For agencies and consultancies
Client-side security for every client you run
Every client site in one account, at $5.32 a site a month. That is the Business plan with all 75 of its sites in use, and billed annually it is $4.43.
Each client's alerts go to that client's own channel or webhook, and the free site scanner gives you a grade to start the conversation.
| Plan | Client sites | A month | A site, billed monthly | A site, billed annually |
|---|---|---|---|---|
| Team | 5 | $49 | $9.80 | $8.17 |
| Professional | 25 | $199 | $7.96 | $6.63 |
| Business | 75 | $399 | $5.32 | $4.43 |
Each figure is the plan's price over its sites, with every site in use. The pricing page has the rest of each plan.
Setup
One account, every client
A site per client, each with its own headers
Each client site is a site in your account with its own report host. Adding one gives you the response headers for that site, and the client's developer pastes them where the site sets headers today. There is no agent to install and nothing added to the page.
On the Professional and Business plans you can name a site's report host after the client, such as acme-shop.ingest.us.headerhawk.com.
Try it on a client site first
Start on the Free plan with 1 client site and 25k reports a month, at no cost. When the portfolio outgrows it, every paid plan starts with a 30-day free trial.
One allowance, tuned per site
Reports a month are one allowance for the whole account, shared by every site. Each site has its own switch and sample rate for every report type, so a busy client's shop can send a fraction of its reports while a quiet brochure site sends all of them.
Up to 10 people can sign in to the account on the Team plan, 50 on the Professional plan and 100 on the Business plan.
Alerts
Each client's alerts go where that client's work happens
A rule per client
An alert rule covers the sites you choose, so a rule for one client sends that client's alerts and nobody else's. Each rule can send to as many destinations as you like.
Send to a channel for that client in your Slack workspace, to a webhook on the client's own endpoint, or to email addresses that have confirmed they want the alerts. Slack connects one workspace to an account, so each client's channel sits in yours.
Email is on every plan. Slack and webhooks start on the Team plan.
Sites acme.com, shop.acme.com
Events every kind, including kinds added later
Delivery immediately, then a 24-hour cooldown
Destinations #client-acme in your Slack
Acme's webhook, signed with HMAC SHA-256For the client
Something to show the client
A grade to open the conversation
Before a client signs, run their site through the free site scanner. It grades the Content Security Policy and security headers, says what caps the grade and what to change, and its Share button copies a link to the result. The result is kept for thirty days, and neither you nor the client needs an account.
Evidence for a client under PCI DSS
The Professional and Business plans export the evidence for requirements 6.4.3 and 11.6.1 from the Compliance page, and the payment-page script inventory, as CSV files for the client's assessor.
The PCI DSS page has a sample of each file.
Plans
What each plan adds for a portfolio
Team plan
For a team rolling out a policy
- Sites
- 5
- Users
- 10
- Reports/month
- 500k
- Retention
- 30 days
Everything in the Free plan, plus:
- Slack alerts
- Webhooks
- Team access
- Script inventory
Professional plan
For payment pages under PCI DSS 4.0
- Sites
- 25
- Users
- 50
- Reports/month
- 2M
- Retention
- 90 days
Everything in the Team plan, plus:
- Payment pages
- Daily header scans
- Script authorization
- PCI DSS evidence export
- Payment-page script alerts
- API and MCP access
- Priority support
Business plan
For agencies and companies with many sites
- Sites
- 75
- Users
- 100
- Reports/month
- 10M
- Retention
- 90 days
Everything in the Professional plan, plus:
- Dedicated support
- Single sign-on (SAML)
- Report hosts on your own domain
Scope
One layer, and where it stops
HeaderHawk runs every client's browser reports, alerts and evidence from one account. Who at each client sees what, and how you package it for them, stays with you.
| For a portfolio, HeaderHawk | It is not built for |
|---|---|
| Holds every client site in one account, up to your plan's limit | Access limited to one client's sites. Everyone you invite sees every site in the account |
| Sends each client's alerts to that client's channel, webhook or inbox | Reports branded for your client, or a white-label dashboard |
| Grades any site for free, with a link to share the result | Billing each client separately. One subscription covers the account |
| Exports PCI DSS evidence for payment pages, on the Professional and Business plans |
Start with 1 client site, free
The Free plan covers 1 site with no card. Every paid plan starts with a 30-day free trial.