diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index a8edd27c2..9634f9658 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -8,6 +8,10 @@ reuse, SSL offload and HTTP media streaming.
 Plugin Changelog
 ================
 
+1.10
+
+* fix content security settings (missing checkbox, correct templating)
+
 1.9
 
 * add advanced options to configure hostname hash sizes for long hostnames
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml
index 78e7c40dd..f4004ea58 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml
@@ -82,6 +82,12 @@
     <type>checkbox</type>
     <help>If checked, the CSP is enabled.</help>
   </field>
+  <field>
+    <id>security_header.csp_report_only</id>
+    <label>Content Security Policy: Report Only</label>
+    <type>checkbox</type>
+    <help>If checked, the CSP is not enforced (learning mode).</help>
+  </field>
   <field>
     <type>header</type>
     <label>Content Security Policy: Default Source</label>
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf
index d5c5bc08d..354db6121 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf
@@ -67,7 +67,7 @@
 {%   endfor %}
 {% do our_headers.append('Content-Security-Policy') %}
 {% do our_headers.append('Content-Security-Policy-Report-Only') %}
-    add_header Content-Security-Policy{% if security_rule.csp_report_only %}-Report-Only{% endif %} "{%
+    add_header Content-Security-Policy{% if security_rule.csp_report_only is defined and security_rule.csp_report_only == '1' %}-Report-Only{% endif %} "{%
     for key, value in hash_csp.items() %}{{ key }} {{ value|join(' ') }}; {% endfor %}{#
     #} report-uri /opnsense-report-csp-violation" always;
 {% endif %}