> For the complete documentation index, see [llms.txt](https://firstoken.gitbook.io/api-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://firstoken.gitbook.io/api-docs/guides/implementing-monitor/security-headers-scanner/how-security-headers-scanning-works.md).

# How Security Headers Scanning Works

This section outlines the process for Security Headers Scanning, detailing the schedule, possible results, and incident notification system.

* Scanning Schedule: Weekly at 4:00 AM (UTC-5).
* Actionable Results: If a header is Missing or has an Invalid Value, an immediate email is sent.
* Incident Management: The detailed dashboard report allows users to update the incident status by marking it as resolved or ignored.

### **Scanning Schedule**

* **First Scan**: Automatically runs at 4:00 AM (UTC-5) the day after configuration
* **Subsequent Scans**: Weekly automatic scans every 7 days at the same time

> 🕐 **Timezone**: All scans operate on UTC-5 (Colombia/Eastern Standard Time)

### **Scan Results**

Each header scan produces one of three results:

| Result                   | Status                                 | Action                  |
| ------------------------ | -------------------------------------- | ----------------------- |
| **Correct Header value** | Header found with expected value       | No action needed        |
| **Invalid Value**        | Header present but value doesn't match | Email notification sent |
| **Header Missing**       | Header not found in response           | Email notification sent |

### **Incident Notifications**

When headers are missing or incorrect, you'll receive:

* Immediate email notification
* Detailed incident report in dashboard
* Specific header that failed validation
* Current vs. expected values comparison (In the incident page)
* Opportunity to update the incident status (mark as resolved or ignored) in the Incident Page