Subresource Integrity lets a browser check whether a loaded script or stylesheet matches its expected content.
Definition source: MDN: Subresource Integrity. Read on 24 October 2026. The practical questions on this page help you define the issue with your administrator.
What does the browser check?
Your developer can record an expected verification value for a script or stylesheet. The browser compares downloaded content with that value. MDN explains that a mismatch prevents the resource from loading.
The check concerns matching content; it does not decide whether that content is useful or safe.
A CDNA CDN is a network of servers around the world that keeps copies of your website close to your visitors, so pages load fast wherever they are. may supply files for your website. For suitable files, SRI helps check that the delivery matches what was approved beforehand. It is not a general scan of everything a visitor receives.
Ask your developer to identify which files actually have this check in the current website.
What might an SRI problem look like?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
A developer can identify an integrity error in the browser when content and the expected value differ. You may notice a missing feature or unexpected styling. A legitimate update with an outdated verification value can cause that.
The error alone therefore does not establish an attack.
Ask which change was planned and which file the browser refused. Have the new content compared with the intended release. Disabling the check because a button does not work also removes the agreed protection.
First discuss why the contents differ and which file version should be used.
What should maintenance cover?
Ask how updates to the file and its verification value are managed together. Have important functions checked on a test copy. Cross-origin delivery has additional requirements, documented by MDN.
Leave implementation to someone able to apply those requirements to your site, rather than pasting an example into production without testing it.
A Content Security PolicyA Content Security Policy (CSP) is a rule your site sends to browsers that lists where scripts, styles and images on a page may come from. All else is blocked. and SRI answer different questions. The policy can restrict permitted sources; SRI compares content. This can help with a supply chain attackA supply chain attack reaches you through a supplier or supplied component, rather than only through your own website., but does not cover every supplier, every file or every change to your own page.
When should you ask for help?
Have a developer investigate if a payment function, form or important styling fails after a change. Provide the page and the time of the change. Ask whether the block was expected and what is needed to load the intended content with the check in place.
SRI does not prove that information was never intercepted earlier. It also does not assess content you have already approved as expected. Keep configuration, functional tests and investigation of a possible incident as separate parts of the maintenance record.
Each establishes a different fact and needs its own scope.
Product and company names on this page belong to their respective owners. We use them to describe the subject. We are not affiliated with those parties.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Does an SRI error prove a supplier was hacked?
No. An ordinary file update can also cause a mismatch. Compare the content, expected value and planned change before drawing conclusions.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.