What does Lemwatch monitor?

Lemwatch runs 20+ automated checks per site: uptime, response time, SSL/TLS expiry, domain expiry, DNS changes, sitemap health, broken links, content changes, SEO audits, mobile usability, security headers, and more.

Yes. The free tier monitors up to 5 sites. Pro is $19/month for 50 sites and Agency is $59/month for 100 sites, both with full feature access.

How is Lemwatch different from UptimeRobot or Pingdom?

Lemwatch bundles uptime, change detection, SEO audits, security scans, and a public API in one platform — features competitors charge separately for. It also includes team workspaces, white-labelled status pages, and a webhook system out of the box.

Does Lemwatch send alerts?

Yes. Lemwatch supports email, browser push, webhooks, and per-site notification routing so the right person hears about the right incident.

Is there a public API?

Yes. Pro and Agency plans get a public REST API with webhooks for sites, checks, incidents, and reports.

Which security header should I add first?

Strict-Transport-Security. It is one line, it breaks nothing on a site already serving HTTPS everywhere, and it closes the protocol-downgrade attack that a plain HTTP-to-HTTPS redirect leaves wide open.

My CSP is present but the grade is still low. Why?

A Content-Security-Policy containing unsafe-inline, unsafe-eval or a wildcard script source permits nearly everything it is supposed to block. The header exists; the protection does not. The check grades what the policy allows, not whether the header is set.

Will these headers break my site?

X-Content-Type-Options, X-Frame-Options and Referrer-Policy are safe to add on almost any site. Content-Security-Policy can break third-party scripts and inline handlers, so roll it out in report-only mode first, read the reports, then enforce.

Do security headers affect SEO?

Not directly as a ranking factor. Indirectly they matter: a site that gets compromised and serves injected spam loses rankings quickly, and mixed-content and framing problems damage user trust signals.

Should headers be set at the CDN or the application?

Either works, but pick one and document it. The common failure is setting them in both places with different values, where whichever layer runs last silently wins and nobody knows which that is.

How often should I re-check?

After every infrastructure or CDN change at minimum. Headers are lost in configuration changes far more often than they are deliberately removed, which is the argument for checking them on a schedule rather than by hand.

Free Tool

Updated 7 June 2026

security header checker

Scan your website's HTTP security headers and get a grade from A+ to F. Find missing headers and get configuration examples.

By Deepak Shukla — Founder & CEO, Pearl Lemon

Part of Security header monitoring — the full answer, the facts and the alternatives in one place.

Enter your URL

What This Tool Checks

Strict-Transport-Security (HSTS)
Content-Security-Policy (CSP)
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy

Why This Matters

Security headers protect your site and visitors from attacks like clickjacking, XSS, and data injection. Missing headers leave your site vulnerable and can lower your security rating.

How to Fix Issues

1.Add HSTS header to enforce HTTPS
2.Implement Content-Security-Policy to prevent XSS
3.Set X-Frame-Options to prevent clickjacking
4.Add X-Content-Type-Options: nosniff

Security headers are instructions your server sends with every response telling the browser what it is allowed to do with your page. They cost nothing, they are configured once, and they close whole classes of attack. Enter a URL above and the check reads the live response headers and reports which protections are present, which are missing, and which are set to values that look right but do nothing.

The headers that matter, in the order they matter

Strict-Transport-Security tells the browser to refuse to load your site over plain HTTP ever again, which stops the downgrade attack that a redirect alone leaves open. Content-Security-Policy declares which sources may execute scripts, which is the single strongest defence against cross-site scripting — and the hardest to get right. X-Frame-Options (or the equivalent CSP frame-ancestors directive) stops your pages being embedded in someone else's site to trick your users into clicking things they cannot see. X-Content-Type-Options stops the browser guessing that an uploaded text file is really JavaScript. Referrer-Policy controls how much of your URL leaks to third parties. Permissions-Policy turns off camera, microphone and geolocation access for code you did not write.

Why headers disappear

Header configuration lives in the layer nobody owns: an nginx include, a CDN rule, a framework middleware, a hosting control panel toggle. Each deploy, migration or CDN change can drop them silently. The site works, the tests pass, and the protection is gone. This is why a header check taken once is worth much less than the same check repeated — most teams do not lose their headers in one dramatic moment, they lose them in a Tuesday afternoon configuration change.

Reading a poor grade

A missing header is not automatically an emergency. The realistic order of work is: get HSTS on, because it is one line and it closes a real attack; set X-Content-Type-Options and X-Frame-Options, because they are one line each and break almost nothing; set a Referrer-Policy; then take Content-Security-Policy seriously as a project rather than a quick fix. A policy containing unsafe-inline and a wildcard source scores as present and protects against very little, which is why the check reports what the value actually allows rather than just whether the header exists.

After the first fix

The value of headers is that they stay set. Once your grade is where you want it, the thing worth watching is regression — the deploy that drops the CSP, the CDN change that strips HSTS. That is a continuous check, not a one-off audit.

Methodology

We issue a single HTTPS GET to the URL you enter, following up to five redirects, and read the response headers of the final response — the one a browser would actually apply. Each header is parsed rather than merely detected: Strict-Transport-Security is checked for a max-age long enough to be meaningful and for includeSubDomains, Content-Security-Policy is inspected for directives that neutralise it such as unsafe-inline, unsafe-eval and wildcard sources, X-Frame-Options is checked for DENY or SAMEORIGIN and cross-referenced against a CSP frame-ancestors directive that supersedes it, and Referrer-Policy and Permissions-Policy are checked against the values browsers currently honour. Headers set on a redirect hop but not on the final response are reported as missing, because that is how the browser treats them. The grade is a weighted deduction from 100, with more weight on HSTS and Content-Security-Policy than on the advisory headers. We read only headers — no page content is executed, and nothing is stored beyond the result you see.

Frequently Asked Questions

This tool also answers

How do I check HTTP headers online?

Enter any URL above. The checker performs a live request and returns every HTTP response header the server sent, including status line, redirects, caching, content-type and the full security header set — no extension or terminal needed.

Is there an HTTP response header checker?

Yes. This tool is a full HTTP response header checker: it shows raw response headers exactly as returned, then grades the security-relevant ones (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy) with fixes for anything missing.

Monitor this continuously with LemWatch

A one-off free security header checker shows you today. LemWatch re-runs the same checks around the clock and alerts you the moment something breaks — free for up to 10 sites, no card needed.