Microsoft Azure (edge and hosting)

An `X-Azure-Ref` header — weight 90. Azure's documentation describes it as a unique reference string identifying a request served by Front Door.

An `X-MSEdge-Ref` header — weight 85.

`*.azureedge.net` or `*.azurefd.net` asset URLs — weight 60; `*.blob.core.windows.net` or `*.azurewebsites.net` URLs — weight 60.

It is reported as an Azure edge or hosting product, never as proof that the whole infrastructure is on Azure.

Azure's App Service security overview says the HTTPS-only redirect is not on by default and must be enabled explicitly.

It adds that the app's default domain name, `<app_name>.azurewebsites.net`, is already reachable over HTTPS.

So a custom domain can answer over plain HTTP until the setting is changed, while the default hostname keeps serving the same app alongside it.

Two hostnames serving one site is also a duplicate-content and canonical question, not only a security one.

For custom subdomains, Azure's custom-domain tutorial recommends a CNAME to the app's default hostname rather than an A record, because the app's IP address can change — which is also why the default hostname never goes away.

Azure's origin security guidance says Front Door's features work best when traffic only flows through Front Door.

It warns that an origin not configured to block other traffic can be reached around Front Door, bypassing its web application firewall, DDoS protection and other security features.

The documented remedies include restricting the origin to Front Door traffic and, on the premium tier, Private Link origins.

An App Service default hostname still answering publicly is exactly that bypass.

Azure Storage can serve a static website from a container named `$web`.

The documentation says files in `$web` are served through anonymous access requests and are available only through read operations.

Everything placed there is therefore public by design, which is the question to ask of every file in it.

Storage URLs referenced from a page show where files are served from, not where the page is hosted.

The documentation adds that file names in `$web` are case-sensitive, so a link differing only in case returns an error rather than the file.

`technology.azure` reports the Azure products observed and the DNS provider when it is Azure DNS.

`infrastructure.cloud_provider` and `infrastructure.cdn` place the detection among the other infrastructure signals.

`transport.http_redirect` reports whether plain HTTP is redirected on the audited host.

`infrastructure.origin_exposure` and `seo.canonical` report signs of a second hostname serving the same content.

Azure's origin security guidance lists four approaches: Private Link on the premium tier, managed identities, IP address filtering and the Front Door identifier.

IP filtering and the Front Door identifier are available on every tier, including classic, which leaves no tier without a way to close the bypass.

Front Door also returns an `X-Cache` header describing the caching status of each request, alongside `X-Azure-Ref`.

From outside, the origin's openness shows only when a second hostname or address answers with the same site; the restriction itself is configured and verified in Azure.