Security Headers Explained
What security headers are, why they matter, and how to fix them.
Part of Security header monitoring — the full answer, the facts and the alternatives in one place.
Security Headers Explained#
LemWatch checks for essential HTTP security headers on every scan and grades your site A+ through F.
Key Headers#
| Header | Purpose | Impact |
|---|---|---|
| Strict-Transport-Security | Forces HTTPS connections | Prevents downgrade attacks |
| Content-Security-Policy | Controls which resources can load | Prevents XSS attacks |
| X-Frame-Options | Controls iframe embedding | Prevents clickjacking |
| X-Content-Type-Options | Prevents MIME type sniffing | Blocks content-type attacks |
| Referrer-Policy | Controls referrer information | Protects user privacy |
| Permissions-Policy | Controls browser feature access | Limits API abuse |
Security Grade#
LemWatch grades from A+ (all headers correctly configured) to F (missing critical headers):
How to Fix#
Click any missing header in LemWatch for stack-specific instructions:
Related Articles
SSL Certificate Monitoring
Track SSL certificate validity, expiry dates, and chain issues. Get warned 30, 14, and 7 days before certificates expire.
Understanding Your Security Grade
How LemWatch calculates your overall security grade.
Mobile-friendly check
Emulates a Moto G4 to detect tap targets <44px, unreadable font sizes, horizontal scroll, and missing viewport meta — the mobile-first indexing killers.
How does Lemwatch monitor XML sitemaps?
Lemwatch fetches every sitemap and sitemap-index nightly, validates XML, and alerts on 404s, drops in URL count, and stale lastmod dates.