How to move from report-only to enforced CSP?

csp-report-only-active page

The issue

A site whose only policy is Content-Security-Policy-Report-Only blocks nothing. Injected scripts run, unknown sources load, and the browser reports each violation after letting it happen. The header looks like protection in an audit, and left in place it becomes the permanent state.

The cause is a rollout that never finished. Report-only mode exists to test a policy before enforcing it, and it is easy to stop at that step.

Scope

The mode is set per response by the header name. Most sites switch the whole site at once; some enforce on certain page types first. Either way, each response either enforces a policy or doesn’t.

How to check you have it

In probeo: probeo reads only the enforced Content-Security-Policy header, so a response that sends only the report-only header is reported as csp-missing, graded critical.
By hand: run curl -sI https://your-site.example/ | grep -i content-security-policy. A content-security-policy-report-only line with no plain content-security-policy line means nothing is enforced.
In the browser: the console reports violations without blocking, and says the policy is report-only.

The fix

Send the same directives under the Content-Security-Policy header name.

Review the violation reports first, so the policy allows everything the site legitimately uses. Keep report-to or report-uri in the enforced policy to keep receiving reports. A report-only policy can stay alongside to test a stricter next version.

Done when: every response sends an enforced Content-Security-Policy, and the check above comes back clean.

Do not

Do not leave report-only as the finished configuration.
Do not enforce before reviewing what report-only mode has recorded.
Do not drop reporting when switching to enforcement.
Do not count a report-only policy as protection.

FAQ

How long should report-only mode run before enforcement?

Long enough to see the site’s real traffic, including pages and features that are used rarely. When no new kinds of violation appear, the policy covers what the site does.

Can both report-only and enforced policies coexist?

Yes. The browser enforces one and reports against the other. That is a good way to test a stricter policy while the current one stays in force.

What happens to existing violation reports after enforcement?

They keep arriving if the enforced policy names a reporting endpoint. In the reporting format that carries it, the disposition field changes from report to enforce.

Should enforcement happen globally or gradually?

Either works. Enforcing everywhere at once protects every page sooner, and enforcing by page type limits what a gap in the policy can break. Sign-in and account pages are the place to start.

What breaks when switching from report-only to enforced?

Whatever the reports listed. Inline scripts without a nonce or hash stop running, sources not in the policy stop loading, and inline styles break if 'unsafe-inline' is gone from style-src.

Does removing report-only improve performance?

Not measurably. Both modes check every resource against the policy. Enforcement stops blocked resources from loading at all, which saves a little.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.