Roll out a Content-Security-Policy header using report-only mode

Steps

1. Start by deploying the header as Content-Security-Policy-Report-Only with a permissive initial policy (default-src 'self') and a report-uri or report-to directive pointing to a CSP report collector endpoint you control
2. Collect violation reports for at least one full traffic cycle; each report is a JSON object containing the blocked-uri, violated-directive, document-uri, and source-file fields
3. Analyze the violation reports to identify legitimate sources that need to be added to the policy (CDN domains, inline script hashes or nonces, analytics endpoints) versus actual injections that should remain blocked
4. Iteratively tighten the policy by adding specific source allowances for each directive (script-src, style-src, img-src, connect-src, frame-src, etc.) until violations from legitimate traffic cease
5. Before switching to enforcement mode, deploy the same policy string in both Content-Security-Policy-Report-Only and Content-Security-Policy simultaneously to catch any remaining violations during the transition
6. Switch to enforcement-only by removing the Report-Only header; keep the report-to directive in the enforced header to capture violations from new code paths going forward