News
NEL vs CSP Reports for Public Site Telemetry
October 1, 2024
NEL vs CSP reports is a telemetry split, not a ranking of which header 'is more secure.' Network Error Logging (NEL) plus Report-To / Reporting-Endpoints tells supporting browsers to report certain network failures to a collector you name. CSP report-uri / report-to tells them to report Content-Security-Policy violations. NEL does not block attacks. CSP reports do not prove the policy is enforcing. Public marketing sites can skip NEL entirely and still have adult headers. If you enable NEL, use HTTPS collectors, watch privacy (failed URLs can be sensitive), and do not confuse a NEL 200 with a roast pass. RoastMyOpsec does not grade NEL today. It reads CSP quality on the primary HTML response and does not POST reports to your endpoint.
The practical difference
CSP reports are policy: 'this script was not allowed.' NEL reports are connectivity: 'this request failed from the user's network.' Different dashboards, different on-call. Mixing them in one bucket without labels is how you ignore real CSP breakages.
Both can use the Reporting API. A misnamed group means silence. See report-uri vs Report-To.
How to choose what to turn on
If you do not have a person who reads reports, do not turn NEL on. Finish enforcing CSP and a real collector for CSP first. Add NEL when you already operate RUM or edge logs and want browser-side failure samples — with a sampling rate you can afford.
| Pipe | What it describes | Security control? | Takeaway |
|---|---|---|---|
| CSP reports | Policy violations | No — telemetry for a policy | Need enforcing CSP too |
| NEL | Network failures from the client | No | Ops signal; optional |
| Server access logs | What reached you | No | Still required |
| URL roast | Public headers and paths | A punch list | Not a log pipeline |
Privacy and OPSEC
Failed request URLs in NEL can include query strings. Keep tokens out of URLs. Do not send NEL to a vendor you would not send access logs to. report-to on HTTP is a miss.
Common mistakes
The first mistake is NEL with max_age in the years and a collector nobody owns.
The second mistake is treating missing NEL as a failed security header checklist.
The third mistake is the same endpoint for NEL and CSP with no type field in your parser.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Should every site enable NEL?
- No. It is optional ops telemetry. Enforce CSP and HSTS first. Add NEL when someone will read it.
- Does RoastMyOpsec check NEL?
- Not as a scoring gate. The free header pack is CSP, HSTS, framing, Referrer-Policy, nosniff, and Permissions-Policy.
- Is NEL a vulnerability if missing?
- No. Missing NEL is not an exposure. A public collector with no access control is the OPSEC problem.