See it, control it, prove it

Every report a browser sends, not only CSP

CSP violations, plus integrity, permissions, cross-origin, document policy and connection allowlist violations, deprecated APIs, browser interventions, failed requests and tab crashes. All through one endpoint, with a switch and a sample rate for each type.

Every plan, the Free plan included

Grouped down to the file and line

A thousand reports of one problem read as one problem, grouped by directive, blocked source and page. Open a group for the pages it affects and the reports behind it, with the source file, line, column, and the script sample where your policy asks for one.

Extension and bot noise held out of alerts

Reports from browser-extension URLs, data:, about: and blob: sources, and known bot user agents are marked as noise. They stay in the dashboard if you want them, and never raise an alert on their own.

A script inventory that names the library, not just the hash

With 'report-sha256' in your policy, Chrome and Edge report a hash of each script they fetch and run. The Scripts view lists them by origin and URL, and a new hash on a familiar URL means that script's contents changed. Where a hash matches a file in a published npm package version, the view names it, such as jquery 3.7.1 and the file inside the package. Your own build output usually matches nothing, and the view says so. It is a sample of what those browsers fetched, not a record of everything that ran.

The Team plan and above; the per-page breakdown on the Professional and Business plans

Your data from your own code, or an AI assistant

A versioned, read-only API answers your code with an API key, so the issues and scripts can go into your own reports and checks. A hosted MCP server lets Claude, ChatGPT, Cursor or Codex answer questions about the same data after you sign in, with nothing to install. Both read what a viewer can read and change nothing.

the Professional and Business plans

A site's own endpoint, and only its own hosts

Each site gets its own reporting endpoint, which you can rotate if it leaks. Reports are accepted only from the hosts the site lists, exactly or with a wildcard for every subdomain. Anything else is dropped and not counted against you.

Headers for the report types you switch on

The setup panel writes the report-only headers for the types you enable, with your endpoint in them, ready to paste. Document policy is the exception, since which features to turn off is your site's decision. Start in report-only, fix what it reports, then switch to the enforcing header.

An alert when a policy you have not been sending shows up

Every violation report quotes the policy in force. HeaderHawk remembers what each site reported recently and alerts when a new policy appears. A fresh nonce, a new directive order or a change of letter case is not a change, so a nonce-based policy is not new on every request. Whether the change was authorized is for a person to decide.

Every plan, the Free plan included

Daily scans of the pages you mark

One fetch per marked page, once a day, graded with the free site scanner's rubric. An alert when the grade drops, when a watched security header is added, removed or changed, or when the page cannot be scanned three days running. On a payment page the scan also fetches and hashes every script the HTML names, so scripts visitors have cached, or load without CORS, still reach the inventory with a hash you can pin. Nothing is crawled, and no JavaScript runs.

the Professional and Business plans

A sample rate for each type, so the noisy ones cannot eat your quota

A deprecated API called on every page load reports on every page load. Each type has its own switch and sample rate (deprecations and interventions start at 5%), and counts are scaled back up, so the page still shows how often it happens. A report switched off or sampled out never counts towards your monthly limit. The browser samples network errors itself, so one it does not send costs nothing.

Payment pages, marked and treated differently

Mark your checkout pages, then filter issues and scripts to them and scope alert rules to them. The pages that matter most get a list of their own.

the Professional and Business plans

Script authorization with a written justification

Authorize or reject each script reported on a payment page or found by its daily scan, with a required justification. An authorization either pins the versions you reviewed or accepts any content from that URL. Decisions are append-only, record who made them and when, and stay readable after a downgrade. The inventory exports as CSV.

the Professional and Business plans

Alerts when a payment page's scripts change

A script new to the site running on a payment page, an unpinned version of a pinned script, a rejected script running again, or, from the daily scan alone, a script that left the page or moved to another host. Anyone can post a report, so new and changed script alerts from browsers wait until two different networks have reported the script within 24 hours. The daily scan fetches each script itself and alerts without waiting. A site's first day, and a page's first scan, set the baseline and raise no alerts. HeaderHawk records the decision and does not enforce it, so a rejected script runs until your site or your policy stops it.

the Professional and Business plans

A verified copy of the script that ran

When a new version of a payment-page script appears, HeaderHawk fetches it once and keeps the file only if its SHA-256 matches what the browser reported. Months later you can open the exact code your decision was about, after the vendor has replaced it. Owners and admins download it, and every download is recorded. If the file changed before the fetch, we record a mismatch with the fingerprint of what was served, so a copy is held for most versions, not every one. Copies are kept for twelve months and stored, not analysed.

the Professional and Business plans

Known vulnerabilities in the libraries it names

A script named as a library version is checked against OSV's published advisories for that version when it is first seen and every day after, so today's advisory reaches a script that has run for months. Each shows its severity, the release that fixes it and a link to the source, and a high or critical one alerts once. It reads what browsers ran, not a lockfile, so it covers the tag manager's script and a vendor's widget too. A flag is about the version, not your page. A script that cannot be identified is not assessed, and never shown as clean.

the Professional and Business plans

Alerts where you already work, scored before they are sent

Email, Slack and webhook destinations, with rules per site. A window reported by two browser families, or twenty times by one, alerts at once, and quieter ones go into a daily or weekly digest. Monday's digest lists the deprecated features your pages still use that are due for removal within 60 days.

Slack and webhooks on the Team plan and above