Quick Start

Get CSP reporting working in 5 minutes.

1. Create a Site in HeaderHawk

1. Sign up at app.headerhawk.com
2. Create a new site for your domain
3. Go to Settings → Sites, open the site’s row menu, and choose View Setup. Copy the Report URI — it is the full endpoint, already carrying your site’s 8-character ingest code:

https://ingest.headerhawk.com/csp/YOUR_INGEST_CODE

Paste the whole URL. The ingest code is the only site-specific part, and it is the value every example below writes as YOUR_INGEST_CODE.

Register the exact host that serves your pages

Reports are matched against a site’s domain exactly. A site registered as example.com accepts reports from example.com and discards reports from www.example.com or app.example.com. If one CSP header covers several hosts, create a site for each one — otherwise reports from the others arrive and are discarded, and the endpoint returns success either way, so nothing in the browser will tell you. A site’s setup panel reports anything discarded for this reason.

2. Add CSP Headers

Choose your platform:

• Nginx
• Apache
• Node.js
• Next.js
• Cloudflare
• Vercel
• Netlify
• Docker

3. Start with Report-Only

We recommend starting with Content-Security-Policy-Report-Only to collect violations without breaking your site:

Content-Security-Policy-Report-Only: default-src 'self'; report-uri https://ingest.headerhawk.com/csp/YOUR_INGEST_CODE

This header tells browsers to:

1. Check if resources violate the policy
2. Report violations to HeaderHawk
3. Not block anything (report-only mode)

4. View Reports

Visit your HeaderHawk dashboard to see incoming CSP violations.

You’ll see:

• Blocked resources - URLs that would be blocked by your policy
• Violated directives - Which CSP rules were violated
• Document URLs - Pages where violations occurred
• Timestamps - When violations happened

Next Steps

• Understand CSP concepts - Learn how CSP works
• CSP directive reference - Tune your policy
• Troubleshooting - Fix common issues