✓
CSP violation grouping
Combine repeated reports by directive, source, page, and impact so patterns are visible.
CSP & security-header monitoring
Know when your browser protections weaken—or block something important.
MetricPoints can inspect public CSP and security headers without installing site software, then group Content Security Policy violations when reporting is configured. Full-site monitoring shows whether the same event also affected availability, performance, or browser events.
Start with External Security Monitoring: uptime, TLS, DNS, domain expiration, security headers, and report-only CSP guidance from outside the site.
Content Security Policy (CSP) is a browser protection layer that controls which scripts, images, frames, and other resources your site is allowed to load. It helps limit malicious code, risky third-party behavior, and unauthorized content.
Violation grouping
Header health
Risky scripts
Change alerts
Included in every unified monitoring plan. Full Coverage adds raw diagnostic investigation.
Protection changed
New script source blocked
checkout.example.com · script-src
Blocked resource
https://payments.example-cdn.com/widget.js
Affected page
/checkout
First detected
After deployment
Browser events
Increased
Occurrences
Grouped incident
→
Review whether the new payment host is expected, then update the policy deliberately or investigate the deployment.
Illustrative incident using evidence captured by MetricPoints.
Continuous protection visibility
A policy is only useful if you know what it is doing in production.
CSP reports can be noisy and security headers can drift quietly. MetricPoints turns raw browser evidence into grouped, reviewable changes without hiding the technical detail developers need.
✓
Security-header health
Watch the browser-facing protections that can weaken during releases or configuration changes.
✓
Risky-script visibility
Identify unexpected third-party sources and investigate what changed before trusting them.
✓
Actionable incident history
Preserve detection, surrounding evidence, and recovery in one reviewable timeline.
Report-only first
Use CSP as proof before you enforce it.
For cautious clients, MetricPoints can begin with public external monitoring and report-only CSP guidance. That lets an agency collect evidence, see what would break, and explain the risk before asking for a beacon, WordPress plugin, or enforced policy change.
Injected or unfamiliar scripts
Show when a new source appears, where it appeared, and whether it touched an important visitor path.
Checkout or form breakage
Catch policy reports on high-value pages before an enforced CSP blocks revenue or lead flow.
Security headers drift
Prove when a release, host change, or plugin update weakens browser protections.
One monitoring product
A blocked script might be protection working—or a customer journey breaking.
CSP evidence becomes more useful when it sits beside deployments, browser events, performance, uptime, SSL, and DNS changes. That context helps teams protect the site without blindly allowing every blocked source.
Explore complete website monitoring →Browser events
Did a protected flow start failing for visitors?
Deployments
Did the source or policy change with a release?
Performance
Did a new third-party script slow key pages?
Infrastructure
Did DNS, SSL, or availability change at the same time?
Flexible installation
Fully managed CSP for any website
Start by watching the public policy and headers from outside the site. Use the hosted bootstrap script for managed CSP, or use the WordPress plugin where plugin-assisted setup better fits the workflow. There is nothing to download for the hosted-script path.
Any website
Hosted bootstrap script
Install once with your site token and keep the integration system-managed.
<script async src="https://csp-heal.metricpoints.com/managed-csp.js?heal-token=YOUR_HEAL_TOKEN"></script>WordPress
Plugin-assisted setup
Use the WordPress integration when plugin-based installation and configuration better match the site workflow.
- ✓ Guided WordPress installation
- ✓ CSP reporting connection
- ✓ Access to policy tools and documentation
Frequently asked questions
CSP and security monitoring, clearly explained
Does MetricPoints automatically loosen my CSP?+
No. Monitoring and recommendations do not silently allow new sources. Policy decisions should be reviewed against the captured evidence before changes are applied.
Can I start without installing anything?+
Yes. MetricPoints can read public CSP and security headers externally, alongside uptime, TLS, DNS, domain, and public-page checks. Add CSP reporting, the browser beacon, or the WordPress plugin later for deeper evidence.
Will CSP monitoring prevent every attack?+
No single browser policy can prevent every threat. CSP reduces specific browser-side risks and provides valuable evidence, but it belongs inside a broader security and maintenance practice.
Is CSP monitoring a separate subscription?+
No. CSP, security headers, risky scripts, uptime, SSL, DNS, domains, browser events, and performance are signals inside the unified monitoring plans.
Which plan includes raw CSP reports?+
Every paid plan includes protection health and important incident summaries. Full Coverage and Full Coverage Team add raw event investigation, advanced filtering, and the deeper developer evidence.
Watch the protection—and the website it protects.
Start collecting CSP and security evidence in the same place as your availability, performance, infrastructure, and browser health.
Compare Unified Monitoring PlansChoose Website Coverage for clear health summaries or Full Coverage for advanced diagnostics.