From 5f263ad851f622ff0e03923ac398fe71ba697da5 Mon Sep 17 00:00:00 2001
From: AndyButland <abutland73@gmail.com>
Date: Sun, 4 Jun 2017 14:34:37 +0200
Subject: [PATCH 1/2] Added check for X-Content-Type-Options and refactored
 existing HTTP header check to use common base class.

---
 .../Checks/Security/BaseHttpHeaderCheck.cs    | 220 ++++++++++++++++++
 .../Checks/Security/ClickJackingCheck.cs      | 210 +----------------
 .../Checks/Security/NoSniffCheck.cs           |  15 ++
 src/Umbraco.Web/Umbraco.Web.csproj            |   2 +
 4 files changed, 241 insertions(+), 206 deletions(-)
 create mode 100644 src/Umbraco.Web/HealthCheck/Checks/Security/BaseHttpHeaderCheck.cs
 create mode 100644 src/Umbraco.Web/HealthCheck/Checks/Security/NoSniffCheck.cs

diff --git a/src/Umbraco.Web/HealthCheck/Checks/Security/BaseHttpHeaderCheck.cs b/src/Umbraco.Web/HealthCheck/Checks/Security/BaseHttpHeaderCheck.cs
new file mode 100644
index 0000000000..165d636a6d
--- /dev/null
+++ b/src/Umbraco.Web/HealthCheck/Checks/Security/BaseHttpHeaderCheck.cs
@@ -0,0 +1,220 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Text.RegularExpressions;
+using System.Xml.Linq;
+using System.Xml.XPath;
+using Umbraco.Core.Configuration;
+using Umbraco.Core.IO;
+using Umbraco.Core.Services;
+
+namespace Umbraco.Web.HealthCheck.Checks.Security
+{
+    public abstract class BaseHttpHeaderCheck : HealthCheck
+    {
+        private readonly ILocalizedTextService _textService;
+
+        private const string SetHeaderInConfigAction = "setHeaderInConfig";
+
+        private readonly string _header;
+        private readonly string _value;
+        private readonly string _localizedTextPrefix;
+        private readonly bool _metaTagOptionAvailable;
+
+        public BaseHttpHeaderCheck(HealthCheckContext healthCheckContext, 
+            string header, string value, string localizedTextPrefix, bool metaTagOptionAvailable) : base(healthCheckContext)
+        {
+            _textService = healthCheckContext.ApplicationContext.Services.TextService;
+
+            _header = header;
+            _value = value;
+            _localizedTextPrefix = localizedTextPrefix;
+            _metaTagOptionAvailable = metaTagOptionAvailable;
+        }
+
+        /// <summary>
+        /// Get the status for this health check
+        /// </summary>
+        /// <returns></returns>
+        public override IEnumerable<HealthCheckStatus> GetStatus()
+        {
+            //return the statuses
+            return new[] { CheckForHeader() };
+        }
+
+        /// <summary>
+        /// Executes the action and returns it's status
+        /// </summary>
+        /// <param name="action"></param>
+        /// <returns></returns>
+        public override HealthCheckStatus ExecuteAction(HealthCheckAction action)
+        {
+            switch (action.Alias)
+            {
+                case SetHeaderInConfigAction:
+                    return SetHeaderInConfig();
+                default:
+                    throw new InvalidOperationException("HTTP Header action requested is either not executable or does not exist");
+            }
+        }
+
+        protected HealthCheckStatus CheckForHeader()
+        {
+            var message = string.Empty;
+            var success = false;
+            var url = HealthCheckContext.HttpContext.Request.Url;
+
+            // Access the site home page and check for the click-jack protection header or meta tag
+            var serverVariables = HealthCheckContext.HttpContext.Request.ServerVariables;
+            var useSsl = GlobalSettings.UseSSL || serverVariables["SERVER_PORT"] == "443";
+            var address = string.Format("http{0}://{1}:{2}", useSsl ? "s" : "", url.Host.ToLower(), url.Port);
+            var request = WebRequest.Create(address);
+            request.Method = "GET";
+            try
+            {
+                var response = request.GetResponse();
+
+                // Check first for header
+                success = DoHttpHeadersContainHeader(response);
+
+                // If not found, and available, check for meta-tag
+                if (success == false && _metaTagOptionAvailable)
+                {
+                    success = DoMetaTagsContainKeyForHeader(response);
+                }
+
+                message = success
+                    ? _textService.Localize(string.Format("healthcheck/{0}CheckHeaderFound", _localizedTextPrefix))
+                    : _textService.Localize(string.Format("healthcheck/{0}CheckHeaderNotFound", _localizedTextPrefix));
+            }
+            catch (Exception ex)
+            {
+                message = _textService.Localize("healthcheck/healthCheckInvalidUrl", new[] { address, ex.Message });
+            }
+
+            var actions = new List<HealthCheckAction>();
+            if (success == false)
+            {
+                actions.Add(new HealthCheckAction(SetHeaderInConfigAction, Id)
+                {
+                    Name = _textService.Localize("healthcheck/setHeaderInConfig"),
+                    Description = _textService.Localize(string.Format("healthcheck/{0}SetHeaderInConfigDescription", _localizedTextPrefix))
+                });
+            }
+
+            return
+                new HealthCheckStatus(message)
+                {
