Subresource Integrity (SRI) Checker
Find cross-origin scripts and stylesheets that load without an integrity hash, leaving your site exposed if that CDN is ever compromised.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
Subresource Integrity lets a browser verify that a script or stylesheet loaded from a third-party CDN hasn't been tampered with, by comparing it against a cryptographic hash in the integrity attribute. This tool lists every cross-origin resource on a page missing that attribute.
Without SRI, if any CDN you depend on is ever compromised, every site loading its script — including yours — silently starts serving the attacker's code to visitors.
Frequently asked questions
Do I need SRI hashes on every script tag?
It matters most for third-party scripts loaded from a CDN you don't control — if that CDN is ever compromised, SRI stops the browser from running a tampered file. Scripts served from your own domain are lower priority since you already control that supply chain.
What happens if a file changes after I've added its SRI hash?
The browser will refuse to load it — the hash has to match exactly, so any legitimate update to a hosted script requires regenerating and updating the hash too, or the resource will silently fail to load.
Related tools