Web security

CDN scripts protected with Subresource Integrity

Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.

Why it matters

If a CDN account or file is ever compromised, every site that loads it without an integrity check runs the attacker's code - card skimmers have spread exactly this way.

How to fix it

Quick fix · under 1 hour

Copy the integrity value the CDN publishes for the file (or compute it).
Add integrity and crossorigin attributes to the script or link tag.
Re-run the scan to confirm.

HTML

<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/library.min.js"
        integrity="sha384-..." crossorigin="anonymous"></script>

Compute the value

curl -s https://cdn.jsdelivr.net/npm/[email protected]/dist/library.min.js \
  | openssl dgst -sha384 -binary | openssl base64 -A

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free