Report-Only rollout with CSP Foundry
The Collect tab opens so you can create a report endpoint. Deploy your policy in Report-Only, point it at the endpoint, and the aggregated reports build a draft policy.
- Create a report endpoint and copy the two header lines.
- Deploy them with your policy as Content-Security-Policy-Report-Only.
- Browse the site and let real visitors for a few days; reports arrive within about a minute.
- Review the table and the draft policy, fix what is yours, and enforce when the reports are clean.
What to know
Content-Security-Policy-Report-Only evaluates a policy and reports violations without blocking anything, which makes it the safe way to find out what an enforced policy would break. Violations are POSTed to the URL in report-uri (supported by every major browser) or to the endpoint named in report-to together with a Reporting-Endpoints header (the newer mechanism, not supported everywhere).
Raw reports are noisy. Browser extensions inject scripts and styles that show up as violations on your page, and URLs often carry tokens in query strings. The collector drops reports that come from extension schemes, strips query strings and fragments, and keeps only counts and one sample per distinct violation, so you can read the result instead of a log. From the aggregate it drafts the policy that would have allowed the legitimate traffic, and notes the inline code and eval() uses that need a code change rather than an allowlist entry.
Report volume depends on traffic and policy. On a busy site a broken policy can generate a lot of reports, which is why the endpoint has a daily ceiling and drops the excess. Roll out on a single section first if you are unsure.
Updated · Cosmovex
Questions
What is the difference between report-uri and report-to?
report-uri is the older directive and works in all major browsers. report-to uses a named endpoint defined with the Reporting-Endpoints header and is not supported everywhere, so many sites send both.
Does Report-Only block anything?
No. It only reports. That is its purpose: you see what would be blocked without affecting visitors.
Why do I get reports from chrome-extension URLs?
Browser extensions inject code into pages and the browser reports it against your policy. They are not your site's problem; the collector filters them out.
How long are reports kept?
Free endpoints keep daily counts for 7 days and Pro for 30 days. Only counters and one scrubbed sample per violation are stored, never IP addresses.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
