diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 569d03b..e02e912 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,10 +25,10 @@
 ## Getting started
 
 1. Complete the steps in the
-[Go Contribution Guide](https://golang.org/doc/contribute.html).
+   [Go Contribution Guide](https://golang.org/doc/contribute.html).
 
 2. Download the source code for x/pkgsite:
-`git clone https://go.googlesource.com/pkgsite`
+   `git clone https://go.googlesource.com/pkgsite`
 
 3. Review the [design document](doc/design.md).
 
@@ -45,10 +45,10 @@
 ## Before sending a CL for review
 
 1. Run `./all.bash` and fix all resulting errors. See
-  [doc/precommit.md](doc/precommit.md) for instructions on setting up a
-  pre-commit hook.
+   [doc/precommit.md](doc/precommit.md) for instructions on setting up a
+   pre-commit hook.
 2. Ensure your commit message is formatted according to
-  [Go conventions](http://golang.org/wiki/CommitMessage).
+   [Go conventions](http://golang.org/wiki/CommitMessage).
 
 ## Questions
 
diff --git a/all.bash b/all.bash
index bef2b31..ebe990d 100755
--- a/all.bash
+++ b/all.bash
@@ -5,6 +5,9 @@
 
 source devtools/lib.sh || { echo "Are you at repo root?"; exit 1; }
 
+# Support ** in globs, for check_script_hashes.
+shopt -s globstar
+
 warnout() {
   while read line; do
     warn "$line"
@@ -112,6 +115,13 @@
     -td=content/static/html/pages | warnout
 }
 
+
+# check_script_hashes checks that our CSP hashes match the ones
+# for our HTML scripts.
+check_script_hashes() {
+  runcmd go run ./devtools/cmd/csphash content/static/html/**/*.tmpl
+}
+
 run_prettier() {
   if ! [ -x "$(command -v prettier)" ]; then
     err "prettier must be installed: see https://prettier.io/docs/en/install.html"
@@ -127,6 +137,7 @@
   check_staticcheck
   check_misspell
   check_unparam
+  check_script_hashes
   run_prettier
 }
 
@@ -145,6 +156,7 @@
   unparam     - (lint) run unparam on source files
   prettier    - (lint, nonstandard) run prettier on .js and .css files.
   templates   - (lint, nonstandard) run go-template-lint on templates
+  script_hashses - (lint) check script hashes
 EOUSAGE
 }
 
