---
description: How to add a Content Security Policy header in IIS using web.config customHeaders or IIS Manager, and report violations to Report URI.
---

# IIS

IIS adds response headers through the `<customHeaders>` element of `<httpProtocol>`, either by editing `web.config` directly or through the HTTP Response Headers pane in IIS Manager. Custom response headers are returned on every response, which is what you want for a CSP.

## What IIS gives you

- `<customHeaders>` under `<system.webServer><httpProtocol>`, configurable per site, application or directory.
- The same setting exposed through IIS Manager: select the site, open **HTTP Response Headers**, then **Add**.
- Configuration also possible via AppCmd and the management APIs, so it can be scripted into a deployment.

## Setting the header

Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

```xml
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Content-Security-Policy-Report-Only"
             value="default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>
```

That is the same starting policy we recommend for the [CSP Wizard](/setup/wizard/), and report-only blocks nothing.

## Things to watch for

- Settings are inherited down the tree, so a `web.config` in a subdirectory or a nested application can override the policy you set at the site level. If a section of the site is missing its header, look for a nested config before anything else.
- `<customHeaders>` is a static value - IIS cannot generate a per-request nonce here. Nonce-based policies need the application, or an outbound URL Rewrite rule.
- If the application also sets the header in code, you end up with two policies and the browser enforces both. Pick one layer and keep it there.

## Official documentation

[Microsoft - Custom Headers &lt;customHeaders&gt;](https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httpprotocol/customheaders/)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Prefer a guided setup? The [CSP Wizard](/setup/wizard/) builds a policy from your reports automatically once you're signed in.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)