Open Developer Tools → Network, reload, and find the script. If it shows 404, the path is wrong or the file wasn't deployed. If it's blocked, the console says why: your site's Content Security Policy doesn't allow that source, it's an http:// script on an HTTPS page (mixed content), or an ad or privacy blocker stopped it. If it loads but nothing happens, it's loading in the wrong order or erroring as soon as it runs.
What's the problem
A widget, tracking code, chat box or your own script doesn't run. The console may show "Failed to load resource", "Refused to load the script", or "blocked:mixed-content".
Why it happens
- Wrong path or missing file after a deploy (404).
- Content Security Policy doesn't list the script's domain.
- Mixed content: an
http://script on an HTTPS page. - Ad or privacy blockers blocking tracking and third-party scripts.
- Load order: the script runs before something it needs, or before the page is ready.
- The third party's server is down.
How to fix it
- Find the script in the Network tab and note its status.
- For 404, fix the path or make sure the file is in your deployed build.
- For CSP blocks, add the script's domain to the
script-srcdirective of your Content Security Policy. - For mixed content, change the script URL to
https://. - Test in a private window without extensions to rule out blockers.
- For order problems, load dependencies first, or use
deferso scripts run after the page is parsed.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows script libraries on your homepage with published security holes; every outside service your homepage loads scripts and files from; insecure http:// files on any of up to 50 pages; whether your site loads, how fast, and where its redirects go. It doesn't run your pages in a browser, so open the browser console on the failing page to see the error itself.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- MDN Web Docs: <script>: The Script elementreference
The <script> HTML element is used to embed executable code or data; this is typically used to embed or refer to JavaScript code.
- MDN Web Docs: CSP: script-srcreference
The HTTP Content-Security-Policy (CSP) script-src directive specifies valid sources for JavaScript.
- MDN Web Docs: Mixed contentreference
"Mixed content" refers to securely loaded web pages that use resources to be fetched via HTTP or another insecure protocol.