Report-Only CSP lacks an enforcing response header

Why it matters

MDN describes Content-Security-Policy-Report-Only as a way to monitor violations without enforcing the policy, so that they can be tested or repaired before an enforcing Content-Security-Policy is applied. On its own, the report-only header restricts nothing.

What to do

1. Look at the finding: it shows the report-only policy and up to ten pages that send it, with their headers.
2. After testing the policy and addressing violations, send a suitable version as Content-Security-Policy; you can keep a report-only header beside it to trial a stricter one.

When to leave it as it is: if the page already enforces a policy through a CSP <meta> tag, or the report-only header is a deliberate trial, you can leave it; the check looks for the enforcing header only.

What we read

We read the final response headers of each crawled page with our own user agent. Each Content-Security-Policy-Report-Only header is split into non-empty policy text; an empty or whitespace-only value produces no finding. A policy is reported when the same response has no Content-Security-Policy header at all; any such enforcing header counts, even an empty one. A CSP <meta> tag does not clear the finding.

Pages that send the same report-only text are reported together, one finding per exact text; a policy that carries a new nonce on every response gives each page a finding of its own. Pages whose headers or HTML were not captured in full are not judged.

Example & evidence

Illustrative example — one response, not a live audit.

https://bakery.example/ answers with:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Security-Policy-Report-Only: default-src 'self'; report-to csp

There is no Content-Security-Policy header, so the report-only policy is reported with this page and the other pages that send the same text.

A possible correction after testing: also send Content-Security-Policy: default-src 'self'.

Confirm & check again

Check for yourself: open the page's response headers in your browser's developer tools and look for both Content-Security-Policy-Report-Only and Content-Security-Policy.

Check again: Full audit — run a new full audit. With complete coverage, this policy-text finding closes only when no currently crawled page sends this same report-only text without an enforcing Content-Security-Policy response header; a new page with the same combination keeps it open. Adding only a CSP <meta> tag does not close it. Changing the report-only text may open a finding for the new text.

Limits & sources

The check does not prove that the page enforces no policy, because a <meta> tag can enforce one. A non-empty header containing only semicolons can still be reported; the check does not validate that the report-only policy has useful directives. It does not check whether reports are sent or read, and it reads only the final response each page gave our crawler.

Confidence: High because both headers are read directly from the response.

Sources

• MDN, Content-Security-Policy-Report-Only header — describes the header as monitoring violations without enforcing the policy, as a step before an enforced Content-Security-Policy. Checked 28 September 2026.

Editorial review: 2 November 2026

Related

• Pages have no Content Security Policy — whether the page has any enforcing policy, in a header or a meta tag, on two answers; this separate check is currently deferred in the audit.