Connection allowlist
Connections your pages attempted outside the allowlist. Build the list from observed traffic, then narrow it. A permissive list is a record, not a control.
Last update:
This page lists connection attempts that fell outside your allowlist. Where CSP is expressed in resource types and directives, this looks at the connection itself, which catches outbound connections a connect-src review can miss.
Blocked connections are grouped by connection type and destination origin:
Columns
The report table has these columns:
| Column | What it means |
|---|---|
| Connection type | The kind of connection attempted |
| Connection origin | Where it was going |
| Document origin | The page that attempted it |
| Browsers | Browsers that reported it |
| Disposition | Enforced means blocked, Report-only means it would have been |
| Reports | Reports collapsed into this row |
| Last seen | Most recent occurrence |
The full connection URL and the allowlist entry that was in force are recorded too.
Build the list from traffic
Start in report-only and let the reports define the list rather than guessing it. Run it across a normal business cycle, at least two weeks, so periodic connections appear. Weekly batch jobs and month-end flows are the ones a short window misses.
Then narrow. An allowlist permitting everything currently observed is a record, not a control. The value is in the entries you decide not to include.
What to look for
Your first-party API and known vendor endpoints are the bulk of any healthy list. The rare entries matter most. Look for an origin nobody recognizes, a destination that appeared after a third-party update, or traffic from a page that should not reach anything external.
Payment pages first. A connection from checkout to an origin outside your allowlist is the pattern data exfiltration produces, and it is what the PCI DSS client-side requirements target.
Vendor update or injection
They look the same at first glance. Two things separate them: whether the change coincides with a vendor release you can independently confirm, and whether the destination resolves to infrastructure that vendor actually operates.
If neither checks out, treat it as an incident rather than a configuration gap.