I decided to move the site to domain root. Same problem. Here are the logs
Refused to load the stylesheet ‘https://cdn.jsdelivr.net/select2/3.5.2/select2.css?ver=3.5.2’ because it violates the following Content Security Policy directive: “style-src ‘self’ ‘unsafe-inline’ *.googleapis.com *.google.com *.jquery.com”. Note that ‘style-src-elem’ was not explicitly set, so ‘style-src’ is used as a fallback.
load-scripts.php?c=0&load[chunk_0]=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=5.3.2:8 JQMIGRATE: Migrate is installed, version 1.4.1
/wp-content/themes/simplemag/images/error-page.png:1 Failed to load resource: the server responded with a status of 404 (Not Found)
themes.php?page=SimpleMagLi-An:1 Refused to load the script ‘https://ajax.googleapis.com/ajax/libs/webfont/1.5.0/webfont.js?ver=1.5.0’ because it violates the following Content Security Policy directive: “script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’ *.videopress.com *.google.com *.wp.com”. Note that ‘script-src-elem’ was not explicitly set, so ‘script-src’ is used as a fallback.
themes.php?page=SimpleMagLi-An:1 Refused to load the script ‘https://cdn.jsdelivr.net/select2/3.5.2/select2.min.js?ver=3.5.2’ because it violates the following Content Security Policy directive: “script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’ *.videopress.com *.google.com *.wp.com”. Note that ‘script-src-elem’ was not explicitly set, so ‘script-src’ is used as a fallback.
field_typography.min.js?ver=1582358735:1 Uncaught TypeError: j(…).select2 is not a function
at Object.redux.field_objects.typography.select (field_typography.min.js?ver=1582358735:1)
at HTMLDivElement.<anonymous> (field_typography.min.js?ver=1582358735:1)
at Function.each (load-scripts.php?c=0&load[chunk_0]=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=5.3.2:2)
at a.fn.init.each (load-scripts.php?c=0&load[chunk_0]=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=5.3.2:2)
at HTMLFieldSetElement.<anonymous> (field_typography.min.js?ver=1582358735:1)
at Function.each (load-scripts.php?c=0&load[chunk_0]=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=5.3.2:2)
at a.fn.init.each (load-scripts.php?c=0&load[chunk_0]=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=5.3.2:2)
at HTMLFieldSetElement.<anonymous> (field_typography.min.js?ver=1582358735:1)
at Function.each (load-scripts.php?c=0&load[chunk_0]=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=5.3.2:2)
at a.fn.init.each (load-scripts.php?c=0&load[chunk_0]=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=5.3.2:2)
themes.php?page=SimpleMagLi-An:1 Refused to load the stylesheet ‘https://cdn.jsdelivr.net/select2/3.5.2/select2.css?ver=3.5.2’ because it violates the following Content Security Policy directive: “style-src ‘self’ ‘unsafe-inline’ *.googleapis.com *.google.com *.jquery.com”. Note that ‘style-src-elem’ was not explicitly set, so ‘style-src’ is used as a fallback.