Checks / Links, canonical and speed
Content-Security-Policy allows inline scripts
script-src contains 'unsafe-inline' with no nonce or hash, so a script injected into a page runs as if it were yours and the policy gives little protection. It does not affect search or AI answers.
csp_unsafe_inline · Links, canonical and speed · Notice
What triggers it
The Content-Security-Policy your home page enforces allows 'unsafe-inline' in script-src (or in default-src when there is no script-src), with no nonce, hash or 'strict-dynamic' next to it. A Report-Only policy does not count.
What to change
Replace 'unsafe-inline' in script-src with per-response nonces or script hashes (a strict CSP). On frameworks that inline their bootstrap scripts this takes real work.
Example
Response headers to add on your server or CDN:
Content-Security-Policy: script-src 'nonce-RANDOM_PER_RESPONSE' 'strict-dynamic'How to confirm the fix
- Run curl -sI https://example.com/ and read content-security-policy: script-src has no 'unsafe-inline', or has a nonce or hash next to it
- Run a new crawl
How common it is
In the audits of our own sites on 26 Oct 2026 (4 sites): finding judged right on resaleiq.dev.
Source: finding audit 2026-10-26 (English).
About this check
| Check ID | csp_unsafe_inline |
|---|---|
| Report section | Links, canonical and speed |
| Severity | Notice |
| How it is decided | Measured: read directly from the page or the server's response. |
| Added | Before 19 Oct 2026 (versions 1 and 2), or a site-wide check with no version date yet |
| Status | Measured in every report |
| Report gives the code | No, the fix is described in words |
Related checks
- Link to a page that no longer exists
- No canonical URL
- Page has no internal links (dead end)
- Page is more than 3 clicks from the home page
See whether it applies to your site
Paste your address and we crawl up to 10 pages and show every issue we find, with its fix. No account, no card.
Every plan crawls up to its page limit and lists these checks with the fix: plans.
How an audit works: method