Content-Security-Policy-Report-Only HTTP response header

Content-Security-Policy-Report-Only

The HTTP Content-Security-Policy-Report-Only response header allows web developers to experiment with policies by monitoring (but not enforcing) their effects. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI

Header usage statistics

Content-Security-Policy-Report-Only response header information and usage statistics.


Websites using header Content-Security-Policy-Report-Only	314,515
Percentage of websites that use Content-Security-Policy-Report-Only header	0.32%
Total discovered header values	More than 10,000
Header uses directives	Yes
Header values are unique or random	No
Most popular in the country	DE

Content-Security-Policy-Report-Only directives (29 total)

base-uri
block-all-mixed-content
child-src
connect-src
default-src
font-src
form-action
frame-ancestors
frame-src
img-src
manifest-src
media-src
navigate-to
object-src
plugin-types
prefetch-src
report-to
report-uri
require-trusted-types-for
sandbox
script-src
script-src-attr
script-src-elem
style-src
style-src-attr
style-src-elem
trusted-types
upgrade-insecure-requests
worker-src

Directive	Share	Websites count	Unique Values
block-all-mixed-content	6.80%	21,392	9
upgrade-insecure-requests	1.25%	3,928	10
frame-ancestors	<0.1%	87	1
worker-src	<0.1%	44	2
child-src	<0.1%	38	1
report-uri	<0.1%	36	2
media-src	<0.1%	34	1
frame-src	<0.1%	27	1
object-src	<0.1%	26	1
base-uri	<0.1%	21	2
sandbox	<0.1%	20	1
default-src	<0.1%	16	1
img-src	<0.1%	14	1
font-src	<0.1%	12	1
manifest-src	<0.1%	12	1
connect-src	<0.1%	11	1
prefetch-src	<0.1%	11	2
script-src	<0.1%	11	1
style-src	<0.1%	11	1
plugin-types	<0.1%	10	1
trusted-types	<0.1%	9	1
style-src-elem	<0.1%	7	1
form-action	<0.1%	6	1
report-to	<0.1%	6	1
require-trusted-types-for	<0.1%	6	1
script-src-attr	<0.1%	6	1
script-src-elem	<0.1%	6	1
style-src-attr	<0.1%	6	1
navigate-to	<0.1%	5	1

Directive

Websites count

Unique Values

block-all-mixed-content

6.80%

21,392

upgrade-insecure-requests

1.25%

3,928

frame-ancestors

<0.1%

worker-src

<0.1%

child-src

<0.1%

report-uri

<0.1%

media-src

<0.1%

frame-src

<0.1%

object-src

<0.1%

base-uri

<0.1%

sandbox

<0.1%

default-src

<0.1%

img-src

<0.1%

font-src

<0.1%

manifest-src

<0.1%

connect-src

<0.1%

prefetch-src

<0.1%

script-src

<0.1%

style-src

<0.1%

plugin-types

<0.1%

trusted-types

<0.1%

style-src-elem

<0.1%

form-action

<0.1%

report-to

<0.1%

require-trusted-types-for

<0.1%

script-src-attr

<0.1%

script-src-elem

<0.1%

style-src-attr

<0.1%

navigate-to

<0.1%

Domain	Country	Rank
www.facebook.com	US	2
www.messenger.com	US	12
m.facebook.com	US	16
maps.google.com	US	24
plus.google.com	US	25
www.pinterest.com	US	32

