Home / Knowledge hub / CSP report-only mode
Knowledge hub
CSP report-only mode
Trying a content security policy by logging breaches without blocking anything.
What it means
CSP report-only mode is a way to try a content security policy without enforcing it. You send the policy in the Content-Security-Policy-Report-Only header instead of Content-Security-Policy. The browser checks every load against it, reports the breaches, and lets everything run anyway.
The reports go to an address you give with report-uri or report-to, and they also show in the browser console. You can run both headers at once: one policy enforced, and a stricter candidate in report-only mode while you see what it would break.
Why it matters
A strict policy switched on without a trial breaks pages. Analytics, chat widgets, fonts and inline scripts stop loading, and the quick fix is to loosen the policy until it protects very little. Report-only mode lets you find those dependencies first, with no outage.
It also shows you what you did not know you were loading. Reports often reveal scripts from third parties that nobody on the team remembers adding, which is useful for a supply chain review. The risk is leaving a policy in report-only mode for ever, so that it looks like protection and gives none.
How it shows up
You meet it in the weeks before a policy is enforced, and in the checks that run after a big front-end change. Teams collect reports in a logging tool or a reporting service, group them by blocked address and by directive, and clear the noise before switching the header.
Common mistakes: the report endpoint is not set up, so nothing is collected. Browser extensions create reports that look like attacks. The report-only header is never promoted to the enforcing one. And the meta tag cannot carry a report-only policy, so it has to be an HTTP header. Check which header production actually sends.
Questions people ask
CSP report-only mode, answered
Does report-only mode block anything?
No. It never blocks a script, style or frame. It only records a violation report. If you want protection, the same policy has to be sent in the enforcing header.
Can I send two policies at once?
Yes. Browsers enforce the Content-Security-Policy header and separately report on the report-only one. Teams use that to tighten a live policy step by step without breaking the site.
Why do I get reports from extensions?
Browser extensions inject their own scripts and styles, and the browser may report those as violations of your policy. Filter on source files and known extension schemes before treating a report as an attack or a bug.
How long should we stay in report-only mode?
Long enough to cover your normal traffic, including rare pages, sign-in flows, checkout and admin screens. For many teams that is a few weeks. Set a date to enforce, or the trial becomes permanent.
Is report-only mode useful for security testing?
It tells you what a policy would stop, but it does not prove the policy works. To prove that, inject a script through a real input under the enforcing policy and watch whether the browser blocks it.
Sources
Where this comes from
Related
Terms that sit next to this one
Content Security Policy
A header telling the browser which scripts a page may load.
CSP nonce
A one-time value that marks which inline scripts a content security policy allows.
Security headers
Response headers that switch on browser protections against common web attacks.
XSS
An attacker's script running in your pages, in your customers' sessions.
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Is your policy enforced or just watching?
We check whether your content security policy actually stops an injected script, and report only what we ran, with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.