Changelog

Today we replaced the CentralCSP website, dashboard, and documentation with a new version, and we changed our plans. If you are an existing customer, your plan, your price, and your reporting endpoints do not change. You now sign in at app.centralcsp.com.

CentralCSP started as a Content Security Policy (CSP) reporting tool. You added one header, we collected the violation reports, and we helped you build a policy from them. That is still the core of the product. But the product is moving from CSP reporting to client-side security, everything your users' browsers can tell you about your site, and the old platform was not the base to build that on.

So we rebuilt it, and not only to support new report types. The new platform ingests and aggregates every report type more efficiently at high volume, runs entirely in the EU, in France on OVH, and ships a redesigned interface that looks better and is faster to work in. The site, the dashboard, and the docs were all rebuilt on the same foundation, a client-side security platform built on the browser Reporting API.

What shipped on September 13

• A new dashboard at app.centralcsp.com, rebuilt around every browser report type, not only CSP.
• Monitoring for 12 browser report types through the same single header you already send.
• Alerting on six channels with custom rules and no monthly alert caps.
• Technologies, a client-side SBOM with version and CVE detection, on the Scale and Enterprise plans.
• A rebuilt PCI DSS v4 module with payment page monitoring and auditor-ready evidence exports.
• Two role systems and website-level access control, so people only see the sites they work on.
• A full REST API and a built-in MCP server, so your agents can do anything you can click.
• A new documentation site, a new website, and both in English and French.
• Seven free tools with no account, a rebuilt CSP scanner and evaluator plus three new ones.
• New plans, Start, Business, and Scale. Existing customers keep their current plan and price.

New features

Each feature below links to the documentation that covers it in detail.

One header, every report type

The old CentralCSP ingested two report types, CSP violations and script hashes. The new Reports section ingests 12, through the same Reporting-Endpoints header you already have in production:

Reporting-Endpoints: default="https://MyEndpoint.report.centralcsp.com"

The 12 types, each with its own dashboard and filters:

• CSP violations, what your pages load that the policy does not allow.
• CSP hashes, every script that runs on a page, and whether it changed.
• Integrity violations, scripts loading with no integrity verification.
• Permissions-Policy violations, which browser features your pages still use.
• Document-Policy violations, legacy APIs your documents still call.
• Deprecations, code a future browser release will break.
• Interventions, what the browser overrode on its own.
• Crashes, pages that crash the browser tab.
• Connection-Allowlist reports, where your pages connect out to.
• COEP violations, the cross-origin resources blocking isolation.
• COOP violations, the popup logins an opener policy would break.
• Network errors (NEL), request failures your server logs never see. NEL is the exception, it needs the legacy Report-To header next to Reporting-Endpoints.

Every raw payload lands in the Explorer, whatever its type.

The reasoning is simple. Your server logs stop at your server. These reports are the only signal that comes from your users' browsers, and CSP violations are just one of them. If a checkout script changes, a third party starts failing, or a browser starts crashing on one page, the browser reports it. Now we catch all of it.

Documentation: Reports for the product, Report types for the standards behind them.

Alerting that fits your stack

The old alerting supported Slack, Teams, email, and webhooks, three rule families, and a monthly alert quota per plan. The new alerting delivers on six channels:

• Slack
• Microsoft Teams
• Google Chat
• Telegram
• Email
• Signed webhooks

Behind them are 16 rule types covering every report type: a new origin on a page, a script hash change, a violation spike, a new CVE in a library your visitors load, a change on a payment page, and more.

Every send is recorded in Deliveries, so you can see what fired, where it went, and whether the channel accepted it. Alert quotas are gone. On plans that include alerting, alerts are unlimited.

Documentation: Alerting, Get started, Rules, Channels.

Know every script your visitors run

The script inventory lists every script observed on your payment pages, with the pages it appears on and the full history of its hash. When a justified script changes, it comes back for review. Read more on the supply-chain page, or in the script inventory article.

Documentation: Script inventory, CSP hashes.

