Reference
What is Subresource Integrity?
Subresource Integrity lets you pin a cryptographic hash to an external script or stylesheet, so the browser verifies the file before executing it and refuses to run anything that has changed. It protects against a compromised CDN or a hijacked third-party host serving modified code to your visitors.
Also called: SRI · integrity attribute
How it works
You add an integrity attribute containing a hash of the expected file. The browser fetches the resource, hashes it, and refuses to execute it if the values differ.
When it cannot be used
On versionless URLs that the provider updates in place — a pinned hash would break the resource on their next release. Analytics beacons and some widget scripts are distributed this way deliberately.
What to do instead in those cases
Restrict script sources with a Content Security Policy, so only the specific origins you nominated can execute anything at all. That is the control that applies when SRI is not available.
The broader lesson: every third-party script is a party you have granted execution rights to on your own domain. The most effective mitigation is not a hash — it is auditing whether the script needs to be there at all.
Where this is covered in depth
A definition can only go so far. Technical SEO, in the order the problems actually block you covers this properly — 4 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.