Public website - security baseline
95-public-web-security-baseline.yaml
HTTP(S)
What this example does
This example demonstrates public website - security baseline.
Checks and behavior
- Sends an GET request to https://www.example.com/.
- Checks allowed/denied HTTP status codes.
- Validates required, forbidden or matching HTTP headers.
- Looks for expected response content and/or rejects known error markers.
- Validates redirect behavior and destination constraints.
- TLS settings cover certificate trust, certificate expiry.
- Applies response-time thresholds for operational alerting.
- Formats results for nagios output.
Adapt example domains, addresses, credentials and thresholds to your environment before use.
YAML configuration
# Copyright (c) 2026 mati peterson. Maintainer: mati peterson <ipsonic@mailbox.org>. Project: https://ipsonic.com/probe/. Disclaimer: Provided AS IS, without warranty of any kind. Use at your own risk; validate checks and configurations before production use.
# Public website: availability + HTTPS + HSTS + basic content integrity.
name: "Public website - security baseline"
url: "https://www.example.com/"
request:
method: GET
follow_redirects: true
timeouts: {connect: 3, response: 10}
tls: {verify: true, min_valid_days: 30}
tests:
status: {allow: [200]}
redirects:
max_count: 3
require_https: true
allowed_hosts: [www.example.com, example.com]
security: {hsts_min_age: 31536000}
headers:
exists: [Content-Type, Strict-Transport-Security]
absent: [X-Debug]
contains:
Content-Type: [text/html]
body:
contains: ["<html"]
not_contains: ["Traceback", "Internal Server Error"]
monitoring:
service_name: "Public Web Security Baseline"
output: nagios
on_failure: critical
thresholds:
response_time: {warning: 2, critical: 5}