Subresource Integrity (SRI)
When a site loads a script from an external CDN (e.g. jQuery from cdnjs.com), it trusts that CDN. If the CDN is compromised and delivers a m…
Analyse my site for freeUnderstanding "Subresource Integrity (SRI)"
Subresource Integrity (SRI) is a browser mechanism that verifies a file loaded from an external server (CDN) hasn't been tampered with, by comparing its content against a cryptographic fingerprint (SHA hash) provided in the integrity attribute of the <script> or <link> tag. If the downloaded content doesn't match the expected hash, the browser simply refuses to execute it.
This protection specifically concerns resources loaded from a third-party domain (a CDN for a JavaScript library like jQuery, Bootstrap, Google Fonts…). A CSS or JS file hosted on your own domain doesn't need SRI — you already control its integrity.
How TheSiteFuse checks "Subresource Integrity (SRI)"
TheSiteFuse examines every <script src="http...">> and <link rel="stylesheet" href="http...">> tag on the page whose URL points to a domain different from the audited domain. For each, the presence of the integrity attribute is checked. An external resource without this attribute is flagged. No external CDN resources at all, or their consistent presence with SRI, is considered correct.
Why "Subresource Integrity (SRI)" matters
- Supply chain compromise — if the third-party CDN is hacked or its account compromised, the tampered JavaScript file is automatically executed on your site, with full access to the DOM, non-HttpOnly cookies, and forms (credential theft, card-skimmer injection).
- Man-in-the-middle attack — on an untrusted network, an attacker can intercept and replace the content of a CDN resource loaded without SRI, even if the initial connection to your site is HTTPS.
- Real documented incidents — several popular JavaScript libraries have been compromised via their CDN in the past, simultaneously affecting tens of thousands of sites that loaded them without integrity verification.
Fix "Subresource Integrity (SRI)" step by step
Generate the integrity hash
Use srihash.org or the following command to generate the SHA-384 hash of a resource:
curl -s https://cdn.example.com/lib.js | openssl dgst -sha384 -binary | openssl base64 -A
Add the integrity attribute
<script src="https://cdn.example.com/lib.js"
integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
crossorigin="anonymous"></script>
Watch out during updates: if you change the version of a CDN library, the SRI hash must be regenerated — an outdated hash will block the new version from loading. Consider automating this step if you use a build pipeline.
Alternative: host critical libraries directly on your own server to eliminate the dependency on a third-party CDN entirely (a trade-off between performance/shared caching and full control).
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — Subresource Integrity (SRI)Does your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.