Refused to load the script with CSP Foundry
The Decode tab is pre-filled with a typical error for an external script. The tool names the directive that actually governs it and the origin to add.
- Copy the whole console line, not just the URL.
- Read which directive the browser says blocked it, and which directive you actually need to edit.
- Add the suggested origin, or press Add to my policy to merge it into the Build tab.
- Reload and check that the error is gone.
What to know
The message names two things that people often confuse: the blocked URL, and the directive that blocked it. The "Note that script-src-elem was not explicitly set, so script-src is used as a fallback" sentence is the browser telling you which directive to edit. A script tag is governed by script-src-elem if it exists, then script-src, then default-src. Editing img-src will never fix it.
Add the origin of the script, not the full URL: https://js.stripe.com rather than the whole path, unless you deliberately want to allow one file. Allowing a whole host is convenient but trusts everything that host serves; several popular CDNs and Google hosts are on public lists of hosts that can be used to bypass a script-src allowlist, which the Evaluate tab flags.
If the blocked script is yours and served from your own origin, check that script-src contains 'self' and that the page really is on the origin you expect. Mixed www and non-www hosts, a CDN subdomain, or an http page loading https scripts are the usual causes.
Updated · Cosmovex
Questions
What does "Refused to load the script" mean?
The browser found a script tag whose URL is not allowed by the page's Content-Security-Policy, so it did not run it. The message names the URL and the directive that blocked it.
Which directive should I change?
The one the message names, unless it says another directive was used as a fallback. Script tags are governed by script-src-elem, then script-src, then default-src. Edit the most specific one that exists in your policy.
Should I just add unsafe-inline or a wildcard?
No. unsafe-inline only affects inline code and does nothing for an external URL, and a wildcard lets any host serve scripts. Add the specific origin.
Why do I see this error only in production?
Production usually has a stricter policy than development, or loads third-party scripts such as analytics and payments that your local setup does not. Test with the production headers in Report-Only first.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
