Starting Content Security Policy in report-only mode

CSP report-only mode provides evidence about resources that an enforcing policy would block. It is a discovery stage, not protection by itself.

Define an intended baseline

Begin with default-src and explicit script, style, image, font and frame sources. Keep the draft narrower than the current site so reports reveal undocumented dependencies rather than automatically approving them.

Make reports usable

Receive reports on a dedicated endpoint, limit payload size and group repeated violations. Exercise administration, checkout, validation and consent states because quiet public pages do not cover the complete application.

Remove before allowing

For each blocked source, identify its purpose and owner. Remove obsolete tags, replace inline code where practical and add the narrowest necessary source only after the dependency is accepted.