Your Next Step

A site that sends no security headers today cannot go to every header at once. Paste them all and every third party on every page becomes an issue on the first day, each issue an email, and the reports spend your monthly allowance before you can act on them. HeaderHawk asks for one change at a time instead, and each step waits until your own reports say the last one has settled.

The Overview shows each site’s next step: one action, why it matters, and what HeaderHawk has seen that says it is time. Beside it is the site’s whole ladder: the stages done, any passed over, the one it is on and those to come. Every stage is decided from reports and decisions HeaderHawk already holds, not from a checklist you tick.

The stages

Stage	What you do	Done when
Install	Start discovery and add its header	A discovery report arrives
Discover	Let discovery run	7 days have run and at least one source has enough evidence to be proposed
Review	Keep or drop each source the proposed policy allows	Every proposed source has a decision
Report-only	Deploy the proposed policy as `Content-Security-Policy-Report-Only`	Reports have quoted it for 7 days, and the last 7 days brought no new CSP issue
Enforce	Rename the header to `Content-Security-Policy`	A report from an enforced policy arrives
Payment pages	Mark your payment pages and decide on their scripts	Every script seen on a payment page has a decision
Payment policy	Serve the policy built from those decisions on your payment pages	A payment page’s reports or its daily scan show it served, enforced
Browser changes	Add the deprecation, intervention, crash and network error headers	One of those reports arrives
Isolation	Add the window, feature and integrity policies	A Cross-Origin-Opener-Policy report arrives

The CSP stages follow Build a Policy From Your Traffic, so the policy you end up enforcing allows what your pages actually load rather than default-src 'self' over a site that loads a dozen third parties. Signing up starts discovery for the site you add, and for any later site it is the first step the Overview offers; either way the run lasts two weeks, a week of traffic and a week to review it, then stops on its own. Script hashes start with the report-only stage: the policy you deploy then carries 'report-sha256', which asks browsers for a hash of each script it lets run.

Payment pages are on the Professional and Business plans; on other plans the ladder passes over that stage, and over the payment policy, which also waits for a payment page to be marked. The payment policy is a second header, for your payment pages only, whose script-src is your script decisions (A policy from your decisions). Serve it in report-only first. A decision made after it is deployed changes it, so the stage opens again until your payment pages serve the new one. The isolation stage also turns on document policy reports, which come from a Document-Policy your site already serves rather than from a line the setup writes (how to point one at HeaderHawk). Once a site is past the isolation stage, the step disappears. COEP is never part of the ladder, and stays something you switch on yourself.

The header block follows the stage

A site’s setup panel shows the headers its current stage asks for: the Reporting-Endpoints line, the stage’s Content-Security-Policy line, and the lines of the other report types the site already has on, for each that has a line of its own. All report types, below it, still lists every type with its switch and the full block, so you can turn everything on at once if you would rather.

A site created in the dashboard starts with every type a later stage turns on switched off, so its reports cost nothing until you get there. Reaching a stage, or switching a type on yourself, turns it on. Sites created before the ladder keep their settings.

A site that already has a policy

The ladder is placed by evidence, so a site that already enforces a policy you wrote yourself is past the CSP stages from its first enforced report, and its setup panel leaves that policy to you. A site that already sends browser change or COOP reports is past those stages too. A site serving only a report-only policy starts at Install: discovery runs beside the policy you already serve without changing what it reports.

Not now

Not now passes over the current stage and shows the next one. The card then names the stage it passed over, with Undo. Later, the stage stays on the ladder marked “Not now”, and Go back makes it the site’s step again. If you pass over a site’s last stage, the card stays, with no step, so the stage can still be taken back. Owners, admins and members can use all three; viewers see the step and the ladder but none of them. A stage you passed over still counts as done when its evidence arrives.

Stages the site has no use for are left off the ladder and out of its count: the payment stages on a plan without payment pages, the payment policy before a payment page is marked, and the review of a proposal when discovery never ran.

A new type’s first week goes to your digest

The first week after the isolation stage turns its policies on brings their issues in bulk, by design: everything that was already true of your pages is reported at once. For that week, an alert rule that sends immediately holds those issues back, and your daily or weekly digest lists them instead and names the stage. After seven days, immediate rules send as before.

The hold applies only where a digest covers the site too, so an issue is never left unsent. A blocked script from an enforced integrity policy and a network error or crash spike are never held back. Browser changes raise no issue, so the browser stage holds nothing back.