Priced in the open
Every limit is on this page. Start on the Free plan with no card, or try any paid plan for 30 days, with no card either.
Free
For trying HeaderHawk on a real site.
$0
Free forever, no card
- Sites1
- Reports/month25k
- Retention15 days
- Team members1 user
Plan features
- Reports grouped into issues
- Every browser report type
- Policy change alerts
- PCI DSS readiness view
Team
For a team rolling out a policy.
$49/mo
$41/mo billed annually
30-day free trial, no card
- Sites5
- Reports/month500k
- Retention30 days
- Team members10 users
Everything in the Free plan, plus:
- Slack alerts
- Webhooks
- Team access
- Script inventory
For PCI DSS
Professional
For payment pages under PCI DSS 4.0.
$199/mo
$166/mo billed annually
30-day free trial, no card
- Sites25
- Reports/month2M
- Retention90 days
- Team members50 users
Everything in the Team plan, plus:
- Payment pages
- Daily header scans
- Script authorization
- PCI DSS evidence export
- Payment-page script alerts
- API and MCP access
- Priority support
Business
For agencies and companies with many sites.
$399/mo
$333/mo billed annually
30-day free trial, no card
- Sites75
- Reports/month10M
- Retention90 days
- Team members100 users
Everything in the Professional plan, plus:
- Dedicated support
- Single sign-on (SAML)
- Report hosts on your own domain
Over your limit? We keep the reports, up to twice your limit, and upgrading shows them. How going over works
Enterprise
For organisations buying on their own terms, with limits and obligations set by contract
An Enterprise contract can cover any of the items below. We work out which ones you need on the first call.
CustomTalk to us
Everything in the Business plan, plus:
- Custom limits
- Sites, reports a month, retention and team members, set by your contract.
- Dedicated server instance
- Your own deployment, separate from the shared one.
- Geographic hosting and processing
- The region your reports are stored and processed in, named in the contract.
- A dedicated account contact
- Named people on both sides, and a regular review.
- An SLA
- An availability commitment, with service credits behind it.
- Onboarding support
- We roll the policy out alongside your team, from report-only to enforced.
- Invoicing and payment terms
- Purchase orders, net terms, and annual or multi-year agreements.
- Security review support
- Security questionnaires, a DPA, and contracts on your paper.
- PCI DSS assessment support
- Working through 6.4.3 and 11.6.1 with your assessor, from the evidence the product already produces.
| Feature | Free | Team | Professional | Business | Enterprise |
|---|---|---|---|---|---|
| Core Features | |||||
CSP report ingestion | |||||
Real-time dashboard | |||||
Basic filtering | |||||
Report deduplication | |||||
Every browser report type | |||||
Policy change alerts | |||||
PCI DSS readiness view | |||||
| Team Features | |||||
Slack integration | |||||
Webhook notifications | |||||
Team member access | |||||
Script inventory | |||||
| Professional Features | |||||
Payment pages | |||||
Daily header scans | |||||
Script authorization | |||||
Script inventory CSV | |||||
PCI DSS evidence export | |||||
Your own report host name | |||||
Payment-page script alerts | |||||
API and MCP access | |||||
Priority support | |||||
| Business Features | |||||
Dedicated support | |||||
Single sign-on | |||||
Report hosts on your own domain | |||||
| Enterprise | |||||
Custom limits | |||||
Dedicated server instance | |||||
Geographic hosting and processing | |||||
A dedicated account contact | |||||
An SLA | |||||
Onboarding support | |||||
Invoicing and payment terms | |||||
Security review support | |||||
PCI DSS assessment support | |||||
Frequently asked questions
What happens if I go over my report limit?
We keep your reports. Reports past your monthly limit are still received and stored. They are hidden from your dashboard until you upgrade, and upgrading shows them, as far back as your plan's retention reaches. A collector that stops at its limit loses whatever arrives after that. We stop storing new reports only when a billing period reaches twice your limit, until you upgrade or the period resets.
Do sampled-out reports count towards my limit?
No. Only the reports we keep count. A report type you sample below 100%, or a repeat during a policy discovery run, costs nothing when it is sampled out, and the dashboard scales its counts back up. CSP violation reports are never sampled.
Can I change plans later?
Yes. Upgrades take effect immediately with prorated billing. Downgrades take effect at the end of your current billing cycle.
Do you offer a free trial?
Yes. The Team, Professional and Business plans each include a 30-day free trial, and you need no credit card to start it. You get the whole plan, payment-page features included, and nothing is charged during the trial. Add a payment method before day 30 to keep the plan; if you don't, the subscription cancels itself. One trial per customer, whichever plan it is on.
What payment methods do you accept?
All major credit and debit cards, processed by Stripe, on the Team, Professional and Business plans. Purchase orders, invoicing and net payment terms are part of an Enterprise agreement.
Is there an Enterprise plan?
Yes. The Enterprise plan sits above the Business plan and is priced by contract. It can cover custom limits, a dedicated instance in a named region, an SLA, invoicing and payment terms, and support through your security review. Start on the contact page.