Glossary · Security

Subresource Integrity (SRI)

Subresource Integrity lets a page declare a cryptographic hash for a script or stylesheet so the browser refuses to run the file if it has been altered.

Updated October 6, 2026

Subresource Integrity (SRI) is a browser feature that checks a fetched script or stylesheet against a hash you provide. If the downloaded file does not match, the browser blocks it.

Why it matters

Many pages load libraries from a CDN or other third party. If that host is compromised, every site using the file would run the attacker's version. SRI means a tampered file is rejected instead of executed, which limits supply-chain risk. It works best with versioned, immutable files, since any legitimate change alters the hash.

Example

<script src="https://cdn.example.com/lib.min.js"
  integrity="sha384-BASE64HASHHERE"
  crossorigin="anonymous"></script>

The integrity attribute holds the algorithm and base64 digest. The crossorigin attribute is needed so the browser can check cross-origin resources.

Common mistakes

  • Adding SRI to a URL whose content changes, such as a "latest" file, which then breaks the page.
  • Forgetting crossorigin, which makes the check fail.
  • Believing SRI protects scripts that load further scripts dynamically.
  • Copying a hash from an untrusted source instead of computing it from a known-good file.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCSP (Content Security Policy)Content Security Policy is an HTTP header that lists which sources a page may load scripts, styles and other resources from, limiting the damage of XSS attacks.Glossary · SecurityCSP NonceA CSP nonce is a random, single-use token that marks specific inline scripts or styles as allowed under a Content Security Policy.Glossary · Internet & Webiframe (Inline Frame)An iframe is an HTML element that embeds another web page inside the current one, commonly used for maps, videos and third-party widgets.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · E-commerceE-commerce Site Security Checklist: 30 Checks for Online StoresA practical security checklist for online stores covering HTTPS, headers, payment pages, third-party scripts, admin access, updates, backups and monitoring.7 min readGuide · SSL & SecurityMixed Content Warnings: How to Find and Fix HTTP Resources on HTTPSUnderstand active vs passive mixed content, hunt down http:// references in HTML, CSS, JS and databases, fix them with wp-cli or CSP, and verify the result.8 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.