CSP Monitoring
Content Security Policy monitoring and management
CSP Monitoring Setup
Content Security Policy (CSP) monitoring helps you track violations and optimize your security headers.
Quickest setup: Managed CSP on csp-heal
Install one hosted csp-heal script on any website where changing response headers is difficult, keep the token in place, and manage policy behavior from your MetricPoints account.
<script async src="https://csp-heal.metricpoints.com/managed-csp.js?heal-token=YOUR_HEAL_TOKEN"></script>No download is required. For production enforcement, server or CDN headers are still the stronger option when you can control them.
Open csp-heal Install GuideWordPress Plugin Installation
Install the unified MetricPoints Browser Beacon plugin when WordPress is the easiest place to add browser telemetry and CSP reporting.
Setup Steps:
- Download the MetricPoints Browser Beacon plugin
- Upload and activate in WordPress admin
- Configure your API key
- Enable the optional CSP monitoring section
- Choose external owner, report-only, or WordPress-managed CSP headers
Custom / Manual CSP Setup
For custom implementations, add the report-uri directive to your CSP headers.
Please remember to replace (YOUR_API_KEY) with your actual API key.
Note: These are examples only. Your Content Security Policy setup will be different.
Content-Security-Policy-Report-Only (This will not enforce the policy, but will report violations):
Content-Security-Policy-Report-Only: default-src 'self'; report-uri https://metricpoints.com/api/csp-reports/(YOUR_API_KEY)Content-Security-Policy (This will enforce the policy):
Content-Security-Policy: default-src 'self'; report-uri https://metricpoints.com/api/csp-reports/(YOUR_API_KEY)