title: Refused to load scripts because it violates the following Content Security Policy directive
body: <p>All of the scripts that come externally have this error:</p>
  <blockquote>
  <p>Refused to load the script
  'https://code.jquery.com/jquery-3.4.1.slim.min.js' because it violates
  the following Content Security Policy directive: &quot;script-src 'self'
  <a href="https://xxxx.com" rel="nofollow noreferrer">https://xxxx.com</a> <a href="https://ajax.googleapis.com" rel="nofollow noreferrer">https://ajax.googleapis.com</a>
  'sha256-V8KVL4e3S2PwNnwHfycBcJMRnRhyyPiEpdxcGNLxzvk='&quot;. Note that
  'script-src-elem' was not explicitly set, so 'script-src' is used as a
  fallback.</p>
  </blockquote>
  <p>I search for this error, but all the solutions have a <strong>'unsafe-eval' 'unsafe-inline</strong>.</p>
  <p>From my understanding, I need to write a meta tag. Something like this:</p>
  <pre class="lang-html prettyprint-override"><code>&lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot;default-src *; style-src 'self' http://* 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'&quot; /&gt;
  </code></pre>
  <p>I removed the unsafe-inline and unsafe-eval, but the issue still persists. Any idea?</p>
  <p>This is what's in my header:</p>
  <pre class="lang-html prettyprint-override"><code>&lt;head&gt;
      &lt;link rel=&quot;icon&quot; href=&quot;img/am.png&quot;&gt;
      &lt;meta charset=&quot;utf-8&quot;&gt;
      &lt;!-- Required meta tags --&gt;
      &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1, shrink-to-fit=no&quot;&gt;
      &lt;script src=&quot;https://use.fontawesome.com/releases/v5.0.6/js/all.js&quot;&gt;&lt;/script&gt;
      &lt;link rel=&quot;stylesheet&quot; href=&quot;https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css&quot;
          integrity=&quot;sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh&quot; crossorigin=&quot;anonymous&quot;&gt;
      &lt;link href=&quot;https://fonts.googleapis.com/css?family=Montserrat:300,600,700i&quot; rel=&quot;stylesheet&quot;&gt;
      &lt;link rel=&quot;stylesheet&quot; href=&quot;style.css&quot;&gt;
  
      &lt;title&gt;Title&lt;/title&gt;
  
  &lt;/head&gt;
  </code></pre>
  <p>Before my closing body tags, I have more included scripts</p>
  <pre class="lang-html prettyprint-override"><code>&lt;script src=&quot;https://code.jquery.com/jquery-3.4.1.slim.min.js&quot;
      integrity=&quot;sha384-J6qa4849blE2+poT4WnyKhv5vZF5SrPo0iEjwBvKU7imGFAV0wwj1yYfoRSJoZ+n&quot;
      crossorigin=&quot;anonymous&quot;&gt;&lt;/script&gt;
  &lt;script src=&quot;https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js&quot;
      integrity=&quot;sha384-Q6E9RHvbIyZFJoft+2mJbHaEWldlvI9IOYy5n3zV9zzTtmI3UksdQRVvoxMfooAo&quot;
      crossorigin=&quot;anonymous&quot;&gt;&lt;/script&gt;
  &lt;script src=&quot;https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js&quot;
      integrity=&quot;sha384-wfSDF2E50Y2D1uUdj0O3uMBJnjuUD4Ih7YwaYd1iqfktj0Uod8GCExl3Og8ifwB6&quot;
      crossorigin=&quot;anonymous&quot;&gt;&lt;/script&gt;
  </code></pre>
  <p>It's a total of four scripts that are being blocked. One in the header(frontawesome) and the other scripts before the closing body tag.</p>