"Refused to execute inline script" — CSP explained
CSP is doing its job. The usual workaround removes the protection you just added.
What it means
A Content-Security-Policy header is active and your page contains a script written directly in the HTML. The policy does not permit inline scripts, so the browser refused to run it. This is CSP's core purpose: an attacker who injects markup cannot execute it.
Why it happens in AI-built apps
- A framework or analytics snippet emits an inline <script> block.
- An inline event handler such as onclick="…" — these count as inline scripts.
- A JSON-LD or configuration block placed inline.
- A newly added CSP that was never tested against the existing page.
Is this error actually a problem?
Check it yourself
See the policy your site currently sends
curl -sI https://YOURAPP.com | grep -i content-security-policy
Fix it
Copy this into your AI coding tool
My Content-Security-Policy is blocking inline scripts. 1. List every inline script and inline event handler on the page, and tell me which are mine and which come from libraries. 2. Move my own inline code into external files served from my origin. 3. For scripts that must stay inline (framework bootstrap, JSON-LD), add a per-request nonce and include that nonce in the CSP header. Generate a fresh nonce per response — a fixed one is no better than allowing everything. 4. Replace inline event handlers with addEventListener. 5. Roll the change out as Content-Security-Policy-Report-Only first so I can see what would break before it does. Do NOT add 'unsafe-inline' to script-src. If something genuinely cannot work without it, tell me which and why rather than adding it quietly.
This is one check out of 40+
Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.
Check my site — free