Keep the headers that protect your site in place
Security headers are easy to lose. They are often set in one place — a reverse proxy, a CDN rule, a framework middleware — and when that place changes and they disappear, nothing visibly breaks. The site looks and works exactly as before; only the protection against clickjacking, mixed content or cross-site scripting has quietly disappeared. A yearly scan finds it eventually.
Pingsured checks the headers on every run.
What to check
Header checks read the response headers only, not the body, so they can sit on the same ping as your uptime check:
| Header | Operator | Value |
|---|---|---|
Content-Security-Policy | contains | frame-ancestors |
Strict-Transport-Security | matches | max-age=\d{8,} |
X-Content-Type-Options | equals | nosniff |
Referrer-Policy | exists | |
Server | does not exist |
The HSTS line passes for a max-age of eight digits or more — at least 10,000,000 seconds, about four months — so a header that was cut to a few minutes fails. The TLS check below judges its exact length. The last line is the reverse case: a header that should not be there, such as a version banner a new server image brought back.
Together with the TLS check
A TLS check on the same host covers the other half once a day: whether HSTS is long enough by Mozilla's guidelines, whether port 80 redirects to HTTPS, and whether cookies carry the Secure attribute. The header checks on an HTTP ping add the headers you choose, at the interval you choose.
Why check security headers with Pingsured
- On every run, not once a year. A header lost in a deploy is reported within minutes, not at the next penetration test.
- The headers you care about. Exact values, substrings, regular expressions or plain presence, up to 16 header checks per ping.
- Each location on its own. Headers set by a CDN can differ between edges; a check from several locations shows where one is missing.
- Since when, not only whether. The ping's history shows when a header went missing, and from which location.
Limits worth knowing
- A header check judges the response of the URL you configure. Pages served by a different application — a shop, a help centre on its own system — need a ping of their own.
- Header values are compared, not interpreted: a check confirms that a CSP contains
frame-ancestors, not that the policy is a good one.