CSP violation reporting is misconfigured
The Content-Security-Policy header declares where to send violation reports, and the declaration is wrong. `report-to` takes the NAME of a group defined in a separate header — given a URL it is silently ignored, so nothing is reported at all. And `report-uri` aimed at your own origin turns every violation into another request to the page you are already trying to keep fast. Neither breaks the page; both mean the reporting you think you have is either absent or self-inflicted. 81 sites had this problem when we measured them in the last 7 days. The list gives each one with its domain, name where known, platform, every technology we detected, its A–F grade with all its findings, location where known, and what it serves AI crawlers.
- 81 sites, last 7 days
- 5 US local businesses
- 9% also block an AI crawler
- $99 once, 30 days of downloads
Who has it
Platform
No CMS detected 54%Next.js 23%Drupal 12%WordPress 10%
Grade
D 46%C 31%A 11%F 7%B 5%
Where
Wider corpus 67%SaaS and software 22%US local businesses 6%Government and education 5%
| Where | Category | Grade | Platform | AI crawlers |
|---|---|---|---|---|
| SaaS and software | Other | A | Next.js | allowed |
| Elma, Washington | Car Parts | B | WordPress | allowed |
| Wider corpus | Other | C | WordPress | allowed |
| Wider corpus | Other | D | No CMS detected | allowed |
| SaaS and software | Other | D | Next.js | allowed |
| Wider corpus | Other | D | No CMS detected | allowed |
| SaaS and software | Other | D | Next.js | allowed |
| Wider corpus | Other | D | Next.js | allowed |
A sample from the live files. Names and websites are withheld here; they are in the file you buy. A business found with a defect is never named publicly before its owner has been contacted.
Every field: what a row holds · 25 free rows · a problem, country or industry we do not list: order a custom dataset.