probeo

What does probeo check in security?

Probeo reads the response headers of every page it checks and grades what they protect and what they give away. A missing policy or a header naming the server’s version changes nothing a visitor sees, so it stays in place until someone looks.

What probeo checks

Content Security Policy

  • Content security policyWhat a Content Security Policy is, why teams lose track of the one they have, and what becomes visible once a policy is clearly defined for the whole site.
  • ClickjackingClickjacking hides your page in an invisible iframe to trick people into clicks they never meant. How the CSP frame-ancestors directive stops that embedding.
  • Configuration issuesA misconfigured Content Security Policy gives false confidence: policies that do nothing, conflicting headers, deprecated directives and insecure HTTP sources.
  • Frame SRCA Content Security Policy with no frame-src, or one that allows any origin, lets injected markup embed any site. How to list only the frames you use.
  • Injection directivesWithout base-uri and form-action, a CSP leaves attacks that script-src cannot stop: base tag hijacking of relative URLs, and forms that send data elsewhere.
  • Object SRCA missing or wildcard object-src lets plugin content run code through object, embed and applet elements. Setting object-src to 'none' closes this attack path.
  • Report onlyContent-Security-Policy-Report-Only records violations without blocking them. When to move from monitoring to an enforced policy, and what changes then.
  • Script SRCA CSP without script-src falls back to default-src, which may allow any script, and a wildcard script-src does the same. Both defeat the point of the policy.
  • XSS cross site scriptingCross-site scripting runs untrusted code inside your page. How a Content Security Policy limits where scripts can come from, so injected scripts cannot execute.

Response headers

  • CF cache statusThe CF-Cache-Status header reveals that a response came through Cloudflare. Why that leaks information about your infrastructure, and how to remove the header.
  • CF rayCloudflare adds the CF-Ray header to trace requests, and it leaks information about your infrastructure. Why that matters, and how to remove it from responses.
  • FrameworksHeaders like X-Powered-By and Server tell attackers which framework and server you run, details they can use against you. Why to remove them, and how to do it.
  • MIME sniffingMIME sniffing allows browsers to override Content-Type headers creating security risks. This page explains why MIME sniffing is dangerous and how to disable it.
  • Referrer policyReferrer-Policy controls how much of your URL is shared when people leave your site. Missing or weak policies leak paths and query strings to other websites.
  • Server-TimingServer-Timing is meant for metric names and durations. When it carries a credential, a private hostname or a server path, anyone can read it.
  • Vary leaks frameworkThe Vary header can reveal your framework through cache key fingerprinting. How framework-specific Vary values leak information, and how to stop them doing it.
  • Version leakingVersion numbers in headers, error pages and responses help attackers find software with known flaws. How version information leaks, and how to stop it.
  • X content type optionsX-Content-Type-Options stops browsers from guessing a response's type instead of using the declared Content-Type. Why it matters, and how to set it correctly.
  • X-Frame-OptionsThe X-Frame-Options header controls whether pages can be embedded in iframes. This page explains correct values and when to use each to prevent clickjacking.
  • X-Frame-Options or frame-ancestorsX-Frame-Options and the CSP frame-ancestors directive both control iframe embedding. Which one to use, and why frame-ancestors supersedes the older header.
  • X powered byThe X-Powered-By header advertises your framework and runtime, giving attackers a head start on reconnaissance. Why it matters, and how to remove the header.

HTML and scripts

  • Inline event handlersInline event handlers in HTML attributes weaken security and get in the way of a strict CSP. Why they cause problems, and how to move them into your scripts.
  • Inline scriptsInline scripts embedded in HTML weaken security and make a strict Content Security Policy harder to enforce. Why they cause problems, and how to resolve them.
  • Mixed contentMixed content occurs when HTTPS pages load resources over HTTP. This page explains why browsers block or warn about mixed content and how to resolve it.
  • Unsafe evalThe unsafe-eval CSP keyword allows eval and dynamic code, which attackers can use for cross-site scripting. Why it is dangerous, and how to remove it safely.
  • Unsafe inlineThe unsafe-inline CSP keyword switches off XSS protection by allowing every inline script and event handler. Why it undermines a policy, and how to remove it.
  • XSS vectorsjavascript: URLs and data: URIs in script-src open cross-site scripting paths that get past many CSP setups. What each allows, and how to close them for good.

Clickjacking and CORS

  • Protection gapsTwo gaps leave pages open to clickjacking: no framing headers at all, or X-Frame-Options silently overridden by CSP frame-ancestors. Both leave no real defense.
  • MisconfigurationCORS mistakes open authenticated endpoints to other sites: wildcard origins with credentials, open wildcards, trusting the null origin, and a missing Vary.

HTTPS and HSTS

  • HSTS subdomainsThe includeSubDomains directive forces HTTPS across all subdomains. This page explains how to deploy HSTS safely without creating unreachable subdomain states.
  • ConfigurationHSTS configuration combines max-age, includeSubDomains, and preload directives. This page explains which values provide maximum security with minimal risk.
  • Max ageHSTS max-age sets how long browsers insist on HTTPS for your site. Recommended durations, and the trade-off between stronger security and room to change.
  • All trafficForcing HTTPS requires redirecting HTTP requests and preventing future HTTP connections. This page explains the mechanisms needed to enforce HTTPS universally.

How probeo checks it

Each finding is graded critical, major or minor.

  • Content Security Policy. No policy is critical. A policy is graded, not just detected: 'unsafe-inline' or 'unsafe-eval' for scripts, scripts from any origin or from data:, and inline styles are each findings. So is a missing frame-ancestors, object-src, base-uri, form-action or frame-src, or one open to any origin. Directives fall back to default-src as browsers do, and a page with several policies is judged on what all of them allow.
  • HSTS. No Strict-Transport-Security is major. A max-age under one year, or no includeSubDomains, is minor.
  • X-Content-Type-Options. A missing header is minor.
  • Disclosure. Headers that expose a framework version or internal identifiers, such as X-Powered-By and X-AspNet-Version, are critical. Headers that reveal platform or routing internals are major, and CDN cache headers such as X-Served-By are minor. Server is flagged only when it carries a version number or a private host name.
  • Server-Timing. Credentials in its value are critical. Private host names and server file paths are major.

Ordinary headers, such as Cache-Control, Vary, CF-Ray and Referrer-Policy, are never flagged.

What this does not cover

These checks read response headers only. They don’t read the page’s HTML, request the HTTP version of a URL to test its redirect, or grade Referrer-Policy and X-Frame-Options. A clean result means the headers are sound, not that the site has been tested for vulnerabilities.

Common questions

Why is a missing Content Security Policy critical?

It is the header that limits what a page can run if an attacker gets markup into it. Without one, nothing does.

Why doesn’t probeo flag CF-Ray or a plain Server: cloudflare?

They name the CDN, which is public from DNS anyway, and carry no version. Probeo saves its findings for headers that point at specific software.

Is this a penetration test?

No. It reads the headers every visitor receives, on every page, each time probeo rechecks them. A penetration test looks for ways in.

Which product this is part of

Security headers is part of Site Clarity.