Enforce the report-only Content-Security-Policy

Why it matters

A report-only policy reports violations but blocks nothing, so it gives no protection yet. Once its reports are clean, send the same policy as Content-Security-Policy.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: review the violation reports (or the developer console on every page type) and fix or allow each legitimate source until nothing your site needs is reported.
2. Stage 2: send the same value as Content-Security-Policy. Keep a Report-Only header alongside if you want to trial a stricter next version.
3. Watch for errors after the change; renaming the header back is the rollback.

Content-Security-Policy: <the value you now send as Content-Security-Policy-Report-Only>

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax