Script nonces

Turn on Nonces for scripts to let the inline scripts WordPress prints run without 'unsafe-inline'. Every response gets a fresh nonce, in the policy and on every script tag WordPress prints.

Turn nonces on

Under Policy → Options, switch on Nonces for scripts and choose Save. Try it in Report-only mode first.

What changes

• The policy. 'nonce-…' is added to script-src. A policy without script-src gets one copied from default-src first, because adding a nonce on its own would narrow it to nonced scripts only. A script-src 'none' is left alone. 'unsafe-inline' stays in place: browsers that understand nonces ignore it when a nonce is present, and older ones still need it.
• The tags. Every script printed through wp_get_script_tag() and wp_get_inline_script_tag() gets a nonce attribute. That covers enqueued scripts, wp_add_inline_script() and wp_localize_script() output, and script modules.
• The nonce. 18 random bytes, base64 encoded (24 characters), created once per response.

<script crossorigin="anonymous" id="hoverintent-js-js" integrity="sha384-rBLWcPfsabENsRH5gK14W1p8G/GX+WzxI3dG/X4uIZztqO7t67Mx9a4Ie2YPgBOy" nonce="vTX5MxcJkFoDxN1RYL2a0TND" src="http://localhost:9400/wp-includes/js/hoverintent-js.min.js?ver=2.2.1"></script>

Nonces go on script-src only. WordPress prints its inline <style> blocks (global styles, block supports, wp_add_inline_style()) without an attributes filter, so they cannot carry a nonce, and a nonce in style-src would make browsers ignore 'unsafe-inline' there and block every one of them.

What will be blocked once you enforce