Technologies, a client-side SBOM with CVE detection

More vulnerabilities are published every year, and AI-assisted vulnerability research is pushing that rate up. Patching only works if you know what runs, and the client side is the part most teams cannot list: the libraries in your bundles, the CDN copies, and the scripts a tag manager injects on every page.

Technologies keeps that list for you. It is a software bill of materials (SBOM) of the JavaScript libraries your visitors' browsers load, built from the hashes browsers already report, with no crawler and no agent. Each library version carries its lifecycle status (up to date, outdated, dormant, or deprecated) and the CVEs that affect it, with the severity, the affected version range, and the script file that carries it.

Two alert rules come with it. New vulnerability fires when an advisory is published for a version already in production, above a minimum severity you choose. Outdated or deprecated version fires when a library falls behind or stops being maintained, so the upgrade happens before the next advisory rather than after it. Export the inventory as CSV, or query it through the API and the list_technologies MCP tool.

Technologies is included in the Scale and Enterprise plans.

Documentation: Technologies, Get started, Review a technology. Read more in how to detect vulnerable JavaScript libraries on a live website and which jQuery versions are vulnerable.

PCI DSS v4 evidence, rebuilt

The PCI DSS module is now a full compliance area. You declare your payment pages, the platform inventories the scripts that run there, and you authorize and justify each one. When a justified script changes, the change is flagged for re-review and can trigger an alert. Evidence for requirements 6.4.3 and 11.6.1 exports as CSV and PDF, written for the person who reads it, your assessor.

The same wording applies as before. CentralCSP helps you meet 6.4.3 and 11.6.1 by producing the evidence; it does not certify compliance. The module is included on Scale and Enterprise plans.

Documentation: PCI DSS, Get started, Evidence export.

Roles, groups, and website-level access

Access control was rebuilt around two independent role systems:

• Workspace roles (Owner, Admin, Member) decide who administers the account, its members, its API keys, and its billing.
• Website roles (Viewer, Analyst, Manager, Admin) decide what someone can do on one particular site. They are granted per site under Settings > Access control.

So access is no longer all or nothing. An agency gets Analyst on the one site it works on. A payments team gets Manager on the checkout site and nothing else. Instead of granting site by site and person by person, put people in a group and grant the group a role on the website. Onboarding becomes one action, and every grant is visible in one place and in the audit log.

Documentation: Roles and permissions, Groups, Website access.

An API, and an MCP server

Everything in the dashboard is now on a REST API: sites, reports, the script inventory, metrics, alert rules, members, and the audit log.

Next to it sits a built-in MCP server, so Claude Code, Cursor, or any MCP client can query your reports, inspect your script inventory, and manage alert rules with scoped, revocable tokens. The API and MCP reference documents both. Both are included from the Business plan up.

Documentation: API and MCP, Get started, API keys.

New docs, and everything in French

The documentation moves to its own site with three sections:

• Platform, how the product works.
• Web Security, the standards themselves: the Reporting API, CSP and every directive, COOP, COEP, Permissions-Policy, NEL, and the rest.
• API and MCP, the reference.

The blog moves from /articles to /blog.

The website, the dashboard, and the docs are now fully available in French. All data is hosted in France on OVH and never leaves the EU.

Free tools, rebuilt and expanded

Seven tools run on any public URL with no account. The scanner and the evaluator were rebuilt on the same analysis engine as the platform, so they check more than the CSP header alone and explain each finding instead of only grading it. Three tools are new.

CSP scanner

Point the CSP scanner at a live URL. It reads the policy the page actually serves, headers and <meta> tags, and reviews it directive by directive: what each one allows, where the policy falls back to default-src, which sources widen it, and which weaknesses ('unsafe-inline', wildcards, an allowlisted CDN that hosts a bypass) an attacker could use. Run it on your own site before and after a change, or on a page you did not write.

CSP evaluator

The CSP evaluator runs the same review on a policy you paste, before it goes anywhere near production. Same checks, same severities, nothing to deploy. Use the evaluator while you are editing a policy, and the scanner once it ships.

