How long does it take to connect a site?

One response header. Add it at your CDN, reverse proxy, framework, or application layer, and reports appear as real users browse. There is no JavaScript agent and no SDK to deploy.

Can CentralCSP break my application?

No. Collecting reports changes nothing about how your pages behave. For CSP work, start with Content-Security-Policy-Report-Only, review real violations, and enforce only when the policy runs clean.

Is this just a CSP report collector?

No. CentralCSP dedupes and classifies reports, keeps the raw JSON with source file, line and column, inventories scripts with integrity hashes, flags known CVEs, builds policy from production traffic, scores your posture, routes alerts, and exports audit evidence.

Does it replace Sentry or a WAF?

No. Those tools cover application errors, network and server telemetry. CentralCSP covers the scripts, requests and policy violations that execute in your users' browsers, then feeds that signal back into the stack you already run.

Can I use the data in my own automation?

Yes. Everything in the dashboard is available over the REST API, webhooks, and CSV, timeline and raw-report exports. AI agents can drive the platform over the built-in MCP server.

Where is the data hosted?

In France, on OVH. It never leaves the EU.

For developers

Ship the site. Keep the browser under watch.

One response header collects CSP and browser security reports from your real traffic: violations to debug, alerts to act on. No agent, no SDK.

1.5B: reports ingested
12: report types collected
0: agents or SDKs to install
100%: EU data residency

The blind spot

Your server tools stop at the response.

Third-party scripts, injected code and policy violations execute in the browser, after the page leaves your infrastructure. CentralCSP collects the signal browsers already emit and routes it back to your stack.

01 - Browsers

Native Reporting-API signals from your real production traffic.

csp-violation
deprecation
intervention
network-error
crash

02 - Endpoint

Your managed reporting endpoint.

MyEndpoint.report.centralcsp.com

Normalize and dedupe
Classify by report type and origin
Enrich with source context
Score and inventory

03 - Your stack

The signal lands where you already work.

Live dashboard
REST API
MCP server

Real production traffic

Reports come from your actual visitors' browsers, not a crawler pointed at a staging URL.

Source-level context

Every violation keeps its source file, line, column, directive, browser and origin.

Zero runtime dependency

Nothing loads on your pages. Browsers report natively, so performance impact is zero.

Setup

One header. That's the integration.

Ship it from the CDN, reverse proxy, framework or application layer, whichever you own.

response header

Reporting-Endpoints: default="https://MyEndpoint.report.centralcsp.com"

Have a CSP already? Point its report-to at the same endpoint and every violation lands there too.

1Add your siteCreate the site in your dashboard and copy its managed reporting endpoint.
2Ship the headerDeploy from your edge or app. Reports flow from real visitor browsers immediately.
3Route the signalWatch the live dashboard, wire alerts to your channels, pull anything over the API.

Free tools

Try the full security toolkit.

Six tools, no account required. The same engines the platform runs on.

Full header inventory
Findings ranked by severity
Results on a shareable page

Scan a site

Directive-by-directive findings
A clear overall score
Powered by the platform engine

Evaluate a policy

Endpoint and binding checks
Coverage per report type
Dropped-report warnings

Check your setup

Every header, graded
Fixes for what's missing
Rescan after you deploy

Scan security headers

Live scan of your site
Industry cohort comparison
Assess your maturity

Compare your site

Live violation feed
Build and test policies in place
Works on the page you're viewing

Get the extension

The dashboard

Everything happens in one place.

Reports, scores, inventories and evidence for every site you ship, behind one login.

Live reports from real visitors
Directive, browser and origin filters
Auditor-ready PCI evidence

Automation

Everything in the dashboard, over the API.

Reports, inventories, scores and evidence are all queryable. Automate site onboarding, export everything, or let your AI agents drive it over MCP.

Full REST API with scoped tokens
Webhooks, CSV and raw-report exports
Built-in MCP server for AI agents
Alerts to Slack, Teams or any webhook

See the API and MCP platform

GET /reports/csp-violation/raw

$ curl -G https://api.centralcsp.com/v1/websites/$WEBSITE/reports/csp-violation/raw \

-H "Authorization: Bearer $CENTRALCSP_TOKEN" \

-d range=90d -d limit=50

{

"data": [

{

"type": "csp-violation",

"receivedAt": "2026-07-14T09:12:04.295Z",

"url": "https://my-store.com/checkout",

"userAgent": { "family": "Chrome", "version": "138.0", "os": "macOS" },

"data": {

"blocked_url": "https://cdn.evil-analytics.io/t.js",

"effective_directive": "script-src-elem",

"source_file": "https://my-store.com/checkout.js",

"line_number": 184,

"column_number": 22,

"disposition": "enforce"

}

],

"pagination": { "hasMore": true, "total": 40495687 }

}

Past the code review

Answers for the rest of the room.

What compliance, security review and procurement will ask about, covered by the same platform.

01 - Compliance
PCI DSS evidence
If your checkout is in scope, requirements 6.4.3 and 11.6.1 are covered from the same signal.
02 - Security review
Enterprise controls
The controls your security review asks about, already in place. Data hosted in France, on OVH.
03 - Access
Team and access
Bring the whole team without sharing one login, and scope who sees what.

The signal

Every report type browsers can send.

One endpoint collects them all. Each type is parsed, deduped and searchable from day one.

csp-violation
CSP violations
A resource was blocked, or would be blocked, by your Content Security Policy.
View docs
csp-hash
Script hashes
The hash of every script the page executes, the raw material for hash-based policies.
View docs
integrity-violation
Integrity violations
A script failed its Subresource Integrity check under your Integrity-Policy.
View docs
coop
COOP violations
A cross-origin window interaction your Cross-Origin-Opener-Policy blocked or would block.
View docs
coep
COEP violations
A resource loaded without the opt-in your Cross-Origin-Embedder-Policy requires.
View docs
document-policy-violation
Document Policy violations
A page behavior that breaks the configuration your Document-Policy declares.
View docs
permissions-policy-violation
Permissions Policy violations
A feature like camera or geolocation was used against your Permissions-Policy.
View docs
connection-allowlist
Connection Allowlist violations
A connection left your page for an origin outside the allowlist you declared.
View docs
network-error
Network errors
DNS, TLS and connection failures your server never sees, logged by the browser itself.
View docs
deprecation
Deprecations
The page uses a browser API scheduled for removal, with the removal date when known.
View docs
intervention
Interventions
The browser changed your page's behavior itself, like blocking an autoplay or a slow script.
View docs
crash
Crashes
The tab crashed or ran out of memory while a user was on your page.
View docs

FAQ

Frequently asked questions

Implementation, safety and automation, answered.

Add the header. See what the browser sees.

Start with one site and real production traffic. 14-day free trial, no agent to deploy.

Start free trial Scan your site

Ship the site. Keep the browser under watch.

Your server tools stop at the response.

Real production traffic

Source-level context

Zero runtime dependency

One header. That's the integration.

Try the full security toolkit.

CSP scanner

CSP evaluator

Reporting-API checker

Security headers scanner

Security compare

Chrome extension

Everything happens in one place.

Everything in the dashboard, over the API.

Answers for the rest of the room.

PCI DSS evidence

Enterprise controls

Team and access

Every report type browsers can send.

Frequently asked questions

Add the header. See what the browser sees.