Network Error Logging (NEL), report network failures

NEL tells the browser to report network-level request failures, DNS, TLS, connection, and HTTP errors, to an endpoint you control.

Network Error Logging (NEL) asks the browser to collect the outcome of network requests, DNS failures, TLS and connection errors, resets, and HTTP errors, and report them to a server endpoint. It gives operators visibility into failures that never reach their own logs, because the request failed before it arrived. NEL is observability, not enforcement.

Experimental, and uses the legacy header

NEL is Chromium-only: Mozilla holds a negative standards position on privacy grounds and Safari never shipped it. It is also the one mechanism that still requires the deprecated Report-To header; Reporting-Endpoints does not deliver NEL. Chrome has announced a successor mechanism, but nothing has shipped and there is no removal date, so NEL is experimental, not deprecated.

Turning it on takes the two headers together, the group definition and the policy:

Report-To: {"group":"nel-group","max_age":31536000,"endpoints":[{"url":"https://<Endpoint-ID>.report.centralcsp.com"}]}

NEL: {"report_to":"nel-group","max_age":31536000,"include_subdomains":true,"success_fraction":0.0,"failure_fraction":1.0}

How NEL works

The NEL header is a JSON object that names a Report-To group and sets sampling. The browser then reports the outcome of requests to your origin to that group's endpoint, at the rates you configure. It takes two headers working together: NEL turns logging on and points at a group, and Report-To defines where that group sends.

How to configure NEL

Field	Status	Meaning
`report_to`	✅ Good	Required. The `Report-To` group name that receives the reports.
`max_age`	✅ Good	Seconds the browser remembers the policy; `0` clears it. For example `2592000` is 30 days.
`include_subdomains`	✅ Good	Apply the policy to subdomains too. Default `false`.
`success_fraction`	🧪 Experimental	Fraction of successes to report (0.0 to 1.0, default 0.0). Keep small, for example `0.01` on a high-traffic site.
`failure_fraction`	✅ Good	Fraction of failures to report (0.0 to 1.0, default 1.0).

Report-only mode

NEL has no Report-Only header; it is a reporting mechanism by nature, since it never blocks anything. You tune volume with the two fractions instead: report failures at 1.0 and successes at 0 or a small sample.

What it protects against

NEL is observability rather than an enforcement control, but it surfaces problems your own monitoring cannot see: TLS interception or certificate failures, DNS issues at a particular resolver, and connectivity failures, all of which can be availability or integrity signals.

Insecure configurations to avoid

Endpoints must be HTTPS. A high success_fraction can generate large volumes of reports; sample conservatively.

Report failures fully and successes sparingly; a busy site sampling successes at a meaningful rate floods the endpoint with routine traffic.

Known bypasses and limitations

Chromium-only, tied to the legacy Report-To header (not Reporting-Endpoints), and HTTPS-only. Firefox and Safari do not implement it, and Mozilla holds a negative standards position citing privacy.

Risks

Sampling successes at a high fraction is costly and noisy, and a long max_age persists the policy on clients for a long time, so choose both deliberately.

Recommendation

Report-To: {"group":"nel-group","max_age":2592000,"endpoints":[{"url":"https://<Endpoint-ID>.report.centralcsp.com"}]}

NEL: {"report_to":"nel-group","max_age":2592000,"success_fraction":0.01,"failure_fraction":1.0}

Report every failure (failure_fraction 1.0, the default) and a small sample of successes as a baseline, with a 30-day max_age, delivered through the legacy Report-To header since nothing else carries NEL. Treat the result as Chromium telemetry only: it covers Chrome, Edge, and Opera users, not your whole audience.

Reporting

The report_to value names a group in the Report-To header, and the browser emits the network-error report to that group's endpoint. CentralCSP collects the NEL stream alongside your other reports.

Browser support

Chromium-based browsers only (Chrome, Edge, Opera). Mozilla holds a negative standards position on privacy grounds and Safari never shipped it. Chrome has announced a successor mechanism, but nothing has shipped and no removal date exists, so treat NEL as experimental and Chromium-only rather than deprecated.

FAQ

What is Network Error Logging?

Network Error Logging (NEL) asks the browser to collect the outcome of network requests, so DNS failures, TLS and connection errors, resets, and HTTP errors, and report them to an endpoint you control. It gives operators visibility into failures that never reach their own logs, because the request failed before it arrived. NEL is observability, not enforcement.

Is NEL a privacy risk?

It reports network failures back to the origin, and Mozilla holds a negative standards position on privacy grounds, part of why Firefox and Safari never shipped it. Keep sampling conservative: report failures fully and successes at a small fraction or zero, and set max_age deliberately since the policy persists on clients.

Network Error Logging