Refused to load the script because it violates the following Content Security Policy directive
The page’s Content-Security-Policy doesn’t allow that script, style, image or connection source.
Exact message you may see
violates the following Content Security Policy directiveRefused to load the scriptRefused to connect toRefused to apply inline style
Seen on:
JavaScript
Meaning
CSP headers whitelist sources. New third-party scripts (analytics, ads, fonts), inline scripts or eval are blocked until added to the policy.
Common causes
- Third-party domain not in script-src/connect-src
- Inline script without nonce/hash
- eval/new Function blocked by missing unsafe-eval
- Images/fonts from unlisted domains
⚡ Quick fix
- Add the domain to the right directive
- Use nonces/hashes for inline scripts
- Test with Content-Security-Policy-Report-Only first
Detailed fix by platform
Nginx
add_header Content-Security-Policy "script-src 'self' https://www.googletagmanager.com" always;
How to diagnose
- Directive — Which directive is violated?
- Source — Which URL was blocked?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in JavaScript
Other ways to find it
Where this error sits
Origin: On your device. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Did this fix work for you?
Report a correction or suggest an improvement
Last updated 9 Oct 2026