script blocked by CSP
A blocked script usually comes down to one of four things: the origin is missing, the code is inline, the nonce or hash does not match, or the script relies on unsafe patterns like eval.
Identify the type of block
- External script: add the exact origin to
script-src. - Inline script: use a nonce or hash.
- Dynamic loader: check whether
strict-dynamicis needed. - Tooling issue: remove dev-only patterns such as
unsafe-evalfrom production.
Next step
Open the generator to patch the policy, then use the checker to confirm the live header matches your fix.