GOV.UK switched their Content Security Policy to enforce mode in Summer 2023, “following a number of years running in report-only mode”. Years — not a fortnight of nerves before someone signed it off.
It is the best-documented rollout in this research, because GOV.UK builds in the open. The decision record that proposed it, the developer manual that describes it, the shared library the policy lives in and the header it produces are all public, and you can read every one of them.
What their headers say
www.gov.uk — HTTP response header
content-security-policy: default-src 'self';
base-uri 'none'; object-src 'none';
script-src 'self' … 'nonce-kaWyTALQYs9ESXh1Y1N+xA==';
report-uri https://csp-reporter.publishing.service.gov.uk/report
A nonce on script-src, base-uri and object-src denied outright, and a reporting endpoint they run themselves. Their manual records that they considered removing the reporting because of false-positive volume — and the endpoint is still there.
Not a customer
GOV.UK has no relationship with Report URI, nothing here is an endorsement by any government, and they run their own reporting service. The page exists because their rollout is public from end to end, which is true of almost nobody else.
