Get started with CentralCSP
CentralCSP collects the policy and error reports browsers send about your site, inventories your scripts, and turns both into signal and PCI DSS evidence.
Last update:
CentralCSP is a client-side security platform built on the browser Reporting API. You register a website, point its reporting headers at the endpoint CentralCSP generates for it, and the policy violations and network errors your visitors' browsers report arrive in your dashboard.
The browser does the enforcing. CentralCSP never sits in the request path, so adding it cannot break a page or slow a response. What you get is observability, policy tooling, and compliance evidence, not a WAF and not a proxy.
Before you start
Before you add a website, make sure you have:
- A way to set HTTP response headers on your site, at your web server, CDN, or framework.
- The site served over HTTPS. The Reporting API delivers nothing from a plain HTTP page.
- Workspace Admin or Owner to add a website.
Start here
Three pages cover the first hour:
- Quickstart: Add a website, deploy its headers, and confirm the first report arrives. Quickstart
- Websites: Everything you configure per site, including the endpoint, ingestion filters, usage, and access. Websites
- Reports: All 13 report types plus the raw Explorer. Reports
What you can set up
Each goal has a page to start from:
| Goal | Start at |
|---|---|
| See what your pages load and block what they should not | CSP violations |
| Know which scripts run and whether they changed | CSP hashes |
| Evidence for PCI DSS v4 script controls, 6.4.3 and 11.6.1 | PCI DSS |
| Be told when something new appears | Alerting |
| Restrict who sees which sites | Access control |
CentralCSP helps you meet the PCI DSS script requirements. It does not certify you.
If the browser standards are new to you, the Reporting API reference covers delivery and Policies covers each policy.
Before you add anything, the free security headers scanner, CSP scanner, and Technology Checker show where your site stands today. None of them needs an account, and all three are a useful baseline to compare against once reports start arriving.