@@ -176,6 +188,7 @@
     prettier) run_prettier ;;
     templates) check_templates ;;
     unparam) check_unparam ;;
+    script_hashes) check_script_hashes ;;
     *)
       usage
       exit 1
diff --git a/devtools/cmd/csphash/main.go b/devtools/cmd/csphash/main.go
new file mode 100644
index 0000000..d1fea80
--- /dev/null
+++ b/devtools/cmd/csphash/main.go
@@ -0,0 +1,146 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// csphash computes the hashes of script tags in files,
+// and checks that they are added to our content
+// security policy.
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/base64"
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"os"
+	"regexp"
+)
+
+var hashFile = flag.String("hf", "internal/middleware/secureheaders.go", "file with hashes for CSP header")
+
+func main() {
+	flag.Usage = func() {
+		fmt.Fprintf(flag.CommandLine.Output(), "usage: %s [flags] FILES\n", os.Args[0])
+		fmt.Fprintf(flag.CommandLine.Output(), "suggestion for FILES: content/static/html/**/*.tmpl\n")
+		flag.PrintDefaults()
+	}
+
+	flag.Parse()
+
+	if flag.NArg() == 0 {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	cspHashes, err := extractHashes(*hashFile)
+	if err != nil {
+		log.Fatal(err)
+	}
+	cspHashMap := map[string]bool{}
+	for _, h := range cspHashes {
+		cspHashMap[h] = true
+	}
+
+	ok := true
+	for _, file := range flag.Args() {
+		scripts, err := scripts(file)
+		if err != nil {
+			log.Fatal(err)
+		}
+		for _, s := range scripts {
+			if bytes.Contains(s.tag, []byte("src=")) {
+				fmt.Printf("%s: has script with src attribute: %s\n", file, s.tag)
+				ok = false
+			}
+			hash := cspHash(s.body)
+			if !cspHashMap[hash] {
+				fmt.Printf("missing hash: add the lines below to %s:\n", *hashFile)
+				fmt.Printf("    // From %s\n", file)
+				fmt.Printf(`    "'sha256-%s'",`, hash)
+				fmt.Println()
+				ok = false
+			} else {
+				delete(cspHashMap, hash)
+			}
+		}
+	}
+	for h := range cspHashMap {
+		fmt.Printf("unused hash %s\n", h)
+		ok = false
+	}
+	if !ok {
+		fmt.Printf("Add missing hashes to %s and remove unused ones.\n", *hashFile)
+		os.Exit(1)
+	}
+}
+
+var hashRegexp = regexp.MustCompile(`'sha256-([^']+)'`)
+
+// extractHashes scans the given file for CSP-style hashes and returns them.
+func extractHashes(filename string) ([]string, error) {
+	contents, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+	var hashes []string
+	matches := hashRegexp.FindAllSubmatch(contents, -1)
+	for _, m := range matches {
+		hashes = append(hashes, string(m[1]))
+	}
+	return hashes, nil
+}
+
+func cspHash(b []byte) string {
+	h := sha256.Sum256(b)
+	return base64.StdEncoding.EncodeToString(h[:])
+}
+
+// script represents an HTML script element.
+type script struct {
+	tag  []byte // `<script attr="a"...>`
+	body []byte // text between open and close script tags
+}
+
+// scripts returns all the script elements in the given file.
+func scripts(filename string) ([]*script, error) {
+	contents, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %v", filename, err)
+	}
+	return scriptsReader(contents)
+}
+
+var (
+	// Assume none of the attribute values contain a '>'.
+	// Regexp flag `i` means case-insensitive.
+	scriptStartRegexp = regexp.MustCompile(`(?i:<script>|<script\s[^>]*>)`)
+	// Assume all scripts end with a full close tag.
+	scriptEndRegexp = regexp.MustCompile(`(?i:</script>)`)
+)
+
+func scriptsReader(b []byte) ([]*script, error) {
+	var scripts []*script
+	offset := 0
+	for {
+		start := scriptStartRegexp.FindIndex(b)
+		if start == nil {
+			return scripts, nil
+		}
+		tag := b[start[0]:start[1]]
+		b = b[start[1]:]
+		offset += start[1]
+		end := scriptEndRegexp.FindIndex(b)
+		if end == nil {
+			return nil, fmt.Errorf("%s is missing an end tag", tag)
+		}
+		scripts = append(scripts, &script{
+			tag:  tag,
+			body: b[:end[0]],
+		})
+		b = b[end[1]:]
+		offset += end[1]
+	}
+}
diff --git a/devtools/cmd/csphash/main_test.go b/devtools/cmd/csphash/main_test.go
new file mode 100644
index 0000000..e032120
--- /dev/null
+++ b/devtools/cmd/csphash/main_test.go
@@ -0,0 +1,57 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestScriptStartRegexp(t *testing.T) {
+	for _, test := range []struct {
+		in   string
+		want bool
+	}{
+		{`<script>`, true},
+		{`<Script>`, true},
+		{`<script src="/static/min.js">`, true},
+		{`<script
+					integrity="sha256-xyz"
+					src=/foo
+			  >`, true},
+		{`<scriptify>`, false},
+		{`<enscript>`, false},
+	} {
+		got := scriptStartRegexp.MatchString(test.in)
+		if got != test.want {
+			t.Errorf("%s: got %t, want %t", test.in, got, test.want)
+		}
+	}
+}
+
+func TestScriptsReader(t *testing.T) {
+	in := `
+		<script>foo </script>
+		<script src="/static/min.js"></script>
+	`
+	got, err := scriptsReader([]byte(in))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []*script{
+		{
+			tag:  []byte(`<script>`),
+			body: []byte(`foo `),
+		},
+		{
+			tag:  []byte(`<script src="/static/min.js">`),
+			body: []byte(""),
+		},
+	}
+	if diff := cmp.Diff(want, got, cmp.AllowUnexported(script{})); diff != "" {
+		t.Errorf("mismatch (-want, +got):\n%s", diff)
+	}
+}
diff --git a/doc/frontend.md b/doc/frontend.md
index de86796..153900a 100644
--- a/doc/frontend.md
+++ b/doc/frontend.md
@@ -35,3 +35,7 @@
 your local database with packages of your choice.
 
 You can then run the frontend with: `go run cmd/frontend/main.go`
+
+If you add, change or remove any inline scripts in templates, run
+`devtools/cmd/csphash` to update the hashes. Running `all.bash`
+will do that as well.
diff --git a/internal/middleware/secureheaders.go b/internal/middleware/secureheaders.go
index ee36bc2..7eee866 100644
--- a/internal/middleware/secureheaders.go
+++ b/internal/middleware/secureheaders.go
@@ -21,6 +21,8 @@
 	"'sha256-s16e7aT7Gsajq5UH1DbaEFEnNx2VjvS5Xixcxwm4+F8='",
 	// From content/static/html/pages/pkg_doc.tmpl
 	"'sha256-AvMTqQ+22BA0Nsht+ajju4EQseFQsoG1RxW3Nh6M+wc='",
+	// From content/static/html/worker/index.tmpl
+	"'sha256-5EpitFYSzGNQNUsqi5gAaLqnI3ZWfcRo/6gLTO0oCoE='",
 }
 
 // SecureHeaders adds a content-security-policy and other security-related