Shipping Content Security Policy Without Breaking Production
CSP is one of the most effective XSS defenses ever shipped — and one of the most feared to deploy. Report-only mode turns a scary launch into a boring one.
Why report-only
Report-only mode is a dry run. The browser evaluates the policy exactly as it would in enforcement mode, but never blocks a request — it just sends a report. That means zero user impact while you learn what the policy would break.
Set up a reporting endpoint
Use report-to (the modern replacement for report-uri). A tiny Cloudflare Worker or serverless function can accept POSTs and forward them to your log aggregator.
Watch the reports
You will see everything: Google Fonts, Segment, Intercom, Hotjar, that one inline script your CMS still injects. Allowlist each intentional dependency, then reject or replace the rest.
Flip to enforcement
When reports are quiet for a week, rename the header from Content-Security-Policy-Report-Only to Content-Security-Policy. Keep the report-to so you catch regressions.