I work on OnePassApps, and this is our own site's edge configuration, measured on 10 November 2026 from outside the browser.

I asked for every URL in our sitemap.xml, one at a time, over plain HTTPS, with no cookies and no JavaScript. All 56 of them answered 200. Every one of them carried the same pair of headers describing where an error report would be sent, and nobody had ever published what those two headers actually say.

The pair, on every page

The two headers are report-to and nel . Both are present on 56 of 56 pages, and on every page they carry the same values:

report-to names one reporting group, cf-nel , with a max_age of 604800 seconds, which is seven days.

nel is the newer spelling of the same policy: the same group name, the same max_age of 604800, and a success_fraction of 0.0.

The endpoint in both is a single host, a.nel.cloudflare.com , on the path /report/v4 .

Two things are worth noticing before anything else.…