How to remove unsafe-inline from your CSP
unsafe-inline lets any script written into the page run — including injected code — which cancels most of what CSP protects. The fix is a nonce: a fresh random value per response that only your own scripts carry.
The nonce must be new in every response. A fixed value is the same as no protection.
How to fix it
Your web server
Where: your Content-Security-Policy header
Drop 'unsafe-inline' from script-src and use a nonce or hash instead, e.g. Content-Security-Policy: script-src 'self' 'nonce-<RANDOM_PER_REQUEST>'; object-src 'none'; base-uri 'self'
'unsafe-inline' lets injected <script> run — it defeats most of CSP's XSS protection. Emit a fresh random nonce per response and add it to every legit inline <script nonce=...>.
How to confirm: Re-scan — the CSP weakness should downgrade or clear.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site freeRelated guides
- How to add the HSTS header to your site
- How to get your site on the HSTS preload list
- How to add the X-Frame-Options header (clickjacking protection)
- How to add X-Content-Type-Options: nosniff
- How to add the Referrer-Policy header
- How to add the Permissions-Policy header
- How to add a Content-Security-Policy (CSP)