Browser Report Types

Browsers report more than CSP violations, but only when a response header asks them to. Each report type below has its own header, and HeaderHawk only keeps the types a site has switched on. A new site starts with CSP violations alone, and the Overview turns the others on one step at a time (Your Next Step); a site created before then keeps the types it had.

Your site’s setup, under Settings → Sites or Set up this site in the dashboard’s site switcher, generates the header block for exactly the types switched on there. Copy it from there rather than from this page: it carries your own endpoint, and a type switched off in HeaderHawk but still requested by your headers costs you requests for reports nothing shows.

How the headers fit together

Every header is report-only. It changes nothing about what your pages can do; it only asks the browser to say what a policy would have blocked. Each policy value here is an example to adapt to your site.

Reporting-Endpoints names where reports go, and each policy header points at that name. HeaderHawk calls it headerhawk, except while deprecations, interventions or crashes are switched on: browsers send those to the endpoint named default, so the setup names it default instead. (Chrome sends a crash to an endpoint named crash-reporting instead, if the page declares one.) The CSP header also keeps report-uri for browsers without the Reporting API.

A header the browser does not understand is often ignored without an error, so a typo is silent. After deploying, open DevTools, Application → Reporting API, to see the endpoint the browser registered and the reports it has queued.

CSP violation

A resource, inline script or eval that your Content Security Policy would block, with the directive it broke and where on the page it happened.

Listed in Issues and the Reports Explorer. Always on, with every report kept.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Content-Security-Policy-Report-Only: default-src 'self'; report-uri https://your-ingest-code.ingest.us.headerhawk.com/r; report-to headerhawk

Specified in w3c.github.io/webappsec-csp/.

Script hash

The SHA-256 hash of each script the browser fetched and ran, from the 'report-sha256' keyword in script-src. See Script Integrity Monitoring.

Off on a new site until its report-only step or its switch turns it on. Then it starts with 10% of reports kept, so counts are estimates. The switch and the rate are in the site’s settings.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' 'report-sha256'; report-uri https://your-ingest-code.ingest.us.headerhawk.com/r; report-to headerhawk

Specified in w3c.github.io/webappsec-csp/.

Integrity violation

A script loaded without an integrity attribute that Integrity Policy would have refused. Issues groups these by the origin the scripts load from, not by file, so a deploy that renames your bundles adds no new issue. Each file is in the issue’s reports, and Scripts → Integrity lists every script with its coverage.

Listed in Issues and the Reports Explorer. Off on a new site until its isolation step or its switch turns it on. Then it starts with every report kept. The switch and the rate are in the site’s settings.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Integrity-Policy-Report-Only: blocked-destinations=(script), endpoints=(headerhawk)

Specified in w3c.github.io/webappsec-subresource-integrity/.

Cross-Origin Embedder Policy

A cross-origin resource embedded without the Cross-Origin-Resource-Policy or CORS opt-in that cross-origin isolation requires. Turn it on only if the site needs cross-origin isolation, which is what SharedArrayBuffer, WebAssembly threads and precise timers ask for: COEP protects nothing on its own. Under require-corp every cross-origin image, font or script that does not opt in, such as a README badge or an avatar, sends a report on every page view for as long as the header stays, and each one counts toward your quota.

Listed in Issues and the Reports Explorer. Off by default. Switched on, it starts with every report kept. The switch and the rate are in the site’s settings.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="headerhawk"

Specified in html.spec.whatwg.org/multipage/browsers.html.

Cross-Origin Opener Policy

A window interaction, such as opening a popup or closing it, that a same-origin opener policy would sever.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="headerhawk"

Specified in html.spec.whatwg.org/multipage/browsers.html.

Permissions policy violation

A page or frame using a browser feature, such as the camera, that your Permissions Policy denies.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Permissions-Policy-Report-Only: camera=();report-to=headerhawk, microphone=();report-to=headerhawk, geolocation=();report-to=headerhawk

Specified in github.com/w3c/webappsec-permissions-policy/blob/main/reporting.md.

