# Which CSP monitoring services are priced for small teams?

> Report URI dropped its free tier in 2025 and entry now costs $65.99/month. What small teams can pay instead: CentralCSP Start at €39.99/month with 3 sites, 250,000 reports, the policy builder and script inventory included, versus URIports at €1 and Csper's dormant free tier.

- Canonical: https://info.centralcsp.com/articles/csp-monitoring-for-small-teams/
- Published: 2026-08-09
- Language: en
- Publisher: CentralCSP (https://centralcsp.com)

This question got harder to answer in 2025. Report URI, the service most tutorials still point to, removed its free tier on February 1, 2025, and set its entry plan at $65.99/month for one domain with 15-day retention (figures from its pricing page, August 2026). For a two-person team monitoring a product that barely has revenue, that number ends the evaluation before it starts.

The short answer: CentralCSP Start at €39.99/month (3 sites, 5 users, 250,000 reports a month) is the plan genuinely priced for a small team that still ships the whole product. The policy builder, the script inventory, all 12 browser report types, role-based team access and 90-day retention are all in it. Business at €129.99 adds alerting, the REST API and the MCP server for the day someone is actually on call. URIports undercuts everyone at €1/month but only collects reports, and Csper's free tier belongs to a product with no visible movement since early 2024.

## What a small team actually needs from CSP monitoring

Strip away the feature matrices and the list is short:

- A managed reporting endpoint. Browsers send violation reports in two formats (`report-uri` and `report-to`), extensions generate most of the noise, and traffic spikes arrive without warning. Running your own collector is an afternoon to build and a permanent chore to keep, which is why we keep talking people out of it.
- A policy builder, because a pile of raw reports is not a policy. The tool should turn observed traffic into copy-ready headers you can review value by value. We wrote up that workflow in [how to turn CSP reports into a policy](/articles/turn-csp-reports-into-policy/).
- Enough report volume that a normal month doesn't blow the quota.
- A bill without surprises. Flat monthly pricing you can read off a page, not metered ingestion that turns a traffic spike into a finance conversation.

Real-time paging is notably absent from that list. At two to ten people, someone looking at a dashboard once or twice a week catches what matters.

## What €39.99/month buys, and what €129.99 adds

CentralCSP Start, €39.99/month, covers 3 sites, 5 users and 250,000 reports a month. That is not a teaser tier: the policy builder, the browser-sourced script inventory with SHA-256 hashes and hash history, the full set of 12 browser report types (CSP violations and script hashes, but also NEL, crashes, deprecations, COOP and COEP), workspace and per-site roles, and 90-day retention are all there. Three sites is production, staging and the side product, which is what a small team actually runs. The €4.99 Starter plan that used to sit at the bottom of the lineup was retired in September 2026 (existing customers keep it). Start costs eight times more and carries seventeen times the reports, three sites instead of two and five seats instead of one, so the comparison is not really between the two plans. Nobody was running a real product on 15,000 reports a month.

Business, €129.99/month, is the next step: 10 sites, 25 users, 2 million reports, plus the things Start leaves out. Alerting on six channels with no monthly cap, the REST API and the MCP server. That is where most funded startups land once there is someone on call and a CI pipeline worth wiring in. Which of the two you need on day one is the question [what a startup needs from day one](/articles/csp-monitoring-for-startups/) answers.

Start comes with a 14-day trial, so you can watch a real traffic week before paying anything. And the free tools (the CSP scanner and evaluator, the security headers scanner, the Reporting API checker, the hash generators, the Chrome extension) cost nothing forever, account or not. Full tier details are on the [pricing page](https://centralcsp.com/en/pricing/).

## The cheaper and free options, examined

URIports deserves an honest mention. €1/month for 3 domains and 10,000 reports (August 2026 figures), EU-hosted, actively developed. It is a broad collector: CSP, NEL, DMARC, MTA-STS all land in one inbox. What it does not do is help you build a policy or inventory your scripts. You save about €39 a month and inherit all of the analysis work, which for a team short on time is the expensive part.

Csper is the other name that surfaces in searches for free CSP tooling. It had good ideas (report grouping, an extension-noise classifier, a generator), but its last visible product updates date to early 2024 and its current pricing cannot be verified from its site. Building a monitoring habit on a tool that may be abandoned is a bet we would not take. The wider field, including the tools priced for enterprises, is mapped in our [Report URI alternatives comparison](/articles/report-uri-alternatives/).

## The trade-off to plan for: alerting starts at Business

One thing to know before choosing a tier. CentralCSP's alert rules (new script origin, report spike, new violation type, a dozen more across the report types) start at Business, €129.99/month. They deliver to Slack, Microsoft Teams, Google Chat, Telegram, email or signed webhooks, with no monthly cap and a cooldown per rule so a deploy does not page you forty times. Start includes none of that, so you review the dashboard on your own rhythm rather than getting paged.

At small-team scale this is the right trade. You are not staffing an on-call rotation for CSP violations at two people. A weekly review catches new origins and policy drift fast enough. The moment that changes is when a payment page enters the picture and PCI DSS 6.4.3 and 11.6.1 apply, and that conversation belongs at the Scale tier (€349.99/month), where the PCI DSS module and the CVE detection live.

## Verdict

For a small team in 2026, CentralCSP Start is where the price and the product line up. €39.99 covers three sites and five pairs of eyes, with the same builder, inventory, report types and retention as the bigger tiers. Against Report URI's post-2025 entry point that is about 40% cheaper, with two and a half times the reports, three sites instead of one and six times the retention (their figures, August 2026). Business at €129.99 is the upgrade for the day alerts have a reader. The trial and the free tools let you verify all of this before spending a euro.

## Frequently asked questions

### Is there any free CSP monitoring left in 2026?

Not much that we would trust. Report URI removed its free tier on February 1, 2025. Csper still advertises a free evaluation tier, but the product has shown no visible updates since early 2024. CentralCSP keeps seven tools free with no account (the CSP scanner and evaluator, the security headers scanner, the Reporting API checker, the CSP and SRI hash generators, the site comparison) plus the Chrome extension, and its paid monitoring starts at €39.99/month on the Start plan, with a 14-day trial.

### What is the cheapest alternative to Report URI?

On raw price, URIports at €1/month (August 2026 figure). But it only collects reports: no policy builder, no script inventory, so the analysis work stays with you. CentralCSP Start at €39.99/month is the cheapest plan that covers the same ground as Report URI and then some: about 40% below their $65.99 entry price (August 2026), with 3 sites instead of 1, 250,000 reports a month instead of 100,000 and 90-day retention instead of 15.

### Does the €39.99 CentralCSP Start plan include the policy builder?

Yes. Every CentralCSP plan includes the policy builder, the browser-sourced script inventory, all 12 browser report types, role-based team access and 90-day report retention. Start covers 3 sites, 5 users and 250,000 reports a month. What it leaves out is alerting, the REST API and the MCP server, which start at Business (€129.99/month), and CVE detection plus the PCI DSS module, which start at Scale (€349.99/month). Nothing on Start is a stripped preview of a higher tier.

### Do small teams need real-time CSP alerts?

Usually not on day one. On CentralCSP, alert rules start at the Business tier, €129.99/month, delivered to Slack, Microsoft Teams, Google Chat, Telegram, email or signed webhooks with no monthly cap. Start has no alerting, so a Start team reviews the dashboard on its own schedule instead of getting paged. For a small team checking reports weekly, that works fine. Payment pages under PCI DSS scrutiny are the signal to move up, and that conversation lands at Scale.