Cybersecurity glossary
What is CSP Report-Only?
Learn what Content-Security-Policy-Report-Only is, how violation reports help tune CSP safely, how to use reporting endpoints, and when to switch to enforcing CSP.
Definition
CSP Report-Only is a deployment mode using the Content-Security-Policy-Report-Only header that evaluates a Content Security Policy and emits violation reports without blocking resources—allowing teams to discover breakages before enforcing the policy.
Why Report-Only matters
A sudden enforcing CSP can break checkout widgets, analytics, or admin tools in production. Content-Security-Policy-Report-Only lets you learn what would break—without blocking users—while you inventory scripts and tighten directives.
It is the recommended on-ramp to strict CSP, not a permanent substitute for enforcement.
How Report-Only works
Draft a candidate policy
Define script-src and other directives you eventually want to enforce.
Send Report-Only header
Deliver Content-Security-Policy-Report-Only with reporting endpoints configured.
Browser evaluates without blocking
Violations are recorded; resources still load under Report-Only alone.
Collect and triage reports
Distinguish real app issues from extension noise and hostile injections.
Fix then enforce
Update code or policy, then switch the mature policy to Content-Security-Policy.
Enforce vs Report-Only
| Mode | Blocks violations? | Purpose |
|---|---|---|
| Content-Security-Policy | Yes | Protect users in production |
| Content-Security-Policy-Report-Only | No | Discover and tune safely |
| Both together | Enforcing policy blocks; Report-Only observes a second policy | Tighten gradually without losing current protection |
Making reports actionable
Stable report endpoints
Use Reporting-Endpoints / report-to with authenticated, rate-limited collectors.
Noise filtering
Ignore known browser-extension patterns that are not in your app.
Journey coverage
Exercise login, checkout, editors, and admin consoles during the observation window.
Exit criteria
Define what “clean enough” means before flipping to enforce.
Rollout checklist
- Start Report-Only before any first enforcing CSP on a complex site.
- Configure modern reporting endpoints and verify reports arrive.
- Cover primary user journeys and third-party tag paths.
- Fix first-party violations; document accepted third-party exceptions.
- Run a stricter Report-Only policy beside a looser enforcing policy if needed.
- Set a calendar date to enforce; avoid perpetual Report-Only.
- Retest after marketing pixel or GTM changes.
- Keep monitoring after enforcement—regressions still appear.
The practical takeaway
CSP Report-Only evaluates a Content Security Policy and emits violation reports without blocking. It is how mature teams deploy CSP without surprise outages.
Use it to learn, fix, and then enforce. A Report-Only header alone does not stop XSS—only an enforcing policy does.
Related security terms
Content Security Policy (CSP)
Enforcing CSP header that Report-Only is used to prepare for.
Reporting API
Modern browser reporting mechanism used with reporting endpoints.
Reporting-Endpoints
Header that declares endpoints for CSP and other reports.
CSP Nonce
Common strict CSP building block validated during Report-Only rollouts.
Frequently asked questions
What is CSP Report-Only?
It is a header that applies CSP checking for monitoring only. Violations are reported, but the browser does not block the violating resource based on that policy.
Can I send both Report-Only and enforcing CSP?
Yes. Teams often enforce a known-good policy while testing a stricter Report-Only policy in parallel.
Where do reports go?
To endpoints configured via report-to / Reporting-Endpoints (modern) or legacy report-uri, depending on your setup and browser support.
Do Report-Only policies protect users?
Not by themselves. They generate telemetry. Protection requires an enforcing Content-Security-Policy.
How long should Report-Only run?
Long enough to cover major user journeys and third-party tags across releases—then enforce. Do not leave Report-Only forever as a substitute for enforcement.
Why am I flooded with reports?
Browser extensions, malware injections, and noisy third parties generate false positives. Filter known noise and focus on first-party violations.
Does Report-Only work in meta tags?
CSP delivery via meta is limited; prefer HTTP headers for Report-Only and especially for framing-related directives in enforcing policies.
References
Explore authoritative guidance and frameworks related to csp report-only.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.