HTTP Security-Header Monitoring

What it checks

When you enable security-header monitoring on an asset, Merlonix fetches the site's homepage on your normal check cadence and grades the six core HTTP response security headers:

• Strict-Transport-Security (HSTS) — forces HTTPS. We also flag a header that is present but effectively off (a max-age of 0).
• Content-Security-Policy (CSP) — constrains what can load and run.
• X-Frame-Options — clickjacking / frame-embedding defence.
• X-Content-Type-Options — nosniff, stops MIME-type confusion.
• Referrer-Policy — controls what referrer data leaks outbound.
• Permissions-Policy — gates powerful browser features.

We also surface two quality signals a present/absent scanner misses: an HSTS header that is effectively disabled, and Set-Cookie headers missing the Secure flag.

Reading your grade

Each check records an A–F letter grade by how many of the six headers are present, shown as e.g. B · 5/6 on the asset detail page. The grade is informational — it is not folded into any pass/fail or compliance score, so it stays consistent with the free scanner and the audit report.

When it alerts

The value of monitoring (versus a one-time scan) is catching a regression: when a header that used to be present silently disappears — a deploy drops HSTS, a proxy change strips CSP — that present→absent transition trips a warning alert naming the dropped header. When it is restored you get an info recovery. If the site is unreachable or returns a non-2xx response, the check is recorded as unknown and never alerts, so a transient outage is not misread as a header regression.

Turning it on

Enable Monitor HTTP security headers when you add an asset (or on an existing asset). It is a $0 deterministic check — one homepage request on your existing cadence, no extra cost — and is available on every plan. To see your posture right now with no signup, use the free security-headers scanner on the marketing site.