# CentralCSP

> CentralCSP simplifies web security with powerful Content Security Policy (CSP) and PCI DSS v4 tools. It collects browser-sent CSP violation reports, analyzes them in real time, inventories first- and third-party scripts (with SRI hashes and known CVEs), monitors payment pages for PCI DSS v4.0 compliance, and generates tight CSP policies from real-world traffic.

CentralCSP protects websites against XSS, formjacking, and clickjacking by turning CSP, which is otherwise time-consuming and error-prone to manage, into a continuous, actionable workflow. Integration is a single header pointing browser violation reports at a CentralCSP collector endpoint; from there the dashboard surfaces violations, scripts, and PCI DSS findings, with alerting to Slack, email, webhooks.

Audience: developers integrating CSP, security engineers monitoring violations and supply-chain risk, and merchants subject to PCI DSS v4.0 (requirements 6.4.3 and 11.6.1).

## Product

- [Homepage](https://centralcsp.com/): Overview of the platform, features, and value propositions.
- [Pricing](https://centralcsp.com/pricing): Plans and free trial details.
- [About](https://centralcsp.com/about): Company background and mission.
- [Contact](https://centralcsp.com/contact): Get in touch with the team.

## Solutions (paid features)

- [CSP Violations Reporting](https://centralcsp.com/features/reporting): Collect, categorize, and analyze Content-Security-Policy violation reports from browsers in real time, with severity scoring and source identification.
- [CSP Policy Builder](https://centralcsp.com/features/builder): Automatically generate a tight, production-ready CSP from your site's actual traffic and content, instead of hand-rolling directives.
- [Script Inventory](https://centralcsp.com/features/script-inventory): Continuously discover every first- and third-party script on your site, compute integrity hashes, and flag known CVEs.
- [PCI DSS v4.0 Monitoring](https://centralcsp.com/features/pci-dss): Monitor payment pages for PCI DSS v4.0 requirements 6.4.3 (script management) and 11.6.1 (change detection).
- [Alerting](https://centralcsp.com/features/alerting): Real-time notifications for violations, new scripts, CVEs, and policy drift via Slack, email, webhooks, and SIEM/ticketing integrations.
- [Enterprise Ready](https://centralcsp.com/features/enterprise-ready): SSO, team collaboration, audit logs, and API integration for enterprise deployments.

## Free tools

- [CSP Scanner](https://centralcsp.com/features/scanner): Online scanner that audits the CSP configuration of any public URL and returns actionable recommendations.
- [CSP Evaluator](https://centralcsp.com/features/evaluator): Offline evaluator to test a CSP string before deploying it.
- [Hash Calculator](https://centralcsp.com/features/hashes): Compute SHA-256/384/512 hashes for inline scripts and styles to allowlist them in CSP.
- [SRI Hash Calculator](https://centralcsp.com/features/sri-hash): Compute Subresource Integrity hashes for third-party scripts.
- [Chrome Extension](https://centralcsp.com/features/extension): Test and inspect a site's CSP on the fly from the browser.

## API and integration

- [API Documentation](https://api.centralcsp.com/): REST API reference for integrating CentralCSP with your applications, SIEM, and CI/CD.
- Integration model: configure a `Content-Security-Policy-Report-Only` (or enforcing) header with a `report-uri` / `report-to` / `Reporting-Endpoints` pointing at a CentralCSP collector. Violations stream into the dashboard with no code changes on the site.

