Setup & Installation
Add CSP reporting to your site and connect it to MetricPoints.
CSP Monitoring Setup
Content Security Policy (CSP) monitoring helps you track violations and optimize your security headers.
Quickest setup: Managed CSP on csp-heal
Install one hosted csp-heal script on any website where changing response headers is difficult, keep the token in place, and manage policy behavior from your MetricPoints account.
<script async src="https://csp-heal.metricpoints.com/managed-csp.js?heal-token=YOUR_HEAL_TOKEN"></script>No download is required. For production enforcement, server or CDN headers are still the stronger option when you can control them.
Open csp-heal Install GuideWordPress Plugin Installation
Install the unified MetricPoints Browser Beacon plugin when WordPress is the easiest place to add browser telemetry and CSP reporting.
Setup Steps:
- Download the MetricPoints Browser Beacon plugin
- Upload and activate in WordPress admin
- Configure your API key
- Enable the optional CSP monitoring section
- Choose external owner, report-only, or WordPress-managed CSP headers
Custom / Manual CSP Setup
For custom implementations, add the report-uri directive to your CSP headers.
Please remember to replace (YOUR_API_KEY) with your actual API key.
Note: These are examples only. Your Content Security Policy setup will be different.
Content-Security-Policy-Report-Only (This will not enforce the policy, but will report violations):
Content-Security-Policy-Report-Only: default-src 'self'; report-uri https://metricpoints.com/api/csp-reports/(YOUR_API_KEY)Content-Security-Policy (This will enforce the policy):
Content-Security-Policy: default-src 'self'; report-uri https://metricpoints.com/api/csp-reports/(YOUR_API_KEY)