You set Content-Security-Policy-Report-Only to test CSP without blocking resources. But no reports arrive, and you cannot see what would be blocked. This is a common problem: Report-Only is easy to misconfigure. This guide explains why CSP Report-Only is not working and how to fix it.
What CSP Report-Only does
Content-Security-Policy-Report-Only is a header that tells the browser to monitor policy violations but not enforce them. Resources are not blocked, but reports are sent to a specified endpoint.
It is used to:
— test CSP before enforcing;
— find resources that would be blocked;
— avoid breaking the site during rollout.
But Report-Only only works if configured correctly. If the header is wrong or the reporting endpoint is missing, no reports arrive.
Reason 1: header is not sent
The most common issue: the header is not actually sent. You may have configured it, but it is not applied.
What to check:
— is the header present in the response;
— is it sent for the correct pages;
— is it removed by a proxy or CDN.
Use CSP checker to see the current CSP headers.
Reason 2: missing report-uri or report-to
Report-Only needs a reporting endpoint. Without report-uri or report-to, no reports are sent.
What to check:
— is report-uri present;
— is report-to present;
— is the endpoint accessible;
— is the endpoint configured to receive reports.
The fix: add report-uri or report-to with a valid endpoint.
Reason 3: browser does not support
Not all browsers support CSP Report-Only or report-to. Older browsers may ignore it.
What to check:
— which browsers support Report-Only;
— which browsers support report-to;
— whether reports arrive from all browsers.
The fix: use report-uri for broader support. report-to is newer and not universally supported.
Reason 4: reports are blocked
Reports may be blocked by the browser, network, or endpoint. If the endpoint is unreachable or rejects reports, you will not see them.
What to check:
— is the endpoint reachable;
— does it accept POST requests;
— is it blocked by CORS;
— is it blocked by firewall.
The fix: ensure the endpoint is reachable and accepts reports.
Reason 5: policy has no violations
If the policy is too permissive, no violations occur, and no reports are sent. This is not an error, but it may look like Report-Only is not working.
What to check:
— is the policy restrictive enough;
— are there resources that should be blocked;
— is the policy applied to all pages.
The fix: tighten the policy and test again.
How to diagnose Report-Only issues
A practical sequence:
— check the header;
— check report-uri or report-to;
— check browser support;
— check the endpoint;
— check for violations;
— test with a restrictive policy.
If the header is present and the endpoint is reachable but no reports arrive, the policy may be too permissive or the browser may not support Report-Only. For a broader audit, SEO audit can help verify CSP, HSTS and other security headers in one place.
How to fix Report-Only issues
Fix steps:
— ensure the header is sent;
— add report-uri or report-to;
— ensure the endpoint is reachable;
— use report-uri for broader support;
— tighten the policy;
— test after changes.
FAQ
Why is CSP Report-Only not working?
Most often because the header is not sent, report-uri or report-to is missing, the endpoint is unreachable, or the policy has no violations.
What is the difference between CSP and CSP Report-Only?
CSP enforces the policy and blocks resources. Report-Only does not block; it only sends reports.
Do I need report-uri?
Yes. Without a reporting endpoint, no reports are sent.
What is the difference between report-uri and report-to?
report-uri is older and widely supported. report-to is newer and uses a different format. Use both for compatibility.
Can I test CSP without blocking resources?
Yes. Use Report-Only. It monitors violations without blocking.
Why are no reports arriving?
Check the header, endpoint, browser support and policy. If the policy is too permissive, no violations occur.
Does Report-Only affect SEO?
No. It does not block resources or affect rendering. But if CSP is enforced incorrectly, it can break the site.
How long should I use Report-Only?
Until you have collected enough reports and fixed violations. Then switch to enforcing CSP.
Can I use Report-Only with meta tags?
No. Report-Only works only as an HTTP header, not as a meta tag.
What if reports are blocked by CORS?
Ensure the endpoint accepts requests from your domain. Check CORS configuration.
