What does Lemwatch monitor?

Lemwatch runs 20+ automated checks per site: uptime, response time, SSL/TLS expiry, domain expiry, DNS changes, sitemap health, broken links, content changes, SEO audits, mobile usability, security headers, and more.

Yes. The free tier monitors up to 5 sites. Pro is $19/month for 50 sites and Agency is $59/month for 100 sites, both with full feature access.

How is Lemwatch different from UptimeRobot or Pingdom?

Lemwatch bundles uptime, change detection, SEO audits, security scans, and a public API in one platform — features competitors charge separately for. It also includes team workspaces, white-labelled status pages, and a webhook system out of the box.

Does Lemwatch send alerts?

Yes. Lemwatch supports email, browser push, webhooks, and per-site notification routing so the right person hears about the right incident.

Is there a public API?

Yes. Pro and Agency plans get a public REST API with webhooks for sites, checks, incidents, and reports.

What are security headers?

Security headers are HTTP response headers that tell browsers how to handle your site's content securely. They help prevent attacks like XSS, clickjacking, and MIME-type sniffing by instructing browsers to enable security features.

Which security headers does Lemwatch check?

We check for HSTS (Strict-Transport-Security), CSP (Content-Security-Policy), X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, and other important security headers.

Why is HSTS important?

HSTS (HTTP Strict Transport Security) tells browsers to only connect to your site over HTTPS. This prevents downgrade attacks and cookie hijacking, ensuring all communication is encrypted.

What is Content Security Policy (CSP)?

CSP is a security header that specifies which sources of content (scripts, styles, images) are allowed on your page. It's one of the most effective defenses against XSS attacks.

How is the security grade calculated?

We score your site based on the presence and proper configuration of security headers, weighted by their importance. Critical headers like HSTS and CSP have higher weight than advisory headers.

Will missing security headers hurt my SEO?

While security headers aren't direct ranking factors, they protect your site from attacks that could lead to malware warnings, defacement, or blacklisting—all of which devastate SEO.

How do I add security headers to my site?

Security headers are typically added via your web server configuration (Apache, Nginx), CDN settings (Cloudflare, AWS CloudFront), or application framework. We provide specific recommendations for each header.

How often does Lemwatch check security headers?

Security headers are checked during every site audit, which runs daily by default. You can also trigger manual checks after making configuration changes.

Security Feature

Security Headers Monitoring

Protect your site from XSS, clickjacking, and other attacks. Lemwatch monitors your security headers and alerts you when configurations are missing or weak.

Security Headers We Monitor

Comprehensive checks for all important security headers

Strict-Transport-Security (HSTS)

Critical

Forces HTTPS connections, preventing downgrade attacks

Content-Security-Policy (CSP)

Critical

Controls allowed content sources, prevents XSS attacks

X-Frame-Options

High

Prevents clickjacking by blocking iframe embedding

X-Content-Type-Options

High

Prevents MIME-type sniffing vulnerabilities

Referrer-Policy

Medium

Controls how much referrer information is sent

Permissions-Policy

Medium

Controls browser features like geolocation, camera

Why Security Headers Matter

Without Proper Headers

✗XSS Attacks: Malicious scripts can run on your pages
✗Clickjacking: Your site can be embedded in malicious iframes
✗Downgrade Attacks: Users can be tricked into using HTTP
✗Data Leakage: Sensitive information exposed via referrers

With Lemwatch Monitoring

Know exactly which headers are missing or misconfigured
Get specific recommendations for each header
Track your security grade improvement over time
Include security status in client reports

How Security Header Monitoring Works

Automatic analysis and recommendations

Add Your Sites

Enter your URLs and Lemwatch immediately analyzes your security headers.

Automatic Analysis

We check all important security headers and grade your configuration.

Get Recommendations

Receive specific recommendations to improve your security posture.

Complete Security Monitoring

Everything you need to maintain a secure site

Security Header Analysis

Check for essential headers like HSTS, CSP, X-Frame-Options, and more.

HTTPS Configuration

Verify your site properly redirects to HTTPS and uses secure protocols.

Content Security Policy

Monitor your CSP headers to prevent XSS and injection attacks.

Security Alerts

Get notified when security headers are missing or misconfigured.

Security Reports

Include security scores in your professional reports for clients.

Server Configuration

Detect common server misconfigurations that expose vulnerabilities.

Security Headers FAQ

Common questions about security header monitoring

Start Securing Your Site Today

Join teams who use Lemwatch to monitor and improve their security posture. Security header monitoring included in all plans.

Get Started Free

No credit card requiredFree forever planCancel anytime

Quick answer

How do I monitor security headers like CSP and HSTS?

Read the response headers on every check, grade them against the current baseline, and alert when a header is weakened or disappears after a deploy.

Headers graded: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Output: A letter grade from A to F with the missing headers listed
Alerting: Fires when a previously present header is removed or weakened
Free check: Public security header checker, no account needed

Everything we publish on security header monitoring

Facts checked: 14 September 2026 by the Lemwatch research team.