## Documentation (CSP reference)

- [What is CSP?](https://centralcsp.com/docs/what-is-csp): Introduction to Content-Security-Policy and how it prevents XSS and injection attacks.
- [CSP Directives](https://centralcsp.com/docs/csp-directives): Overview of all CSP directives and how they compose.
- [CSP Values](https://centralcsp.com/docs/csp-values): Keywords, source expressions, hashes, nonces, and special values.
- [CSP Headers](https://centralcsp.com/docs/csp-headers): `Content-Security-Policy`, `Content-Security-Policy-Report-Only`, and legacy headers.
- [Report-Only header](https://centralcsp.com/docs/csp-header-report-only): Monitor violations without blocking content.
- [report-uri directive](https://centralcsp.com/docs/report-uri): Legacy violation reporting endpoint.
- [report-to directive](https://centralcsp.com/docs/report-to): Modern Reporting API endpoint groups.
- [Reporting Endpoints header](https://centralcsp.com/docs/csp-header-reporting-endpoints): Declaring endpoint groups for the Reporting API.
- [Report-To header](https://centralcsp.com/docs/csp-header-report-to): Deprecated companion to the Reporting API.
- [X-Frame-Options](https://centralcsp.com/docs/csp-header-x-frame-options): Legacy clickjacking protection and its CSP equivalent.
- [CSP Keywords](https://centralcsp.com/docs/csp-keywords): `'none'`, `'self'`, `'unsafe-inline'`, `'unsafe-eval'`, and others.
- [Host Source](https://centralcsp.com/docs/csp-host-source): Domain, subdomain, port, and path expressions.
- [Scheme Source](https://centralcsp.com/docs/csp-scheme-source): `https:`, `data:`, `blob:` and other scheme sources.
- [Hashes and Nonce](https://centralcsp.com/docs/csp-hashes-nonce): Allowlisting specific inline scripts and styles safely.
- [report-shaXXX keyword](https://centralcsp.com/docs/report-sha-keyword): Including script hashes in violation reports.
- [default-src](https://centralcsp.com/docs/default-src): Fallback for other fetch directives.
- [script-src](https://centralcsp.com/docs/script-src): Allowed JavaScript sources.
- [script-src-attr](https://centralcsp.com/docs/script-src-attr): Inline event handlers and script attributes.
- [script-src-elem](https://centralcsp.com/docs/script-src-elem): Script elements.
- [style-src](https://centralcsp.com/docs/style-src): Allowed CSS sources.
- [style-src-attr](https://centralcsp.com/docs/style-src-attr): Inline style attributes.
- [style-src-elem](https://centralcsp.com/docs/style-src-elem): Style elements.
- [img-src](https://centralcsp.com/docs/img-src): Allowed image sources.
- [font-src](https://centralcsp.com/docs/font-src): Allowed font sources.
- [media-src](https://centralcsp.com/docs/media-src): Allowed audio and video sources.
- [object-src](https://centralcsp.com/docs/object-src): Plugin content (legacy).
- [connect-src](https://centralcsp.com/docs/connect-src): fetch/XHR/WebSocket endpoints.
- [child-src](https://centralcsp.com/docs/child-src): Frames and workers.
- [frame-src](https://centralcsp.com/docs/frame-src): Frames and iframes.
- [worker-src](https://centralcsp.com/docs/worker-src): Workers, SharedWorkers, ServiceWorkers.
- [manifest-src](https://centralcsp.com/docs/manifest-src): Web app manifest sources.
- [plugin-types](https://centralcsp.com/docs/plugin-types): Allowed plugin MIME types.
- [prefetch-src](https://centralcsp.com/docs/prefetch-src): Prefetch/prerender sources (deprecated).
- [fenced-frame-src](https://centralcsp.com/docs/fenced-frame-src): Experimental fenced frame sources.
- [trusted-types](https://centralcsp.com/docs/trusted-types): Trusted Types DOM sink protection.
- [require-trusted-types-for](https://centralcsp.com/docs/require-trusted-types-for): Enforce Trusted Types for DOM operations.
- [frame-ancestors](https://centralcsp.com/docs/frame-ancestors): Clickjacking protection (parents allowed to embed).
- [form-action](https://centralcsp.com/docs/form-action): Allowed form submission targets.
- [base-uri](https://centralcsp.com/docs/base-uri): Allowed `<base>` URLs.
- [sandbox](https://centralcsp.com/docs/sandbox): iframe-like restrictions for the document.
- [upgrade-insecure-requests](https://centralcsp.com/docs/upgrade-insecure-requests): Upgrade HTTP requests to HTTPS automatically.
- [block-all-mixed-content](https://centralcsp.com/docs/block-all-mixed-content): Block mixed content (deprecated).