Domain

Country

Rank

Contacts

Header value	Value prevalence
default-src ;script-src 'unsafe-inline' 'unsafe-eval' ;style-src 'unsafe-inline' ;connect-src blob:;report-uri https://cdn.website-start.de/app/reporting/policyviolation/submit	40.02%
default-src ;script-src 'unsafe-inline' 'unsafe-eval' ;style-src 'unsafe-inline' ;connect-src blob:;report-uri https://cdn.initial-website.com/app/reporting/policyviolation/submit	6.14%
default-src 'self'; img-src * data:; media-src ; font-src https://.aptrinsic.com data:; style-src 'self' 'unsafe-inline' 'unsafe-eval' sf.wildapricot.org caas-sf.wildapricot.org https://fonts.gstatic.com https://fonts.googleapis.com https://.aptrinsi	3.79%
script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.googletagman	3.42%
block-all-mixed-content; report-uri /csprep/log;	3.03%
default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://www.blogger.com/cspreport	2.61%
default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report	2.53%
block-all-mixed-content; report-uri https://blog.hatena.ne.jp/api/csp_report	2.14%
default-src https: wss: 'unsafe-inline' 'unsafe-eval' data:; report-uri https://sp.report-uri.com/r/default/csp/reportOnly	1.31%
default-src ;script-src 'unsafe-inline' 'unsafe-eval' ;style-src 'unsafe-inline' ;connect-src blob:;report-uri https://cdn.eu.mywebsite-editor.com/app/reporting/policyviolation/submit	1.00%
default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; connect-src 'self' .shopifycloud.com .shopifysvc.com .amazon.com .paypal.com *.facebook.com sessions.bugsnag.com analytics.tiktok.com bat.bing.com www.google-analytics.com ct.pinterest.com stats	0.89%
report-uri https://sjc1.qualtrics.com/csp-report	0.86%
default-src https: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'	0.85%
default-src https: blob:; connect-src https: wss:; img-src https: data:; font-src https: data:; style-src https: 'unsafe-inline'; script-src https: 'unsafe-inline' 'unsafe-eval' blob:; report-uri /csp-violation-endpoint/	0.68%
font-src 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.auth	0.64%
base-uri 'self';script-src https://.cnzz.com http://alimei-sub.alibaba.com https://.tbcdn.cn https://.alicdn.com https://g.alicdn.com http://.alicdn.com http://.tbcdn.cn https://.alibaba-inc.com http://.mxhichina.com https://.tdum.alibaba.com http	0.52%
script-src 'unsafe-eval' blob: 'self' https: 'self' data: 'unsafe-inline' 'unsafe-eval' blob: 'unsafe-inline' internal-soap.wikia.com internal-soap.fandom.com internal-soap.wikia.org internal-soap.gamepedia.com www.fandom.com www.wikia.com www.wikia.org w	0.46%
default-src https: data: blob: wss: 'unsafe-inline' 'unsafe-eval'; report-uri /_csp	0.45%
default-src https: wss: data: blob: 'unsafe-inline' 'unsafe-eval'; report-uri https://tpj.report-uri.io/r/default/csp/reportOnly	0.38%
default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'sel	0.35%

Header value

Value prevalence

default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.website-start.de/app/reporting/policyviolation/submit

40.02%

default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.initial-website.com/app/reporting/policyviolation/submit

6.14%

default-src 'self'; img-src * data:; media-src *; font-src * https://*.aptrinsic.com data:; style-src 'self' 'unsafe-inline' 'unsafe-eval' sf.wildapricot.org caas-sf.wildapricot.org https://fonts.gstatic.com https://fonts.googleapis.com https://*.aptrinsi

3.79%

script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.googletagman

3.42%

block-all-mixed-content; report-uri /csprep/log;

3.03%

default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://www.blogger.com/cspreport

2.61%

default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report

2.53%

block-all-mixed-content; report-uri https://blog.hatena.ne.jp/api/csp_report

2.14%

default-src https: wss: 'unsafe-inline' 'unsafe-eval' data:; report-uri https://sp.report-uri.com/r/default/csp/reportOnly

1.31%

default-src *;script-src 'unsafe-inline' 'unsafe-eval' *;style-src 'unsafe-inline' *;connect-src * blob:;report-uri https://cdn.eu.mywebsite-editor.com/app/reporting/policyviolation/submit

1.00%

default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; connect-src 'self' *.shopifycloud.com *.shopifysvc.com *.amazon.com *.paypal.com *.facebook.com sessions.bugsnag.com analytics.tiktok.com bat.bing.com www.google-analytics.com ct.pinterest.com stats

0.89%

report-uri https://sjc1.qualtrics.com/csp-report

0.86%

default-src https: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'

0.85%

default-src https: blob:; connect-src https: wss:; img-src https: data:; font-src https: data:; style-src https: 'unsafe-inline'; script-src https: 'unsafe-inline' 'unsafe-eval' blob:; report-uri /csp-violation-endpoint/

0.68%

font-src 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.auth

0.64%

base-uri 'self';script-src https://*.cnzz.com http://alimei-sub.alibaba.com https://*.tbcdn.cn https://*.alicdn.com https://g.alicdn.com http://*.alicdn.com http://*.tbcdn.cn https://*.alibaba-inc.com http://*.mxhichina.com https://*.tdum.alibaba.com http

0.52%

script-src 'unsafe-eval' blob: 'self' https: 'self' data: 'unsafe-inline' 'unsafe-eval' blob: 'unsafe-inline' internal-soap.wikia.com internal-soap.fandom.com internal-soap.wikia.org internal-soap.gamepedia.com www.fandom.com www.wikia.com www.wikia.org w

0.46%

default-src https: data: blob: wss: 'unsafe-inline' 'unsafe-eval'; report-uri /_csp

0.45%

default-src https: wss: data: blob: 'unsafe-inline' 'unsafe-eval'; report-uri https://tpj.report-uri.io/r/default/csp/reportOnly

0.38%

default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'sel

0.35%

Top 10k sites	436 websites
Top 100k sites	1,982 websites
Top 1m sites	9,184 websites