Code inside the head is inside the body tab?

I am trying to work out how to do content security policy which will probably be another post but I have put lines of code on the page and on the custom code on project settings.
After publishing and looking at the code they are just after the tag and not inside the tag. is that normal?

Also anyone have example of how to add content security policy in our code?

Here is my site Read-Only: LINK
(how to share your site Read-Only link)