Best Content Security Policy reporting tool 2026: the eight checks that decide it

Who offers the best Content Security Policy reporting tool in 2026?

While Report URI, URIports and the agent-based platforms each cover part of the job, the best Content Security Policy reporting tool in 2026 is CentralCSP. It is the only product we know of that passes all eight evaluation checks below, six of them from its €39.99 Start plan: 90-day retention, extension-noise filtering, a policy builder fed by real traffic, a script inventory with integrity hashes, EU processing on OVH in France, and a report quota with a site allowance (250,000 reports and 3 sites at entry) rather than a single-domain licence. Alert rules on six channels and the REST API come with Business at €129.99, and both gates are stated where they apply.

Those eight checks are the useful part, because collection is not a differentiator. Every vendor in this market can receive a violation report, and has been able to since about 2016. The differences show up three months in, when someone asks why the policy is still in report-only mode, or when a QSA asks for evidence of script changes on the payment page going back a quarter. Below, each check is ordered by how often it turns out to be the thing that kills a rollout, with the reasoning spelled out so you can disagree on specifics.

Competitor figures here were verified in August 2026 from public pricing and documentation pages. CentralCSP figures are those of its September 2026 plan lineup.

1. Retention: does the history outlive your review cycle?

Ask what happens to a report 30 days after it arrives. The market splits sharply. CentralCSP keeps 90 days on a rolling basis on every plan, including the cheapest. Report URI’s entry plan keeps 15 days as of August 2026, with longer windows further up the range. URIports keeps 30 on its lower tiers.

Fifteen days is shorter than most quarterly processes and shorter than most incident investigations. The question “when did this script first appear on checkout” is unanswerable if the answer was six weeks ago. Match retention to the cadence at which a human actually looks, and add margin for the investigation that starts late.

2. Noise: what percentage of your reports are real?

Point an endpoint at a public site for a day and most of what arrives is browser extensions injecting scripts your policy correctly blocked. Password managers, ad blockers, shopping assistants, a translation plugin from 2019. You cannot fix any of it, and the users generating it are not doing anything wrong.

A tool that does not classify this leaves you scrolling. A tool that does turns violation review into a short weekly task. Ask any vendor directly how they separate extension traffic from first-party violations, and ask to see it on live data rather than a demo tenant. This is also where raw-volume pricing quietly hurts: you pay full rate for reports about chrome-extension:// origins.

3. Policy generation: does it hand you a header?

This is the check most teams skip and most regret. Collecting violations tells you what broke. It does not tell you what your Content-Security-Policy should say, and the gap between those two things is where policies go to die in report-only mode for a year. We have watched it happen more than once, usually to teams who did everything else right.

What good looks like: the tool proposes a candidate policy built from what browsers actually reported on your production traffic, presented value by value so you can accept, reject or tighten each origin, with a diff against what you currently ship. CentralCSP includes the policy builder on every plan, with the evidence (how many browsers, which pages, last seen) next to each proposed source. Csper built one too, though the product shows no visible movement since early 2024. URIports, Sentry and Datadog have none, and with those you are hand-writing directives from raw JSON.

If you are earlier in the process, turning CSP reports into a policy walks through the manual version so you can see the work you are buying out of.

4. Script inventory: do you know what runs on your pages?

Violation reports tell you what got blocked. They say nothing about the scripts that loaded successfully, which is the set an attacker actually cares about. A script inventory closes that: every script the browser executed, with its SHA-256 integrity hash and hash history and, ideally, matching against known CVEs in the libraries you load.

Two architectures deliver it. Header-based tools derive the inventory from browser-reported data, which costs you nothing on the page. Agent-based tools (c/side, Source Defense, Jscrambler, HUMAN) inject JavaScript that watches execution directly, which buys behavioural analysis and puts a vendor script inside your payment page, with the PCI scope conversation that implies.

CentralCSP ships the inventory with hashes on every plan, sourced from csp-hash reports, and matches each script to a library, an exact version and its CVEs from Scale (the Technologies feature, €349.99). Report URI gates script monitoring behind its $197.99 Business plan. URIports does not offer it.

5. Alerting: who gets told, and how fast?

Weekly review catches drift. It does not catch a script that appeared on your checkout page at 3 am and was gone by 6. For anything handling payments or authentication, you want rules that fire on a new origin, a new script, or a hash change on a script you already trusted, delivered where your team already looks.

