Magento Module Beta

Help us test it. Report URI is on us while you do.

We have built an open source Magento module that turns on the CSP reporting your store already generates. We want to know how it behaves on stores that are not ours.

Twenty-five places. Free until 31 December 2026, then 50% off your first year for taking part.

Apply for a Place Read the source first
What You Would Be Testing

One Composer command, then four fields fill themselves in

Every Magento 2 store since 2.3.5 sends a Content-Security-Policy-Report-Only header, and every visitor's browser builds violation reports against it. The field those reports are meant to be delivered to ships empty, so the browser builds each one and then throws it away. The module fills that field in.

Install — Magento root
composer require report-uri/magento2-csp-reporting
bin/magento module:enable ReportUri_CspReporting
bin/magento setup:upgrade

Then paste one address from your Report URI Setup page into the Admin. It writes all four CSP reporting fields for you, giving the two enforcing pages and the two report-only pages the endpoint each actually needs.

It changes headers, nothing else

No markup, no JavaScript, no checkout logic. It cannot alter what your store displays or how an order is placed.

It fixes the Chrome problem

Magento builds its Report-To header from the CSP address, which is the wrong endpoint. Browsers that support the Reporting API prefer it and ignore the one that works, so their reports are lost. The module repoints it.

It leaves other setups alone

It only ever acts on a Report URI address. Point Magento at a different collector and your configuration is untouched.

MIT licensed, and the whole thing is about 500 lines. Read it on GitHub →

The Offer

Free while you test it, half price for a year afterwards

We are not asking you to evaluate a product. We are asking you to run new code on a real store, which is a favour, so the terms are written to reflect that.

Until 31 December 2026

A full Report URI account, on a paid plan, free. No card is asked for at any point, so there is nothing to cancel if you decide to stop. We size the plan to your store's traffic rather than putting you on a fixed one, because a busy storefront that has never had an endpoint configured produces a lot of reports on day one.

Afterwards, if you stay

50% off your first twelve months. Everyone who takes part gets it, whether the module worked perfectly or you spent the beta telling us what was wrong with it. It is a thank you for the time, not a reward for a good review.

What We Are Asking For

Run it, then tell us what happened

1. Staging first, then live

Install it on staging, check your headers look right, then move it to production when you are comfortable. It changes response headers on every page, so it deserves the same care as anything else that does.

2. Tell us what broke

Or what was confusing, or what you expected to happen and did not. A GitHub issue, an email, whichever suits. "It worked, nothing to report" is a genuinely useful answer and takes a minute to send.

3. Nothing else

If it goes well we would like to ask about quoting you, but that is a separate conversation and you are free to say no. It has no bearing on the discount.

Who It Is For

A real Magento store, and someone who can deploy to it

  • Magento 2.4.7 or later, or one of the backports that carry the per-page CSP configuration: 2.4.4-p9, 2.4.5-p8, 2.4.6-p6. Open Source, Adobe Commerce and Mage-OS all qualify.
  • Composer access to the store, and somewhere to try it before production.
  • Ideally you take card payments, because the checkout is where this matters most and where PCI DSS 6.4.3 and 11.6.1 apply. Not a requirement.
  • Agencies are welcome, and are the most useful testers because you see many configurations rather than one. Say how many stores you look after and we will talk about what fits.
Apply

Twenty-five places

Tell us your store and your Magento version and we will come back to you. We read every one of these ourselves, so it is a reply from a person rather than an automatic acceptance.

Applications close when the places are gone or on 31 December 2026, whichever comes first.

Would rather just use it?

The module is MIT licensed and free forever, beta or not. Nothing here gates it. See what it does →

Email us

magento@report-uri.com

Three lines is plenty. It helps if you say:

  • Your store's address
  • Which Magento version and edition
  • Whether you have somewhere to try it before production
Email Us About a Place
FAQ

Frequently asked questions

The report-uri/magento2-csp-reporting module, installed with Composer. It fills in the four CSP reporting fields Magento ships empty, giving each page the disposition it actually uses, and it corrects the Report-To header so reports from Chromium browsers arrive rather than being discarded. It is MIT licensed and it works with any Report URI account.

It changes response headers and nothing else. It renders no markup, loads no JavaScript and touches no checkout logic, so it cannot alter what your store displays or how an order is placed. It also only ever acts on a Report URI address: configure a different collector and it leaves your configuration untouched. It is beta because it is new, not because it is risky, and we still ask you to run it on staging first.

No. The reporting endpoint decides where reports are delivered, not what the policy permits. Your storefront runs a report-only policy that blocks nothing before you configure this and blocks nothing afterwards. Checkout has enforced its policy since 2.4.7 regardless of whether anyone is collecting the reports.

A full account on a paid plan, on the same terms a subscriber gets, for the whole beta period. No card is asked for. Report volume follows your traffic, and a busy storefront that has never had an endpoint configured can generate a lot at first, so we size the plan to your store rather than putting you on a fixed one.

You decide whether to carry on. If you do, the 50% applies to your first twelve months and we send you the code to use at checkout. If you would rather stop, the account simply ends and there is nothing to cancel, because there was never a card on it.

Tell us what broke, what was confusing, or what you expected to happen and did not. A one-line "it worked" is a genuinely useful result and takes a minute. If it goes well we would like to ask about quoting you, but that is a separate conversation you are free to decline, and it has no bearing on the discount.

Any version carrying the per-page CSP configuration: 2.4.7 and later, plus the backports in 2.4.4-p9, 2.4.5-p8 and 2.4.6-p6. Magento Open Source, Adobe Commerce and Mage-OS all ship the same module and all qualify.

Yes, and you are the most useful kind of tester because you see many configurations rather than one. Apply once and tell us roughly how many stores you look after, and we will talk about what makes sense across a portfolio.

Your store has been generating this evidence all along.

Help us make it two commands to stop throwing it away.

Apply for a Place