Subresource Integrity

What it is

Subresource Integrity. The integrity= attribute on <script> and <link> elements lets you pin a specific SHA-256/384/512 hash. The browser computes the hash of the fetched bytes and refuses to execute on mismatch.

Why it matters

When a CDN, npm package, or analytics vendor gets compromised, SRI is the difference between 'no impact' and 'every visitor ran attacker code'. Magecart-style supply-chain attacks are why this exists.

Who it applies to

Any site loading scripts or stylesheets from a third-party CDN.

How WQI scores it

Web Quality Index considers this standard satisfied when the supporting factor passes.

Related standards

See also

CSP 3 , Security headers

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Cross-Origin isolation (COOP / COEP / CORP) 1 shared factor Security Three response headers that together unlock SharedArrayBuffer and high-resolution timers — and incidentally close a class of cross-origin side-channel leaks.
• HTTP Strict Transport Security 1 shared factor Security One header tells every future visitor 'always HTTPS, never HTTP, no exceptions'. Should ship everywhere; preload only after you're sure.
• ISO/IEC 27001:2022 1 shared factor Security International gold standard for an Information Security Management System. The 2022 revision restructures the Annex A controls to align with ISO 27002:2022.
• NIST Cybersecurity Framework 2.0 1 shared factor Security Voluntary, US-government-blessed taxonomy for cybersecurity programs. The 2.0 revision (Feb 2024) added a 'Govern' function alongside the original Identify / Protect / Detect / Respond / Recover.
• OWASP Top 10 (2025) 1 shared factor Security Industry consensus on the ten most critical web application security risks. The 2025 edition is current; 2021 is superseded but still widely referenced.

Other references

• guidance MDN — Subresource Integrity
• guidance OWASP — Third-party JavaScript Management