diff --git a/config.js b/config.js
index ec04a8c9d..77ed4ab2b 100644
--- a/config.js
+++ b/config.js
@@ -48,10 +48,9 @@ const CONFIG = {
   // request all of the records. Otherwise, minimum limits of 0 are enforced.
   ALLOW_NO_LIMIT_QUERIES: process.env.TALK_ALLOW_NO_LIMIT_QUERIES === 'TRUE',
 
-  // ONLY_REPORT_CSP_VIOLATIONS disables strict CSP enforcement, and only
-  // reports CSP violations instead of blocking them.
-  ONLY_REPORT_CSP_VIOLATIONS:
-    process.env.TALK_ONLY_REPORT_CSP_VIOLATIONS === 'TRUE',
+  // ENABLE_STRICT_CSP enables strict CSP enforcement, and will enforce as well
+  // as report CSP violations.
+  ENABLE_STRICT_CSP: process.env.TALK_ENABLE_STRICT_CSP === 'TRUE',
 
   // LOGGING_LEVEL specifies the logging level used by the bunyan logger.
   LOGGING_LEVEL: ['fatal', 'error', 'warn', 'info', 'debug', 'trace'].includes(
diff --git a/docs/source/02-02-advanced-configuration.md b/docs/source/02-02-advanced-configuration.md
index d4ef5f2f7..035d994b6 100644
--- a/docs/source/02-02-advanced-configuration.md
+++ b/docs/source/02-02-advanced-configuration.md
@@ -497,12 +497,13 @@ tracing of GraphQL requests.
 
 **Note: Apollo Engine is a premium service, charges may apply.**
 
-## TALK_ONLY_REPORT_CSP_VIOLATIONS
+## TALK_ENABLE_STRICT_CSP
 
-Setting this to `TRUE` will enable the [report only](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#Testing_your_policy)
-mode of the Content Security Policy. The policy is not enforced, but any
-violations are reported to a provided URI. If you are encountering issues with
-resources not loading, try experimenting with this parameter. (Default `FALSE`)
+Setting this to `TRUE` will enforce the [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
+(or CSP) policy. By default, this configuration is set to
+[report only](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#Testing_your_policy)
+where the policy is not enforced, but any violations are reported to a provided
+URI. (Default `FALSE`)
 
 ## ALLOW_NO_LIMIT_QUERIES
 
diff --git a/middleware/contentSecurityPolicy.js b/middleware/contentSecurityPolicy.js
index ca30f7c6e..d6036ca76 100644
--- a/middleware/contentSecurityPolicy.js
+++ b/middleware/contentSecurityPolicy.js
@@ -1,5 +1,5 @@
 const helmet = require('helmet');
-const { WEBSOCKET_LIVE_URI, ONLY_REPORT_CSP_VIOLATIONS } = require('../config');
+const { WEBSOCKET_LIVE_URI, ENABLE_STRICT_CSP } = require('../config');
 const { BASE_PATH, BASE_URL, STATIC_URL } = require('../url');
 const { URL } = require('url');
 
@@ -47,5 +47,5 @@ module.exports = helmet.contentSecurityPolicy({
   },
   browserSniff: false,
   // Allow the configuration to disable strict enforcement of CSP.
-  reportOnly: ONLY_REPORT_CSP_VIOLATIONS,
+  reportOnly: !ENABLE_STRICT_CSP,
 });