How do I remove a header from a role?

Steps

1. Start from the profile that holds the role, then pick Authentication.
2. Find the role card and scroll to its header block. Each header sits on a row with a name, a value and a trash icon.
3. Click the trash icon at the end of the row you no longer need.
4. Press Save to keep the change.

Good to know

• Deleting the last row brings back the empty message, No headers.
• For the whole role, untick Header (token / API key) and no header goes out at all, instead of removing rows one by one.
• To remove the entire role, use the trash icon in the role card's top row. See how to remove a login role.

Nothing changes for scans until you save. If you leave the page without saving, the row stays. Edit mode on an existing profile works the same way as on a new one, so there is no separate screen to learn.

One thing to watch: if the removed header was the only way the scanner proved who it was, the next scan may see only public pages. Check the sitemap after the next run. The chips on endpoints show which role reached each one.

Can you not see the trash icon? Check that the Header method still has its tick, then look again, or ask through /contact.

Related questions

• How do I authenticate the scanner with an API key header?
• How do I send a Bearer token in the Authorization header?
• How do I remove a login role from a profile?
• How do I edit a role without re-entering its password?
• How do I combine form login and a header token for one role?

Full tutorial

How to add header token authentication to a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre