Great question — answering as the UphillTech team:
The Short Answer For script-src (JavaScript / XSS): YES. You can eliminate 'unsafe-inline' and achieve an A/A+ rating on Mozilla Observatory by using CSP Level 3 'strict-dynamic' with a per-request Nonce . For style-src (CSS): NO. Elementor fundamentally relies on inline style="..." attributes dynamically rendered on HTML elements. In CSP specifications, nonces and hashes do not cover inline style attributes. In production, retaining 'unsafe-inline' inside style-src is an industry-standard, accepted trade-off for page builders (as CSS injection carries far lower real-world risk than JS execution). Step 1: The Modern CSP Header ( 'strict-dynamic' + Nonce) Modern browsers support CSP Level 3....
Full answer by Druvi Shah: https://stackoverflow.stackexchange.com/a/80014663 (CC BY-SA 4.0).
Need it done for your business? UphillTech.