Content-Security-Policy-Report-Only

HTTP response header

The HTTP Content-Security-Policy-Report-Only response header allows web developers to experiment with policies by monitoring (but not enforcing) their effects. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI

Header usage statistics

Content-Security-Policy-Report-Only response header information and usage statistics.
Websites using header Content-Security-Policy-Report-Only401,985
Percentage of websites that use Content-Security-Policy-Report-Only header0.70%
Total discovered header valuesMore than 10,000
Header uses directivesYes
Header values are unique or randomNo
Most popular in the country United States

Content-Security-Policy-Report-Only directives (29 total)

  • base-uri
  • block-all-mixed-content
  • child-src
  • connect-src
  • default-src
  • font-src
  • form-action
  • frame-ancestors
  • frame-src
  • img-src
  • manifest-src
  • media-src
  • navigate-to
  • object-src
  • plugin-types
  • prefetch-src
  • report-to
  • report-uri
  • require-trusted-types-for
  • sandbox
  • script-src
  • script-src-attr
  • script-src-elem
  • style-src
  • style-src-attr
  • style-src-elem
  • trusted-types
  • upgrade-insecure-requests
  • worker-src

Content-Security-Policy-Report-Only Directives

Content-Security-Policy-Report-Only directives value information and usage statistics
DirectiveShareWebsites countUnique Values
block-all-mixed-content4.26%17,13815
upgrade-insecure-requests3.42%13,75533
report-uriless than 0.1%1253
frame-ancestorsless than 0.1%571
object-srcless than 0.1%541
trusted-typesless than 0.1%512
child-srcless than 0.1%452
base-uriless than 0.1%401
frame-srcless than 0.1%372
script-srcless than 0.1%341
worker-srcless than 0.1%331
media-srcless than 0.1%191
report-toless than 0.1%162
default-srcless than 0.1%131
form-actionless than 0.1%101
manifest-srcless than 0.1%81
sandboxless than 0.1%82
connect-srcless than 0.1%61
style-srcless than 0.1%61
style-src-attrless than 0.1%51
script-src-attrless than 0.1%41
font-srcless than 0.1%31
img-srcless than 0.1%31
plugin-typesless than 0.1%31
prefetch-srcless than 0.1%31
script-src-elemless than 0.1%31
style-src-elemless than 0.1%31
require-trusted-types-forless than 0.1%21
navigate-toless than 0.1%11

Connected technologies

Technologies that utilize the header
Amazon S3, category Content Delivery Networks, total 460,119 websites
Cardinal, category Payment Processors, total 18,143 websites
Recurly, category Payment Processors, total 12,736 websites
Kameleoon, category Personalization, total 3,916 websites
Payplug, category Payment Processors, total 3,633 websites
Cvent, category Event Management, total 3,030 websites
Medallia, category User Onboarding, total 1,599 websites
Zuora, category Payment, total 779 websites
RapidSec, category Security Solutions, total 50 websites
Digital River, category Ecommerce, total 17 websites

Websites utilizing Content-Security-Policy-Report-Only

List of websites that use Content-Security-Policy-Report-Only header
DomainCountryRankContacts
google.com United States3
maps.google.com United States24
accounts.google.com United States28
google-analytics.com United States38
support.google.com United States43
blogger.com United States44
See full domain list

Common header values

List of top common Content-Security-Policy-Report-Only header values
Header valueValue prevalence
default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.website-start.de/app/reporting/policyviolation/submit18%
default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.initial-website.com/app/reporting/policyviolation/submit2%
default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; report-to blogspot; report-uri https://www.blogger.com/cspreport2%
block-all-mixed-content; report-uri https://blog.hatena.ne.jp/api/csp_report1%
block-all-mixed-content; report-uri /csprep/log;1%
upgrade-insecure-requests; default-src 'self' https: data: wss: 'unsafe-inline' 'unsafe-eval';1%
frame-ancestors 'self'1%
default-src http: https: 'self'; connect-src 'self' http: https: javascript: wss: *.doubleclick.net *.facebook.com *.freshdesk.com ajax.googleapis.com *.google-analytics.com www.justuno.com *.loyaltylion.net www.shopboostapp.com *.smartsupp.com *.tawk.to 1%
default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; object-src 'none'; base-uri 'self'; frame-ancestors *; report-uri /csp-report0%
frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report0%
default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report0%
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/6b8ce7c01e3dacd3d2c7a8cd322ff979/mr0%
script-src 'self' api.stacksports.com ayso.bluesombrero.com cdn.cookielaw.org cdn.pendo.io cdn.segment.com cdnjs.cloudflare.com connect.facebook.net clubs.bluesombrero.com data.pendo.io dt5602vnjxv0c.cloudfront.net ep2.adtrafficquality.google fonts.google0%
default-src 'self'; script-src 'self' *.salesforce.com 'report-sample'; style-src *.force.com 'unsafe-inline' 'self' *.salesforce.com *.visualforce.com:*; img-src *.force.com slack-imgs-mil-dev.com a.static.lightning.force.com *.slack.com 'self' *.slack-i0%
default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.eu.mywebsite-editor.com/app/reporting/policyviolation/submit0%
default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline' https:; script-src 'self' https://www.googletagmanager.com https://www.google-analytics.com https://securepubads.0%
default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://js.stripe.com; script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://js.stripe.com https://maps.g0%
report-uri /csp-violation-report-endpoint0%
default-src * data: ; script-src * 'unsafe-inline' 'unsafe-eval' ; style-src * 'unsafe-inline' data: ; frame-ancestors 'none'; report-uri /csp-violation-report-endpoint/0%
frame-ancestors 'self'; report-uri /csp_logger?path=/0%