Site Sentinel identifies selected header names that were absent from the fetched response. Use the result as a starting point for a website configuration review.

Review the advisory

1. Open PD Modules → Site Sentinel → Needs attention.
2. Select Advisory if needed and find Security headers are missing.
3. Read the missing names in What it means.
4. Confirm Grade the security headers is enabled in Settings and check the site’s scan time.

The check looks for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. A missing-header advisory is not proof that a site has been breached.

Review the site’s intended policy

Use the website’s normal administration process to decide appropriate values. Do not paste a restrictive policy simply to remove an advisory; it can affect scripts, embedded content and other website behaviour. The module tests presence of header names, not whether each value is safe, complete or suitable for the application.

Check redirects and a later result

Review the final page response and redirect behaviour independently. The module’s collected response headers can include values from earlier redirect responses, so an absent finding is not a complete final-response policy assessment.

After a website change, verify its actual response and the relevant site’s next scan. Keep the check enabled while comparing results. Accepting a finding changes the attention list rather than configuring a header.

See the PD Site Sentinel Blesta guide for related tasks, or explore PD Site Sentinel.