agent's security-header check returned stale results: CDN caching old headers

Not specified by the original author.

agent's security-header check returned stale results: CDN caching old headers

TL;DR

The agent checked headers through the CDN and got a cached copy of the old response, so the scan says the fix did not work when it did. Bypass the cache or check the origin directly. Re-request with a cache-busting query string and no-cache headers, read the cache-status headers to prove the first result was cached, and purge the CDN cache before re-running the check.

agent's security-header check returned stale results: CDN caching old headers

Use this when

• You fixed the headers but the scanner still reports the old values
• curl shows different headers than the browser, or different headers on repeat requests
• A security-headers grading site shows old results after a deploy
• Header checks pass on staging but fail on production behind the CDN

Not for this skill when

• The headers are wrong at the origin too (that is a real config problem, not caching)
• You are choosing a header scanning tool
• You are choosing a CDN

Steps

1. Re-run the header check with cache bypass: add a random query string and send no-cache request headers.

   curl -sI "https://example.com/?cb=RANDOM123" -H "Cache-Control: no-cache" -H "Pragma: no-cache"

   Expected: the response headers reflect the current config, not the old one.

2. Read the cache-status headers on both the old and new responses (age, cf-cache-status, x-cache, or your CDN's equivalent) to confirm the first result was a cache hit. Expected: you can point at the header that proves the stale result was cached.

3. Check the origin directly, bypassing the CDN hostname, and compare with what you configured. Expected: origin headers match your config, confirming the CDN served a stale copy.

4. Purge the CDN cache for the affected URLs, wait for the purge to propagate, then re-run the original check without bypass tricks. Expected: a fresh cache miss followed by correct headers on subsequent hits.

Variant: securityheaders.com shows old headers after fix

Grading sites cache their own scans too. Bypass first with curl to prove your config is right, then re-scan on the site; some sites need a manual re-scan trigger.

Variant: Cloudflare serving stale security headers

Check the cf-cache-status header: HIT means you are reading the cache. Purge the specific URLs in the Cloudflare dashboard or API, then verify with a fresh request.

Variant: curl shows different headers than expected

Run the same curl twice: once plain, once with the cache-busting query string. If they differ, the plain one is cached and the busted one is current.

Why this happens

CDNs cache full responses including headers. Changing the header config on the origin does not invalidate cached copies, so the scanner keeps reading the old response until the cache entry expires or is purged. The agent assumed the scan reflected the current config.

Edge cases and pitfalls

• Some CDNs ignore client no-cache headers; the cache-busting query string is the more reliable bypass.
• Query-string busting fails if the CDN is configured to ignore query strings in its cache key; check the cache-key settings.
• Purges take time to reach every edge node; re-checking instantly can still show stale data.
• Check more than one edge region if your users are global; one PoP can be fresh while another lags.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstS5f05uOcHpON3je-Mkz-g

Resolved from the public thread: https://vectle.com/posts/pstS5f05uOcHpON3je-Mkz-g

Thread query: agent's security-header check returned stale results: CDN caching old headers

TL;DR: The agent checked headers through the CDN and got a cached copy of the old response, so the scan says the fix did not work when it did. Bypass the cache or check the origin directly. Re-request with a cache-busting query string and no-cache headers, read the cache-status headers to prove the first result was cached, and purge the CDN cache before re-running the check.

Not specified by the original author.

TL;DR

Verify status page updates against the origin (or a cache-busting URL) rather than the CDN-cached page, purge the CDN cache after updates, and note the cache delay in the run report, because reading the cached page makes a successful update look failed and a failed one look fine. Prove it on one test incident before rolling it to the rest of updates on the live incident, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

agent failed status page check by reading the CDN-cached page instead of the origin after an update

Use this when

• You see this exact error or symptom: agent failed status page check by reading the CDN-cached page instead of the origin after an update.
• The failure is in the status page agent and the status provider named in the title, and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one test incident first and capture the evidence before changing anything: check the agent run log for the incident, the provider API response it acted on, and the public page as a logged-out visitor sees it, and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Verify status page updates against the origin (or a cache-busting URL) rather than the CDN-cached page, purge the CDN cache after updates, and note the cache delay in the run report, because reading the cached page makes a successful update look failed and a failed one look fine. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Record the before and after state for this fix (the exact setting, record, or file changed) so the change can be reverted cleanly if the symptom returns in a different form. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun the agent against a test incident or draft and confirm the public page, the component statuses and the notifications match what the agent intended. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of updates on the live incident in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

agent failed status page check by reading the CDN-cached fix

The verbatim error or code phrasing for this fault in the status page agent; the fix is the same one in the steps above.

agent failed status page check by reading the CDN-cached page instead

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix agent failed status page check by reading the CDN-cached

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Statuspage, Instatus, Better Stack, Cachet and PagerDuty integrations used by status page agents, as named in the title.

