Policy change detection
Every violation report quotes the Content Security Policy in force when it happened. HeaderHawk remembers the policies each site has been sending and alerts when a new one appears, so a directive loosened in a hurry on Friday reaches you on Friday, not at the next audit.
The Changes view keeps each version with the dates it was first and last seen, so you can say what the policy was on a given day.
- Plans
- Every plan, the Free plan included
- In the dashboard
- Policy › Changes
What's at stake
The policy you approved is not always the one being sent
Deploys, frameworks, edge rules and whoever is fixing a broken widget all change a Content Security Policy. Most of those changes are fine, and the harmful ones look just like them.
Quiet loosening
One keyword to make the error go away
A widget breaks, someone adds 'unsafe-inline' or a wildcard host to get it working, and the fix ships. The site works, the policy is weaker, and nothing turns red.
Changed elsewhere
Not every policy change is a pull request
A CDN rule, a framework upgrade with new defaults, or a proxy in front of one route can each send a policy different from the one in your repository, and none of them asks for review.
No history
What was the policy in March?
An assessor or an incident review asks what your pages were sending on a date. The live header answers for today only.
What it does
Read from the reports you already send
An alert when a new policy appears
Each site has a set of policies it has sent in the last 30 days. A policy outside that set is watched until two browser families have reported it, or it has twenty reports, the evidence a real issue needs. Then it alerts once and joins the set. Rolling back to a policy last seen more than a month ago alerts too.
While a deploy rolls out, the old and new policies both appear, and both are known, so switching between them raises nothing. A site's first day of reports sets its baseline without alerting.
Nonces are not changes
Before policies are compared, nonces become one placeholder, directives are sorted and case is ignored. A nonce-based policy stays one policy across requests, and a framework that reorders directives does not look like a change.
Every version, with its dates
The Changes view lists each policy a site has sent, whether it was enforcing or report-only, when it was first and last seen, and how many reports quoted it, as far back as your plan keeps reports. Where a site sends different policies on different routes, it narrows to one monitored page.
HeaderHawk says a policy changed. Whether the change was authorized is for a person to decide, against your own deploys.
enforce first seen 12 Sep last seen today 14,210 reports
default-src 'self'; script-src 'nonce-*' 'self'
'unsafe-inline' https://js.stripe.com; ...
enforce first seen 02 Jul last seen 12 Sep 38,904 reports
default-src 'self'; script-src 'nonce-*' 'self'
https://js.stripe.com; ...How it runs
Nothing to switch on, and nothing to add.
Because it listens instead of fetching, it hears about a policy only when a page sending it produces a violation report. A page that reports nothing, or a policy that stops being sent, goes quiet without an alert. On the Professional and Business plans, daily header scans fetch the pages you mark and catch that case.
- It reads the policy your violation reports already carry, so there is no new header and no setup step.
- Nothing fetches your pages. The evidence is what real browsers were sent.
- It sees the policy on every route that produces reports, including the ones behind a login.
Scope
One layer, and where it stops
This is the passive half of watching your headers. The active half is the daily scan on the Professional and Business plans, which reads every watched security header on the pages you mark whether or not anything reports.
| Policy change detection does | It does not replace |
|---|---|
| Alerts when a site starts sending a policy it has not sent in 30 days | Review of the change itself. It says a policy changed, not whether it should have |
| Treats a fresh nonce, a new directive order or a change of case as the same policy | A scan of the policy a page serves when nothing reports, which the daily header scans do |
| Keeps each version with its first and last sighting | A judgement of whether a policy is strong. The free CSP analyzer grades one |
| Works on every plan, from the reports you already send |
Know when your policy changes
Policy change alerts are on every plan. The Free plan covers 1 site with no card.