Potential permissions policy violation

A frame whose allow attribute asks for a feature your Permissions Policy denies, before the frame uses it.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Permissions-Policy-Report-Only: camera=();report-to=headerhawk, microphone=();report-to=headerhawk, geolocation=();report-to=headerhawk

Specified in github.com/w3c/webappsec-permissions-policy/blob/main/reporting.md.

Document policy violation

A page using a feature that your own Document-Policy header turns off, for each feature in it that names a reporting endpoint.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"

HeaderHawk writes no Document-Policy line, only the endpoint for one. Which features a document policy turns off is your site’s decision, and a browser reports only on features it recognises, so there is no line that would work as a starting point on every site. If your site already serves Document-Policy or Document-Policy-Report-Only, add ;report-to= and the endpoint’s name from your Reporting-Endpoints line to each feature you want reports for. The setup names it default while deprecations, interventions or crashes are switched on, and headerhawk otherwise, so check the name again after changing those switches:

Document-Policy: js-profiling=?0;report-to=headerhawk

report-to is a parameter on a feature, not an entry in the list: js-profiling=?0, report-to=headerhawk is read as a second feature named report-to, which Chrome ignores with an Unrecognized document policy feature name warning in the console. A feature Chrome does not recognise gets the same warning and sends nothing.

Specified in wicg.github.io/document-policy/.

Connection allowlist

A connection the page made, or tried to make, to an origin outside its allowlist, from a resource in the HTML it was served. The example allows only the page’s own origin (response-origin); add the origins your pages really use, as URL patterns in the same list. Chrome sends at most one report per page load, and holds it until the visitor loads another page on your site, so a visit of one page sends none. Chrome 152 and later only.

Reporting-Endpoints: headerhawk="https://your-ingest-code.ingest.us.headerhawk.com/r"
Connection-Allowlist-Report-Only: (response-origin);report-to=headerhawk

Specified in wicg.github.io/connection-allowlists/.

Deprecation

A call to a browser API that is going away, with the date the browser expects to remove it. Deprecations appear on the dashboard’s Browser signals → Deprecations view, soonest removal first.

Off on a new site until its browser changes step or its switch turns it on. Then it starts with 5% of reports kept, so counts are estimates. The switch and the rate are in the site’s settings.

Reporting-Endpoints: default="https://your-ingest-code.ingest.us.headerhawk.com/r"

Specified in wicg.github.io/deprecation-reporting/.

Intervention

A request the browser refused or changed on the page’s behalf, such as a blocked autoplay or a slow-loading ad. Interventions appear on Browser signals → Deprecations beside deprecations.

Off on a new site until its browser changes step or its switch turns it on. Then it starts with 5% of reports kept, so counts are estimates. The switch and the rate are in the site’s settings.

Reporting-Endpoints: default="https://your-ingest-code.ingest.us.headerhawk.com/r"

Specified in wicg.github.io/intervention-reporting/.

Network error

A request to your origin that failed before a response arrived: DNS, TCP, TLS or protocol errors, with the phase they happened in. Shown on the dashboard’s Reliability page, by error type, phase and origin. Only failures are asked for (success_fraction: 0), so the page counts failed requests rather than an error rate. Chromium-based browsers only.

Off on a new site until its browser changes step or its switch turns it on. Then it starts with the rate (100%) written into the header as failure_fraction, so the browser samples and a report it does not send costs nothing. The switch and the rate are in the site’s settings.

Report-To: {"group":"headerhawk-nel","max_age":2592000,"endpoints":[{"url":"https://your-ingest-code.ingest.us.headerhawk.com/r"}]}
NEL: {"report_to":"headerhawk-nel","max_age":2592000,"failure_fraction":1,"success_fraction":0}

Specified in w3c.github.io/network-error-logging/.

Crash

A page or frame that crashed, was killed for running out of memory, or stopped responding, with a stack when the page opted in to one. Shown on the Reliability page’s Crashes tab. Chromium-based browsers only.

Off on a new site until its browser changes step or its switch turns it on. Then it starts with every report kept. The switch and the rate are in the site’s settings.

Reporting-Endpoints: default="https://your-ingest-code.ingest.us.headerhawk.com/r"

Specified in wicg.github.io/crash-reporting/.