About HeaderHawk
Client-side security for the code you ship to machines you do not run.
What we are building
HeaderHawk is where your visitors’ browsers send their security reports, and the dashboard that reads them: violations of your Content Security Policy and your integrity, permissions and cross-origin policies, deprecated APIs, failed requests, crashes, and a fingerprint of each script those browsers ran.
The controls for that layer have been in browsers for years. Reading what they report has been the hard part. Reports arrive in the thousands with no context, many of them caused by somebody’s ad blocker, and the tools on offer showed everything except the page and the line.
So the product is built around that screen. A thousand reports read as one problem, opening onto the file, line and script sample behind it, with extension and bot noise kept out of your alerts. Features sets out the rest, by plan.
Why we built it
HeaderHawk was founded by Michael Cameron, who spent years running platform engineering, IT operations and security for a health insurer. The servers there had every control you would expect, layer on layer: firewalls, scanning, logging and review.
The same code then shipped to users’ browsers, next to vendors’ scripts, with almost nothing around it. The browser is not your infrastructure, but your code runs there and your customers type their data there, so it is part of your environment. What client-side security is makes that argument in full.
The controls were already there, as response headers every major browser enforces. What was missing was a way to read what they reported. Rollouts stalled under thousands of reports, most of them noise from browser extensions and bots, and teams either built their own collection or went without.
HeaderHawk closes that gap. Security and engineering teams see what runs in their visitors’ browsers, put policies around it that the browser enforces, and keep the evidence that those policies held.
What we hold to
The principles behind the product.
Response headers, no agent
Rollout is a change to the response headers you already manage. Nothing loads into your pages and nothing sits in your visitors’ request path, so there is no new script for your own review and no new dependency for your site to fail on.
Findings your team can act on
A thousand reports read as one issue, with the file and line behind it. Noise from browser extensions and bots stays out of your alerts, so a rollout keeps moving.
Evaluate before you buy
Every self-serve price and limit is on the pricing page. Your team can try HeaderHawk on its own traffic on the Free plan before procurement starts, and the Enterprise plan is a contract built around what you need.
Careful with your data
A report carries whatever the browser sent, including the page URL, the referrer and the user agent, and HeaderHawk records the sending IP with the raw body. None of it is used to track individual people, and none of it is sold. It is deleted on a retention schedule, and the privacy policy says what is kept and for how long.
Working with larger organisations
Anyone can sign up and start on a published plan without talking to us. Larger organisations buy the Enterprise plan, an agreement written around their procurement, security and legal requirements. Security and data handling sets out what we store, where it runs, how long it is kept and who else touches it.
- Security review support
- Security questionnaires, a DPA, and contracts on your paper.
- Invoicing and payment terms
- Purchase orders, net terms, and annual or multi-year agreements.
- An SLA
- An availability commitment, with service credits behind it.
- Geographic hosting and processing
- The region your reports are stored and processed in, named in the contract.
- A dedicated account contact
- Named people on both sides, and a regular review.
- Onboarding support
- We roll the policy out alongside your team, from report-only to enforced.
Talk to us
Evaluating HeaderHawk, working through a security review, or planning a rollout across several sites? Tell us what you need and we will come back to you.