Managed CSP Script
Install the hosted MetricPoints safety-net script when response headers are hard to change.
Managed CSP Script Install Guide
The Managed CSP Script is the quickest way to add a MetricPoints-hosted CSP fallback to sites where changing server or CDN headers is difficult. Install one hosted script, keep the token in place, and manage policy behavior from your MetricPoints account.
What to know first
- No JavaScript download is required. MetricPoints hosts the bootstrap script for you.
- The website-side install has one variable only: your heal token.
- Policy learning, scoring, digests, alerts, and trust mode all stay in your MetricPoints account.
- For strongest production enforcement and full browser reporting behavior, use server or CDN CSP headers when your stack allows it.
Step 1: Create or open a CSP site in MetricPoints
In your MetricPoints dashboard, go to your CSP sites, enable Managed CSP Script, and copy the install snippet generated for that site.
Step 2: Install the hosted script on your website
Paste the generated script tag into the layout or template that loads on every page. Replace YOUR_HEAL_TOKEN with the token from your MetricPoints project.
<script async src="https://csp-heal.metricpoints.com/managed-csp.js?heal-token=YOUR_HEAL_TOKEN"></script>There is no separate file to download, upload, or keep updated. The script is hosted by MetricPoints and calls back to your account-managed configuration.
Step 3: Let MetricPoints manage the script policy
- MetricPoints fetches the current managed policy for that token.
- The install refreshes periodically and can keep using a cached last-known-good payload if needed.
- Runtime health events are sent back so your team can be warned if the install cannot reach MetricPoints or falls back to cache.
- Teams can choose manual review, safe auto-handling, or fully managed behavior from the dashboard.
Where configuration lives
The website is just a stub. MetricPoints is the source of truth for:
- Trust mode and automation rules
- Policy versions and rollback
- Digests and critical alerts
- Source verification and install health
- Future policy learning and auto-healing decisions
Important note
The hosted JavaScript install is an easy fallback, not a complete replacement for HTTP headers. Browser CSP delivered through a meta tag has limits, including report-only behavior and directives that require response headers.