SRI Checker

An SRI checker is a free online tool that fetches your page and inspects every external script and stylesheet for a Subresource Integrity hash. It reports which third-party resources load without an integrity attribute, which have one but are missing crossorigin, and what the corrected tag should look like.

Enter your website URL in the SRI checker above. We fetch the page, list every external script and stylesheet, and flag each one that loads from a third-party origin without an integrity attribute — no signup needed.

Subresource Integrity is a browser feature that pins a third-party file to a cryptographic hash. You add integrity="sha384-…" to a script or link tag, and the browser refuses to execute the file if its contents no longer match the hash — which is what stops a compromised CDN from serving malicious code to your visitors.

An integrity attribute on a cross-origin resource only works when the request is made in CORS mode. Without crossorigin="anonymous" the browser cannot read the response to verify the hash, so it blocks the resource outright — the tag looks protected but the script silently never loads.

Run openssl dgst -sha384 -binary file.js | openssl base64 -A on the exact file you serve, then use the output as integrity="sha384-<output>". Most CDNs (jsDelivr, cdnjs, unpkg) also publish a ready-made integrity attribute next to each file, which is the safer route because it is generated from the file they actually serve.

Usually not. SRI protects against a file changing on an origin you do not control — a CDN, a widget vendor, an analytics host. On self-hosted files it mostly gets in the way, because every deploy that changes the file also has to update the hash or the page breaks.

Yes, our SRI checker is completely free. It's part of SecScanner's free toolkit that runs 62 security checks covering SSL, HTTP headers, DNS, cookies, and content.