Is report-only CSP enough?

No. It does not stop XSS or clickjacking. Use it to learn, then enforce. Ship framing controls in the enforcing policy immediately.

Can I run Report-Only and enforcing at the same time?

Yes. Browsers apply the enforcing policy and can still report against the Report-Only policy. Use that to tighten without a big-bang outage.

Does RoastMyOpsec send CSP violation reports?

No. It reads response headers on a consented GET. It does not execute a violation campaign against your collector.

Safety

CSP Report-Only vs Enforcing CSP for Marketing Sites

February 5, 2023

CSP report-only vs enforcing CSP is a staging-vs-production-policy split, not two equal headers. Content-Security-Policy-Report-Only tells the browser to send violation reports and still run every script your tags injected. Content-Security-Policy (enforcing) is the lock: disallowed scripts, frames, and objects do not run. Marketing sites should start report-only, watch the report endpoint until GTM and fonts stop screaming, then enforce — including frame-ancestors even earlier. Living in Report-Only forever is a dashboard hobby, not OPSEC. RoastMyOpsec reads CSP quality signals on the primary HTML response. It does not inject XSS payloads to prove the policy.

The practical difference

Report-Only is a flight recorder. Enforcing is the circuit breaker. You can ship both: a tight enforcing policy for framing and object-src, plus a report-only policy while you nonce scripts. Do not confuse 'we have CSP' with a Report-Only header that allows everything via default-src *.

frame-ancestors in Report-Only does not stop clickjacking. Framing belongs in the enforcing policy (and X-Frame-Options). See CSP vs X-Frame-Options.

How to choose based on how messy the tags are

If the site is a brochure with three first-party scripts: enforce this week. If tag manager, chat, and A/B tools fight you: Report-Only with report-to, fix the noisiest hosts, then enforce script-src with nonces or hashes. object-src 'none' and base-uri 'none' can often enforce on day one.

Mode	Blocks bad scripts?	Collects reports?	Takeaway
Report-Only only	No	Yes, if report-to/report-uri works	A start, not a finish
Enforcing, loose *	Barely	Maybe	Cosplay CSP
Enforcing + tight frame-ancestors	Yes for that directive	Optional	Do framing now even if scripts wait
Both headers	Enforcing subset	Report-Only for the rest	Usual rollout pattern

What the roast can see

Presence and quality signals of CSP on the document response — not whether your report collector is up, and not whether a nonce rotates. A Report-Only-only site can still fail the spirit of the header check if nothing is enforcing. Pair with the security headers checklist.

Common mistakes

The first mistake is Report-Only for two years because a chat widget violated once.

The second mistake is enforcing CSP and putting the report endpoint on HTTP.

The third mistake is unsafe-inline forever 'until we have time for nonces.'

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is report-only CSP enough?: No. It does not stop XSS or clickjacking. Use it to learn, then enforce. Ship framing controls in the enforcing policy immediately.
Can I run Report-Only and enforcing at the same time?: Yes. Browsers apply the enforcing policy and can still report against the Report-Only policy. Use that to tighten without a big-bang outage.
Does RoastMyOpsec send CSP violation reports?: No. It reads response headers on a consented GET. It does not execute a violation campaign against your collector.