+                    ResultType = success ? StatusResultType.Success : StatusResultType.Error,
+                    Actions = actions
+                };
+        }
+
+        private bool DoHttpHeadersContainHeader(WebResponse response)
+        {
+            return response.Headers.AllKeys.Contains(_header);
+        }
+
+        private bool DoMetaTagsContainKeyForHeader(WebResponse response)
+        {
+            using (var stream = response.GetResponseStream())
+            {
+                if (stream == null) return false;
+                using (var reader = new StreamReader(stream))
+                {
+                    var html = reader.ReadToEnd();
+                    var metaTags = ParseMetaTags(html);
+                    return metaTags.ContainsKey(_header);
+                }
+            }
+        }
+
+        private static Dictionary<string, string> ParseMetaTags(string html)
+        {
+            var regex = new Regex("<meta http-equiv=\"(.+?)\" content=\"(.+?)\"", RegexOptions.IgnoreCase);
+
+            return regex.Matches(html)
+                .Cast<Match>()
+                .ToDictionary(m => m.Groups[1].Value, m => m.Groups[2].Value);
+        }
+
+        private HealthCheckStatus SetHeaderInConfig()
+        {
+            var errorMessage = string.Empty;
+            var success = SaveHeaderToConfigFile(out errorMessage);
+
+            if (success)
+            {
+                return
+                    new HealthCheckStatus(_textService.Localize(string.Format("healthcheck/{0}SetHeaderInConfigSuccess", _localizedTextPrefix)))
+                    {
+                        ResultType = StatusResultType.Success
+                    };
+            }
+
+            return
+                new HealthCheckStatus(_textService.Localize("healthcheck/setHeaderInConfigError", new [] { errorMessage }))
+                {
+                    ResultType = StatusResultType.Error
+                };
+        }
+
+        private bool SaveHeaderToConfigFile(out string errorMessage)
+        {
+            try
+            {
+                // There don't look to be any useful classes defined in https://msdn.microsoft.com/en-us/library/system.web.configuration(v=vs.110).aspx
+                // for working with the customHeaders section, so working with the XML directly.
+                var configFile = IOHelper.MapPath("~/Web.config");
+                var doc = XDocument.Load(configFile);
+                var systemWebServerElement = doc.XPathSelectElement("/configuration/system.webServer");
+                var httpProtocolElement = systemWebServerElement.Element("httpProtocol");
+                if (httpProtocolElement == null)
+                {
+                    httpProtocolElement = new XElement("httpProtocol");
+                    systemWebServerElement.Add(httpProtocolElement);
+                }
+
+                var customHeadersElement = httpProtocolElement.Element("customHeaders");
+                if (customHeadersElement == null)
+                {
+                    customHeadersElement = new XElement("customHeaders");
+                    httpProtocolElement.Add(customHeadersElement);
+                }
+
+                var removeHeaderElement = customHeadersElement.Elements("remove")
+                    .SingleOrDefault(x => x.Attribute("name") != null &&
+                                          x.Attribute("name").Value == _value);
+                if (removeHeaderElement == null)
+                {
+                    removeHeaderElement = new XElement("remove");
+                    removeHeaderElement.Add(new XAttribute("name", _header));
+                    customHeadersElement.Add(removeHeaderElement);
+                }
+
+                var addHeaderElement = customHeadersElement.Elements("add")
+                    .SingleOrDefault(x => x.Attribute("name") != null &&
+                                          x.Attribute("name").Value == _header);
+                if (addHeaderElement == null)
+                {
+                    addHeaderElement = new XElement("add");
+                    addHeaderElement.Add(new XAttribute("name", _header));
+                    addHeaderElement.Add(new XAttribute("value", _value));
+                    customHeadersElement.Add(addHeaderElement);
+                }
+
+                doc.Save(configFile);
+
+                errorMessage = string.Empty;
+                return true;
+            }
+            catch (Exception ex)
+            {
+                errorMessage = ex.Message;
+                return false;
+            }
+        }
+    }
+}
diff --git a/src/Umbraco.Web/HealthCheck/Checks/Security/ClickJackingCheck.cs b/src/Umbraco.Web/HealthCheck/Checks/Security/ClickJackingCheck.cs
index 54f72dc88a..34ba7bee19 100644
--- a/src/Umbraco.Web/HealthCheck/Checks/Security/ClickJackingCheck.cs
+++ b/src/Umbraco.Web/HealthCheck/Checks/Security/ClickJackingCheck.cs
@@ -1,217 +1,15 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Linq;
-using System.Net;
-using System.Text.RegularExpressions;
-using System.Xml.Linq;
-using System.Xml.XPath;
-using Umbraco.Core.Configuration;
-using Umbraco.Core.IO;
-using Umbraco.Core.Services;
-
-namespace Umbraco.Web.HealthCheck.Checks.Security
+namespace Umbraco.Web.HealthCheck.Checks.Security
