Checks / Links, canonical and speed
Content-Security-Policy allows inline scripts
script-src contains 'unsafe-inline' with no nonce or hash, so a script injected into a page runs as if it were yours and the policy gives little protection. It does not affect search or AI answers.
csp_unsafe_inline · Links, canonical and speed · Notice
What to change
Replace 'unsafe-inline' in script-src with per-response nonces or script hashes (a strict CSP). On frameworks that inline their bootstrap scripts this takes real work.
How common it is
In the audits of our own sites on 26 Oct 2026 (4 sites): finding judged right on resaleiq.dev.
Source: finding audit 2026-10-26 (English).
About this check
| Check ID | csp_unsafe_inline |
|---|---|
| Report section | Links, canonical and speed |
| Severity | Notice |
| How it is decided | Measured: read directly from the page or the server's response. |
| Added | Before 19 Oct 2026 (versions 1 and 2), or a site-wide check with no version date yet |
| Status | Measured in every report |
| Report gives the code | No, the fix is described in words |
Related checks
- Broken internal links
- Canonical points to a broken or redirecting URL
- Redirect loop
- Canonical points to a noindex page
- Canonical points to another page
- Pages refuse or do not answer our crawler
See whether it applies to your site
Paste your address and we crawl up to 10 pages and show every issue we find, with its fix. No account, no card.
Every plan crawls up to its page limit and lists these checks with the fix: plans.
How an audit works: method