Content-Security-Policy is in report-only mode — the fix
A Content-Security-Policy-Report-Only header is present. Violations are being collected but nothing is blocked yet.
Where this fits: security in SEO
Security issues erode both rankings and trust. HTTPS has been a ranking signal since 2014, and browsers actively warn users away from insecure or mixed-content pages — a warning interstitial is a 100% bounce rate. Missing security headers rarely block indexing, but they widen your attack surface, and a hacked site (injected spam, malicious redirects) can be removed from results entirely. Security is the SEO work you do so you never have to do recovery work.
Why content-security-policy is in report-only mode hurts your rankings
This is the recommended way to roll out a policy: observe what would break before enforcing. It is progress, not an absence — but until the policy moves to the enforcing header it protects nothing, and rollouts have a way of never finishing.
This is an advisory finding: not a defect, but an opportunity flagged so you can decide deliberately rather than by accident.
How to fix it
When the collected reports are clean, move the same policy to the enforcing Content-Security-Policy header. Keep Report-Only alongside it for a release if you want to watch a stricter draft.
Security best practices
- Serve everything over HTTPS and redirect HTTP with a single 301.
- Send HSTS, X-Content-Type-Options, and a Content-Security-Policy on every response.
- Eliminate mixed content — one insecure asset breaks the padlock.
- Keep dependencies and CMS plugins patched; most site hacks are known-CVE exploits.
- Monitor Search Console's security section — Google often knows you're hacked before you do.
The full library: SEO best practices, by category.
Frequently asked questions
What does "Content-Security-Policy is in report-only mode" mean?
A Content-Security-Policy-Report-Only header is present. Violations are being collected but nothing is blocked yet.
Why does content-security-policy is in report-only mode matter for SEO?
This is the recommended way to roll out a policy: observe what would break before enforcing. It is progress, not an absence — but until the policy moves to the enforcing header it protects nothing, and rollouts have a way of never finishing.
How do I fix content-security-policy is in report-only mode?
When the collected reports are clean, move the same policy to the enforcing Content-Security-Policy header. Keep Report-Only alongside it for a release if you want to watch a stricter draft.
How serious is this issue?
This is an advisory finding: not a defect, but an opportunity flagged so you can decide deliberately rather than by accident. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects content-security-policy is in report-only mode on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by content-security-policy is in report-only mode, and hands you a ready-made fix task.
Check my site free