Configure reporting

NOTE: The following headers are preconfigured for reporting, you can change the reporting URI, or you can leave the default value.
The default report URI used by the diagnostics HTTP headers profiler is /Sitefinity/Frontend/Diagnostics/HttpHeadersReport

To configure the reporting headers, perform the following:

1. In Sitefinity CMS backend, navigate to Administration » Settings » Advanced.
2. In the tree on the left, expand WebSecurity » HttpSecurityHeaders » ResponseHeaders.
   A list of the predefined headers appear. Locate the Content-Security-Policy-Report-Only or Public-Key-Pins-Report-Only headers.
3. Click the header that you want to configure.
4. Edit the HTTP header value input field or select Disable checkbox.
   

1. Disable the Public keys for web servers security policy. For more information see, Configure the security policies and HTTP response headers
2. In Sitefinity CMS backend, navigate to Administration » Settings » Advanced.
3. In the tree on the left, expand WebSecurity » HttpSecurityHeaders » ResponseHeaders.
4. Locate the Public-Key-Pins-Report-Only header and click on it.
5. Uncheck the Disable checkbox.
6. Configure the response URI of the header in the Http header value field.
7. Save your changes.

Perform the following:

1. Enable the Enable prevention of cross-scripting attack security policy. For more information see: Configure the security policies and HTTP response headers
2. Configure the response URI of the header in the Http header value field.

   NOTE: Value 1, entered in the field before the response URI, means the all attacks will be blocked and reported to the configured URI.

After you have configured one or more headers to report activity, you can view the reports.
Perform the following:

1. In Sitefinity CMS backend, navigate to Administration » Diagnostics.
2. In the left pane, click HTTP headers warnings.
   A list of warnings appears.
3. To check the details, click View details link of the respective warning.