Security headers scanner

New. The security headers scanner grades every security header a URL returns, not only CSP: Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Cross-Origin-Resource-Policy, cookie flags, plus the deprecated and information-disclosure headers you should be removing. Each result links to the header reference explaining what it protects against and what to set.

Reporting API checker

New. The Reporting API checker answers one question, is reporting actually wired up. It checks that Reporting-Endpoints (or the legacy Report-To) is present and well formed, and that the endpoint group your policy names exists in it. Run it after you deploy the header, rather than waiting for reports that will never arrive.

Compare your site

New. Compare your site benchmarks your configuration against the dataset behind our annual State of the Web report, built from 521,442 scanned domains. You see your posture next to your industry, so you can tell a stakeholder where you stand and not only what you are missing.

Hash generators and the extension

The CSP hash generator produces the 'sha256-...' value that allowlists one inline script or style, and the SRI generator produces the integrity value for a script or stylesheet URL. The Chrome extension applies a policy locally on real pages, so you can see what it would block before you ship it.

New plans

The old Starter, Advanced, Pro, and Corporate plans are no longer sold. The new lineup is three self-serve plans plus Enterprise, priced in EUR, with annual billing at ten times the monthly price (two months free). See the full comparison on the pricing page.

The entry price is higher than the old Starter plan, and the entry plan is much bigger:

• Start includes 250,000 reports per month where Starter included 15,000, five users instead of one, all 12 report types, and the script inventory.
• Business adds the API, the MCP server, and unlimited alerting.
• Scale adds the PCI DSS v4 module, Technologies with CVE detection, SSO, and the audit log.

What stays the same on every plan:

• The single-header setup and custom reporting subdomains.
• The policy builder and unlimited scans.
• 90-day retention and EU hosting.

If you are an existing customer

Your plan and price do not change

Nothing changes on your bill. Your current plan, price, quotas, and features are grandfathered for as long as you keep your subscription. The new plans apply to new signups from September 13.

You also get the new platform. Your plan keeps every feature it includes today and gains all 12 report types, with their dashboards and the Explorer, the first time you log in. Features introduced with the new plans, like the MCP server or the PCI DSS v4 module, follow the new lineup; you can switch plans from the billing page if you want them.

Your data and endpoints are migrated

Your account, websites, historical reports, policies, and alert rules are migrated automatically. Your reporting endpoints keep working unchanged, there is nothing to redeploy. The one visible change, you now sign in at app.centralcsp.com.

SSO connections need remapping

If your workspace signs in with SSO, the connection has to be remapped to the new platform. We contacted every affected customer directly before the release, so in most cases this is already handled.

If anything is wrong with SSO after the migration, sign-in failing or a user landing without their usual access, reach out to us and we will fix it.

Questions you may have

What are the new CentralCSP plans?

Start, Business, and Scale, plus Enterprise on quote. The pricing page has the full comparison table.

Will my price change?

No. Existing subscriptions keep their current price and quotas indefinitely. If you want the new plans, you can switch from the billing page, and switching is permanent.

Do I need to change my reporting header?

No. Your endpoint and your custom subdomain keep working exactly as before.

Do I need to do anything about SSO?

Only if we contacted you. SSO connections are remapped to the new platform, and every affected customer was contacted before the release. If sign-in through SSO does not work, contact us.

Where did the docs and old articles go?

The docs live on the new documentation site and the blog moved from /articles to /blog. Old article and docs URLs redirect to their new equivalents, so existing bookmarks and links keep working.

Can I move to a new plan?

Yes, from the billing page in the dashboard. Compare what you would gain on the pricing page first, because you cannot move back to a retired plan.

Is my data affected by the migration?

No. Reports, policies, and settings are migrated automatically, and retention stays at 90 days. Data is hosted in France on OVH.

What comes next

This release is the foundation, one platform for every signal browsers report about your site. Next we build on it, more report types as browsers ship them, deeper analysis, and more evidence for the people you answer to.

Log in at app.centralcsp.com to see your sites on the new platform, or start a free trial if you are new. If something looks wrong after the migration, contact us and we will fix it.