Security headers check

What it verifies

A security headers monitor requests the URL with one GET from each of its regions at its interval. It follows redirects and reads the names of the response headers. The monitor reports which selected headers are present and which are missing, and it never judges a value. As its own monitor with its own history, it keeps the header posture of a host visible apart from its availability.

Use it when

• Another monitor already covers the availability of the endpoint, and only the headers need watching.
• The header posture needs its own record: its own uptime figure, its own detail lines, and its own incident when you set the severity to failed.
• A deploy, a CDN change, or a reverse proxy update can drop a header without notice. You want the loss on the record after the next check or, with the severity set to failed, in an incident once the quorum agrees.

It judges presence, not values, so a Content-Security-Policy that allows everything passes. For assertions on status code and body, use the HTTP(S) check, which carries the same 5 headers as a sub-check in one monitor. For the certificate as its own signal, use the TLS certificate check.

Swipe sideways to inspect the product view.

app.perstat.io

Configuration

Target. A full URL including the scheme (https:// or http://), the same rule as the HTTP(S) check. The probe resolves and validates the URL and every redirect hop before fetching. It refuses loopback, private, link-local, and cloud metadata addresses, so the monitor cannot be pointed into an internal network.

How a check runs

1. When a check is due, each region parses the URL and resolves the host through the node’s own resolver. It validates every address of the selected family against the blocked ranges. Every check times out after 10 s.
2. Each address gets one GET, with the connection pinned to that address. The probe follows redirects itself, at most 5 hops, and resolves and validates each hop again before fetching it.
3. After the last redirect, the probe collects the names of the response headers in lowercase. It does not read the values.
4. The probe matches the selection against the list of 5 recommended headers and determines the missing ones. The missing_severity setting decides whether a missing header means degraded or failed.
5. On an https URL, the probe reads the certificate once for display. The certificate never changes the verdict.
6. The region sends its result to the control plane. The alert policy decides whether a failed result opens an incident once the quorum agrees. A degraded result stays out of the incident evaluation.

Swipe sideways to inspect the product view.

app.perstat.io

What a result contains

Status code

The status code of the response after redirects.

Response time

Time to the answer, per region and per address.

Detail line

One line that says all checked headers were present, or names the missing ones by their short labels, for example HSTS and CSP.

Cause layer

Whether a failure sat with the target’s DNS (name not found) or, after a successful lookup, with the target itself. Every other cause is reported as unknown.

Certificate

On an https URL, for display only: common name and alternative names, issuer, validity dates, and trust status.

Region, family, address

Every result carries the region that measured it, and one sub-result per IP family and per address.

States and severity

• okEvery selected header is present in the response after redirects.
• degradedAt least one selected header is missing at the default severity, or one IP family fails while the other answers.
• downA selected header is missing with missing_severity set to failed. A failed request counts too: a resolution error, a blocked target, a transport error, or a timeout.
• errorThe header selection contains no valid name. It counts as an outage with severity critical.

Confirmed by quorum: by default, 2 regions must report the failure before an incident opens. The organization default asks for 2 regions and 2 consecutive checks. A monitor can carry its own rule with count or percent, consecutive checks, and a minimum duration.

Plans and limits

Shortest interval

300 s on Free, 60 s on Pulse, 30 s on Sentinel, 15 s on Command, and 10 s on Enterprise. The web form offers 30 s, 1 min, 5 min, 15 min, and 1 h. The 15 s and 10 s floors are reachable only through MCP.

Regions

2 of 6 on Free, 3 of 6 on Pulse, and all 6 from Sentinel.

Monitors

10 probe monitors on Free, 50 on Pulse, 150 on Sentinel, 500 on Command, and a custom quota on Enterprise. Eleven regional check types share this quota, while host agents and heartbeats have their own. A pack of 50 more monitors costs €39.

Compare every plan limit

From the pipeline or an agent

The same config works in the deploy step, in an MCP client such as Claude Code, and in the form above. create_monitor needs an organization-wide API key. If you omit regions, the plan picks its default.

{
  "name": "Web security headers",
  "type": "http_headers",
  "interval_seconds": 300,
  "config": {
    "url": "https://www.example.com",
    "headers": [
      "strict-transport-security",
      "content-security-policy",
      "x-content-type-options"
    ],
    "missing_severity": "degraded"
  }
}

Every interface, with its boundary

Limits

• The check never reads the value of a header, so a weak policy passes as long as the header is set.
• Only the 5 listed headers can be selected. A selection without a valid name ends the check as an error.
• The check judges the response after the last redirect, not the first response. A header set only on the redirecting response is not seen.
• The probe sends one GET per address, with no method choice and no custom request headers.
• The probe refuses targets on private, loopback, link-local, and cloud metadata addresses.
• Not every region probes IPv6, so selecting ipv6 restricts the usable regions.

Related check types

• HTTP(S) checkAvailability and response of a URL, with assertions on status, body, and TLS.
• TLS certificate checkExpiry, issuer, and subject of a certificate by direct TLS handshake, with an advisory ahead of expiry.
• DNS hygiene checkSPF, DMARC with its policy, and CAA of a domain, graded as posture and never as an outage.

All check types