Getting Started

Getting started with Header Centaur

You can go from sign-up to live CSP reports in about 10 minutes. There are five steps: create an account, create an organisation, choose a plan, add a site, and add one header to that site.

Header Centaur does two things for your websites:

• CSP violation monitoring. Visitors' browsers report anything your Content Security Policy blocks. Header Centaur collects those reports, groups them and shows you what is breaking.
• Security header scanning. An on-demand check of 10 security headers on your live site, with plain-language fixes.

This guide is for developers, site owners and agencies setting up their first site. You don't need a working CSP to start. A report-only policy is a safe first step.

1. Create account
2. Create organisation
3. Choose a plan
4. Add a site
5. Add reporting header
6. See reports

Want to see how your site scores first? Try the free header scanner. You don't need an account.

Step 1: Create your organisation and choose a plan

Everything in Header Centaur belongs to an organisation: your sites, your team, your plan and your reports. Use one organisation for your company, or one per client if you're an agency.

Create an account and an organisation

1. Sign up with your email address and a password.
2. The setup wizard asks you to Create your organisation. Enter a name, such as your company or client name, and select Continue.
3. You become the organisation's Owner automatically.

You can belong to more than one organisation. See all of them, and create new ones, under Organisations.

Choose a plan

You need an active plan before you can add a site. Go to Billing in your organisation, pick a plan and pay through Stripe's secure checkout. Only the organisation Owner can subscribe.

Plan	Price per month	Sites	CSP reports per month	Data kept for
Hobby	£4.99	1	50,000	7 days
Pro	£19	3	500,000	30 days
Agency Lite	£49	15	2,500,000	90 days
Agency Pro	£99	50	10,000,000	180 days

Your plan can take a few moments to show as active after checkout, while Stripe confirms the payment. You can switch plans, update your card or cancel at any time from Billing → Manage billing.

If you go over your monthly report allowance, we email your Owners and Admins when you reach 80% and 100% of the allowance.

Step 2: Add your site

Adding a site gives it a private reporting address. Your site's CSP reports are sent there.

1. In your organisation, go to Sites and select Add site.
2. Fill in the form:

Field	What to enter	Example
Site name	A name your team will recognise	Marketing site
Primary domain	The domain only, with no https:// or path	example.com
Production URL	The full address of your live site	https://www.example.com
Status	Active to accept reports now. Paused to stop them for a while.	Active

3. Select Add Website.

Your site can accept reports straight away. Reports from other domains are ignored.

Your plan sets how many sites you can add. To add more, upgrade in Billing.

Step 3: Send your CSP reports to Header Centaur

To connect your site, add Header Centaur's reporting address to your Content Security Policy. You'll find ready-to-copy snippets with your own address on your site's page in Header Centaur.

Your reporting address looks like this:

https://report.headercentaur.com/csp-report/YOUR-SITE-TOKEN

Pick a reporting method

For the widest browser coverage, use both methods together.

Option A: report-uri (older, works in every major browser). Add report-uri to the end of your existing policy:

Content-Security-Policy: default-src 'self'; report-uri https://report.headercentaur.com/csp-report/YOUR-SITE-TOKEN;

Option B: report-to (the current standard). You need two headers. The first names a reporting group and the second points your policy at it:

Report-To: {"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://report.headercentaur.com/csp-report/YOUR-SITE-TOKEN"}]} Content-Security-Policy: default-src 'self'; report-to csp-endpoint;

Replace default-src 'self' with your own policy. Only the reporting part is new.

Start safely with report-only mode

If you don't have a CSP yet, or worried about breaking things? Send your policy as Content-Security-Policy-Report-Only. Browsers report what the policy would block but still load everything. Once the reports are clean, switch to the enforcing Content-Security-Policy header. Header Centaur tracks both.

Where to add the header

Platform	Where it goes
Nginx	add_header Content-Security-Policy "..." always; in your server block
Apache	Header always set Content-Security-Policy "..." in your config or .htaccess
Cloudflare, CDNs and hosting platforms	A response header rule or transform rule
Drupal, WordPress and other CMSs	A security headers module or plugin, or your server config

A CSP in an HTML <meta> tag can't send reports. Browsers ignore report-uri and report-to in meta tags, so the policy has to be sent as an HTTP header.