 {
     [HealthCheck(
         "ED0D7E40-971E-4BE8-AB6D-8CC5D0A6A5B0",
         "Click-Jacking Protection",
         Description = "Checks if your site is allowed to be IFRAMEd by another site and thus would be susceptible to click-jacking.",
         Group = "Security")]
-    public class ClickJackingCheck : HealthCheck
+    public class ClickJackingCheck : BaseHttpHeaderCheck
     {
-        private readonly ILocalizedTextService _textService;
-
-        private const string SetFrameOptionsHeaderInConfigActiobn = "setFrameOptionsHeaderInConfig";
-
-        private const string XFrameOptionsHeader = "X-Frame-Options";
-        private const string XFrameOptionsValue = "sameorigin"; // Note can't use "deny" as that would prevent Umbraco itself using IFRAMEs
-
-        public ClickJackingCheck(HealthCheckContext healthCheckContext) : base(healthCheckContext)
+        public ClickJackingCheck(HealthCheckContext healthCheckContext) 
+            : base(healthCheckContext, "X-Frame-Options", "sameorigin", "clickJacking", true)
         {
-            _textService = healthCheckContext.ApplicationContext.Services.TextService;
-        }
-
-        /// <summary>
-        /// Get the status for this health check
-        /// </summary>
-        /// <returns></returns>
-        public override IEnumerable<HealthCheckStatus> GetStatus()
-        {
-            //return the statuses
-            return new[] { CheckForFrameOptionsHeader() };
-        }
-
-        /// <summary>
-        /// Executes the action and returns it's status
-        /// </summary>
-        /// <param name="action"></param>
-        /// <returns></returns>
-        public override HealthCheckStatus ExecuteAction(HealthCheckAction action)
-        {
-            switch (action.Alias)
-            {
-                case SetFrameOptionsHeaderInConfigActiobn:
-                    return SetFrameOptionsHeaderInConfig();
-                default:
-                    throw new InvalidOperationException("HttpsCheck action requested is either not executable or does not exist");
-            }
-        }
-
-        private HealthCheckStatus CheckForFrameOptionsHeader()
-        {
-            var message = string.Empty;
-            var success = false;
-            var url = HealthCheckContext.HttpContext.Request.Url;
-
-            // Access the site home page and check for the click-jack protection header or meta tag
-            var serverVariables = HealthCheckContext.HttpContext.Request.ServerVariables;
-            var useSsl = GlobalSettings.UseSSL || serverVariables["SERVER_PORT"] == "443";
-            var address = string.Format("http{0}://{1}:{2}", useSsl ? "s" : "", url.Host.ToLower(), url.Port);
-            var request = WebRequest.Create(address);
-            request.Method = "GET";
-            try
-            {
-                var response = request.GetResponse();
-
-                // Check first for header
-                success = DoHeadersContainFrameOptions(response);
-
-                // If not found, check for meta-tag
-                if (success == false)
-                {
-                    success = DoMetaTagsContainFrameOptions(response);
-                }
-
-                message = success
-                    ? _textService.Localize("healthcheck/clickJackingCheckHeaderFound")
-                    : _textService.Localize("healthcheck/clickJackingCheckHeaderNotFound");
-            }
-            catch (Exception ex)
-            {
-                message = _textService.Localize("healthcheck/httpsCheckInvalidUrl", new[] { address, ex.Message });
-            }
-
-            var actions = new List<HealthCheckAction>();
-            if (success == false)
-            {
-                actions.Add(new HealthCheckAction(SetFrameOptionsHeaderInConfigActiobn, Id)
-                {
-                    Name = _textService.Localize("healthcheck/clickJackingSetHeaderInConfig"),
-                    Description = _textService.Localize("healthcheck/clickJackingSetHeaderInConfigDescription")
-                });
-            }
-
-            return
-                new HealthCheckStatus(message)
-                {
-                    ResultType = success ? StatusResultType.Success : StatusResultType.Error,
-                    Actions = actions
-                };
-        }
-
-        private static bool DoHeadersContainFrameOptions(WebResponse response)
-        {
-            return response.Headers.AllKeys.Contains(XFrameOptionsHeader);
-        }
-
-        private static bool DoMetaTagsContainFrameOptions(WebResponse response)
-        {
-            using (var stream = response.GetResponseStream())
-            {
-                if (stream == null) return false;
-                using (var reader = new StreamReader(stream))
-                {
-                    var html = reader.ReadToEnd();
-                    var metaTags = ParseMetaTags(html);
-                    return metaTags.ContainsKey(XFrameOptionsHeader);
-                }
-            }
-        }
-
-        private static Dictionary<string, string> ParseMetaTags(string html)
-        {
-            var regex = new Regex("<meta http-equiv=\"(.+?)\" content=\"(.+?)\"", RegexOptions.IgnoreCase);
-
-            return regex.Matches(html)
