM+2KHN9CatGKln78GjnDpf4WmI3g="; pin-sha256="MWfCxyqG2b5RBmYFQuLllhQvYZ3mjZghXTRn9BL9q10="; includeSubDomains; max-age=2592000; report-uri="https://scotthelme.report-uri.io/r/default/hpkp/enforce"
Public-Key-Pins-Report-Only: pin-sha256="X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg="; pin-sha256="Vjs8r4z+80wjNcr1YKepWQboSIRi63WsWXhIMN+eWys="; pin-sha256="IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4="; max-age=2592000; report-uri="https://scotthelme.report-uri.io/r/default/hpkp/reportOnly"
Referrer-Policy: strict-origin-when-cross-origin
Server: Encrypt All The Things!!!
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
Vary: Accept-Encoding
Vary: Accept-Encoding
X-CSP-Nonce: t5slRAfVLPIw0JeOc7ftbn3b2d0Hgmx6
X-Content-Type-Options: nosniff
X-Emoji: 🔒🔒🔒
X-Frame-Options: DENY
X-Proxy-Cache: HIT
X-Xss-Protection: 1; mode=block; report=https://scotthelme.report-uri.io/r/default/xss/enforce

Screenshot:

cURL:

HTTP/2 200
server: Encrypt All The Things!!!
date: Sun, 09 Jul 2017 18:37:31 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'self' cdnjs.cloudflare.com code.jquery.com scotthelme.disqus.com a.disquscdn.com www.google-analytics.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com; style-src 'self' a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com; img-src 'self' data: www.gravatar.com www.google-analytics.com links.services.disqus.com referrer.disqus.com a.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com cdn.ampproject.org amp.cloudflare.com; child-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; frame-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; connect-src 'self' links.services.disqus.com; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.io/r/default/csp/enforce
content-security-policy-report-only: default-src 'nonce-qdLyaIO4fRJfnBCSc0EfuFkdw8Ce4NQF' 'strict-dynamic'; img-src *; child-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; frame-src fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com; connect-src 'self' links.services.disqus.com; font-src cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self'; report-uri https://scotthelme.report-uri.io/r/default/csp/reportOnly
public-key-pins: pin-sha256="9dNiZZueNZmyaf3pTkXxDgOzLkjKvI+Nza0ACF5IDwg="; pin-sha256="X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg="; pin-sha256="V+J+7lHvE6X0pqGKVqLtxuvk+0f+xowyr3obtq8tbSw="; pin-sha256="9lBW+k9EF6yyG9413/fPiHhQy5Ok4UI5sBpBTuOaa/U="; pin-sha256="ipMu2Xu72A086/35thucbjLfrPaSjuw4HIjSWsxqkb8="; pin-sha256="+5JdLySIa9rS6xJM+2KHN9CatGKln78GjnDpf4WmI3g="; pin-sha256="MWfCxyqG2b5RBmYFQuLllhQvYZ3mjZghXTRn9BL9q10="; includeSubDomains; max-age=2592000; report-uri="https://scotthelme.report-uri.io/r/default/hpkp/enforce"
public-key-pins-report-only: pin-sha256="X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg="; pin-sha256="Vjs8r4z+80wjNcr1YKepWQboSIRi63WsWXhIMN+eWys="; pin-sha256="IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4="; max-age=2592000; report-uri="https://scotthelme.report-uri.io/r/default/hpkp/reportOnly"
x-frame-options: DENY
x-xss-protection: 1; mode=block; report=https://scotthelme.report-uri.io/r/default/xss/enforce
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-emoji: 🔒🔒🔒
x-csp-nonce: qdLyaIO4fRJfnBCSc0EfuFkdw8Ce4NQF
x-proxy-cache: EXPIRED

Screenshot:

[jakubroztocil]

Seems to be the value that comes from python-requests:

$ python3 -c 'import requests; print(requests.get("https://scotthelme.co.uk/").headers["X-Emoji"])'
🔒🔒🔒

[sriyanfernando]

you can change your Emoji.js file. there is something called window.onload= function(){}. Using this you can get Emoji Back.