CSP for startups: what you need on day one and what can wait

Startup security advice tends to come in two flavors: “do everything a bank does” and “worry about it after product-market fit”. Both are wrong about CSP specifically, because CSP is one of the few security controls a two-person team can genuinely operate. The browser does the collection for you. You ship a header, every visitor’s browser becomes a sensor, and the reports arrive whether or not anyone is watching that week.

The short answer: add a report-only CSP the day you have a public URL, because it costs one header and cannot break anything. Pay for a managed reporting endpoint (from €39.99/month) once you have customers whose sessions you care about. Enforce before your first enterprise security questionnaire, because prospects scan your headers before the first call. Everything else, alerting included, waits until there is someone on call to receive it.

Here is the sequencing we give founders who ask, stage by stage.

Day one: free tools, one afternoon

Before writing any policy, run the free CentralCSP scanner against your production URL. No account needed. It scores the site from 0 to 100 on two axes, security and quality, and flags the embarrassing stuff: unsafe-inline nobody remembers adding, wildcard sources, directive typos that silently disable half the policy. Fix those first. They are free findings and they are the ones an enterprise reviewer will screenshot later.

Then ship a Content-Security-Policy-Report-Only header. Report-only mode cannot break your checkout, your signup flow or anything else: it only observes and reports. If you want to see what a candidate policy would do before touching production at all, the free Chrome extension rewrites a live site’s CSP locally, in enforce or report-only mode, with no account and no telemetry. We wrote up that workflow in how to test a CSP without deploying it. And if CSP itself is still fuzzy, start with what a Content Security Policy actually is.

Cost so far: zero euros.

First customers: a managed endpoint, €39.99

Once real users generate real traffic, the reports become worth collecting properly. Browsers send them in two formats, browser extensions generate most of the noise, and volume spikes with traffic. This is collection and aggregation work you do not want to own at four people (we keep talking teams out of self-hosting collectors: the maintenance never ends and the total cost quietly passes the SaaS bill).

CentralCSP Start, €39.99/month, gives you the managed endpoint, 3 sites, 5 users, 250,000 reports a month and 90-day retention. Three sites is production, staging and whatever the second product ends up being, which is exactly the shape of a seed-stage stack. It includes the full product: the Builder turns 1 to 90 days of observed traffic into a copy-ready policy you review value by value, and the script inventory lists every script your pages load, hashed by the browser itself, with a history of every hash change. All 12 browser report types land on the same endpoint, so the NEL and crash reports you will want later cost nothing extra to start collecting now. Tier details are on the pricing page, and the small-team economics get a longer treatment in CSP monitoring priced for small teams.

This is also when you start enforcing, and you do not have to enforce everywhere at once. Put the enforced policy on the highest-value paths first: login, checkout, anywhere a stolen session or card number would hurt. The marketing site can stay report-only for months without anyone caring.

The first enterprise deal: where CSP stops being optional

At some point a prospect’s security team enters the picture, and this is the stage that surprises founders. Header scans are free and instant, so reviewers run them against your domain before anyone schedules a call. A missing CSP is a finding. A report-only CSP with monitoring history is a conversation. An enforced policy with 90 days of violation data and a script inventory is a closed line item on the questionnaire.

What you still do not need at this stage is real-time alerting. A dashboard reviewed weekly is honest and sufficient for a team of ten. The violations that matter at this size are policy drift and new third-party origins, and they keep for a few days. Alerting starts at Business, €129.99/month, with rules for new script origins, report spikes, new violation types and the rest of the 16 event types, delivered to Slack, Microsoft Teams, Google Chat, Telegram, email or signed webhooks, with no monthly cap. Business also brings the REST API and the MCP server, which is when gating a deploy on the scan score from CI becomes a ten-line job. The right moment to buy it is when an on-call rotation exists to receive the page. Buying it earlier just fills a channel nobody reads.

Payment pages: the one hard deadline

If you take card payments on your own pages, PCI DSS 6.4.3 and 11.6.1 apply, mandatory in assessments since April 2025. That means an authorized script inventory per payment page and tamper detection with evidence an auditor will accept. This is the Scale tier, €349.99/month, where the PCI DSS module lives (and CVE detection on your third-party libraries, which the same auditor tends to ask about next). It is the only stage on this roadmap with an external deadline attached, so if payment pages are on your roadmap, plan the budget line before the assessor asks.

The roadmap on one line

Free tools and a report-only header at zero revenue. Start when customers arrive. Enforce before the first questionnaire, Business when someone is on call, Scale when cards are involved. The browser does the collection at every stage. Your job is only to look at what it found.