---
title: Script nonces
---

Turn on **Nonces for scripts** to let the inline scripts WordPress prints run without `'unsafe-inline'`. Every response gets a fresh nonce, in the policy and on every script tag WordPress prints.

## Turn nonces on

Under **Policy → Options**, switch on **Nonces for scripts** and choose **Save**. Try it in **Report-only** mode first.

## What changes

- **The policy.** `'nonce-…'` is added to `script-src`. A policy without `script-src` gets one copied from `default-src` first, because adding a nonce on its own would narrow it to nonced scripts only. A `script-src 'none'` is left alone. `'unsafe-inline'` stays in place: browsers that understand nonces ignore it when a nonce is present, and older ones still need it.
- **The tags.** Every script printed through `wp_get_script_tag()` and `wp_get_inline_script_tag()` gets a `nonce` attribute. That covers enqueued scripts, `wp_add_inline_script()` and `wp_localize_script()` output, and script modules.
- **The nonce.** 18 random bytes, base64 encoded (24 characters), created once per response.

<!-- wp:docspress/colorful-code {"language":"html","filename":"Page source","code":"\u003cscript crossorigin=\u0022anonymous\u0022 id=\u0022hoverintent-js-js\u0022 integrity=\u0022sha384-rBLWcPfsabENsRH5gK14W1p8G/GX+WzxI3dG/X4uIZztqO7t67Mx9a4Ie2YPgBOy\u0022 nonce=\u0022vTX5MxcJkFoDxN1RYL2a0TND\u0022 src=\u0022http://localhost:9400/wp-includes/js/hoverintent-js.min.js?ver=2.2.1\u0022\u003e\u003c/script\u003e","highlightedLines":"","showLineNumbers":false,"caption":"A core script on a WordPress 7.1 test site with nonces and integrity pinning both on."} /-->

Nonces go on `script-src` only. WordPress prints its inline `<style>` blocks (global styles, block supports, `wp_add_inline_style()`) without an attributes filter, so they cannot carry a nonce, and a nonce in `style-src` would make browsers ignore `'unsafe-inline'` there and block every one of them.

## What will be blocked once you enforce

<!-- wp:docspress/callout {"tone":"danger","title":"Scripts printed outside the WordPress APIs","content":"\u003cp\u003eA theme or plugin that echoes a \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tag directly, instead of enqueueing it, prints it without the nonce. Nonce-aware browsers then ignore \u003ccode\u003e'unsafe-inline'\u003c/code\u003e and block it. Report-only mode shows these as violations before anything breaks.\u003c/p\u003e","collapsible":false} /-->

<!-- wp:docspress/callout {"tone":"warning","title":"Full-page caches","content":"\u003cp\u003eA nonce is only safe when the page and its header are produced together. A cache that stores the HTML but not the headers serves one response's nonces with another response's policy, and every script fails. Check that the site's page cache stores headers with pages before enforcing with nonces on.\u003c/p\u003e","collapsible":false} /-->