-                .Cast<Match>()
-                .ToDictionary(m => m.Groups[1].Value, m => m.Groups[2].Value);
-        }
-
-        private HealthCheckStatus SetFrameOptionsHeaderInConfig()
-        {
-            var errorMessage = string.Empty;
-            var success = SaveHeaderToConfigFile(out errorMessage);
-
-            if (success)
-            {
-                return
-                    new HealthCheckStatus(_textService.Localize("healthcheck/clickJackingSetHeaderInConfigSuccess"))
-                    {
-                        ResultType = StatusResultType.Success
-                    };
-            }
-
-            return
-                new HealthCheckStatus(_textService.Localize("healthcheck/clickJackingSetHeaderInConfigError", new [] { errorMessage }))
-                {
-                    ResultType = StatusResultType.Error
-                };
-        }
-
-        private static bool SaveHeaderToConfigFile(out string errorMessage)
-        {
-            try
-            {
-                // There don't look to be any useful classes defined in https://msdn.microsoft.com/en-us/library/system.web.configuration(v=vs.110).aspx
-                // for working with the customHeaders section, so working with the XML directly.
-                var configFile = IOHelper.MapPath("~/Web.config");
-                var doc = XDocument.Load(configFile);
-                var systemWebServerElement = doc.XPathSelectElement("/configuration/system.webServer");
-                var httpProtocolElement = systemWebServerElement.Element("httpProtocol");
-                if (httpProtocolElement == null)
-                {
-                    httpProtocolElement = new XElement("httpProtocol");
-                    systemWebServerElement.Add(httpProtocolElement);
-                }
-
-                var customHeadersElement = httpProtocolElement.Element("customHeaders");
-                if (customHeadersElement == null)
-                {
-                    customHeadersElement = new XElement("customHeaders");
-                    httpProtocolElement.Add(customHeadersElement);
-                }
-
-                var removeHeaderElement = customHeadersElement.Elements("remove")
-                    .SingleOrDefault(x => x.Attribute("name") != null &&
-                                          x.Attribute("name").Value == XFrameOptionsHeader);
-                if (removeHeaderElement == null)
-                {
-                    removeHeaderElement = new XElement("remove");
-                    removeHeaderElement.Add(new XAttribute("name", XFrameOptionsHeader));
-                    customHeadersElement.Add(removeHeaderElement);
-                }
-
-                var addHeaderElement = customHeadersElement.Elements("add")
-                    .SingleOrDefault(x => x.Attribute("name") != null &&
-                                          x.Attribute("name").Value == XFrameOptionsHeader);
-                if (addHeaderElement == null)
-                {
-                    addHeaderElement = new XElement("add");
-                    addHeaderElement.Add(new XAttribute("name", XFrameOptionsHeader));
-                    addHeaderElement.Add(new XAttribute("value", XFrameOptionsValue));
-                    customHeadersElement.Add(addHeaderElement);
-                }
-
-                doc.Save(configFile);
-
-                errorMessage = string.Empty;
-                return true;
-            }
-            catch (Exception ex)
-            {
-                errorMessage = ex.Message;
-                return false;
-            }
         }
     }
 }
diff --git a/src/Umbraco.Web/HealthCheck/Checks/Security/NoSniffCheck.cs b/src/Umbraco.Web/HealthCheck/Checks/Security/NoSniffCheck.cs
new file mode 100644
index 0000000000..4982d9f272
--- /dev/null
+++ b/src/Umbraco.Web/HealthCheck/Checks/Security/NoSniffCheck.cs
@@ -0,0 +1,15 @@
+namespace Umbraco.Web.HealthCheck.Checks.Security
+{
+    [HealthCheck(
+        "1CF27DB3-EFC0-41D7-A1BB-EA912064E071",
+        "Content/MIME Sniffing Protection",
+        Description = "Checks that your site contains a header used to protect against MIME sniffing vulnerabilities.",
+        Group = "Security")]
+    public class NoSniffCheck : BaseHttpHeaderCheck
+    {
+        public NoSniffCheck(HealthCheckContext healthCheckContext) 
+            : base(healthCheckContext, "X-Content-Type-Options", "nosniff", "noSniff", false)
+        {
+        }
+    }
+}
diff --git a/src/Umbraco.Web/Umbraco.Web.csproj b/src/Umbraco.Web/Umbraco.Web.csproj
index 0b5652e509..d6d622315f 100644
--- a/src/Umbraco.Web/Umbraco.Web.csproj
+++ b/src/Umbraco.Web/Umbraco.Web.csproj
@@ -325,6 +325,8 @@
     <Compile Include="HealthCheck\Checks\Config\TraceCheck.cs" />
     <Compile Include="HealthCheck\Checks\Config\ValueComparisonType.cs" />
     <Compile Include="HealthCheck\Checks\Config\CompilationDebugCheck.cs" />
+    <Compile Include="HealthCheck\Checks\Security\BaseHttpHeaderCheck.cs" />
+    <Compile Include="HealthCheck\Checks\Security\NoSniffCheck.cs" />
     <Compile Include="HealthCheck\Checks\Services\SmtpCheck.cs" />
     <Compile Include="HealthCheck\Checks\Permissions\FolderAndFilePermissionsCheck.cs" />
     <Compile Include="HealthCheck\Checks\Security\ExcessiveHeadersCheck.cs" />

