Managed CSP on csp-heal
Install the hosted csp-heal MetricPoints option when response headers are hard to change.
Managed CSP on csp-heal
csp-heal.metricpoints.com is the hosted MetricPoints option for CSP management. Use it when changing server or CDN headers is difficult: install one heal-token script, keep the token in place, and manage policy behavior from your MetricPoints account.
What to know first
- No JavaScript download is required. The csp-heal host serves the bootstrap script for you.
- The website-side install has one variable only: your heal token.
- Policy learning, scoring, digests, alerts, and trust mode all stay in your MetricPoints account.
- This is separate from browser event tracking. Error tracking uses the MetricPoints browser beacon; CSP-heal manages CSP behavior.
- For strongest production enforcement and full browser reporting behavior, use server or CDN CSP headers when your stack allows it.
Step 1: Create or open a CSP site in MetricPoints
In your MetricPoints dashboard, go to your CSP sites, enable Managed CSP on csp-heal, and copy the install snippet generated for that site.
Step 2: Install the hosted script on your website
Paste the generated script tag into the layout or template that loads on every page. Replace YOUR_HEAL_TOKEN with the token from your MetricPoints project.
<script async src="https://csp-heal.metricpoints.com/managed-csp.js?heal-token=YOUR_HEAL_TOKEN"></script>There is no separate file to download, upload, or keep updated. The script is hosted on the csp-heal MetricPoints origin and calls back to your account-managed configuration.
Step 3: Let MetricPoints manage the script policy
- MetricPoints fetches the current managed policy for that token.
- The install refreshes periodically and can keep using a cached last-known-good payload if needed.
- Runtime health events are sent back so your team can be warned if the install cannot reach MetricPoints or falls back to cache.
- Teams can choose manual review, safe auto-handling, or fully managed behavior from the dashboard.
Where configuration lives
The website is just a stub. MetricPoints is the source of truth for:
- Trust mode and automation rules
- Policy versions and rollback
- Digests and critical alerts
- Source verification and install health
- Future policy learning and auto-healing decisions
Important note
CSP-heal is a practical hosted option, not a complete replacement for HTTP headers. Browser CSP delivered through a meta tag has limits, including directives that require response headers. Use server or CDN headers whenever you can control them, and use csp-heal when you need an account-managed fallback.