Checks if your site is allowed to be IFRAMEd by another site and thus would be susceptible to click-jacking.

How to fix this health check

This health check can be fixed by adding a header before the response is started.

Preferable you use a security library like NWebSec.

Adding Click-Jacking Protection using NWebSec

If you take a NuGet dependency on NWebsec.AspNetCore.Middleware/, you can use third extension methods on IApplicationBuilder.

...
WebApplication app = builder.Build();
app.UseXfo(options => options.SameOrigin());

Adding Click-Jacking Protection using manual middleware

Avoid third-party library dependency by using custom middleware added to the request pipeline.

app.Use(async (context, next) =>
{
    context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
    await next();
});

Checks that your site contains a header used to protect against Multipurpose Internet Mail Extensions (MIME) sniffing vulnerabilities.

How to fix this health check

This health check can be fixed by adding a header before the response is started.

Preferable you use a security library like NWebSec.

Adding Content/MIME Sniffing Protection using NWebSec

If you take a NuGet dependency on NWebsec.AspNetCore.Middleware/, you can use third extension methods on WebApplication.

...
WebApplication app = builder.Build();

app.UseXContentTypeOptions();
...

Adding Content/MIME Sniffing Protection using manual middleware

If you do not like to have a dependency on third party libraries, you can add the following custom middleware to the request pipeline.

First create the middleware class:

namespace MySite.Middleware;

public class NoSniffMiddleware : IMiddleware
{
    public async Task InvokeAsync(HttpContext context, RequestDelegate next)
    {
        context.Response.Headers.Append("X-Content-Type-Options", "nosniff");
        await next(context);
    }
}

Next register it in Program.cs

using MySite.Middleware;

WebApplicationBuilder builder = WebApplication.CreateBuilder(args);

builder.Services.AddSingleton<NoSniffMiddleware>();

builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

WebApplication app = builder.Build();

app.UseMiddleware<NoSniffMiddleware>();

await app.BootUmbracoAsync();
...

This check verifies if your site has a Content Security Policy (CSP) header to defend against Cross-Site Scripting (XSS) and data injection attacks.

How to fix this health check

This health check can be fixed by adding a header before the response is started.

Preferable you use a security library like NWebSec.

Adding a Content Security Policy (CSP) using NWebSec

If you take a NuGet dependency on NWebsec.AspNetCore.Middleware/, you can use third extension methods on IApplicationBuilder.

...
WebApplication app = builder.Build();
app.UseCsp(options => options
    .ImageSources(s => s
        .Self()
        .CustomSources(
            "our.umbraco.com data:",
            "dashboard.umbraco.com"))
    .DefaultSources(s => s
        .Self()
        .CustomSources(
            "our.umbraco.com",
            "marketplace.umbraco.com"))
    .ScriptSources(s => s
        .Self())
    .StyleSources(s => s
        .Self())
    .FontSources(s => s
        .Self())
    .ConnectSources(s => s
        .Self())
    .FrameSources(s => s
        .Self()));

Adding a Content Security Policy (CSP) using manual middleware

Avoid third-party library dependencies by using custom middleware added to the request pipeline as shown below.

app.Use(async (context, next) =>
{
    context.Response.Headers.Append("Content-Security-Policy", "img-src 'self' our.umbraco.com data: dashboard.umbraco.com; default-src 'self' our.umbraco.com marketplace.umbraco.com; script-src 'self'; style-src 'unsafe-inline' 'self'; font-src 'self'; connect-src 'self'; frame-src 'self'; ");
    await next();
});

Checks to see if your site reveals information in its headers that gives away unnecessary details about the technology used to build and host it.

How to fix this health check

This health check can be fixed by removing headers before the response is started.

Be aware these headers are often added by the server and not by the application.

Unless you publicly expose the Kestrel server (not recommended by Microsoft), you can't handle this directly in middleware.

Removing headers when hosted on IIS

For IIS you will need to manipulate web.config (If you don't have web.config already in your project you will need to add it at the root). Ensure to remove the custom X-Powered-By and Server header as shown in the following example.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
      </customHeaders>
    </httpProtocol>
    <security>
      <requestFiltering removeServerHeader="true" />
    </security>
  </system.webServer>
</configuration>

Removing headers when hosted on Kestrel

By default Kestrel will only expose the Server header. To disable this, you have to configure Kestrel in Program.cs. You can use the UseKestrel extension method on WebApplicationBuilder like in the following example.

WebApplicationBuilder builder = WebApplication.CreateBuilder(args);

builder.WebHost.UseKestrel(options => options.AddServerHeader = false);
...

Check to make sure a fixed application URL is specified. This URL is for example used when sending emails from backoffice. If this is not specified in configuration, Umbraco gets the application URL from last host used to request the application

How to fix this health check

This health check can be fixed by providing configuration on the following path: Umbraco:CMS:WebRouting:UmbracoApplicationUrl.

This configuration can be setup in a configuration source of your choice. This guide shows how to set it up in one of the JSON file sources.

