- From
- Netonica
- To
- You
- Subject
- Security Headers check of shop.example.com: HSTS disabled
Selected assertion “HSTS enabled” fails.
- Change
- 1 year → 0 seconds
- Seen at
- Sun, 01 Nov 2026 16:00:11 UTC
Open the monitor for details.
View monitorDid your server drop post-quantum TLS?
We test your TLS handshake on every scan. If post-quantum key exchange is dropped, “Supports post-quantum key exchange” fails and we alert you.
Security change monitoring for IT and DevOps teams.
Now
Other checks: DNS TLS Security Headers security.txt MCP Agent Card x402 all checks
When Example change Last scan This scan Result
18 minutes ago example.com Post-quantum key exchange support added — X25519MLKEM768 Logged, no alert
The endpoint added and now prefers hybrid post-quantum key exchange while retaining classical support.
1 hour ago example.com (A) Records changed 192.0.2.34 removed 192.0.2.35 192.0.2.34 added 198.51.100.35 Alert raised“DNS answer unchanged” fails
18 minutes ago
example.
X25519MLKEM768
Logged, no alert
Start free trial
14 days of the Team plan. No credit card required.
Read: Is post-quantum key exchange still on after your last CDN change?
Keep checking after the pentest
Your hosting provider, CDN and DNS host change settings on their own schedule. Most of their changes leave your site up, so your uptime monitor says nothing and you hear about them from a customer or at the next pentest. Each line names the assertion that catches its change.
- Your hosting provider Moved your certificate to a different CA. Use “Issuing CA unchanged” on your TLS check and pin your current issuer.
- Your CDN Dropped the Content-Security-Policy header it used to add. Use “CSP present” on your Security Headers check.
- Your DNS host Moved your zone to new nameservers. Use “DNS answer unchanged” on your DNS check for the NS record at example.com and pin your current records.
- Your email provider Set your DMARC policy to none. Use “DMARC set to quarantine or reject” on your DNS check for the DMARC record at example.com.
- Your docs provider Removed the hostname your docs subdomain still points to. Use “No dangling alias” on your DNS check for the A record at docs.example.com.
- An MCP server your agent calls Stopped requiring sign-in. Use “Authentication required” on your MCP check.
You're in the middle of a release
The alert tells you what changed and which selected assertion failed. Open the affected monitor from the email to review the exact diff.
- deploy You ship a release
- scan The next scan sees HSTS disabled
- inbox This email arrives
Example email
See which default assertions your endpoint fails today.
Run a free check
No sign-up needed
When a subdomain outlives its app
A hosted app was shut down, but the docs CNAME still points to the app’s hostname. Whoever claims that hostname next can serve pages on your docs subdomain. A DNS monitor for that CNAME alerts when its target stops resolving, with “No dangling alias” ticked by default. Every change is dated with before and after values.
When Example change Last scan This scan Result
2 days ago docs.example.com (CNAME) Alias stopped resolving example-docs.pages.dev resolves example-docs.pages.dev does not resolve Alert raised“No dangling alias” fails
2 days ago
docs.
example-docs.resolves does not resolve
Alert raised“No dangling alias” fails
- Ticked by default:
- Name exists, DNS answer present, DNS answer unchanged and No dangling alias
- You can also tick:
- Alert on every change
Run the same DNS check on your own domain.
Run a free check
No sign-up needed
An auditor asks when that header changed
Every change is kept with its date and its before and after values, including changes that sent no alert. When a security questionnaire asks, find it under “All changes”. Your plan sets how far back you can look.
When Example change Last scan This scan Result
18 minutes ago example.com Post-quantum key exchange support added — X25519MLKEM768 Logged, no alert
1 hour ago example.com (A) Records changed 192.0.2.34 removed 192.0.2.35 192.0.2.34 added 198.51.100.35 Alert raised“DNS answer unchanged” fails
6 hours ago api.example.com Expiry approaching 30 days or less 14 days or less Alert raised“Expires in more than 14 days” fails
1 day ago shop.example.com HSTS disabled 1 year 0 seconds Alert raised“HSTS enabled” fails
2 days ago example.com Contact added — mailto:security@example.net Alert raised“No new contacts” fails
2 days ago mcp.example.com/mcp Tool added — fetch_site_map Alert raised“Tool wording unchanged” and “No new tools” fail
2 days ago example.com Skill wording changed Summarises one public web page. Summarises any page, including ones behind a login. Alert raised“Skill wording unchanged” fails
2 days ago api.example.com/api/data Price changed 50000 100000 Logged, no alert
18 minutes ago
example.
X25519MLKEM768
Logged, no alert
1 hour ago
example.
removed 192. added 198.
Alert raised“DNS answer unchanged” fails
6 hours ago
api.
30 days or less 14 days or less
Alert raised“Expires in more than 14 days” fails
1 day ago
shop.
1 year 0 seconds
Alert raised“HSTS enabled” fails
2 days ago
example.
mailto:
Alert raised“No new contacts” fails
2 days ago
mcp.
fetch_
Alert raised“Tool wording unchanged” and “No new tools” fail
2 days ago
example.
Summarises one public web page. Summarises any page, including ones behind a login.
Alert raised“Skill wording unchanged” fails
2 days ago
api.
50000 100000
Logged, no alert
Questions before the first check
Is this a vulnerability scanner?
No. You can check your site's certificates, DNS records and security headers and see how they change between scans. We don't try to exploit your site or API.
Is it an uptime monitor?
No. Keep your uptime monitor running alongside Netonica for outage alerts.
Do I need to install anything?
No. We check from outside, the way anyone on the internet can. We need no access to your servers and nothing installed on them.
Why not run a free check now and then?
You have to remember to run each free check. A monitor repeats your check and records changes. Default scan schedule: hourly. Scans can run hourly on Pro, every 30 minutes on Team and every 15 minutes on Business.
How noisy is it?
Monitors alert when selected assertions fail or recover. A new monitor selects a few by default. The first scan alerts on failing selected assertions. Assertions that compare saved values, like your certificate's issuer, start once you pin the current value. Every other change goes under “All changes” without an alert, unless you turn on “Alert on every change”.
What if nothing changes during my trial?
The first scan alerts on failing selected assertions. For example, a required security header may be missing. You get 14 days of the Team plan. No credit card required.
What happens when my trial ends?
If you have not chosen a paid plan, your monitors are paused when the trial ends. Choose a paid plan to resume them. See plans.
Where can I receive alerts?
You can receive alerts by email, in Slack or through webhooks on every paid plan. Set up the channels in your workspace, then choose which ones each monitor uses.
What does your scanner do to my site?
We make TLS connections, DNS lookups or HTTP requests to the address you choose. We don't try to exploit your site, sign in, guess passwords or crawl your pages. What our scanner reads and how to request a stop.
Check your site or API
See which assertions your site or API passes today.
Run a free check
Start free trialNo sign-up needed