← back to examples

Violation report fields

The page loads an image and a stylesheet from external origins. Both are reported as separate violations with different effectiveDirective values — "img-src" and "style-src-elem" — both derived from the single "default-src" in originalPolicy.

Response header
Content-Security-Policy-Report-Only: default-src 'self'
Markup triggering violation
<img src="https://images.example.com/photo.jpg" alt="">
<link rel="stylesheet" href="https://static.example.com/style.css">
Violation report