From 6861453166e7498527925f292ee12e3097eb9a47 Mon Sep 17 00:00:00 2001
From: AndyButland <abutland73@gmail.com>
Date: Sun, 4 Jun 2017 14:35:37 +0200
Subject: [PATCH 2/2] Added localised texts and renamed some to less specific
 names when used across checks

---
 src/Umbraco.Web.UI/umbraco/config/lang/en.xml         | 11 ++++++++---
 src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml      |  6 +++---
 src/Umbraco.Web.UI/umbraco/config/lang/fr.xml         |  6 +++---
 src/Umbraco.Web.UI/umbraco/config/lang/nl.xml         |  6 +++---
 src/Umbraco.Web.UI/umbraco/config/lang/ru.xml         |  6 +++---
 src/Umbraco.Web.UI/umbraco/config/lang/zh.xml         |  6 +++---
 .../Checks/Security/ExcessiveHeadersCheck.cs          | 10 +++++-----
 .../HealthCheck/Checks/Security/HttpsCheck.cs         |  4 ++--
 8 files changed, 30 insertions(+), 25 deletions(-)

diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/en.xml b/src/Umbraco.Web.UI/umbraco/config/lang/en.xml
index d99cd8f43f..78326ab051 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/en.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/en.xml
@@ -1476,7 +1476,7 @@ To manage your website, simply open the Umbraco back office and start adding con
 
 	  <key alias="httpsCheckValidCertificate">Your site certificate was marked as valid.</key>
 	  <key alias="httpsCheckInvalidCertificate">Certificate validation error: '%0%'</key>
-	  <key alias="httpsCheckInvalidUrl">Error pinging the URL %0% - '%1%'</key>
+	  <key alias="healthCheckInvalidUrl">Error pinging the URL %0% - '%1%'</key>
 	  <key alias="httpsCheckIsCurrentSchemeHttps">You are currently %0% viewing the site using the HTTPS scheme.</key>
 	  <key alias="httpsCheckConfigurationRectifyNotPossible">The appSetting 'umbracoUseSSL' is set to 'false' in your web.config file. Once you access this site using the HTTPS scheme, that should be set to 'true'.</key>
 	  <key alias="httpsCheckConfigurationCheckResult">The appSetting 'umbracoUseSSL' is set to '%0%' in your web.config file, your cookies are %1% marked as secure.</key>
@@ -1516,10 +1516,15 @@ To manage your website, simply open the Umbraco back office and start adding con
 
     <key alias="clickJackingCheckHeaderFound"><![CDATA[The header or meta-tag <strong>X-Frame-Options</strong> used to control whether a site can be IFRAMEd by another was found.]]></key>
     <key alias="clickJackingCheckHeaderNotFound"><![CDATA[The header or meta-tag <strong>X-Frame-Options</strong> used to control whether a site can be IFRAMEd by another was not found.]]></key>
-    <key alias="clickJackingSetHeaderInConfig">Set Header in Config</key>
+    <key alias="setHeaderInConfig">Set Header in Config</key>
     <key alias="clickJackingSetHeaderInConfigDescription">Adds a value to the httpProtocol/customHeaders section of web.config to prevent the site being IFRAMEd by other websites.</key>
     <key alias="clickJackingSetHeaderInConfigSuccess">A setting to create a header preventing IFRAMEing of the site by other websites has been added to your web.config file.</key>
-    <key alias="clickJackingSetHeaderInConfigError">Could not update web.config file. Error: %0%</key>
+    <key alias="setHeaderInConfigError">Could not update web.config file. Error: %0%</key>
+    
+    <key alias="noSniffCheckHeaderFound"><![CDATA[The header or meta-tag <strong>X-Content-Type-Options</strong> used to protect against MIME sniffing vulnerabilities was found.]]></key>
+    <key alias="noSniffCheckHeaderNotFound"><![CDATA[The header or meta-tag <strong>X-Content-Type-Options</strong> used to protect against MIME sniffing vulnerabilities was not found.]]></key>
+    <key alias="noSniffSetHeaderInConfigDescription">Adds a value to the httpProtocol/customHeaders section of web.config to protect against MIME sniffing vulnerabilities.</key>
+    <key alias="noSniffSetHeaderInConfigSuccess">A setting to create a header protecting against MIME sniffing vulnerabilities has been added to your web.config file.</key>
 
     <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml b/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml
index 63fc12101f..1b161ae33f 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml
@@ -1471,7 +1471,7 @@ To manage your website, simply open the Umbraco back office and start adding con
 
     <key alias="httpsCheckValidCertificate">Your site certificate was marked as valid.</key>
     <key alias="httpsCheckInvalidCertificate">Certificate validation error: '%0%'</key>
-    <key alias="httpsCheckInvalidUrl">Error pinging the URL %0% - '%1%'</key>
+    <key alias="healthCheckInvalidUrl">Error pinging the URL %0% - '%1%'</key>
     <key alias="httpsCheckIsCurrentSchemeHttps">You are currently %0% viewing the site using the HTTPS scheme.</key>
     <key alias="httpsCheckConfigurationRectifyNotPossible">The appSetting 'umbracoUseSSL' is set to 'false' in your web.config file. Once you access this site using the HTTPS scheme, that should be set to 'true'.</key>
     <key alias="httpsCheckConfigurationCheckResult">The appSetting 'umbracoUseSSL' is set to '%0%' in your web.config file, your cookies are %1% marked as secure.</key>
@@ -1511,10 +1511,10 @@ To manage your website, simply open the Umbraco back office and start adding con
 