## Articles

- [Get started with CSP](https://centralcsp.com/articles/get-started-csp): End-to-end walkthrough of deploying a Content Security Policy.
- [CSP and meta tags](https://centralcsp.com/articles/csp-meta-tags): HTTP headers vs `<meta>` and the limitations of meta-tag CSP.
- [Multiple CSP policies overlap](https://centralcsp.com/articles/multiple-csp): How browsers combine multiple CSP headers/meta tags.
- [CSP enforce vs report-only](https://centralcsp.com/articles/csp-enforce-report-only): When and how to use each mode.
- [frame-ancestors vs X-Frame-Options](https://centralcsp.com/articles/frame-ancestor-frame-options): Modern clickjacking protection.
- [Setting up a reporting endpoint](https://centralcsp.com/articles/get-started-reporting-report-uri-report-to): Using `report-uri` and `report-to` with CentralCSP.
- [Nonce with Next.js](https://centralcsp.com/articles/how-to-setup-nonce-with-nextjs): Per-request CSP nonces in Next.js.
- [Stay safe, no more unsafe-inline](https://centralcsp.com/articles/unsafe-inline): Migrating away from `'unsafe-inline'` using nonces and hashes.
- [CSP and GA/GTM](https://centralcsp.com/articles/csp-and-ga-gtm): Allowing Google Analytics and Tag Manager safely with `strict-dynamic`.
- [JSONP and CSP](https://centralcsp.com/articles/jsonp-and-content-security-policy): How JSONP endpoints can bypass CSP and what to do about it.
- [How to build the best CSP](https://centralcsp.com/articles/how-to-build-the-best-csp): Methodology for a production-grade policy.
- [How to use the CSP Builder](https://centralcsp.com/articles/how-to-use-the-csp-builder): Generating a CSP from real traffic with CentralCSP.
- [Fix Bitsight & SecurityScorecard CSP findings](https://centralcsp.com/articles/how-to-fix-bitsight-csp-findings): Resolving common rating-agency CSP findings.
- [Bitsight Web App Security (WAS) algorithm](https://centralcsp.com/articles/new-algorithms-bisight-wah): Understanding the new WAS scoring.
- [CentralCSP Chrome Extension](https://centralcsp.com/articles/centralcsp-chrome-extension): Inspecting and testing CSP from the browser.
- [Subresource Integrity (SRI)](https://centralcsp.com/articles/sri-hash): Using SRI and `crossorigin` for safe third-party scripts.
- [Script Inventory and PCI DSS](https://centralcsp.com/articles/script-inventory): Inventory-driven script security and compliance.
- [Alerting in CentralCSP](https://centralcsp.com/articles/centralcsp-alerting): Real-time notifications for security and compliance events.
- [The data: scheme in CSP](https://centralcsp.com/articles/csp-data-scheme): Risks of `data:` URIs and how to remove them.
- [The blob: scheme in CSP](https://centralcsp.com/articles/csp-blob-scheme): Risks of `blob:` URIs and dynamic scripts.
- [The Reporting-Endpoints header](https://centralcsp.com/articles/reporting-endpoints): Modern endpoint declaration for the Reporting API.
- [report-sha256/384/512 in CSP](https://centralcsp.com/articles/csp-sha-directives): How the report-shaXXX keywords work and how CentralCSP processes them.
- [The trusted-types-eval keyword](https://centralcsp.com/articles/trusted-types-eval): What it is, why to avoid it, and what to use instead.

## Optional

- [Article index](https://centralcsp.com/articles): All published articles.
- [Sitemap](https://centralcsp.com/sitemap.xml): Machine-readable list of all public URLs.
- [robots.txt](https://centralcsp.com/robots.txt): Crawler directives.