Check it's working

Reports only arrive when a browser blocks something. To test, load a page that breaks your policy, or add a report-only policy that's deliberately strict. Then check your Health dashboard. Until the first report arrives, the dashboard shows the snippet you need.

Step 4: Read your reports

Header Centaur groups similar reports together. You see a short list of real problems, not thousands of individual events.

Health dashboard

The dashboard is your organisation's home page. It shows the last 24 hours, 7 days or 30 days for one site or for all of them:

• total violations
• new violation groups
• newly blocked origins, meaning domains your policy blocked for the first time
• unresolved groups
• sites that haven't sent a report in the last 24 hours

Violations

Violations lists every violation group. You can filter by site, directive, blocked origin, text or date. Each row is one problem, for example "scripts from cdn.example.net are blocked on 14 pages".

Select Investigate to see:

• a plain-language explanation of what was blocked and why
• every page it happened on, with first-seen and last-seen times
• a few example reports, with personal data removed

Already filtered out for you: noise from browser extensions, localhost and malformed reports.

CSP Policy

Each site's CSP Policy tab shows the policy browsers are reporting against. It keeps a history of changes, and you can compare any two versions. Enforced and report-only policies are tracked separately. A change that weakens your protection, such as adding unsafe-inline, is flagged.

Header scans

From a site's page, select Run a header scan to check your live site against 10 checks:

• Content-Security-Policy
• clickjacking protection (X-Frame-Options or frame-ancestors)
• Strict-Transport-Security (HSTS)
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• Cross-Origin-Opener-Policy (COOP)
• Cross-Origin-Embedder-Policy (COEP)
• Cross-Origin-Resource-Policy (CORP)
• cookie security flags

Each check is marked Pass, Warning or Critical, with advice on how to fix it. Every scan is compared with the one before, so you can see what changed. You can run up to 5 scans per site each hour.

Step 5: Turn on email alerts

Get an email when a site hits a new kind of violation, so you don't need to watch the dashboard.

1. Open the site and go to its Notifications tab.
2. Subscribe. Alerts go to your account email by default, but you can use a different address, such as a team inbox.

You're emailed the first time a new violation group appears. Repeats of the same problem don't trigger more emails. Subscriptions are personal: each team member chooses their own, and you can unsubscribe from the same tab at any time.

Your organisation's Owners and Admins are also emailed when you reach 80% and 100% of your monthly report allowance.

Invite your team

Owners and Admins can invite people from the organisation's settings page.

1. Select Invite member.
2. Enter their email address and choose Admin or Member.
3. We email them an invite link. It works for 7 days.

The person you invite must accept while signed in with the invited email address. If they don't have an account, they can create one from the link. Owners and Admins can see pending invites on the settings page and cancel them there.

Role	What they can do
Owner	Everything an Admin can do. Also: manage the subscription and payment, make other people Owners, and delete the organisation.
Admin	Invite and remove Admins and Members. Add, edit and remove sites. See billing and usage.
Member	View dashboards, violations, policies and scans. Subscribe to email alerts.

You can't invite someone as an Owner. Invite them as an Admin first and then make them an Owner. An organisation always has at least one Owner.

FAQ and troubleshooting

I added the header but no reports are showing.

• Check the site's status is Active. Reports for paused sites are ignored.
• Check the page's domain matches the site's primary domain or one of its subdomains. Reports from other domains are ignored.
• Check the header is on the live response. Use your browser's developer tools or run a header scan.
• Make sure your policy isn't in a <meta> tag. Meta-tag policies can't send reports.
• Something has to be blocked before a report is sent. A site with no violations sends nothing.
• Reports from browser extensions and localhost are filtered out.

I can't add a site.

Your organisation either has no active plan or has reached its plan's site limit. Choose or upgrade a plan in Billing.

I've paid, but my plan isn't showing.

Stripe confirms payments in the background, so it can take a moment. Refresh the Billing page.

How long is my data kept?

It depends on your plan: 7, 30, 90 or 180 days. Older reports and scans are deleted automatically.

Will adding the reporting header slow my site down or break it?

No. Browsers send reports in the background after the page loads. The reporting address itself never blocks anything. Blocking is done by your policy, which is why we recommend starting with report-only mode.

My invite link doesn't work.

Invite links expire after 7 days. They also only work for the invited email address. Ask an Owner or Admin to send a new invite.