# html/scripts

> Reports inline scripts, event handler attributes, and executable URLs in HTML files.

Reports inline scripts, event handler attributes, and executable URLs in HTML files.

Part of the [`html`](/reference/configurations/html/) configuration, at the `all` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), per file. gspot runs this check itself.

## Why

A content security policy can block injected code only when the pages carry no inline script.

## What to do

Move the script into its own file, and attach the handler there. Structured data of type `application/ld+json` stays inline.

## Example

A button with an inline `onclick` attribute reports a finding. Remove it, and attach the listener from a script file.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore html/scripts --paths "<glob>" --reason "<why>"
```