I have been messing about with website design for years, but I am no expert - more of a hardware junkie.
CSP is fascinating for me now that I am starting to branch out into web development. I was really battling with hashes for my scripts because I used an online SHA-384 generator & Chrome wouldn't recognise those. Eventually I twigged that Chrome actually supplied 256-bit hashes for me, and I could include those in my .htaccess file - it was just a question of iterating over the pages on my site, grabbing the hashes, and including them in my list of approved scripts & styles.
As I said, I am no coding master, so I have encountered a problem where Chrome doesn't give me the actual hash for a script, trunctating it to sha256..., and I have no clue what script is running (Wordpress). Before you all shout me down, I have built sites without using a CMS, but this is the platform I am working on at the moment.
How do I find the code for the injected script so I can hash it & include it? From Mozilla's docs, I found that a hash should include all white space excluding the "script" tag - I tried that & got nowhere with my FB Pixel code, so I deleted that, perhaps you have an answer for me on that one?
As for the inline injected script - I need to find out how to identify what is being injected, and how to hash it for my CSP.