Your CSP blocked something.
Paste the error your browser printed. We will tell you what it means, what the lazy fix costs you, and how to test the real one safely.
The errors people hit most
Refused to execute inline script
The most common CSP error there is, and the one with the most tempting wrong answer.
My nonce is not working
Usually it is working perfectly — and being reused, cached, or copied by a library.
I set default-src, why is this still blocked?
Three directives never inherit from default-src. This trips up almost everyone.
See a policy do its job →
Live demos with the policy off and on, including a Magecart-style skimmer.
See every error, not just this one
You found this error because you happened to have the console open. Your users do not, and the same policy is quietly blocking things on pages you have not loaded, in browsers you do not test, for people who will never tell you.
Browsers will send you every one of those, for free — CSP has reporting built in. Point
report-uri at a collector and the errors come to you instead of you hunting for them.
Report URI does that,
or collect them yourself — a violation report is
just a JSON POST.