Inline Scripts are Blocked by Default with Content Security Policy. When you have a Content-Security-Policy header defined, the browser will automatically block inline scripts (unless you implement one of the workarounds specified below), such as: <script> doSomething (); </script>. Or.