HeaderHawk

Stronger browser security, one clear step at a time.

Discover what your pages load, review a policy built from your traffic, and test it in report-only before enforcing it.

Start free
  • Response headers, no agent
  • Free for 1 site · No credit card

Your pages

  • Scripts
  • Connections
  • Frames

Browser reports

HeaderHawk

Receives reports.
Alerts you.
Suggests next steps.

Storefront / Overview

Step 3 of 7

Your next step

Review your proposed policy

The draft starts from sources your pages used. Keep the ones you trust and drop the rest before the policy reaches a browser.

3 sources to decide.

Review the draft

Discovery ran 8 days · 23 sources

Illustrative product example

A stronger policy starts with knowing what belongs.

A low score can show the gaps. HeaderHawk helps you work through the next decision, using evidence from your own pages.

  1. 01

    Discover

    See what your pages load without blocking it.

  2. 02

    Review

    Keep the sources you trust. Leave the rest out.

  3. 03

    Test in report-only

    See what your policy would block on real visitors.

  4. 04

    Enforce

    Deploy your policy when you are ready.

Know the source. Make the call.

Review named services and the reports behind each source. Your decisions shape the draft.

Policy Draft

Sources observed in your traffic

  • cdn.segment.com

    Segment · Analytics

    28 reports · 2 browser families

    Included
  • fonts.googleapis.com

    Google Fonts · Fonts

    42 reports · 2 browser families

    Included
  • cdn.unfamiliar.example

    Unknown and rare

    2 reports · 1 browser family

    Excluded

Report-only, reporting to this site's endpoint.

Copy
Illustrative product example

Your policy controls. The browser enforces. HeaderHawk receives reports, alerts you, and suggests next steps.

Explore browser security controls

Find the issue. See what needs your attention.

Grouped browser reports keep the page, source, and code context together. Investigate the evidence, make the change, and review what your visitors report next.

Explore browser reports
  • Investigate
    grouped issues
  • Review
    policy changes
  • Send alerts
    to your team

Storefront / Issues

Unapproved script source

script-src

cdn.unfamiliar.example

Page
/account
Source file
app.js:142

18 reports · 2 browser families

140  function init() {141    // Initialise checkout142    const script = document.createElement('script');143    script.src = 'https://cdn.unfamiliar.example/widget.js';144    document.head.appendChild(script);145  }
Illustrative product example · Context depends on the browser report.

You approved the script. Then it changed.

Support PCI DSS 6.4.3 and 11.6.1 reviews with script decisions, change monitoring, and supporting evidence.

On the Professional plan and above

/checkout · checkout-helper.js

Approved version

Approved fingerprint: a12f…

Approved on Mar 1, 2024

// Checkout helper
function initCheckout() {
  attachCheckout();
}

Observed version

Observed fingerprint: b94c…

Pinned script changed
Review required

// Checkout helper updated
function initCheckout() {
  attachCheckout();
  loadWidget();
}
Illustrative product example

Keep the decision and its evidence together.

Script decision
Approved
Justification
Checkout functionality
Integrity
Pinned version
Illustrative approved-baseline evidence

Script inventory · Requirement evidence · CSV exports

On the Professional plan and above, payment-page script alerts follow reports from two networks or a daily payment-page scan.

See the PCI evidence workflow

Fits where you already set response headers.

The setup writes the headers for the report types you enable. Send the evidence through your existing stack and start in report-only.

No HeaderHawk script or agent to install.

Explore setup guides
  1. Your site
  2. Visitors’ browsers
  3. HeaderHawkReview the evidence

You deploy the policy. The browser enforces it.

  • Email
  • Slack
  • Webhooks

Destinations depend on your plan.

Start free. Choose the plan that fits.

Discovery and Policy Draft are included on every plan.

Prices shown for monthly billing.

Free

$0

For your first website

Free forever · No card

Sites
1
Reports/month
25,000
Retention
15 days

Included:

  • Discovery and Policy Draft
  • Browser reports
  • Grouped policy issues
Start free

Team

$49/mo

For teams rolling out policies

30-day trial · No card

Sites
5
Reports/month
500,000
Retention
30 days

Everything in Free, plus:

  • Team access
  • Slack and webhooks
  • Script inventory
Start free trial

Professional

$199/mo

For payment-page reviews

30-day trial · No card

Sites
25
Reports/month
2 million
Retention
90 days

Everything in Team, plus:

  • Script authorization
  • Daily header scans
  • Script alerts and PCI evidence
  • API and MCP access
Start free trial

Business

$399/mo

For scale and governance

30-day trial · No card

Sites
75
Reports/month
10 million
Retention
90 days

Everything in Professional, plus:

  • Single sign-on (SAML)
  • Report hosts on your own domain
  • Dedicated support
Start free trial

Enterprise

An agreement can include custom limits, dedicated hosting, an SLA, and support with policy rollout and security reviews.

Custom pricingTalk to us
Compare every feature

A few questions before you start.

Will report-only block anything?
No. A report-only policy asks the browser to report what it would block, without blocking it. Review those reports before choosing to enforce your policy. An existing enforced policy still applies independently.
Do I need payment processing to use HeaderHawk?
No. Any website can use HeaderHawk to discover sources, review a Policy Draft and investigate browser security issues. These workflows start on the Free plan. Payment-page monitoring adds script authorization, pinned-version review and supporting evidence on the Professional plan and above.
How do I add HeaderHawk to my site?
Add response headers that tell visitors’ browsers where to send reports. There is no HeaderHawk script or agent to install. Start with discovery or a report-only policy, review the traffic evidence, and deploy an enforced policy when you are ready.
What happens after I enforce my policy?
The browser enforces the policy you deploy. HeaderHawk receives reports, helps you investigate issues and alerts you when a new policy appears in reports. Keep reviewing those reports as your pages and dependencies change.
How does HeaderHawk support PCI DSS reviews?
On the Professional plan and above, payment-page script authorization, pinned-version review, daily scans and CSV evidence support PCI DSS 6.4.3 and 11.6.1 reviews. On those plans, payment-page script alerts follow reports from two networks or a daily payment-page scan. Evidence reflects what browsers report and scans find; it is not a certification or an attestation of compliance.
Can I send alerts to my existing tools?
Email alerts are included on every plan. The Team plan and above add Slack and webhooks, so you can send alerts to the tools your team already uses.

Take the next step toward stronger browser security.

Start free