Security Response Header Regression Gate
Pricing
from $10.00 / 1,000 run starteds
Learn when a deploy, a CDN rule or a proxy change removes or weakens a security header on your production URLs. The Actor compares HSTS, CSP (each directive), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origi
1 to 200 absolute http or https URLs. The Actor sends one GET request to each URL, follows up to 5 redirects, and reads the security headers of the final response. It does not crawl. If you leave this field empty, the Actor checks the three public demo URLs shown below.
[ "https://github.com/", "https://www.mozilla.org/en-US/", "https://www.gov.uk/"]Optional. Headers that must be present, with minimum values. Each key is one of the ten security headers. Each value is true (the header must be present) or an object of rules. All headers: "allowed_values". Strict-Transport-Security: "min_max_age", "include_subdomains", "preload". Content-Security-Policy: "required_directives" and "forbidden_sources" (for example {"script-src": ["'unsafe-inline'"]}). A violation is a policy_violation record with the severity high.
{}The lowest severity that sets gate_pass to false. A regression at or above this severity also keeps its baseline value, so the gate stays failed until the header comes back or you reset the baseline.
Optional. The record key of the baseline in the named key-value store "security-header-baseline". If you leave it empty, the Actor uses one record for each URL set ("urls-" and a hash of the sorted URLs).
Write the current headers as the new baseline, and report no changes. Use it after you removed or changed a header on purpose.
Optional. One public HTTPS URL. The Actor sends one JSON POST when the run finds a regression. Private and reserved addresses are refused, and a redirect is not followed.
Timeout for each request and for the webhook POST. One URL gets one request and one retry, so it takes at most 2 x this value + 5 seconds.
Maximum number of URLs requested at the same time.
Maximum redirect hops for each request. The Actor checks each hop again against the private-address rules.
Wall-clock deadline for the URL list and the confirmation requests. A URL that the run does not reach before this deadline gets the RUN_DEADLINE reason code and keeps its baseline. The run still succeeds.