PingView scans your site with the same Mozilla HTTP Observatory engine that powers MDN's scanner, on a schedule, and tells you when a header changes or disappears.
A proxy config change, a new CDN rule or a framework upgrade silently drops your Content-Security-Policy. Nothing errors, nothing goes down, the page still returns 200.
You lose a protection you already paid an engineer to add.
A header that exists can still be wrong. A CSP with unsafe-inline, an HSTS without a meaningful max-age, or a permissive CORS policy all pass a naive header check.
You believe you are covered while the policy does nothing.
Security questionnaires and vendor reviews want evidence over time, not a scan you ran the morning they asked.
Every audit turns into a scramble.
Same engine, same grading, attached to a monitor you already have.
Scans run through the @mdn/mdn-http-observatory package, so your grade and score match what the public MDN scanner would report.
Each test is evaluated for correct configuration and current best practice, with the reason and recommendation stored alongside the result.
The scan checks both the HTTP redirect behaviour and the HTTPS response, regardless of the scheme configured on the monitor, so a misconfigured redirect cannot hide.
Alongside headers, PingView grades your TLS setup from A+ to F, penalising expired certificates, deprecated protocols and weak cipher suites.
Header posture sits on the same monitor as uptime, SSL expiry and Lighthouse, not in a separate security tool
Failed scans are stored with diagnostic detail instead of vanishing, so you can tell a broken scan from a bad grade
Findings feed the branded PDF and the weekly report your client already receives
Put the Mozilla HTTP Observatory scanner on a schedule and keep the evidence.