Subresource Integrity and third-party scripts
Most websites load scripts from CDNs and third-party services. If one of those sources is compromised, the attacker's code runs on your site with full access to your users' data. Subresource Integrity (SRI) is a simple defence.
How it happens
Your page includes a script tag pointing to another domain. If that file is changed by an attacker, or the CDN is compromised, every visitor loads the modified script. This is how many card-skimming attacks work.
Why it matters
- Theft of payment details and credentials typed into your pages.
- Malware and cryptomining served to your visitors.
- Reputational and regulatory damage.
How to prevent it
- Add an
integrityattribute with a hash to every third-party script and stylesheet. - Self-host critical libraries where practical.
- Limit which domains can serve scripts using Content-Security-Policy.
- Review your third-party scripts regularly and remove the ones you do not need.
How Vooki Pro helps
- Flags scripts and stylesheets loaded without Subresource Integrity.
- Lists cross-domain JavaScript includes.
- Detects outdated JavaScript libraries with known vulnerabilities.
- Checks your CSP, which limits where scripts may come from.
Frequently asked questions
What does Subresource Integrity do?
SRI adds a hash to a script tag. If the file on the CDN changes, the browser refuses to run it.
Does SRI work with scripts that change often?
No. SRI suits versioned, static files. For scripts that change, restrict them with CSP and review the vendor.
Try Vooki Pro free for 7 days
See every third-party script your site depends on, and which ones are unprotected. The trial unlocks every feature for 7 days, and scanning runs on your own machine.
Related: Rate limiting and denial-of-service protection · Securing OAuth, OpenID Connect and SAML single sign-on