Subresource Integrity (SRI) Check

Every external script you load — an analytics snippet, a font loader, a UI library from a CDN — runs with full access to your page. If that third party (or the CDN serving it) is compromised, the attacker's code runs on your site. Subresource Integrity (SRI) is the defense: a cryptographic hash on the tag that tells the browser to refuse the file if it has been tampered with. VitalSite finds external resources that are missing this hash.

What VitalSite checks

Across every crawled page, we look for <script> and <link rel="stylesheet"> tags that load from an external origin and lack an integrity attribute. Results are aggregated by unique resource, so you get a clean list of exactly which third-party files to pin rather than the same warning repeated per page.

Why it matters

Supply-chain attacks via compromised CDNs and dependencies are now one of the most common ways legitimate sites get breached — the most common vulnerabilities of 2026 increasingly come from third parties, not your own code. SRI shrinks that risk dramatically: even if the CDN is hacked, the modified file's hash won't match and the browser simply won't run it.

How to fix it

Add an integrity hash and crossorigin attribute to each external tag:

<script src="https://cdn.example.com/lib.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"></script>

Most reputable CDNs publish the SRI hash next to their snippet, or you can generate one with openssl from the file. For resources you control, your build tool can emit hashes automatically.

A practical note: SRI works best for versioned, immutable files. For scripts that legitimately change at the same URL (some live analytics loaders), pinning a hash isn't possible — in those cases, limit what they can do with a strong Content-Security-Policy instead.

Verify the fix

Re-scan the domain. The SRI check should report that external resources include integrity hashes (or that none are used). This is a low-severity finding on its own, but closing it removes a real supply-chain foothold.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.