Framed Origins

Policy › Frames lists every origin your pages tried to load in a frame. A framed origin is a host named in a frame-src report, or a child-src one, the directive a browser falls back to when frame-src is not set.

A payment page is usually a frame. Stripe, Adyen, Braintree, Mollie, Square and PayPal all host the card fields on their own origin inside your checkout, which is why PCI DSS counts the framed payment form as part of your page. So on the pages that matter most, the question this list answers is the important one: what does this checkout load in a frame, and since when? The view is on every plan.

Where a framed origin comes from

An origin joins the list the first time either of these names it:

• A policy discovery run sees a page frame it. A run reports every origin your pages load, on purpose, so an origin seen there is a baseline and raises no alert. The row says Seen in discovery. On a site whose policy came from discovery, that is usually where your payment provider’s frame comes from: once your policy allows it, it never reports again.
• Your policy refuses it. The row says Refused since and the date.

A report from a browser extension or a bot is left out, and so is a report hidden because the month’s reports went over your plan’s limit.

The list is newest first: a payment provider’s frame is expected and stays, so the useful reading is “these are the origins this checkout has ever framed, and this one appeared on Tuesday”, not which is busiest.

What each column means

Column	What it shows
First seen	When HeaderHawk first saw the origin. Kept after the reports from that day expire
Last seen	The latest report naming it in the range you chose
Reports	Refusals reported in the range
Pages	How many of your pages reported it in the range

Reports opens the Explorer on that origin. A first-seen date is kept for as long as the site exists, longer than your plan’s report retention, so an origin that comes back after a quiet month is not mistaken for a new one.

An origin discovery saw and your policy then allowed never reports again. Its row says No refusal since discovery: your policy has not refused it, not that your pages stopped framing it.

Payment pages only narrows the list to origins first seen on a payment page, or reported from one in the range. It needs the Professional plan or above.

Alerts

When your policy refuses an origin and enough browsers report it to be real, a rule covering New framed origin is told, in place of New CSP issue. It alerts on every page, and when the frame was on a payment page the alert leads with that. See How Alerting Works.

What the list cannot see

Caution

An origin your policy allows sends no report, so a frame from an origin already in your frame-src does not appear here. The list is only as complete as frame-src is tight on the pages that matter.

• What is inside a frame. A frame from another origin is closed to the page that holds it, by design, and no browser report describes its contents. HeaderHawk sees which origin your page tried to frame, never what that frame showed or what was typed into it.
• Who frames your pages. That is frame-ancestors, the opposite question: not what your page frames, but which sites may frame your page. It is not listed here. Its reports are on Issues.
• The path. A framed origin is a host, never a URL. A payment provider’s frame carries a session token in its address on every load, so a URL would make every checkout a new frame; browsers send only the origin anyway.
• The default-src case. A page whose policy has only default-src still reports a refused frame as frame-src in Chrome, Firefox and Safari, so it is listed like any other.
• A site records at most 100 new framed origins a day, counted apart from its destinations. An origin refused after that is recorded the next day it is refused, and its reports are listed meanwhile as Not recorded.