Deduplicated at the edge
Reports land on a Cloudflare worker close to your visitors. Duplicates are collapsed before they reach your account, so one broken script is one row, not fifty thousand.
1 violation · 48,213 hits
edge Reports deduplicated on Cloudflare's network
See what your CSP is actually blocking.
Browsers already report every Content Security Policy violation. Dark Duck catches those reports, folds the duplicates into one clean list, and shows you the handful that matter.
- Free for one site
- No script tag
- Works in every major browser
shop.example.com / cataloguelive
incoming report
POST /r/•••• {"blocked-uri":"https://cdn.sketchy-ads.io/t.js","violated-directive":"script-src"}▍
| directive | blocked | hits |
|---|---|---|
| script-src | https://cdn.sketchy-ads.io/t.js | 31,904 |
| img-src | https://www.google-analytics.com | 9,812 |
| style-src | inline | 4,377 |
| connect-src | wss://chat.vendor.com | 1,986 |
| frame-src | https://www.youtube.com | 134 |
48,213 reports received→ 5 to look at
1 row
per real problem
However many times a violation fires, it shows up once, with a hit count and sample reports.
0 ms
added to your pages
Browsers send reports in the background after the page has loaded. Nothing runs on your site.
$0
in overage fees, ever
Every plan has a hard cap. Go over it and new reports pause until next month. You never get a surprise bill.
How it works
Two header lines. That's the whole install.
No script tag, no SDK, nothing running on your pages. Browsers send the reports in the background.
- 1
Add your domain
Sign up and add your site. You get a reporting endpoint unique to that domain.
- 2
Paste two headers
Add the Reporting-Endpoints and CSP lines to your server, CDN or framework config. Start in Report-Only so nothing breaks.
- 3
Work the catalogue
Each unique violation appears once, with hit counts and real samples. Allow it, fix it or ignore it. Then enforce.
# add to your response headers
Reporting-Endpoints: dark-duck="https://ingest.darkduck.dev/r/YOUR_KEY"
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; report-uri https://ingest.darkduck.dev/r/YOUR_KEY; report-to dark-duckFeatures
Everything you need to reach an enforced policy.
Most teams leave CSP in Report-Only forever because the reports are unreadable. Dark Duck makes them readable.
Alerts that mean something
An email when a new violation appears or a known one spikes. Pro and Team.
new violation · 2m ago
script-src ← evil-cdn.net/x.js
A catalogue, not a log
Each violation keeps its hit count, first and last seen, and up to five real sample reports.
script-srccdn.sketchy-ads.io31.9k
img-srcgoogle-analytics.com9.8k
frame-srcyoutube.com134
Fix it straight from the report
Allow a source from the catalogue and it is staged in the policy editor. Review the diff, then copy a ready-to-ship header.
script-src 'self'
+ https://js.stripe.com
- 'unsafe-inline'
img-src 'self' data:
Live header check
Enter a URL to see the security headers it really serves, with plain-language advice on what is weak.
Content-Security-Policyallows 'unsafe-inline'
Strict-Transport-Securitygood
X-Frame-Optionsmissing
Built for teams and agencies
Invite teammates, share domains across a workspace and triage together. Up to 25 seats and 25 domains on Team.
JMSKT
+ invite by emailThe path
From Report-Only to enforced, safely.
week 1report-only
Listen
Ship a strict policy in Report-Only. Nothing breaks, and the catalogue fills with everything your pages really load.
week 2report-only
Triage
Allow the sources you trust, fix the inline code you own, and flag anything you do not recognise.
week 3enforced
Enforce
Switch the header to enforcing and keep monitoring. A new violation now means something changed, and you will hear about it.
Pricing
Simple plans. Hard caps. No surprise bills.
Start free on one site. Upgrade when you add more.
Free
One site, to see what your policy is really blocking.
$0/mo
Free forever
Start free- 1 domain
- 10K reports a month
- 7-day history
- 1 seat
- Catalogue, policy editor and live check
- Email alerts on new violations and spikes
Pro
Most popularFor developers and freelancers running a handful of sites.
$15/mo
Get Pro- 5 domains
- 500K reports a month
- 90-day history
- 5 team seats
- Catalogue, policy editor and live check
- Email alerts on new violations and spikes
Team
For agencies and product teams with many properties.
$49/mo
Get Team- 25 domains
- 5M reports a month
- 365-day history
- 25 team seats
- Catalogue, policy editor and live check
- Email alerts on new violations and spikes
Prices in USD. Sales tax and VAT worked out at checkout. Hard caps, so you never get an overage bill.
Questions, answered
What happens when I hit my report limit?
New reports are dropped at our edge until your next billing month. Your existing catalogue stays, and you are never charged an overage. Upgrade any time to raise the cap straight away.
Do you store every report?
No. Reports are deduplicated at the edge, and we keep one catalogue entry per unique violation plus up to five sample reports for it. That keeps your dashboard readable and your data small.
Will this slow my site down?
No. Browsers send CSP reports in the background after the page loads. Nothing runs on your site and you don't add a script tag.
Can I use Report-Only mode?
Yes, and we recommend it. Send Content-Security-Policy-Report-Only first, watch the catalogue fill up, fix or allow what is legitimate, then enforce.
Which browsers are supported?
Anything that sends CSP reports: Chromium browsers and Safari via report-to, Firefox via report-uri. Dark Duck gives you both lines.
How does billing work?
Payments are handled by Lemon Squeezy, our merchant of record, so sales tax and VAT are worked out for your country. Cancel any time and you drop to Free at the end of the period.
Find out what's breaking before your users do.
Set up in five minutes. Free for your first site, for as long as you like.
Start monitoring free