Understand QR public security headers
Know the browser protections applied to the public signing page.
Exact navigationPublic QR page → Response headers
Before you begin
- Use an authorised account and confirm the source CRM record or setting is correct.
- Follow the exact route shown above; do not force database values to imitate a completed action.
What this guide covers
Know the browser protections applied to the public signing page. These instructions follow the supplied module’s live hooks, controller, model, view and validation flow.
Exact step-by-step process
- Open a valid public page in an authorised test.
- Inspect response headers.
- Confirm noindex/nofollow/noarchive, nosniff, no-referrer, restricted permissions, CSP, frame blocking and no-store caching are present.
Fields, choices and supported possibilities
Action scopeKnow the browser protections applied to the public signing page.
Module version2.1.0
NavigationPublic QR page → Response headers
EvidenceConfirm the stored record, status, output, email, event or log produced by the code path.
Code-backed validations and workflow rules
- The CSP permits self resources and data images, restricts form action/base URI/frame ancestors and allows geolocation only from self.
Expected result and verification
- The requested record, output or setting is created or updated through the supported module flow.
- Any related status, count, email, audit/event, PDF/file or queue evidence agrees with the source action.
- An error message is investigated rather than bypassed.
Security, privacy and operational checks
- Apply least privilege and verify the correct customer, lead, sales document or recipient before processing.
- Protect public tokens, recipient data, IP/browser evidence, templates and exported files according to organisational policy.
- Test configuration changes with controlled records before production-wide use.
- Retain or delete evidence only under an authorised retention process.