Security headers check

The security headers check fetches your site's homepage once a day, inspects six standard response headers, and assigns a letter grade A–F. A grade drop or a new misconfiguration triggers an alert. The grade summary you see ("Grade F — 4 headers missing") counts only the headers that actually move the grade, so it always points at what you'd fix to improve it.

What it monitors

Four headers carry the grade:

• Strict-Transport-Security (HSTS) — forces clients to use HTTPS. Weighted heaviest in the grade. Misconfigured if max-age is below 180 days or includeSubDomains is missing.
• X-Frame-Options — controls whether the page can be loaded inside a frame (clickjacking protection). Misconfigured if it uses the deprecated ALLOW-FROM directive.
• X-Content-Type-Options — must be nosniff to prevent MIME-type sniffing.
• Referrer-Policy — controls the Referer header on outbound links. Misconfigured if it uses unsafe-url.

Two more are reported but display-only — we show their state without letting them move your grade, because sensible values are highly site-specific and a blanket score would misrepresent them. They're tagged display-only wherever they appear:

• Content-Security-Policy (CSP) — restricts which scripts, styles, and frames the browser will load. Misconfigured if it allows unsafe-inline or unsafe-eval. Display-only for grading, but a CSP regression still raises a high-severity alert on every domain (see Severity classification).
• Permissions-Policy — newer header that gates browser features (camera, geolocation, payment).

How the grade is computed

Each of the four graded headers carries a weight — HSTS 25, X-Frame-Options 15, X-Content-Type-Options 10, Referrer-Policy 10. Full credit when present and correctly configured, half credit when present but misconfigured, zero when missing. Score is normalized to 0–100 then mapped:

• A ≥ 90
• B ≥ 80
• C ≥ 70
• D ≥ 60
• F below 60

The check runs once every 24 hours — headers rarely change, so a tighter interval would just burn rate-limit budget on the upstream.

Alerts this check produces

Event	Tone	When it fires
security_headers_grade_dropped	Warning	The grade letter regressed from the previous run (e.g. A → B, B → D)
security_header_misconfigured	Warning	A specific header gained a new validation issue that wasn't present before

Severity classification

Security headers is an advisory check, and since July 2026 its severity is e-commerce-aware: what these headers are worth depends on what your site is.

• If DomainCare has detected your domain as an online store (see E-commerce detection): header findings are treated as Needs attention. Grades C and D show on a neutral pill; a grade F renders amber, and alert events for the graded headers fire at medium severity (digest tier).
• For every other domain — blogs, marketing sites, apps without a storefront: header findings are informational. All grades below B, including F, show on a neutral pill, and alert events fire at info severity (weekly digest only).
• Content-Security-Policy is the exception: a CSP regression (new unsafe-inline/unsafe-eval, or the header disappearing) always fires a high-severity alert, for every domain.

No grade ever counts toward the critical-failure total or renders red. This keeps your at-a-glance health score focused on outages and broken authentication while still surfacing header gaps you should address — loudest where they cost real money.

The e-commerce classification is read at check time, so a newly detected store gets the stricter treatment on its next security-headers run (within 24 hours, or immediately via a manual recheck).

What to do when alerts fire

1. Open your edge config — most teams set headers via Nginx, Caddy, Cloudflare, Vercel, or a framework next.config.ts. Find where the response headers for the affected route are defined.
2. Add the missing header. A safe starting point:
   • Strict-Transport-Security: max-age=31536000; includeSubDomains
   • Content-Security-Policy: default-src 'self' (then iterate)
   • X-Frame-Options: DENY
   • X-Content-Type-Options: nosniff
   • Referrer-Policy: strict-origin-when-cross-origin
3. Deploy and wait for the next check. The next run (within 24h) re-grades the response. Trigger a manual recheck from the per-domain page if you don't want to wait.
4. Iterate on CSP. A strict CSP often breaks first deploy because of inline scripts you didn't know about. Use the browser console + the Content-Security-Policy-Report-Only header to identify violations before enforcing.

Related

• SSL & TLS check — HSTS works in concert with a valid TLS cert
• Alert reference