# Overview (/en/docs/platform/get-started)



CentralCSP is a client-side security platform built on the browser Reporting API. You register a website, point its reporting headers at the endpoint CentralCSP generates for it, and every policy violation and network error your visitors' browsers observe arrives in your dashboard.

The browser does the enforcing. CentralCSP never sits in the request path, so adding it cannot break a page or slow a response. What you get is observability, policy tooling, and compliance evidence, not a WAF and not a proxy.

## Before you start [#before-you-start]

Before you add a website, make sure you have:

* A way to set HTTP response headers on your site, at your web server, CDN, or framework.
* The site served over HTTPS. The Reporting API delivers nothing from a plain HTTP page.
* Workspace **Admin** or **Owner** to add a website.

## Start here [#start-here]

Three pages cover the first hour:

* **Quickstart:** Add a website, deploy its headers, and confirm the first report arrives. [Quickstart](/en/docs/platform/get-started/quickstart)
* **Websites:** Everything you configure per site, including the endpoint, ingestion filters, usage, and access. [Websites](/en/docs/platform/websites)
* **Reports:** All 13 report types plus the raw Explorer. [Reports](/en/docs/platform/monitoring)

## What you can set up [#what-you-can-set-up]

Each goal has a page to start from:

| Goal                                                      | Start at                                                    |
| --------------------------------------------------------- | ----------------------------------------------------------- |
| See what your pages load and block what they should not   | [CSP violations](/en/docs/platform/monitoring/csp)          |
| Know which scripts run and whether they changed           | [CSP hashes](/en/docs/platform/monitoring/script-hash)      |
| Evidence for PCI DSS v4 script controls, 6.4.3 and 11.6.1 | [PCI DSS](/en/docs/platform/features/pci-dss)               |
| Be told when something new appears                        | [Alerting](/en/docs/platform/features/alerting)             |
| Restrict who sees which sites                             | [Access control](/en/docs/platform/websites/access-control) |

CentralCSP helps you meet the PCI DSS script requirements. It does not certify you.

If the browser standards are new to you, the [Reporting API reference](/en/docs/web-security/reporting-api) covers delivery and [Policies](/en/docs/web-security/policies) covers each policy.

Before you add anything, the free [security headers scanner](/tools/security-headers) and [CSP scanner](/tools/csp-scanner) show where your site stands today. Neither needs an account, and both are a useful baseline to compare against once reports start arriving.

## Next steps [#next-steps]

* [Quickstart](/en/docs/platform/get-started/quickstart)
* [Websites](/en/docs/platform/websites)