Have I Been Pwned runs on this

“I'd never roll out a CSP without it.”

Troy Hunt on Report URI, which Have I Been Pwned has run on for years. If you have wondered what he actually uses to watch what executes in the browser, this is it — and it takes one response header.

Start Free Trial Read the HIBP case study →

30-day free trial · One header · No code · Cancel anytime

Troy Hunt

Creator of Have I Been Pwned

Microsoft Regional Director

In Troy's Words

From the Have I Been Pwned case study

“Report URI has been an integral part of Have I Been Pwned's security posture for many years now. The visibility it gives me into CSP reports in particular has been enormously valuable, I'd never roll out a CSP without it!”

— Troy Hunt, Founder of Have I Been Pwned

Real Scale

A service the whole industry leans on

Have I Been Pwned handles the sort of traffic that finds every weak assumption in an architecture. Whatever it runs is, by necessity, something that holds up — and that is a more useful signal than any vendor benchmark.

Enforced, Not Just Watched

An actual policy, not a report-only stub

HIBP runs an enforcing Content Security Policy, so unauthorised JavaScript does not merely get logged — the browser refuses to run it. Getting to that point is the hard part, and the reporting is what gets you there.

No Runtime Risk

Nothing of ours executes on the page

Nothing installed, nothing injected, nothing in the request path. The browser already generates these reports; we are the endpoint they are sent to. A site keeps working normally even if we do not.

What It Actually Does

Turns browser reports into something you'd act on

Every browser on the internet will tell you what it loaded, what it blocked and what changed — in volumes nobody wants to parse by hand. This is the endpoint that makes that stream useful.

Deploy a Policy Safely

Report-only until the reports say otherwise

The reason most sites never get to an enforcing policy is the fear of breaking something. Report-only mode plus real traffic removes the guesswork: you see precisely what a policy would have refused, on live sessions, before anything is enforced. The CSP Wizard will assemble the first draft from your own reports.

Learn more about CSP Reporting →

Then Watch It Continuously

Told when your dependencies move

A policy tells you what is allowed. Script Watch tells you when the set of scripts actually loading changes — a new dependency, a vendor's update, something a tag manager pulled in that nobody reviewed. That is the class of change a supply-chain compromise looks like from the outside.

Learn more about Script Watch →

Get Started

Run what HIBP runs. On your own site, free for 30 days.

One header. Nothing installed, nothing in the request path, full access while you evaluate.

Start Free Trial Talk to our team →

30-day free trial · One header · No code · Cancel anytime

Who Builds It

Scott Helme, and a decade at the browser layer

Report URI was created by Scott Helme, who also built Security Headers — the grading tool you have almost certainly run a domain through at some point. He has spent over a decade researching browser security and HTTPS, and helping organisations actually operationalise Content Security Policy, HSTS and Certificate Transparency rather than merely publish them.

Free Tools

Security Headers, the CSP Builder, the analyser

All from the same place, all free, no account needed. If you would rather scan something before you sign up for anything, start there — it is the same platform underneath.

See the free tools →

Together On Record

The webinars, with both of them

Scott and Troy have recorded sessions on the British Airways Magecart attack and on the PCI DSS 4.0.1 requirements. Both are free to watch and neither needs an account.

Watch the British Airways breakdown →

Setup

One header, and reports start arriving

Send a report-only header with our endpoint on it. Nothing is blocked, nothing changes for your visitors, and within minutes you have a picture of what your pages actually load — including the parts behind authentication that no external scan will ever see.

You don't need an existing policy. This is how you get one.

Minimal setup — no existing CSP

Content-Security-Policy-Report-Only: script-src 'self';
  report-uri https://your-subdomain.report-uri.com/r/d/csp/reportOnly

Already running a policy? Add the endpoint to your existing report-uri directive and the reporting starts from the next page load.