     <key alias="clickJackingCheckHeaderFound"><![CDATA[The header or meta-tag <strong>X-Frame-Options</strong> used to control whether a site can be IFRAMEd by another was found.]]></key>
     <key alias="clickJackingCheckHeaderNotFound"><![CDATA[The header or meta-tag <strong>X-Frame-Options</strong> used to control whether a site can be IFRAMEd by another was not found.]]></key>
-    <key alias="clickJackingSetHeaderInConfig">Set Header in Config</key>
+    <key alias="setHeaderInConfig">Set Header in Config</key>
     <key alias="clickJackingSetHeaderInConfigDescription">Adds a value to the httpProtocol/customHeaders section of web.config to prevent the site being IFRAMEd by other websites.</key>
     <key alias="clickJackingSetHeaderInConfigSuccess">A setting to create a header preventing IFRAMEing of the site by other websites has been added to your web.config file.</key>
-    <key alias="clickJackingSetHeaderInConfigError">Could not update web.config file. Error: %0%</key>
+    <key alias="setHeaderInConfigError">Could not update web.config file. Error: %0%</key>
 
     <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/fr.xml b/src/Umbraco.Web.UI/umbraco/config/lang/fr.xml
index 0064697d95..244f7921ce 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/fr.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/fr.xml
@@ -1351,7 +1351,7 @@ Pour gérer votre site, ouvrez simplement le backoffice Umbraco et commencez à
     <key alias="xmlDataIntegrityCheckContent">Total XML : %0%, Total publié : %1%</key>
 
     <key alias="httpsCheckInvalidCertificate">Erreur de validation du certificat : '%0%'</key>
-    <key alias="httpsCheckInvalidUrl">Erreur en essayant de contacter l'URL %0% - '%1%'</key>
+    <key alias="healthCheckInvalidUrl">Erreur en essayant de contacter l'URL %0% - '%1%'</key>
     <key alias="httpsCheckIsCurrentSchemeHttps">Vous êtes actuellement %0% à voir le site via le schéma HTTPS.</key>
     <key alias="httpsCheckConfigurationRectifyNotPossible">La valeur appSetting 'umbracoUseSSL' est fixée à 'false' dans votre fichier web.config. Une fois que vous donnerez accès à ce site en utilisant le schéma HTTPS, cette valeur devra être mise à 'true'.</key>
     <key alias="httpsCheckConfigurationCheckResult">La valeur appSetting 'umbracoUseSSL' est fixée à '%0%' dans votre fichier web.config, vos cookies sont %1% marqués comme étant sécurisés.</key>
@@ -1391,10 +1391,10 @@ Pour gérer votre site, ouvrez simplement le backoffice Umbraco et commencez à
 
     <key alias="clickJackingCheckHeaderFound"><![CDATA[Le header ou meta-tag <strong>X-Frame-Options</strong>, utilisé pour contrôler si un site peut être intégré dans un autre via IFRAME, a été trouvé.]]></key>
     <key alias="clickJackingCheckHeaderNotFound"><![CDATA[Le header ou meta-tag <strong>X-Frame-Options</strong> , utilisé pour contrôler si un site peut être intégré dans un autre via IFRAME, n'a pas été trouvé.]]></key>
-    <key alias="clickJackingSetHeaderInConfig">Configurez le Header dans le fichier Config</key>
+    <key alias="setHeaderInConfig">Configurez le Header dans le fichier Config</key>
     <key alias="clickJackingSetHeaderInConfigDescription">Ajoute une valeur dans la section httpProtocol/customHeaders du fichier web.config afin d'éviter que le site ne soit intégré dans d'autres sites via IFRAME.</key>
     <key alias="clickJackingSetHeaderInConfigSuccess">Une configuration générant un header qui empêche l'intégration du site par d'autres sites via IFRAME a été ajoutée à votre fichier web.config.</key>
-    <key alias="clickJackingSetHeaderInConfigError">Impossible de modifier le fichier web.config. Erreur : %0%</key>
+    <key alias="setHeaderInConfigError">Impossible de modifier le fichier web.config. Erreur : %0%</key>
 
     <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/nl.xml b/src/Umbraco.Web.UI/umbraco/config/lang/nl.xml
index bab3bd5d63..69750cb747 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/nl.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/nl.xml
@@ -1363,7 +1363,7 @@ Om een vertalingstaak te sluiten, ga aub naar het detailoverzicht en klik op de
 
