Data Destinations

Policy › Destinations lists every host your pages tried to send data to. A destination is a host named in a connect-src or form-action report:

• connect-src covers fetch, XMLHttpRequest, navigator.sendBeacon, EventSource and WebSocket connections.
• form-action covers a form submitting somewhere.

These are the two ways a skimmer on a checkout page sends what it collected, so the list is where you check what your payment pages talk to. The view is on every plan.

Where a destination comes from

A host joins the list the first time either of these names it:

• A policy discovery run sees it. Discovery reports every host your pages contact, on purpose, so a host seen there is a baseline and raises no alert. The row says Seen in discovery.
• Your policy refuses it. The row says Refused since and the date. A host discovery saw and your policy refused later says both.

A report from a browser extension or a bot is left out, and so is a report hidden because the month’s reports went over your plan’s limit.

What each column means

Column	What it shows
First seen	When HeaderHawk first saw the host. Kept after the reports from that day expire
Last seen	The latest report naming it in the range you chose
Reports	Refusals reported in the range
Pages	How many of your pages reported it in the range

Reports opens the Explorer on that host, where each report’s full URL, path included, is listed.

A first-seen date is kept for as long as the site exists, longer than your plan’s report retention, so a host that comes back after a quiet month is not mistaken for a new one. Last seen, reports and pages come from the reports themselves, so they only cover what retention still holds.

A host discovery saw and your policy then allowed never reports again. Its row says No refusal since discovery. That means your policy has not refused it, not that your pages stopped using it.

A row whose first seen says Not recorded is a host the reports name that HeaderHawk has no first date for: one refused before destinations were kept.

Payment pages only narrows the list to hosts first seen on a payment page, or reported from one in the range. It needs the Professional plan or above.

Alerts

When your policy refuses a host and enough browsers report it to be real, a rule covering New data destination is told, in place of New CSP issue. The alert says whether discovery had seen the host. See How Alerting Works.

What the list cannot see

Caution

A host your policy allows sends no report. A skimmer posting to your own origin, or to a host already in your connect-src, does not appear here. The list is only as complete as connect-src and form-action are tight on the pages that matter.

• HeaderHawk sees where a page tried to send data, never what it sent.
• A destination is a host, never a URL. A server that changes its path each time is one destination; the paths are in its reports.
• Data smuggled out in an image URL reports under img-src, which is not listed here because nearly every image a page loads is only an image. Filter Issues by img-src to see those.
• Origins your pages load in a frame are on their own list, Framed Origins.
• A site records at most 100 new destinations a day. A host refused after that is recorded the next day it is refused, and its reports are listed meanwhile as Not recorded.