Edit: what I see when I inspect my page.
The Content Security Policy (CSP) prevents cross-site scripting attacks by blocking inline execution of scripts and style sheets.
To solve this, move all inline scripts (e.g. onclick=[JS code]) and styles into external files.
adding unsafe-inline as a source to the CSP header
adding the hash or nonce of the inline script to your CSP header.