Updating the JSON configuration

The following JSON needs to be merged into one of your JSON sources. By default the following JSON sources are used: appSettings.json and appSettings.<environment>.json, e.g. appSettings.Development.json or appSettings.Production.json.

{
    "Umbraco": {
        "CMS": {
            "WebRouting": {
                "UmbracoApplicationUrl": "string"
            }
        }
    }
}

One example that can be used in production

{
    "Umbraco": {
        "CMS": {
            "WebRouting": {
                "UmbracoApplicationUrl": "https://www.my-custom-domain.com/"
            }
        }
    }
}

How to fix this health check

This health check can be fixed by ensuring no middleware adds the header.

Checks that the web server folder and file permissions are set correctly for Umbraco to run.

How to fix this health check

This health check can be fixed by ensuring that the process running Umbraco also has write access to the listed folders and files.

Updating the file permissions on Windows

Here's an example of how to adjust permissions for a folder. This process works the same way for files.

First we see an example of an error from the health check

To fix this, we find the specified folder, from the report and choose Properties and the Security tab.

From here you can edit the permissions for a specific user or user group.

Leaving debug compilation mode enabled can severely slow down a website and take up more memory on the server.

How to fix this health check

This health check can be fixed by providing configuration on the following path: Umbraco:CMS:Hosting:Debug.

This configuration can be setup in a configuration source of your choice. This guide shows how to set it up in one of the JSON file sources.

Updating the JSON configuration

The following JSON needs to be merged into one of your JSON sources. By default the following JSON sources are used: appSettings.json and appSettings.<environment>.json, e.g. appSettings.Development.json or appSettings.Production.json.

One example that can be used for production:

If notifications are used, the 'from' email address should be specified and changed from the default value.

How to fix this health check

This health check can be fixed by providing configuration on the following path: Umbraco:CMS:Content:Notifications:Email.

This configuration can be setup in a configuration source of your choice. This guide shows how to set it up in one of the JSON file sources.

Updating the JSON configuration

The following JSON needs to be merged into one of your JSON sources. By default the following JSON sources are used: appSettings.json and appSettings.<environment>.json, e.g. appSettings.Development.json or appSettings.Production.json.

One example that can be used:

Checks if your site is configured to work over HTTPS and if the Umbraco related configuration for that is correct.

How to fix this health check

This health check checks a couple of things.

First of all, it ensures that your website is running on HTTPS using a valid certificate.

Furthermore, it is used to specify the configuration on the following path: Umbraco:CMS:Global:UseHttps.

This configuration can be setup in a configuration source of your choice. This guide shows how to set it up in one of the JSON file sources.

Updating the JSON configuration

The following JSON needs to be merged into one of your JSON sources. By default the following JSON sources are used: appSettings.json and appSettings.<environment>.json, e.g. appSettings.Development.json or appSettings.Production.json.

One example that can be used:

Checks if your site, when running with HTTPS, contains the Strict-Transport-Security Header (HSTS).

How to fix this health check

This health check can be fixed by adding the Strict-Transport-Security header to responses. The header tells browsers that future requests should be made over HTTPS only.

Using the UseHsts extension method

ASP.NET Core implements HSTS with the UseHsts extension method.

You can add UseHsts after the env.IsDevelopment() check-in Program.cs.

if (builder.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}
else
{
    app.UseHsts();
}
    //...
}

This example only enables HSTS if the app is not running in development mode. UseHsts isn't recommended in development because the HSTS settings are highly cacheable by browsers.

It is possible to configure a timespan for the HSTS, preferably six months. This can be done by adding a new builder to the Program.cs file. Learn more in the official Microsoft Documentation.

Full details of UseHsts, and additional configuration, can be found in the ASP.NET Core documentation.

Checks that valid settings for sending emails are in place.

How to fix this health check

This health check can be fixed by providing configuration on the following path: Umbraco:CMS:Global:Smtp

This configuration can be setup in a configuration source of your choice. This guide shows how to set it up in one of the JSON file sources.

Updating the JSON configuration

The following JSON needs to be merged into one of your JSON sources. By default the following JSON sources are used: appSettings.json and appSettings.<environment>.json, e.g. appSettings.Development.json or appSettings.Production.json.

{
    "Umbraco": {
        "CMS": {
            "Global": {
                "Smtp": {
                    "From": "<your email>",
                    "Host": "<host>",
                    "Port": <port>,
                    "PickupDirectoryLocation": "<optional directory>",
                    "Username": "<optional username>",
                    "Password": "<optional password>",
                    "DeliveryMethod": "<Network(default)|SpecifiedPickupDirectory|PickupDirectoryFromIis>",
                    "SecureSocketOptions": "<None|Auto(default)|SslOnConnect|StartTls|StartTlsWhenAvailable>"
                }
            }
        }
    }
}

An example that can be used on localhost, is if you have a local Simple Mail Transfer Protocol (SMTP) server running during development. This could be a tool like Smtp4dev.

{
    "Umbraco": {
        "CMS": {
            "Global": {
                "Smtp": {
                    "From": "my@email.com",
                    "Host": "localhost",
                    "Port": 25
                }
            }
        }
    }
}