# Network Error Logging (/en/docs/web-security/policies/network-error-logging)



Network Error Logging (NEL) asks the browser to collect the outcome of network
requests, DNS failures, TLS and connection errors, resets, and HTTP errors, and
report them to a server endpoint. It gives operators visibility into failures that
never reach their own logs, because the request failed before it arrived. NEL is
observability, not enforcement.

<Callout type="warn" title="Experimental, and uses the legacy header">
  NEL is Chromium-only: Mozilla holds a negative standards position on privacy grounds and Safari never shipped it. It is also the one mechanism that still requires the deprecated [`Report-To`](/en/docs/web-security/reporting-api/headers/report-to) header; `Reporting-Endpoints` does not deliver NEL. Chrome has announced a successor mechanism, but nothing has shipped and there is no removal date, so NEL is experimental, not deprecated.
</Callout>

Turning it on takes the two headers together, the group definition and the policy:

```http
Report-To: {"group":"nel-group","max_age":31536000,"endpoints":[{"url":"https://<Endpoint-ID>.report.centralcsp.com"}]}
```

```http
NEL: {"report_to":"nel-group","max_age":31536000,"include_subdomains":true,"success_fraction":0.0,"failure_fraction":1.0}
```

## How NEL works [#how-nel-works]

The `NEL` header is a JSON object that names a `Report-To` group and sets sampling.
The browser then reports the outcome of requests to your origin to that group's
endpoint, at the rates you configure. It takes two headers working together: `NEL`
turns logging on and points at a group, and [`Report-To`](/en/docs/web-security/reporting-api/headers/report-to)
defines where that group sends.

## How to configure NEL [#how-to-configure-nel]

| Field                | Status          | Meaning                                                                                                           |
| -------------------- | --------------- | ----------------------------------------------------------------------------------------------------------------- |
| `report_to`          | ✅ Good          | Required. The `Report-To` group name that receives the reports.                                                   |
| `max_age`            | ✅ Good          | Seconds the browser remembers the policy; `0` clears it. For example `2592000` is 30 days.                        |
| `include_subdomains` | ✅ Good          | Apply the policy to subdomains too. Default `false`.                                                              |
| `success_fraction`   | 🧪 Experimental | Fraction of successes to report (0.0 to 1.0, default 0.0). Keep small, for example `0.01` on a high-traffic site. |
| `failure_fraction`   | ✅ Good          | Fraction of failures to report (0.0 to 1.0, default 1.0).                                                         |

## Report-only mode [#report-only-mode]

NEL has no Report-Only header; it is a reporting mechanism by nature, since it never
blocks anything. You tune volume with the two fractions instead: report failures at
`1.0` and successes at `0` or a small sample.

## What it protects against [#what-it-protects-against]

NEL is observability rather than an enforcement control, but it surfaces problems
your own monitoring cannot see: TLS interception or certificate failures, DNS issues
at a particular resolver, and connectivity failures, all of which can be availability
or integrity signals.

## Insecure configurations to avoid [#insecure-configurations-to-avoid]

<Callout type="warn">
  Endpoints must be HTTPS. A high `success_fraction` can generate large volumes of reports; sample conservatively.
</Callout>

Report failures fully and successes sparingly; a busy site sampling successes at a
meaningful rate floods the endpoint with routine traffic.

## Known bypasses and limitations [#known-bypasses-and-limitations]

Chromium-only, tied to the legacy `Report-To` header (not `Reporting-Endpoints`),
and HTTPS-only. Firefox and Safari do not implement it, and Mozilla holds a negative
standards position citing privacy.

## Risks [#risks]

Sampling successes at a high fraction is costly and noisy, and a long `max_age`
persists the policy on clients for a long time, so choose both deliberately.

## Recommendation [#recommendation]

```http
Report-To: {"group":"nel-group","max_age":2592000,"endpoints":[{"url":"https://<Endpoint-ID>.report.centralcsp.com"}]}
```

```http
NEL: {"report_to":"nel-group","max_age":2592000,"success_fraction":0.01,"failure_fraction":1.0}
```

Report every failure (`failure_fraction` 1.0, the default) and a small sample of
successes as a baseline, with a 30-day `max_age`, delivered through the legacy
`Report-To` header since nothing else carries NEL. Treat the result as Chromium
telemetry only: it covers Chrome, Edge, and Opera users, not your whole audience.

## Reporting [#reporting]

The `report_to` value names a group in the `Report-To` header, and the browser emits
the [network-error report](/en/docs/web-security/reporting-api/reports/network-error) to that
group's endpoint. CentralCSP collects the
[NEL stream](/en/docs/platform/monitoring/nel) alongside your other reports.

## Browser support [#browser-support]

Chromium-based browsers only (Chrome, Edge, Opera). Mozilla holds a negative
standards position on privacy grounds and Safari never shipped it. Chrome has
announced a successor mechanism, but nothing has shipped and no removal date exists,
so treat NEL as experimental and Chromium-only rather than deprecated.

## FAQ [#faq]

### What is Network Error Logging? [#what-is-network-error-logging]

Network Error Logging (NEL) asks the browser to collect the outcome of network
requests, so DNS failures, TLS and connection errors, resets, and HTTP errors,
and report them to an endpoint you control. It gives operators visibility into
failures that never reach their own logs, because the request failed before it
arrived. NEL is observability, not enforcement.

### Is NEL a privacy risk? [#is-nel-a-privacy-risk]

It reports network failures back to the origin, and Mozilla holds a negative
standards position on privacy grounds, part of why Firefox and Safari never
shipped it. Keep sampling conservative: report failures fully and successes at a
small fraction or zero, and set `max_age` deliberately since the policy persists
on clients.

## See also [#see-also]

* [network-error report](/en/docs/web-security/reporting-api/reports/network-error)
* [Report-To header](/en/docs/web-security/reporting-api/headers/report-to)
* [Report-To vs Reporting-Endpoints](/en/docs/web-security/reporting-api/concepts/report-to-vs-reporting-endpoints)
* [NEL monitoring in CentralCSP](/en/docs/platform/monitoring/nel)

## Sources [#sources]

* [MDN, NEL header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/NEL)
* [W3C, Network Error Logging](https://www.w3.org/TR/network-error-logging/)
* [web.dev, Network Error Logging](https://web.dev/articles/network-error-logging)
* [Mozilla standards position on NEL](https://github.com/mozilla/standards-positions/issues/99)