# Connection allowlist (/en/docs/platform/monitoring/connection-allowlist)





This page lists connection attempts that fell outside your allowlist. Where CSP is expressed in resource types and directives, this looks at the connection itself, which catches outbound connections a `connect-src` review can miss.

Blocked connections are grouped by connection type and destination origin:

<img alt="Blocked connections grouped by connection type and destination origin" src="__img0" width="1359" height="412" />

## Columns [#columns]

The report table has these columns:

| Column                | What it means                                                |
| --------------------- | ------------------------------------------------------------ |
| **Connection type**   | The kind of connection attempted                             |
| **Connection origin** | Where it was going                                           |
| **Document origin**   | The page that attempted it                                   |
| **Browsers**          | Browsers that reported it                                    |
| **Disposition**       | Enforced means blocked, Report-only means it would have been |
| **Reports**           | Reports collapsed into this row                              |
| **Last seen**         | Most recent occurrence                                       |

The full connection URL and the allowlist entry that was in force are recorded too.

## Build the list from traffic [#build-the-list-from-traffic]

Start in report-only and let the reports define the list rather than guessing it. Run it across a normal business cycle, at least two weeks, so periodic connections appear. Weekly batch jobs and month-end flows are the ones a short window misses.

Then narrow. An allowlist permitting everything currently observed is a record, not a control. The value is in the entries you decide not to include.

## What to look for [#what-to-look-for]

Your first-party API and known vendor endpoints are the bulk of any healthy list. The rare entries matter most. Look for an origin nobody recognizes, a destination that appeared after a third-party update, or traffic from a page that should not reach anything external.

**Payment pages first.** A connection from checkout to an origin outside your allowlist is the pattern data exfiltration produces, and it is what the PCI DSS client-side requirements target.

## Vendor update or injection [#vendor-update-or-injection]

They look the same at first glance. Two things separate them: whether the change coincides with a vendor release you can independently confirm, and whether the destination resolves to infrastructure that vendor actually operates.

If neither checks out, treat it as an incident rather than a configuration gap.

## Next steps [#next-steps]

* [CSP violations](/en/docs/platform/monitoring/csp)
* [PCI DSS](/en/docs/platform/features/pci-dss)
* [Connection allowlist reference](/en/docs/web-security/policies/connection-allowlist)