Web Security · Junior · Question 66 of 75

What is `Content-Security-Policy-Report-Only` used for?

✓Correct answer: Testing a policy: violations are reported but nothing is blocked
2Disabling CSP for logged-in users
3Sending CSP only to search engine crawlers

Explanation

Rolling out CSP in report-only mode first shows what would break, so you can fix legitimate scripts before enforcing.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.