Does SEC_CSP_NO_UNSAFE_INLINE affect my score?

Yes. It is an importance 6 rule at SPECIFICATION confidence, so a failure costs 6 × 1 points of impact in the Security category before that category is normalised to 100.

What does SPECIFICATION confidence mean?

A standard says so: HTML, WCAG, an RFC or Google's own documentation. Confidence is a declared tier rather than a per-rule number, so every rule backed by the same class of evidence carries the same weight - which is what makes the score reproducible instead of hand-tuned.

How do I check SEC_CSP_NO_UNSAFE_INLINE on my own site?

Paste your URL into the box above and it runs only this rule, usually in a couple of seconds. It is also included in the Security checker and in a full scan.

SecurityMedium Affects your score

CSP does not allow 'unsafe-inline' scripts

SEC_CSP_NO_UNSAFE_INLINE

A CSP permitting 'unsafe-inline' for scripts provides almost no XSS protection - injected inline script executes exactly as before.

Free, no signupNo account, no card
No AI in the score986 deterministic rules
Nothing publishedYour scans stay yours
Answers in secondsQuick scan, no browser

How this rule is weighted

Importance: 6 / 10; How much this matters relative to other rules.
Confidence: SPECIFICATION; A standard says so: HTML, WCAG, an RFC or Google's own documentation.
Severity: warning; How the finding is presented when it fails.
Scoring: Counts; A failure costs points in its category.

Impact is importance multiplied by the confidence tier’s weight — SPECIFICATION 1.0, RESEARCH 0.7, EMERGING 0.3, EXPERIMENTAL 0.1. Two rules backed by the same class of evidence therefore always carry the same weight, which is what makes the score reproducible rather than hand-tuned.

Questions about this rule

Does SEC_CSP_NO_UNSAFE_INLINE affect my score?: Yes. It is an importance 6 rule at SPECIFICATION confidence, so a failure costs 6 × 1 points of impact in the Security category before that category is normalised to 100.
What does SPECIFICATION confidence mean?: A standard says so: HTML, WCAG, an RFC or Google's own documentation. Confidence is a declared tier rather than a per-rule number, so every rule backed by the same class of evidence carries the same weight - which is what makes the score reproducible instead of hand-tuned.
How do I check SEC_CSP_NO_UNSAFE_INLINE on my own site?: Paste your URL into the box above and it runs only this rule, usually in a couple of seconds. It is also included in the Security checker and in a full scan.

Related Security rules

Run the Security checker All 986 rules

CSP does not allow 'unsafe-inline' scripts

How this rule is weighted

Questions about this rule

Tags

Related Security rules

CSP does not allow 'unsafe-inline' scripts

How this rule is weighted

Questions about this rule

Tags

Related Security rules