Define an endpoint name and URL in a Reporting-Endpoints response header, then add report-to with that name to your Content-Security-Policy. Browsers send violation reports as JSON to that URL. MDN says report-to is meant to replace report-uri, and you can send both while support spreads.
Definitions
CSP violation report: a JSON object the browser sends when a page breaks your policy, with a type of csp-violation.
Reporting-Endpoints: a response header that maps endpoint names to URLs.
report-to: a CSP directive that names which endpoint receives violation reports.
Setup steps
- Create a URL on a server you control that accepts POST requests with a content type of application/reports+json.
- Send the mapping header, for example
Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports". - Add the directive to your policy, for example
Content-Security-Policy-Report-Only: default-src 'self'; report-to csp-endpoint. - Reload a page that loads an outside script and confirm a report arrives.
- Add
report-uritoo if you still need older browser coverage. MDN notes that browsers supporting report-to ignore report-uri.
MDN notes the directive is not supported in a meta element, so it must be sent as a header. MDN also marks the directive as newly available across the latest browsers since March 2026, and warns it might not work in older ones.
What a report contains
MDN's example shows fields in the report body, including these:
| Field | Meaning |
|---|---|
| blockedURL | What was blocked, or inline |
| effectiveDirective | The directive that applied, such as script-src-elem |
| disposition | Whether the policy was enforced or report only |
| documentURL | The page where it happened |
| sample | A snippet of the blocked code, when provided |
| originalPolicy | The policy text in force |
| sourceFile, lineNumber | Where the code came from |
Turning reports into tag decisions
For marketing and web teams, the reports are a free inventory. Each unique blockedURL host is a candidate third party. Group them by host and by documentURL, then ask whether each one has an owner and a purpose. The script inventory method shows how to combine this with the network panel.
Handling the noise
Reports can be noisy. Browser extensions and injected code on visitors' machines can trigger violations that have nothing to do with your site. Triage by volume and by page. A host seen on many pages from many visitors is yours. A single report from one visitor is probably an extension. Keep report-only mode on for a few weeks before enforcing, as in the report-only rollout.
Treat the endpoint as a service
Reports can include page URLs, which might contain personal data. Keep the endpoint private to your team, set a short retention period, and do not forward raw reports to a third party without checking what they contain.
Quick check
Can I set report-to in a meta tag?
No. MDN says the directive is not supported in the meta element. Use a response header.
Do I still need report-uri?
Only for older browsers. Browsers that support report-to ignore it.
Where Safeguard fits
Safeguard's policies and gates can hold changes to header configuration behind review, and dependency scanning covers shipped packages. Try the free scan.
Sources
Last reviewed: 19 October 2026.
