Sign up
→ https://ingest.csplog.io/api/csp-report?token=YOUR_TOKEN
Create a project, get a unique report URL. That's your setup.
Most of your CSP reports
are not about your site.
Browser extensions, antivirus injections and bots produce the bulk of what arrives at a CSP report endpoint. We drop them in the pipeline, before they reach your dashboard and before they count against your plan. What survives is folded into one row per origin, directive and day, so you read origins instead of a firehose.
No AI writes your security policy. You approve every origin, the header is assembled from exactly those, and then we fetch your own pages and check that header is really live. Other tools let you tick a box and call it done. We check.
# current
Content-Security-Policy:
default-src 'self' 'unsafe-inline' *;
# ↑ this is not security. this is a coping mechanism.
# csplog
Content-Security-Policy:
default-src 'self';
script-src 'self' https://cdn.jsdelivr.net;
style-src 'self' https://fonts.googleapis.com;
img-src 'self' data: https://i.imgur.com;
connect-src 'self' https://api.stripe.com;
report-uri https://ingest.csplog.io/…;
Three steps. Five minutes. Done.
how_it_worksConfigure
Reporting-Endpoints: csplog="https://ingest.csplog.io/api/csp-report?token=YOUR_TOKEN"
Content-Security-Policy-Report-Only:
default-src 'none';
report-uri https://ingest.csplog.io/api/csp-report?token=YOUR_TOKEN;
report-to csplog;
default-src 'none' is deliberate. Nothing is pre-approved, so every source your pages load gets reported, your own scripts included. Under 'self' your own scripts never violate, so they are never reported and never authorised, and you end up with a list of other people's domains instead of a complete one. Report-Only means nothing is blocked. You're just listening. Both report-uri and report-to are included for full browser coverage.
We filter
✓ violations flowing
✓ noise dropped
→ commit_policy
Violations stream in automatically. Browser extension garbage, bots and antivirus false positives are dropped before they reach you. When you're ready, Commit Policy assembles a CSP from the origins you allowed, ready to deploy in Report-Only, with a plain-English explanation per directive.
What you get
features
filter
01
Noise dropped by default. Crowdsourced over time.
Browser extensions, antivirus injections and bots are dropped in the pipeline, before a row is ever created. Left unfiltered, that noise gets bad enough that teams allow-list adware domains purely to quiet the feed, which is the opposite of what a CSP is for. Add your own patterns when something slips through. The ones that hit across multiple projects get promoted to the shared list everyone sees. Moderated, not automatic, but the input is yours.
meter
02
Other people's extensions don't count against your plan.
Filtered noise never becomes a row, so it never touches your ceiling. What is left is deduplicated into one row per origin, directive and day: on our own monitored site that turns 202,575 reports into 153 origins to decide. The price is flat either way, and the ceilings are abuse bounds set high enough that no real site meets them.
policy
03
No AI writes your security policy. You do.
Click Commit Policy. The header is assembled deterministically from the origins you allowed, so it can never drift from your decisions and no model output can reach the header string. The AI does the parts that need judgment: it identifies unfamiliar origins before you decide, explains each directive in plain English, warns about risky additions, and lists the origins it left out and why.
the_problem
It's complex.
A Content Security Policy tells browsers which external resources your site is allowed to load. Sounds simple, until you realize you load fonts from Google, scripts from three CDNs, analytics from two providers, a payment iframe from Stripe, and a chat widget you forgot about. Miss one and your site breaks. Add too many and your policy is useless.
Violations are polluted.
You set up reporting and immediately your inbox fills with garbage. Browser extensions injecting scripts. Antivirus rewriting pages. Crawlers and bots triggering false positives. Without serious filtering, CSP violation data is unusable.
Reporting gets skipped.
Most developers know they need a CSP. But the reporting step (actually collecting and analyzing violations) gets skipped because the tooling is too complex, too expensive, or self-hosted. Only 13% of sites with a CSP have reporting enabled.
Compliance is forcing the issue.
PCI-DSS 4.0 (enforced since March 2025) requires merchants to monitor scripts on payment pages. CSP reporting is the recommended approach. The deadline has passed. Many companies are still scrambling.
What we get right
what_makes_us_different
noise
01
Noise dropped by default.
Extensions, antivirus, bots: gone before they hit your dashboard, and gone before they count against your plan. Add your own filters when something slips through.
verified
02
We check the header is live. We don't take your word.
When you switch to Enforce we fetch your own pages and match the live header against the policy you committed. It's a scoped claim, so you see which pages we checked. A daily re-check catches it if a deploy or a platform later drops the header.
policy
03
Deterministic policy, AI-assisted.
Click once. Get a copy-paste-ready CSP assembled from your decisions, with a plain-English explanation per directive. The model never touches the header string.
collect
04
One endpoint. Zero config.
Add a URL to your CSP header. No SDK, no script tag, no code changes. Works with any stack. If you can set an HTTP header, you're done.
price
05
€7 / $8 entry. No asterisks.
Below the €10 no-brainer line. Everything the Trial does, with room to run, and no expiry.
trial
06
14-day trial. No card.
One per registrable domain, with enough Policy commits to take a real site all the way to Enforce. Decide after you've seen it work.
Simple pricing. Start with a trial.
pricing
€0
14 days
One trial per domain.
- 1 project
- 100,000 violations / mo per project
- 30-day retention
- 25 Policy commits (whole trial)
- Email alerts (planned)
- No credit card required
€7 / $8
per month
Below the €10 no-brainer line.
- 1 project
- 1,000,000 violations / mo per project
- 30-day retention
- 100 Policy commits / mo
- Email alerts (planned)
€19 / $22
per month
For agencies + dev teams.
- 10 projects
- 10,000,000 violations / mo per project
- 90-day retention
- 500 Policy commits / mo
- Everything in Starter
- MCP access
The violation ceilings are abuse bounds, not usage targets: they exist so a runaway script cannot run up a bill, and they are set high enough that no honest site meets them. Filtered noise never counts toward them. A Policy commit is one committed header with its explanation; re-assembling the same header costs nothing.
csplog is launching soon. Hit get_notified and we'll email you the moment it's live. EU customers are billed in euros (€7 / €19); everyone else in US dollars ($8 / $22). All prices exclude VAT. Paddle adds VAT / sales tax at checkout based on your country. Upgrades are immediate and prorated; downgrades apply at the end of your billing period. Cancel anytime.