SecOps HTTP security header baseline
109-secops-security-header-baseline.yaml
HTTP(S)
What this example does
This example demonstrates secops http security header baseline.
Checks and behavior
- Sends an GET request to https://www.example.com/.
- Checks allowed/denied HTTP status codes.
- Validates required, forbidden or matching HTTP headers.
- TLS settings cover certificate trust, certificate expiry.
- Formats results for icinga2 output.
Adapt example domains, addresses, credentials and thresholds to your environment before use.
YAML configuration
# Copyright (c) 2026 mati peterson. Maintainer: mati peterson <ipsonic@mailbox.org>. Project: https://ipsonic.com/probe/. Disclaimer: Provided AS IS, without warranty of any kind. Use at your own risk; validate checks and configurations before production use.
# SecOps drift detection: headers agreed as policy for this application.
# Not a vulnerability scan; policies differ by site and framework.
name: "SecOps HTTP security header baseline"
url: "https://www.example.com/"
request: {method: GET, follow_redirects: true}
timeouts: {connect: 3, response: 10}
tls: {verify: true, min_valid_days: 30}
tests:
status: {allow: [200]}
security: {hsts_min_age: 31536000}
headers:
exists:
- Strict-Transport-Security
- X-Content-Type-Options
- Content-Security-Policy
absent: [X-Debug]
contains:
X-Content-Type-Options: [nosniff]
monitoring:
service_name: "SecOps Header Drift"
output: icinga2
on_failure: critical