CSP and security headers / Managed CSP on csp-heal
Managed CSP on csp-heal
csp-heal.metricpoints.com is the hosted MetricPoints option for CSP management. Use it when changing server or CDN headers is difficult: install one heal-token script, keep the token in place, and manage policy behavior from your MetricPoints account.
What to know first
- No JavaScript download is required. The csp-heal host serves the bootstrap script for you.
- The website-side install has one variable only: your heal token.
- Policy learning, scoring, digests, alerts, and trust mode all stay in your MetricPoints account.
- This is separate from browser event tracking. Error tracking uses the MetricPoints browser beacon; CSP-heal manages CSP behavior.
- For strongest production enforcement and full browser reporting behavior, use server or CDN CSP headers when your stack allows it.
Step 1: Open the site’s CSP setup
Open the site in All Sites and review its CSP settings. When Managed CSP is enabled for that site, copy its generated script from the Setup tab. If the option is unavailable, use the report-only header setup or ask your team administrator.
Step 2: Install the hosted script on your website
Paste the generated script tag into the layout or template that loads on every page. Replace YOUR_HEAL_TOKEN with the token from this site’s generated snippet.
<script async src="https://csp-heal.metricpoints.com/managed-csp.js?heal-token=YOUR_HEAL_TOKEN"></script>There is no separate file to download, upload, or keep updated. The script is hosted on the csp-heal MetricPoints origin and calls back to your account-managed configuration.
Step 3: Let MetricPoints manage the script policy
- MetricPoints fetches the current managed policy for that token.
- The install refreshes periodically and can keep using a cached last-known-good payload if needed.
- Runtime health events are sent back so your team can be warned if the install cannot reach MetricPoints or falls back to cache.
- Teams can choose manual review, safe auto-handling, or fully managed behavior from the dashboard.
Where configuration lives
The website is just a stub. MetricPoints is the source of truth for:
- Trust mode and automation rules
- Policy versions and rollback
- Digests and critical alerts
- Source verification and install health
- Available policy learning and review settings
Important note
CSP-heal is a practical hosted option, not a complete replacement for HTTP headers. Browser CSP delivered through a meta tag has limits, including directives that require response headers. Use server or CDN headers whenever you can control them, and use csp-heal when you need an account-managed fallback.