Every browser report type
Browsers report far more than CSP violations, through the same Reporting API and to the same endpoint. HeaderHawk collects every type and files each where you would look for it. Security policy violations sit beside your CSP issues, deprecations under the date they will break, and failed requests and crashes by the origin that caused them.
Each type has its own switch and sample rate on each site, so the noisy ones cannot eat your quota, and the setup panel writes the headers for the types you switch on.
- Plans
- Every plan, the Free plan included
- In the dashboard
- Policy › Issues, and Browser signals
What's at stake
Your visitors' browsers already know what is about to break
A browser that refuses a frame, drops a request or runs an API it plans to remove says so, if you ask. Most sites never ask, and hear it from a customer.
Scheduled breakage
An API your checkout calls is being removed
Browsers announce removals months ahead and report every page that still calls the feature. Most teams first hear about it in the release that removes it.
Invisible failures
Requests that fail before your server sees them
A DNS failure, a TLS error or a dropped connection never reaches your logs, because there was no request to log. Only the browser saw it.
Policies nobody watches
Cross-origin and permission policies fail where nobody looks
A Cross-Origin-Embedder-Policy that breaks an embed, or a vendor script asking for the camera, is refused in the browser and reported only there.
What it does
One endpoint, every type, each where it belongs
Security policies, beside your CSP issues
Integrity Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Permissions Policy (including potential violations), Document Policy and connection allowlist violations arrive in the same Issues list and Explorer as CSP violations. A new issue alerts through the same rules. An enforced integrity check that blocks a script alerts the first time for that URL in a week.
Chrome holds a connection allowlist report until the visitor loads another page on your site, so a single-page visit sends none.
Security policies
CSP violations
Integrity Policy
Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy
Permissions Policy, and potential violations
Document Policy
Connection allowlist
Browser signals
Deprecations sampled from 5%
Interventions sampled from 5%
Reliability
Network errors (NEL)
CrashesDeprecations, soonest removal first
Deprecated APIs your pages still call, and the interventions the browser made on their behalf, are listed under Browser signals with the file and line that called them and the date the feature is due to go. Monday's digest lists every deprecated feature your pages use that is due for removal within 60 days.
{
"type": "deprecation",
"url": "https://shop.example.com/checkout/payment",
"body": {
"id": "UnloadHandler",
"message": "Unload event listeners are deprecated and will be removed.",
"sourceFile": "https://shop.example.com/assets/analytics.js",
"lineNumber": 88,
"columnNumber": 12,
"anticipatedRemoval": "2026-11-17T00:00:00.000Z"
}
}Network errors and crashes, by what caused them
Network Error Logging reports requests that failed before a response arrived, by error type, phase and origin. Crash reports name the tabs that crashed or stopped responding. Of the major browsers, only Chrome and Edge send them. When a site's network errors or crashes pass 20 in 15 minutes and five times their usual rate, it raises an alert.
A switch and a sample rate for each type
A deprecated API called on every page load reports on every page load. Deprecations and interventions start at a 5% sample, script hashes at 10% and the rest at 100%, each adjustable per site. Counts are scaled back up by the rate, so the page still shows how often something happens. A report switched off or sampled out never counts towards your monthly limit, and the browser samples network errors itself, so one it does not send costs nothing.
How it runs
One header names the endpoint. Each policy points at it.
- Reporting-Endpoints names the endpoint once, and each policy header refers to it by name, so the second and third report types cost no more integration than the first.
- The setup panel writes the headers for the types you switch on, report-only wherever a policy has a report-only form. For Document Policy, your own policy names the endpoint.
- No script is added to your pages. The browser generates every report and posts it directly.
- Every type is on every plan. What a plan changes is how many reports a month it covers.
Scope
One layer, and where it stops
These are the reports browsers send about your pages. Anything a browser does not report, or sends only to an email address, is outside this.
| Browser report collection does | It does not replace |
|---|---|
| Stores every Reporting API type browsers send to your endpoint | Email-delivered reports, such as DMARC, TLS-RPT or Certificate Transparency |
| Lists security policy violations with your CSP issues | Real user monitoring or performance timing |
| Orders deprecations by the date they will break | Your error tracker for JavaScript exceptions, which browsers do not report through this API |
| Alerts on a spike in network errors or crashes | Uptime checks from outside. A network error report arrives only from a browser that reached a page |
Ask the browser what it already knows
Every report type is on every plan. The Free plan covers 1 site with no card.