Understand QR public security headers
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
This guide explains that the browser protections applied to the public signing page.
Where to goPublic QR page → Response headers
Before you start
- Use an authorised account and confirm the source CRM record or setting is correct.
- Follow the exact route shown above; do not force database values to imitate a completed action.
What this guide helps you do
Know the browser protections applied to the public signing page. These instructions follow the supplied module’s live hooks, controller, model, view and validation flow.
Follow these steps
- Go to a valid public page in an authorised test.
- Inspect response headers.
- Verify noindex/nofollow/noarchive, nosniff, no-referrer, restricted permissions, CSP, frame blocking and no-store caching are present.
Fields and options
Action scopeKnow the browser protections applied to the public signing page.
Module version2.1.0
NavigationPublic QR page → Response headers
EvidenceVerify the stored record, status, output, email, event or log produced by the code path.
Rules and limits
- The CSP permits self resources and data images, restricts form action/base URI/frame ancestors and allows geolocation only from self.
Check it worked
- The requested record, output or setting is created or updated through the supported module flow.
- Any related status, count, email, audit/event, PDF/file or queue evidence agrees with the source action.
- An error message is investigated rather than bypassed.
Security, privacy and operational checks
- Apply least privilege and verify the correct customer, lead, sales document or recipient before processing.
- Protect public tokens, recipient data, IP/browser evidence, templates and exported files according to organisational policy.
- Test configuration changes with controlled records before production-wide use.
- Retain or delete evidence only under an authorised retention process.
Related guides
Was this guide useful?Your response is stored only in this browser.