     <key alias="httpsCheckValidCertificate">Het cerficaat van de website is ongeldig.</key>
     <key alias="httpsCheckInvalidCertificate">Cerficaat validatie foutmelding: '%0%'</key>
-    <key alias="httpsCheckInvalidUrl">Fout bij pingen van URL %0% - '%1%'</key>
+    <key alias="healthCheckInvalidUrl">Fout bij pingen van URL %0% - '%1%'</key>
     <key alias="httpsCheckIsCurrentSchemeHttps">De site wordt momenteel %0% bekeken via HTTPS.</key>
     <key alias="httpsCheckConfigurationRectifyNotPossible">De appSetting 'umbracoUseSSL' in web.config staat op 'false'. Indien HTTPS gebruikt wordt moet deze op 'true' staan.</key>
     <key alias="httpsCheckConfigurationCheckResult">De appSetting 'umbracoUseSSL' in web.config is ingesteld op '%0%'. Cookies zijn %1% ingesteld als secure.</key>
@@ -1403,10 +1403,10 @@ Om een vertalingstaak te sluiten, ga aub naar het detailoverzicht en klik op de
 
     <key alias="clickJackingCheckHeaderFound"><![CDATA[De <strong>X-Frame-Options</strong> header of meta-tag om IFRAMEing door andere websites te voorkomen is aanwezig!]]></key>
     <key alias="clickJackingCheckHeaderNotFound"><![CDATA[De <strong>X-Frame-Options</strong> header of meta-tag om IFRAMEing door andere websites te voorkomen is NIET aanwezig.]]></key>
-    <key alias="clickJackingSetHeaderInConfig">Voorkom IFRAMEing via web.config</key>
+    <key alias="setHeaderInConfig">Voorkom IFRAMEing via web.config</key>
     <key alias="clickJackingSetHeaderInConfigDescription">Voegt de instelling toe aan de httpProtocol/customHeaders section in web.config om IFRAMEing door andere websites te voorkomen.</key>
     <key alias="clickJackingSetHeaderInConfigSuccess">De instelling om IFRAMEing door andere websites te voorkomen is toegevoegd aan de web.config!</key>
-    <key alias="clickJackingSetHeaderInConfigError">Web.config kon niet aangepast worden door error: %0%</key>
+    <key alias="setHeaderInConfigError">Web.config kon niet aangepast worden door error: %0%</key>
 
     <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/ru.xml b/src/Umbraco.Web.UI/umbraco/config/lang/ru.xml
index 11ce7a3252..11948d9d26 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/ru.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/ru.xml
@@ -664,7 +664,7 @@
 
     <key alias="httpsCheckValidCertificate">Сертификат Вашего веб-сайта отмечен как проверенный.</key>
     <key alias="httpsCheckInvalidCertificate">Ошибка проверки сертификата: '%0%'</key>
-    <key alias="httpsCheckInvalidUrl">Ошибка проверки адреса URL %0% - '%1%'</key>
+    <key alias="healthCheckInvalidUrl">Ошибка проверки адреса URL %0% - '%1%'</key>
     <key alias="httpsCheckIsCurrentSchemeHttps">Сейчас Вы %0% просматриваете сайт, используя протокол HTTPS.</key>
     <key alias="httpsCheckConfigurationRectifyNotPossible">Параметр 'umbracoUseSSL' в секции 'appSetting' установлен в 'false' в файле web.config. Если Вам необходим доступ к сайту по протоколу HTTPS, нужно установить данный параметр в 'true'.</key>
     <key alias="httpsCheckConfigurationCheckResult">Параметр 'umbracoUseSSL' в секции 'appSetting' в файле установлен в '%0%', значения cookies %1% маркированы как безопасные.</key>
@@ -704,10 +704,10 @@
 
     <key alias="clickJackingCheckHeaderFound"><![CDATA[Был обнаружен заголовок или мета-тэг <strong>X-Frame-Options</strong>, использующийся для управления возможностью помещать сайт в IFRAME на другом сайте.]]></key>
     <key alias="clickJackingCheckHeaderNotFound"><![CDATA[Заголовок или мета-тэг <strong>X-Frame-Options</strong>, использующийся для управления возможностью помещать сайт в IFRAME на другом сайте, не обнаружен.]]></key>
-    <key alias="clickJackingSetHeaderInConfig">Установить заголовок в файле конфигурации</key>
+    <key alias="setHeaderInConfig">Установить заголовок в файле конфигурации</key>
     <key alias="clickJackingSetHeaderInConfigDescription">Добавляет значение в секцию 'httpProtocol/customHeaders' файла web.config, препятствующее возможному использованию этого сайта внутри IFRAME на другом сайте.</key>
     <key alias="clickJackingSetHeaderInConfigSuccess">Значение, добавляющее заголовок, препятствующий использованию этого сайта внутри IFRAME другого сайта, успешно добавлено в файл web.config.</key>
-    <key alias="clickJackingSetHeaderInConfigError">Невозможно обновить файл web.config. Ошибка: %0%</key>
+    <key alias="setHeaderInConfigError">Невозможно обновить файл web.config. Ошибка: %0%</key>
 
     <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/zh.xml b/src/Umbraco.Web.UI/umbraco/config/lang/zh.xml
index 0341316f25..7a0f4cac94 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/zh.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/zh.xml
@@ -1358,7 +1358,7 @@
 
