HeaderHawk

HeaderHawk collects and analyzes reports that browsers send in response to security headers set on a site, such as Content-Security-Policy, Integrity-Policy and Permissions-Policy. Nothing is installed on the pages, and nothing sits in the visitors' request path.

How it works:

• The site's server sends response headers for the report types the user enables.
• Browsers enforce the policy, or only report in report-only mode, and send reports to HeaderHawk.
• HeaderHawk groups the reports into issues, one row per problem, with the affected pages, reporting browsers, blocked resources and a confidence level. Extension and bot noise is filtered out of alerts.
• Alerts are sent when a new problem or policy appears.

Capabilities:

• CSP violation reporting and other browser report types (integrity and cross-origin policies, deprecations, network errors, crashes), with a sample rate for each.
• Script inventory by hash from Chrome and Edge browsers, with library and version identification where possible (Team plan and above).
• Payment-page script authorization with written reasons, CSV export, and alerts on new, changed or rejected scripts (Professional and Business plans).
• Daily header scans of marked pages, with grading and alerts on header changes or grade drops (Professional and Business plans).
• PCI DSS 4.0 readiness view for requirements 6.4.3 and 11.6.1. It is a readiness view, not an attestation.
• A free site scanner that grades a site's headers.

Alerts go to Slack, webhooks (JSON) and email digests.

Plans: Free (1 site, 25k reports/month), Team ($49/mo), Professional ($199/mo) and Business ($399/mo), with 30-day free trials on paid plans.