A browser policy can restrict resource loading and script execution. Its effect depends on the actual directives and how the website uses them.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Checks for a Content-Security-Policy that blocks inline scripts. Severity rises when the page has a login.
Add a Content-Security-Policy that lists allowed script sources and avoids 'unsafe-inline' (use nonces or hashes instead). Start with Content-Security-Policy-Report-Only to test.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology