This is a report-only policy: browsers report violations but block nothing.

CSP_REPORT_ONLY · Severity: Info

• InfoCSP_REPORT_ONLY

  This is a report-only policy: browsers report violations but block nothing.

  The value was pasted as Content-Security-Policy-Report-Only. That header is the usual way to test a policy before it is enforced, but it gives no protection.

Reported by

• CSP header parser

Available through the API

• CSP header parser API

Related findings

• Info CSP_DEPRECATED_DIRECTIVE The policy uses a directive that has been removed from CSP.
• Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
• Error CSP_EMPTY_POLICY The pasted Content-Security-Policy has no directives.
• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
• Info CSP_NO_BASE_URI The policy does not restrict the base element (base-uri).
• Warning CSP_NO_DEFAULT_SRC The policy has no default-src directive.

All findings