HeaderHawk

HeaderHawk is a client-side security platform that uses security headers and browser-generated reports to show what code runs in website visitors' browsers. Customers add response headers (Content-Security-Policy, Integrity-Policy, Permissions-Policy and report endpoints) to their servers. Browsers enforce the policies and send reports to HeaderHawk. No agent, script or proxy is added to the site's pages or request path.

The platform groups reports into issues, with extension and bot noise filtered out. Each issue links to the affected pages, browsers, files, lines and script samples. Alerts are sent when a new violation or policy change appears, via Slack, webhooks or email digests. Policies can start in report-only mode and be enforced once reports are clean.

Paid plans add a script inventory by hash (Chrome and Edge), payment-page script authorization with written justifications and CSV export, daily header scans with grading, and alerts on changed scripts or headers. A PCI DSS 4.0 readiness view maps records to requirements 6.4.3 and 11.6.1. The company states this is a readiness view, not an attestation.

Use cases listed include Magecart/formjacking, supply-chain script compromise, XSS, clickjacking, unapproved third-party scripts and mixed content. The company also offers a free site header scanner. Plans range from a free tier (1 site, 25k reports/month) to Team, Professional and Business tiers with published prices. The founders describe a background in platform engineering, IT operations and security at a health insurer.