CentralCSP features
Policy builders, PCI DSS script controls, the script inventory built from hash reports, the Technologies SBOM with CVE detection, and alerting on what changes.
Last update:
Five features are built on the reports CentralCSP collects:
- Builders: Write a Content-Security-Policy, Permissions-Policy, or Connection-Allowlist header from the reports browsers sent, and review every value before you deploy it. Builders
- PCI DSS: Define payment-page scope, review every script found there, and export an evidence pack. PCI DSS
- Script inventory: Every script real browsers load on your site, grouped by origin, with hash history. Script inventory
- Technologies: The libraries your visitors' browsers load, with version, lifecycle status, and known CVEs, a client-side SBOM built from the same hash reports. Technologies
- Alerting: Notify a channel when a new violation type appears, volume spikes, a library gains a CVE, or an unjustified script lands on a payment page. Alerting
All five depend on reports arriving first. For more information, refer to Connect your site.
Your plan decides which features you can use. The Permissions-Policy and Connection-Allowlist builders work on every plan. For more information, refer to Billing.
Next steps
Network errors
Requests to your site that failed, reported by the browser. Failures your server logs cannot contain, because the request never arrived.
Overview
The CSP, Permissions-Policy, and Connection-Allowlist builders turn the reports browsers send into headers you review, then deploy in report-only mode.