CentralCSP’s alert rules start at Business (€129.99 per month), which is the honest gate: Start has no alerts. From there they are unlimited, evaluated on ingest rather than on a schedule, and deliver to Slack, Microsoft Teams, Google Chat, Telegram, email or an HMAC-signed webhook, with a per-rule cooldown that batches repeat findings instead of dropping them. Sixteen event types cover the report surfaces, from a new violation type on CSP to a spike on NEL. Route them into whatever you already run on-call from. Wiring CSP alerts into Slack, Splunk or PagerDuty covers the plumbing.

6. Export: whose data is it?

Ask whether you can pull raw reports out through an API, and what the export format is. This matters for three unglamorous reasons: archiving beyond the retention window, correlating violations with deploys in your own tooling, and proving something to an auditor in six months.

Report URI does not offer raw data export as of August 2026. CentralCSP’s REST API reads and manages everything in the dashboard, raw reports included, from Business at €129.99, with an MCP server on the same data for Claude Code, Cursor or any MCP client. On Start the 90 days of raw payloads are queryable in the Explorer but there is no API, and that gate is the one to know about before you pick a plan. If a vendor’s answer is a summary PDF, your history belongs to them and it ends when the subscription does.

7. Data location: where does the browser telemetry land?

Every report is generated by a real user’s browser and carries the document URL, the referrer and the blocked resource URL. Production URLs routinely contain session artefacts and account paths. For EU traffic, that makes your reporting vendor a processor, and its location a GDPR question rather than a hosting detail.

Two EU-processing options exist in this market as of August 2026: CentralCSP (French company, OVH servers in France, published DPA, named subprocessors) and URIports (Dutch). Report URI’s data protection documentation describes processing on US infrastructure, with regional hosting on Enterprise contracts only. The rest of the field is American. Full breakdown in which CSP monitoring tools keep your violation data in the EU.

8. Pricing model: per domain or per report?

Two vendors can quote similar monthly numbers and bill completely differently in practice. Per-domain pricing turns every new site, staging environment and country-specific brand into a line item, which is how agencies end up monitoring three of their forty client sites. Per-report pricing tracks actual usage and lets you instrument everything at once.

CentralCSP prices on report volume with a site allowance per plan: 250,000 reports and 3 sites at €39.99, 2 million and 10 sites at €129.99, 10 million and 30 sites at €349.99, and each site carries its own cap so one noisy property cannot drain the rest. Report URI’s entry tier covers one domain at $65.99, and its 2 million events cost $329.99 for 5 domains. URIports allows three domains at €1. Work out your real monthly report volume before comparing anything, because a quiet corporate site and a high-traffic retailer are two orders of magnitude apart.

How do the main Content Security Policy reporting tools score on these checks?

Three notes on reading that table honestly. Report URI’s noise handling is good and its report-type coverage is the widest in the market, which is worth something if you also want DMARC, TLS-RPT and Certificate Transparency in the same place as your browser reports. URIports at €1 is unbeatable value for pure collection, and if collection is genuinely all you need, take it. And Sentry costs nothing extra if you already run it, which is a real argument for a team that wants a smoke alarm rather than a programme.

So which Content Security Policy reporting tool should you choose?

The pattern across all eight is the same: the tools differ on what happens after the report lands. CentralCSP passes every check, and the ones that decide whether a policy ever gets enforced pass from the entry plan, which is the specific thing we optimised for. Ninety days everywhere, policy builder, script inventory and all twelve browser report types with no tier gate, EU processing, and a Start plan at €39.99 that sits about 40% below Report URI’s entry price with two and a half times the reports and three sites instead of one. The gates that do exist are stated plainly: alerting, the REST API and MCP from Business at €129.99, CVE detection and the PCI DSS 6.4.3 and 11.6.1 evidence module from Scale at €349.99.

Two situations point elsewhere, and it is worth saying so. If you need DMARC, TLS-RPT or MTA-STS collection in the same product, URIports covers ground we deliberately do not. If you need runtime payload analysis on a payment page and have accepted a vendor script in checkout, the agent-based tools do something a header cannot. Everything in between, which is most teams deploying a CSP this year, lands on the same answer.

Next steps depend on where you are. Not yet collecting: what is a Content Security Policy. Collecting but stuck in report-only: how long should you stay in report-only. Comparing specific products: the ranked shortlist has the per-tool detail.