Subresource Integrity (SRI): Crawl Audit check 156

Short answer: when your page loads a script from someone else's server, you're trusting that server not to change it. Subresource Integrity adds a hash of the file to your script tag, and the browser refuses to run it if the file changes. Check 156 warns when scripts from other domains have no hash.

What Crawl Audit checks

• Pass: no scripts from other domains, or all of them have an integrity attribute.
• Warning: some don't. The report shows how many.

It reads <script src> tags in the page's HTML. Stylesheets aren't counted, and neither are scripts added later by other scripts, such as most tag managers.

What the sources say

• MDN: SRI "works by allowing you to provide a cryptographic hash that a fetched resource must match."
• MDN: because SRI uses CORS, "you must include the crossorigin attribute in your markup".
• Sansec, June 2024: "The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites." Those sites loaded a script from cdn.polyfill.io, and the new owner changed what it served.

<script src="https://cdn.example.com/lib@4.2.1/lib.min.js"
  integrity="sha384-..."
  crossorigin="anonymous"></script>

When it helps and when it can't

• SRI works for a fixed, versioned file, like a library pinned to an exact version on a CDN.
• It can't work for a script that legitimately changes, or that is built differently for each browser. Sansec notes polyfill.io's code was "dynamically generated based on the HTTP headers". For those, the safer option is to host the file yourself or drop it.
• Every third-party script you remove is one less to trust.

On devmarde.com

Our homepage HTML had no script tags pointing at other domains on 6 October, so it passes. Our Google Analytics script is added by our framework after the page loads, which this check doesn't see.

Sources

• MDN, Subresource Integrity (updated 14 April 2026).
• Sansec, Polyfill supply chain attack hits 100K+ sites (25 June 2024), checked 6 October 2026.