Magento Security >> CSP: Refused to Execute Inline Script (How to Read & Fix It)

If you’ve worked with Magento and Content Security Policy (CSP), you’ve likely come across the following Magento CSP error :

Refused to execute inline script because it violates:

“script-src ‘self'”

At first glance, this may look like a generic or vague issue. However, it’s actually very specific. If you read the error carefully, it clearly indicates what is going wrong and what is missing.

Diagnose the Violation

The first place to investigate this issue is the browser Console.

Typically, you will see an magento CSP error message like:

Refused to execute inline script because it violates:

“script-src ‘self'”

In many cases, the browser also provides an additional hint:

Either ‘unsafe-inline’, a hash (‘sha256-…’), or a nonce is required

This part is very important. It’s not just an error message—it’s the browser guiding you toward possible solutions.

How the Browser Evaluates This

Whenever the browser encounters a < script > tag, it checks the script-src directive defined in the CSP header.

For example:

Content-Security-Policy: script-src ‘self’

What this allows

✔ External scripts loaded from the same origin

What this blocks

❌ Inline < script > tags
❌ onclick=”” handlers
❌ Inline Magento init scripts (unless explicitly whitelisted)

So, if your page contains inline JavaScript, it will not execute unless it has been specifically allowed by the CSP rules.

Inline Script Evaluation Logic

When dealing with inline scripts, the browser follows a clear sequence of checks:

Nonce match
script-src ‘nonce-abc123’
Hash match
script-src ‘sha256-XXXX’
unsafe-inline
script-src ‘unsafe-inline’

If none of these conditions are satisfied, the inline script is blocked.

When is Inline JavaScript Allowed?

Inline JavaScript will only execute when one of the following conditions is met:

The script’s hash matches a value defined in the CSP
A valid nonce is present in both the script and the response header

‘unsafe-inline’ is enabled (this is generally not recommended)

Why This Matters

This magento CSP error message is actually quite helpful when debugging.

It clearly tells you:

Which directive failed → script-src
What is missing → hash, nonce, or ‘unsafe-inline’

Because of this, the browser Console becomes the fastest and most reliable place to diagnose CSP-related issues.

Final Thought

In most Magento scenarios, CSP issues usually come down to one core problem –
inline JavaScript is being used without being explicitly allowed.

Once you understand how the browser evaluates the script-src directive, identifying and fixing these issues becomes much simpler and more predictable.