Content-Security-Policy is report-only
What this means
The response sends Content-Security-Policy-Report-Only but no enforcing policy, so violations are logged and nothing is blocked.
How to fix it
Once the reported violations are clean, promote the policy by sending it as Content-Security-Policy.
Fix effort
This check needs a developer fix: it turns on a routing, hosting or infrastructure decision that no automatic edit can make safely.
Authoritative source
Find every page this affects
CrawlX runs this check — and 161 others — across your whole site, ranks the findings by estimated impact, and opens the fixable ones as pull requests. Free for 500 URLs.