HeaderHawk
Product
Platform
How it works
Response headers, no agent
Script authorization
A decision and a reason per script
Script inventory
What ran, named from its hash
CSP violation reporting
Grouped down to the file and line
Policy change detection
Know when your CSP changes
Daily header scans
Each marked page, scanned daily
Browser report types
Every report type, one endpoint
Alerting
Scored alerts, Slack and webhooks
Start here
What client-side security is
The controls browsers already enforce, and how to roll out each one.
Read the guide
All features
Solutions
Threats
Cross-site scripting
Injected code, and what it may do
Magecart skimming
Card data copied off your checkout
Third-party scripts
Vendor code that changed itself
Clickjacking
Your page framed over something else
Mixed content
Insecure requests from a secure page
JavaScript integrity
The same URL serving different code
By team
Agencies
Every client site in one account
PCI DSS 4.0
Evidence for requirements 6.4.3 and 11.6.1
Each point, what HeaderHawk produces for it, and example evidence files to download.
See the mapping
All solutions
Tools
Free, no signup
CSP policy analyzer
Paste a policy, get graded findings
Hash generator
CSP and SRI hashes, or fetch a URL
Report header builder
A report-only header, ready to paste
Free tool
Grade your site's security headers
A letter grade for its Content Security Policy and headers, and what to change.
Scan a site
All free tools
Resources
Learn
Docs
Setup guides and the CSP reference
CSP by platform
Report-only configs for your stack
Blog
Incident write-ups and guides
Changelog
What shipped, and when
Evaluate
Compare
HeaderHawk beside the alternatives
Security
Where your data lives, who sees it
About
Who we are, and why we built it
Contact
Sales, support and partnerships
Incident write-up
The polyfill.io attack, in CSP reports
A CDN on 100,000+ sites began serving malicious code. What a violation report would have shown.
Read the write-up
Pricing
Log in
Sign up free
Menu
Product
Client-side security
How it works
Script authorization
Script inventory
CSP violation reporting
Policy change detection
Daily header scans
Browser report types
Alerting
All features
Solutions
PCI DSS 4.0
Cross-site scripting
Magecart skimming
Third-party scripts
Clickjacking
Mixed content
JavaScript integrity
Agencies
All solutions
Tools
Site scanner
CSP policy analyzer
Hash generator
Report header builder
All free tools
Resources
polyfill.io and CSP reports
Docs
CSP by platform
Blog
Changelog
Compare
Security
About
Contact
Pricing
Sign up free
Log in
← Blog
Topics
alerting
1 post
client-side-security
5 posts
csp-reports
8 posts
incidents
4 posts
magecart
3 posts
noise
1 post
pci-dss
1 post
reporting-api
1 post
script-hashes
2 posts
supply-chain
2 posts