How long does it take to connect a site?

One response header. Add it at your CDN, reverse proxy, framework, or application layer, and reports appear as real users browse. There is no JavaScript agent and no SDK to deploy.

Can CentralCSP break my application?

No. Collecting reports changes nothing about how your pages behave. For CSP work, start with Content-Security-Policy-Report-Only, review real violations, and enforce only when the policy runs clean.

Is this just a CSP report collector?

No. CentralCSP dedupes and classifies reports, keeps the raw JSON with source file, line and column, inventories scripts with integrity hashes, flags known CVEs, builds policy from production traffic, scores your posture, routes alerts, and exports audit evidence.

Does it replace Sentry or a WAF?

No. Those tools cover application errors, network and server telemetry. CentralCSP covers the scripts, requests and policy violations that execute in your users' browsers, then feeds that signal back into the stack you already run.

Can I use the data in my own automation?

Yes. Everything in the dashboard is available over the REST API, webhooks, and CSV, timeline and raw-report exports. AI agents can drive the platform over the built-in MCP server.

Where is the data hosted?

In France, on OVH. It never leaves the EU.

For developers

Ship the site. Keep the browser under watch.

One response header collects CSP and browser security reports from your real traffic: violations to debug, alerts to act on. No agent, no SDK.

1.5B: reports ingested
12: report types collected
0: agents or SDKs to install
100%: EU data residency

The blind spot

Your server tools stop at the response.

Third-party scripts, injected code and policy violations execute in the browser, after the page leaves your infrastructure. CentralCSP collects the signal browsers already emit and routes it back to your stack.

01 - Browsers

Native Reporting-API signals from your real production traffic.

csp-violation
deprecation
intervention
network-error
crash

02 - Endpoint

Your managed reporting endpoint.

MyEndpoint.report.centralcsp.com

Normalize and dedupe
Classify by report type and origin
Enrich with source context
Score and inventory

03 - Your stack

The signal lands where you already work.

Live dashboard
REST API
MCP server

Real production traffic

Reports come from your actual visitors' browsers, not a crawler pointed at a staging URL.

Source-level context

Every violation keeps its source file, line, column, directive, browser and origin.

Zero runtime dependency

Nothing loads on your pages. Browsers report natively, so performance impact is zero.

Setup

One header. That's the integration.

Ship it from the CDN, reverse proxy, framework or application layer, whichever you own.

response header

Reporting-Endpoints:

default="https://MyEndpoint.report.centralcsp.com"

Have a CSP already? Point its report-to at the same endpoint and every violation lands there too.

Add your site
Create the site in your dashboard and copy its managed reporting endpoint.
Ship the header
Deploy from your edge or app. Reports flow from real visitor browsers immediately.
Route the signal
Watch the live dashboard, wire alerts to your channels, pull anything over the API.

Free tools

Try the full security toolkit.

Six tools, no account required. The same engines the platform runs on.

Full header inventory
Findings ranked by severity
Results on a shareable page

Scan a site

Directive-by-directive findings
A clear overall score
Powered by the platform engine

Evaluate a policy

Endpoint and binding checks
Coverage per report type
Dropped-report warnings

Check your setup

Every header, graded
Fixes for what's missing
Rescan after you deploy

Scan security headers

Live scan of your site
Industry cohort comparison
Assess your maturity

Compare your site

Live violation feed
Build and test policies in place
Works on the page you're viewing

Get the extension

The dashboard

Everything happens in one place.

Reports, scores, inventories and evidence for every site you ship, behind one login.

Trends across millions of reports
Reports broken down by browser
Millions of reports, aggregated

Automation

Everything in the dashboard, over the API.

Reports, inventories, scores and evidence are all queryable. Automate site onboarding, export everything, or let your AI agents drive it over MCP.

Full REST API with workspace API keys
Webhooks, CSV and raw-report exports
Built-in MCP server for AI agents
Alerts to Slack, Teams or any webhook

See the API and MCP platform

GET /reports/csp-violation/raw

$ curl -G https://api.centralcsp.com/v1/websites/$WEBSITE/reports/csp-violation/raw \

-H "Authorization: Bearer $CENTRALCSP_TOKEN" \

-d range=90d -d limit=50

{

"data": [

{

"type": "csp-violation",

"receivedAt": "2026-07-14T09:12:04.295Z",

"url": "https://my-store.com/checkout",

"userAgent": { "family": "Chrome", "version": "138.0", "os": "macOS" },

"data": {

"blocked_url": "https://cdn.evil-analytics.io/t.js",

"effective_directive": "script-src-elem",

"source_file": "https://my-store.com/checkout.js",

"line_number": 184,

"column_number": 22,

"disposition": "enforce"

}

],

"pagination": { "hasMore": true, "total": 40495687 }

}

Past the code review

Answers for the rest of the room.

What compliance, security review and procurement will ask about, covered by the same platform.

01 - Compliance
PCI DSS evidence
If your checkout is in scope, requirements 6.4.3 and 11.6.1 are covered from the same signal.
02 - Security review
Enterprise controls
The controls your security review asks about, already in place. Data hosted in France, on OVH.
03 - Access
Team and access
Bring the whole team without sharing one login, and scope who sees what.

Pricing

Priced for a side project. Built for production.

Start covers real collection on your first production site: every report type, the live dashboard and unlimited scans. Upgrade when you need automation.

12 report types, one header
Unlimited scans
Policy builder
14-day free trial

€39.99/ mo

14-day free trial

Applications3
Users5
Reports / month250,000

Plan features

Full Reporting-API support
Unlimited scans
Script inventory
Team access and RBAC
Policy builder

Start free trial

The signal

The reports you will read first.

One endpoint collects all twelve types. These are the three most developers open on day one.

csp-violation
CSP violations
A resource was blocked, or would be blocked, by your Content Security Policy.
View docs
csp-hash
Script hashes
The hash of every script the page executes, the raw material for hash-based policies.
View docs
network-error
Network errors
DNS, TLS and connection failures your server never sees, logged by the browser itself.
View docs

See all 12 browser report types

FAQ

Frequently asked questions

Implementation, safety and automation, answered.

Add the header. See what the browser sees.

Start with one site and real production traffic. 14-day free trial, no agent to deploy.

Start free trial Scan your site

Ship the site. Keep the browser under watch.

Your server tools stop at the response.

Real production traffic

Source-level context

Zero runtime dependency

One header. That's the integration.

Add your site

Ship the header

Route the signal

Try the full security toolkit.

CSP scanner

CSP evaluator

Reporting-API checker

Security headers scanner

Security compare

Chrome extension

Everything happens in one place.

Everything in the dashboard, over the API.

Answers for the rest of the room.

PCI DSS evidence

Enterprise controls

Team and access

Priced for a side project. Built for production.

Start

The reports you will read first.

Frequently asked questions

Add the header. See what the browser sees.