Integration Guides

Choose your platform to get started with CSP reporting.

Web Servers

Configure CSP headers directly on your web server:

• Nginx - add_header directive
• Apache - Header directive

Frameworks

Add CSP headers in your application code:

• Node.js - Express, Koa, Fastify middleware
• Next.js - Middleware and config headers

Platforms

Configure headers on your hosting platform:

• Cloudflare - Workers and Pages
• Vercel - vercel.json and Edge Middleware
• Netlify - _headers file and netlify.toml

Containers

Add CSP to containerized applications:

• Docker - Nginx, Traefik, Envoy configurations

Common Pattern

All integrations follow the same pattern:

1. Add the CSP header with your policy directives
2. Include the report-uri pointing to HeaderHawk
3. Start in report-only mode to avoid breaking your site
4. Review violations in the HeaderHawk dashboard
5. Tune your policy based on legitimate resources
6. Switch to enforce mode when ready

HeaderHawk Endpoint

All guides use this reporting endpoint:

https://your-ingest-code.ingest.us.headerhawk.com/r

Replace your-ingest-code with your site’s ingest code: it is the first part of the host, and the path is always /r. The whole endpoint URL is on the site’s setup panel in the dashboard: choose the site in the site switcher at the top, then Set up this site, or the site’s row under Settings → Sites.

A site created before ingest codes moved into the host also has an earlier URL with an 8-character code in the path, https://ingest.us.headerhawk.com/r/{code}, which the setup panel names under the endpoint. Headers that already use it keep working; new headers should use the site’s own host.