Content-Security-Policy-Report-Only Directives (13 total)
- base-uri
- block-all-mixed-content
- child-src
- default-src
- frame-ancestors
- img-src
- media-src
- report-uri
- sandbox
- script-src
- trusted-types
- upgrade-insecure-requests
- worker-src
Content-Security-Policy-Report-Only
HTTP response headerThe HTTP Content-Security-Policy-Report-Only response header allows web developers to experiment with policies by monitoring (but not enforcing) their effects. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI
Header usage statistics
Content-Security-Policy-Report-Only response header information and usage statistics.| Websites using header Content-Security-Policy-Report-Only | 211,682 |
| Percentage of websites that use Content-Security-Policy-Report-Only header | 0.39% |
| Total discovered header values | 9,269 |
| Header uses directives | Yes |
| Header values are unique or random | No |
| Most popular in the country | 
United States of America
|
Content-Security-Policy-Report-Only Directives
Content-Security-Policy-Report-Only directives value information and usage statistics| Directive | Share | Websites count | Unique Values |
|---|---|---|---|
| block-all-mixed-content | 2.33% | 4,923 | 4 |
| upgrade-insecure-requests | 0.29% | 604 | 6 |
| sandbox | <0.1% | 7 | 1 |
| base-uri | <0.1% | 5 | 1 |
| frame-ancestors | <0.1% | 5 | 1 |
| report-uri | <0.1% | 4 | 2 |
| child-src | <0.1% | 2 | 1 |
| img-src | <0.1% | 2 | 1 |
| worker-src | <0.1% | 2 | 1 |
| default-src | <0.1% | 1 | 1 |
| media-src | <0.1% | 1 | 1 |
| script-src | <0.1% | 1 | 1 |
| trusted-types | <0.1% | 1 | 1 |
Distribution by websites popularity
Content-Security-Policy-Report-Only detection in the top websites by popularity| Top 10k sites | 248 websites |
| Top 100k sites | 767 websites |
| Top 1m sites | 3,907 websites |
Websites utilizing Content-Security-Policy-Report-Only
List of websites that use Content-Security-Policy-Report-Only header| Domain | Country | Rank | Contacts |
|---|---|---|---|
|
|
United States of America
|
4 | |
|
|
United States of America
|
9 | |
|
|
United States of America
|
13 | |
|
|
United States of America
|
19 | |
|
|
United States of America
|
20 | |
|
|
United States of America
|
26 |
Flat price per the report, subscription is not required.
Geographical Distribution
Header usage distribution by websites across the globe.Common header values
List of top common Content-Security-Policy-Report-Only header values| Header value | Value prevalence |
|---|---|
| default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.website-start.de/app/reporting/policyviolation/submit | 36.00% |
| block-all-mixed-content; report-uri https://blog.hatena.ne.jp/api/csp_report | 24.62% |
| default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.initial-website.com/app/reporting/policyviolation/submit | 4.99% |
| default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://www.blogger.com/cspreport | 3.85% |
| script-src 'unsafe-eval' 'self' https: 'self' data: 'unsafe-inline' 'unsafe-eval' blob: 'unsafe-inline' internal-soap.wikia.com internal-soap.fandom.com internal-soap.wikia.org internal-soap.gamepedia.com www.fandom.com www.wikia.com www.wikia.org www.gam | 3.41% |
| block-all-mixed-content; report-uri /csprep/log; | 3.32% |
| default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report | 1.59% |
| frame-ancestors 'none'; report-uri https://bandcamp.com/api/cspreport/1/violation | 1.03% |
| font-src 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.auth | 1.00% |
| default-src https: wss: 'unsafe-inline' 'unsafe-eval' data:; report-uri https://sp.report-uri.com/r/default/csp/reportOnly | 0.92% |
| default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.eu.mywebsite-editor.com/app/reporting/policyviolation/submit | 0.83% |
| object-src 'self' *.qualtrics.com; report-uri https://sjc1.qualtrics.com/csp-report | 0.46% |
| script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikivoyage.org *.mediawiki.org 'uns | 0.43% |
| default-src https: blob:; connect-src https: wss:; img-src https: data:; font-src https: data:; style-src https: 'unsafe-inline'; script-src https: 'unsafe-inline' 'unsafe-eval' blob:; report-uri /csp-violation-endpoint/ | 0.40% |
| default-src https: data: 'unsafe-inline' 'unsafe-eval' | 0.38% |
| default-src https: wss: data: blob: 'unsafe-inline' 'unsafe-eval'; report-uri https://tpj.report-uri.io/r/default/csp/reportOnly | 0.38% |
| font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcom | 0.31% |
| default-src *.acsbap.com *.acsbapp.com *.google-analytics.com;frame-src 'self' *.google.com *.google-analytics.com *.googletagmanager.com *.onboardnavigator.com;img-src 'self' data: *.bing.com *.elmstreettechnology.com *.facebook.com *.google-analytics.co | 0.31% |
| frame-ancestors 'self'; report-uri /csp_logger | 0.28% |
| font-src *.fontawesome.com 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.autho | 0.25% |