Page Security
CSP violation reporting check
Whether your Content-Security-Policy tells you when it blocks something, so an attack or a broken page does not go unnoticed.
Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.
What we look at
We look for a report-uri or report-to directive in your Content-Security-Policy.
Why it matters to your business
Without reporting, a policy that blocks an injected script does so silently, and so does one that breaks your own checkout. Reports are how you learn about either.
How to fix it
- Add a report-to directive naming an endpoint you declare in a Reporting-Endpoints header, pointing at a reporting service your developer watches. Older browsers only understand report-uri, so many sites send both.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.