diff --git a/config.js b/config.js
index 6a1f999a7..ec04a8c9d 100644
--- a/config.js
+++ b/config.js
@@ -48,6 +48,11 @@ const CONFIG = {
   // request all of the records. Otherwise, minimum limits of 0 are enforced.
   ALLOW_NO_LIMIT_QUERIES: process.env.TALK_ALLOW_NO_LIMIT_QUERIES === 'TRUE',
 
+  // ONLY_REPORT_CSP_VIOLATIONS disables strict CSP enforcement, and only
+  // reports CSP violations instead of blocking them.
+  ONLY_REPORT_CSP_VIOLATIONS:
+    process.env.TALK_ONLY_REPORT_CSP_VIOLATIONS === 'TRUE',
+
   // LOGGING_LEVEL specifies the logging level used by the bunyan logger.
   LOGGING_LEVEL: ['fatal', 'error', 'warn', 'info', 'debug', 'trace'].includes(
     process.env.TALK_LOGGING_LEVEL
diff --git a/docs/source/02-02-advanced-configuration.md b/docs/source/02-02-advanced-configuration.md
index 5b638401d..d4ef5f2f7 100644
--- a/docs/source/02-02-advanced-configuration.md
+++ b/docs/source/02-02-advanced-configuration.md
@@ -497,6 +497,13 @@ tracing of GraphQL requests.
 
 **Note: Apollo Engine is a premium service, charges may apply.**
 
+## TALK_ONLY_REPORT_CSP_VIOLATIONS
+
+Setting this to `TRUE` will enable the [report only](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#Testing_your_policy)
+mode of the Content Security Policy. The policy is not enforced, but any
+violations are reported to a provided URI. If you are encountering issues with
+resources not loading, try experimenting with this parameter. (Default `FALSE`)
+
 ## ALLOW_NO_LIMIT_QUERIES
 
 Setting this to `TRUE` will allow queries to execute without a limit (returns
diff --git a/middleware/contentSecurityPolicy.js b/middleware/contentSecurityPolicy.js
index 992e41e36..ca30f7c6e 100644
--- a/middleware/contentSecurityPolicy.js
+++ b/middleware/contentSecurityPolicy.js
@@ -1,5 +1,5 @@
 const helmet = require('helmet');
-const { WEBSOCKET_LIVE_URI } = require('../config');
+const { WEBSOCKET_LIVE_URI, ONLY_REPORT_CSP_VIOLATIONS } = require('../config');
 const { BASE_PATH, BASE_URL, STATIC_URL } = require('../url');
 const { URL } = require('url');
 
@@ -46,4 +46,6 @@ module.exports = helmet.contentSecurityPolicy({
     ],
   },
   browserSniff: false,
+  // Allow the configuration to disable strict enforcement of CSP.
+  reportOnly: ONLY_REPORT_CSP_VIOLATIONS,
 });