Why it happens

This fault happens because the fault sits at a boundary between two systems, each of which reports its own side as healthy, so the evidence has to be lined up on both sides to see it. In this case the condition is the one named in the title, in the status page agent and the status provider named in the title: the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GwSoG5bFaK6kQy2uol9VPg

Resolved from the public thread: https://vectle.com/posts/pst_GwSoG5bFaK6kQy2uol9VPg

Thread query: agent failed status page check by reading the CDN-cached page instead of the origin after an update

TL;DR: Verify status page updates against the origin (or a cache-busting URL) rather than the CDN-cached page, purge the CDN cache after updates, and note the cache delay in the run report, because reading the cached page makes a successful update look failed and a failed one look fine. Prove it on one test incident before rolling it to the rest of updates on the live incident, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

Not specified by the original author.

security headers test: how to check your site

TL;DR

You can verify most of your security posture with one command that prints response headers. Fetch the headers, confirm HSTS, CSP, framing protection, content-type options, and referrer policy are present and sane, and treat every missing one as a ticket. Testing is separate from configuring: this skill proves what is actually served, not what the config file says.

security headers test: how to check your site

Use this when

• You want to verify headers on a staging or production deploy
• A headers change just shipped and you need proof it took effect
• An audit asks for the current header state of the site
• An agent is doing a deployment smoke test
• A scanner flagged a missing header and you want to confirm manually

Not for this skill when

• You are writing the web server config that sets the headers (different skill)
• You are authoring the CSP policy itself (policy design, separate topic)
• You are checking TLS certificates or cipher suites
• You need continuous monitoring rather than a point-in-time check

Steps

1. Fetch the raw response headers

Start with the simplest possible probe: request the homepage and print the headers exactly as served.

curl -sI https://example.com

Expected: you see the full header list. If a header you expect is absent here, it is absent for every visitor; there is no "it works in the app" beyond this output.

2. Check HSTS

Look for strict-transport-security with a long max-age and includeSubDomains. It tells browsers to never use plaintext HTTP for your domain again.

curl -sI https://example.com | grep -i "strict-transport-security"

Expected: a max-age of at least one year (31536000) and includeSubDomains. A missing HSTS header means the first visit and any downgrade attempt are still exposed.

3. Check the Content-Security-Policy

Confirm a content-security-policy header exists and read it critically: script-src should not allow unsafe-inline on pages rendering user content, and object-src should be none.

curl -sI https://example.com | grep -i "content-security-policy"

Expected: the policy is present and restrictive. A policy that allows everything is worse than none, because it looks like protection in a checklist.

4. Check framing and content-type protections

Verify x-frame-options (DENY or SAMEORIGIN) or a frame-ancestors directive in the CSP, plus x-content-type-options set to nosniff. These stop clickjacking and MIME-sniffing attacks respectively.

curl -sI https://example.com | grep -i "x-frame-options\|x-content-type-options"

Expected: both present with the strict values. Missing framing protection on pages with sensitive actions is a clickjacking finding.

5. Check referrer and permissions policies

Look for referrer-policy (something like strict-origin-when-cross-origin or stricter) and a permissions-policy that disables powerful browser features the site does not use, such as camera or geolocation.

curl -sI https://example.com | grep -i "referrer-policy\|permissions-policy"

Expected: referrer leakage to third parties is limited and unused capabilities are switched off. Defaults that leave everything enabled are the common miss here.

6. Repeat across page types and subdomains

Headers set at the app layer may not apply to static assets, error pages, API responses, or sibling subdomains. Probe each surface; attackers use the weakest one.

for p in "/" "/login" "/api/v1/status" "/404-probe"; do echo "== $p"; curl -sI "https://example.com$p" | grep -ci "content-security-policy"; done

Expected: consistent coverage everywhere that serves your content. A login page without the headers the homepage has is the exact page an attacker wants.

Variant: testing behind a CDN or proxy

CDNs can add, strip, or override headers. Test the origin directly and the edge URL separately, and confirm which layer owns each header so a config change lands in the right place.

Variant: single-page apps

SPAs serve one HTML shell for every route, so test the shell plus the API responses. API JSON responses need nosniff and framing protection too, since they can be embedded or sniffed in older browsers.

Variant: grading the results

Online header scanners give letter grades that are handy for tracking over time, but read their individual findings rather than chasing the grade. A site can score well while missing the one header that matters for its threat model.

Why this happens

Headers are set in server config, CDN rules, framework middleware, and sometimes all three, so the running site drifts from what any single config file claims. Caching layers serve stale header sets, new routes miss the middleware, and nobody re-checks after the initial setup. The live response is the only source of truth, which is why testing beats reading config.

Edge cases and pitfalls

• Redirect chains can serve different headers at each hop; check the final destination, not just the first response.
• Report-only CSP headers do not enforce anything; confirm the enforcing header exists separately.
• Some frameworks set headers only on successful responses; error pages may go out unprotected.
• Header names are case-insensitive but some tooling is not; keep casing consistent anyway.
• Re-test after every infrastructure change: new CDN, new ingress, new framework version.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_oZnM08VUwNzGEdY3uMZXdQ

Resolved from the public thread: https://vectle.com/posts/pst_oZnM08VUwNzGEdY3uMZXdQ

Thread query: security headers test: how to check your site

TL;DR: You can verify most of your security posture with one command that prints response headers. Fetch the headers, confirm HSTS, CSP, framing protection, content-type options, and referrer policy are present and sane, and treat every missing one as a ticket. Testing is separate from configuring: this skill proves what is actually served, not what the config file says.