Third-party scripts are loaded without integrity checks
sec_sri_missingShort answer
Your pages load JavaScript from another domain without an integrity hash. If that CDN or host is compromised, or the file is swapped, the new code runs with full access to your pages and visitors. Subresource Integrity (integrity="sha384-..." plus crossorigin="anonymous") makes the browser refuse a file that does not match the hash. It works for files at a fixed version; scripts that change by design should be hosted yourself or left without it.
Why it matters
A third-party script has the same power as your own code: it can read form fields, skim card numbers, inject redirects or spam links. Attacks on popular CDNs and on abandoned script domains have pushed malicious code to thousands of sites at once, and site owners only found out from their visitors or from browser warnings. With SRI the browser compares the downloaded file with the hash you published and blocks any change.
The severity is Low because it only matters if the third party is compromised. Injected spam or malware would hurt search visibility, but SRI itself has no ranking effect.
How Glimana detects it
Glimana lists the <script src> tags on your home page and up to two other pages. A script counts as external when its host is neither your site's host nor one of its subdomains. It is flagged when it has no integrity attribute with a sha256, sha384 or sha512 hash, or when it has one but no crossorigin attribute (browsers then block the script). Services whose scripts change constantly and cannot use SRI are skipped on purpose, among them Google Tag Manager and Analytics, reCAPTCHA, hCaptcha, Stripe, Facebook, Cloudflare Insights and YouTube. The issue lists up to ten flagged scripts (Low).
How to fix it
Watch out
Only add a hash to a URL that points to an exact version, such as /ajax/libs/jquery/3.7.1/jquery.min.js. A URL that serves "latest", or a service that updates its file in place, will change, and the browser will then block it and break whatever depends on it. Without crossorigin="anonymous" the browser cannot verify a file from another domain and blocks the script.
- Find the finding in Glimana. Open Security; this check is in the Cookies and cross-site access group, with the evidence from the last scan under its title. The same problem is listed under Issues › Third-party scripts are loaded without integrity checks.
-
Apply the fix on your platform.
Most public CDNs show the SRI hash next to each file. You can also compute it:
curl -s URL | openssl dgst -sha384 -binary | openssl base64 -A. Then write the tag as<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js" integrity="sha384-HASH" crossorigin="anonymous"></script>, withHASHreplaced by the value.WordPress has no built-in setting for SRI. For a script your theme or a plugin enqueues from a CDN, add the attributes with the
script_loader_tagfilter:add_filter('script_loader_tag', function ($tag, $handle) { if ($handle === 'my-cdn-lib') { $tag = str_replace(' src=', ' integrity="sha384-HASH" crossorigin="anonymous" src=', $tag); } return $tag; }, 10, 2);. Often simpler: download the file into your theme and enqueue it locally (see the next tab).Serving the library from your own domain or a subdomain removes the finding, because Glimana only flags scripts from other domains, and it removes the dependency on the third party. Use the same exact version and update it when you update the rest of the site.
- Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.
How the fix is verified
After fixing, press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes as soon as the check passes.