HeaderHawk

HeaderHawk collects and analyzes reports that browsers send in response to security headers set on a site, such as Content-Security-Policy, Integrity-Policy and Permissions-Policy. Nothing is installed on the pages, and nothing sits in the visitors' request path. How it works: - The site's server sends response headers for the report types the user enables. - Browsers enforce the policy, or only report in report-only mode, and send reports to HeaderHawk. - HeaderHawk groups the reports into issues, one row per problem, with the affected pages, reporting browsers, blocked resources and a confidence level. Extension and bot noise is filtered out of alerts. - Alerts are sent when a new problem or policy appears. Capabilities: - CSP violation reporting and other browser report types (integrity and cross-origin policies, deprecations, network errors, crashes), with a sample rate for each. - Script inventory by hash from Chrome and Edge browsers, with library and version identification where possible (Team plan and above). - Payment-page script authorization with written reasons, CSV export, and alerts on new, changed or rejected scripts (Professional and Business plans). - Daily header scans of marked pages, with grading and alerts on header changes or grade drops (Professional and Business plans). - PCI DSS 4.0 readiness view for requirements 6.4.3 and 11.6.1. It is a readiness view, not an attestation. - A free site scanner that grades a site's headers. Alerts go to Slack, webhooks (JSON) and email digests. Plans: Free (1 site, 25k reports/month), Team ($49/mo), Professional ($199/mo) and Business ($399/mo), with 30-day free trials on paid plans.