 	  <key alias="httpsCheckValidCertificate">Your site certificate was marked as valid.</key>
 	  <key alias="httpsCheckInvalidCertificate">Certificate validation error: '%0%'</key>
-	  <key alias="httpsCheckInvalidUrl">Error pinging the URL %0% - '%1%'</key>
+	  <key alias="healthCheckInvalidUrl">Error pinging the URL %0% - '%1%'</key>
 	  <key alias="httpsCheckIsCurrentSchemeHttps">You are currently %0% viewing the site using the HTTPS scheme.</key>
 	  <key alias="httpsCheckConfigurationRectifyNotPossible">The appSetting 'umbracoUseSSL' is set to 'false' in your web.config file. Once you access this site using the HTTPS scheme, that should be set to 'true'.</key>
 	  <key alias="httpsCheckConfigurationCheckResult">The appSetting 'umbracoUseSSL' is set to '%0%' in your web.config file, your cookies are %1% marked as secure.</key>
@@ -1398,10 +1398,10 @@
 
     <key alias="clickJackingCheckHeaderFound"><![CDATA[The header or meta-tag <strong>X-Frame-Options</strong> used to control whether a site can be IFRAMEd by another was found.]]></key>
     <key alias="clickJackingCheckHeaderNotFound"><![CDATA[The header or meta-tag <strong>X-Frame-Options</strong> used to control whether a site can be IFRAMEd by another was not found.]]></key>
-    <key alias="clickJackingSetHeaderInConfig">Set Header in Config</key>
+    <key alias="setHeaderInConfig">Set Header in Config</key>
     <key alias="clickJackingSetHeaderInConfigDescription">Adds a value to the httpProtocol/customHeaders section of web.config to prevent the site being IFRAMEd by other websites.</key>
     <key alias="clickJackingSetHeaderInConfigSuccess">A setting to create a header preventing IFRAMEing of the site by other websites has been added to your web.config file.</key>
-    <key alias="clickJackingSetHeaderInConfigError">Could not update web.config file. Error: %0%</key>
+    <key alias="setHeaderInConfigError">Could not update web.config file. Error: %0%</key>
 
     <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
diff --git a/src/Umbraco.Web/HealthCheck/Checks/Security/ExcessiveHeadersCheck.cs b/src/Umbraco.Web/HealthCheck/Checks/Security/ExcessiveHeadersCheck.cs
index 2ca63662d8..e82c1c8770 100644
--- a/src/Umbraco.Web/HealthCheck/Checks/Security/ExcessiveHeadersCheck.cs
+++ b/src/Umbraco.Web/HealthCheck/Checks/Security/ExcessiveHeadersCheck.cs
@@ -46,10 +46,10 @@ namespace Umbraco.Web.HealthCheck.Checks.Security
         {
             var message = string.Empty;
             var success = false;
-            var url = HealthCheckContext.HttpContext.Request.Url;
-
-            // Access the site home page and check for the headers
-            var serverVariables = HealthCheckContext.HttpContext.Request.ServerVariables;
+            var url = HealthCheckContext.HttpContext.Request.Url;
+
+            // Access the site home page and check for the headers
+            var serverVariables = HealthCheckContext.HttpContext.Request.ServerVariables;
             var useSsl = GlobalSettings.UseSSL || serverVariables["SERVER_PORT"] == "443";
             var address = string.Format("http{0}://{1}:{2}", useSsl ? "s" : "", url.Host.ToLower(), url.Port);
             var request = WebRequest.Create(address);
@@ -69,7 +69,7 @@ namespace Umbraco.Web.HealthCheck.Checks.Security
             }
             catch (Exception ex)
             {
-                message = _textService.Localize("healthcheck/httpsCheckInvalidUrl", new[] { address, ex.Message });
+                message = _textService.Localize("healthcheck/healthCheckInvalidUrl", new[] { address, ex.Message });
             }
 
             var actions = new List<HealthCheckAction>();
diff --git a/src/Umbraco.Web/HealthCheck/Checks/Security/HttpsCheck.cs b/src/Umbraco.Web/HealthCheck/Checks/Security/HttpsCheck.cs
index 4e2dc4f8f5..e71c801566 100644
--- a/src/Umbraco.Web/HealthCheck/Checks/Security/HttpsCheck.cs
+++ b/src/Umbraco.Web/HealthCheck/Checks/Security/HttpsCheck.cs
@@ -74,11 +74,11 @@ namespace Umbraco.Web.HealthCheck.Checks.Security
                 {
                     message = exception.Status == WebExceptionStatus.TrustFailure
                         ? _textService.Localize("healthcheck/httpsCheckInvalidCertificate", new [] { exception.Message })
-                        : _textService.Localize("healthcheck/httpsCheckInvalidUrl", new [] { address, exception.Message });
+                        : _textService.Localize("healthcheck/healthCheckInvalidUrl", new [] { address, exception.Message });
                 }
                 else
                 {
-                    message = _textService.Localize("healthcheck/httpsCheckInvalidUrl", new[] { address, ex.Message });
+                    message = _textService.Localize("healthcheck/healthCheckInvalidUrl", new[] { address, ex.Message });
                 }
             }