CSP uses deprecated report-uri without report-to

A Content Security Policy (CSP) is a browser security header that restricts what scripts and resources a page is allowed to load, and it can also be configured to report any violations back to the business so they can be investigated. This check looks at how those violation reports are configured. On this site, the CSP uses the older report-uri method, but doesn't also include the newer report-to directive alongside a Reporting-Endpoints header. Modern versions of Chrome only honour the newer report-to and Reporting-Endpoints setup, part of CSP Level 3, so relying on report-uri alone means CSP violation reports silently stop arriving in the most widely used browser. That's a loss of visibility into real attempted attacks, including cross-site scripting (XSS) attempts happening on the live site right now, without anyone knowing. Your developer should migrate the CSP configuration to use report-to alongside a Reporting-Endpoints header, while keeping report-uri in place as a fallback for older browsers during the transition. This is a header configuration change, typically about an hour, and should be tested by triggering a deliberate CSP violation and confirming a report actually arrives.