Get started with CentralCSP
CentralCSP collects the policy and error reports browsers send about your site, inventories your scripts, and turns both into signal and PCI DSS evidence.
Last update:
CentralCSP is a client-side security platform built on the browser Reporting API. You register a website, point its reporting headers at the endpoint CentralCSP generates for it, and every policy violation and network error your visitors' browsers observe arrives in your dashboard.
The browser does the enforcing. CentralCSP never sits in the request path, so adding it cannot break a page or slow a response. What you get is observability, policy tooling, and compliance evidence, not a WAF and not a proxy.
Before you start
Before you add a website, make sure you have:
- A way to set HTTP response headers on your site, at your web server, CDN, or framework.
- The site served over HTTPS. The Reporting API delivers nothing from a plain HTTP page.
- Workspace Admin or Owner to add a website.
Start here
Three pages cover the first hour:
- Quickstart: Add a website, deploy its headers, and confirm the first report arrives. Quickstart
- Websites: Everything you configure per site, including the endpoint, ingestion filters, usage, and access. Websites
- Reports: All 13 report types plus the raw Explorer. Reports
What you can set up
Each goal has a page to start from:
| Goal | Start at |
|---|---|
| See what your pages load and block what they should not | CSP violations |
| Know which scripts run and whether they changed | CSP hashes |
| Evidence for PCI DSS v4 script controls, 6.4.3 and 11.6.1 | PCI DSS |
| Be told when something new appears | Alerting |
| Restrict who sees which sites | Access control |
CentralCSP helps you meet the PCI DSS script requirements. It does not certify you.
If the browser standards are new to you, the Reporting API reference covers delivery and Policies covers each policy.
Before you add anything, the free security headers scanner and CSP scanner show where your site stands today. Neither needs an account, and both are a useful baseline to compare against once reports start arriving.