Improved! Set request headers in your scan scripts

Published Nov 21, 2025

We’re please to announce the introduction of a new scripting function called setHeader(). This function allows you to set request headers during your scans. This is useful in several different scenarios:

• Setting authentication headers to allow scanning of private pages.
• Bypassing bot detection using a custom header.
• Adjusting cache behaviour using the cache-control header.

What makes this function so powerful is the ability to filter which requests a header is applied to. The examples below will demonstrate this:

// Add basic authentication to all requests.
setHeader('authorization', 'Basic YWxhZGRpbjpvcGVuc2VzYW1l')

// Add a custom header to all requests on cdn.a11ypulse.com.
setHeader('x-cache-debug', '1', 'https://cdn.a11ypulse.com/*')

// Add a cache-control header to any /favicon.ico requests.
setHeader('cache-control', 'none', '*/favicon.ico')

To learn more about the setHeader() function, read our Scripting reference.