External scripts missing integrity hash: what it is, why it matters, and how to fix it
External scripts loaded from CDNs or third-party domains do not use Subresource Integrity (SRI) attributes. Without SRI, you cannot verify that the script has not been tampered with.
Where this fits: security in SEO
Why external scripts missing integrity hash hurts your rankings
If a CDN or third-party is compromised, attackers can modify the scripts your site loads, injecting malicious code that runs on your users' browsers. SRI provides a cryptographic guarantee that the script content matches what you expected. Supply chain attacks on JavaScript libraries are increasingly common.
This is a low-severity issue: a polish item. Fix it in batches during scheduled maintenance; the win is cumulative quality, not a step change.
How to fix it
Add integrity and crossorigin attributes to external script tags. Generate the hash using the sha384 algorithm. Update the hash whenever the script version changes.
<script
src="https://cdn.example.com/library.js"
integrity="sha384-abc123..."
crossorigin="anonymous"
></script>Frequently asked questions
What does "External scripts missing integrity hash" mean?
External scripts loaded from CDNs or third-party domains do not use Subresource Integrity (SRI) attributes. Without SRI, you cannot verify that the script has not been tampered with.
Why does external scripts missing integrity hash matter for SEO?
If a CDN or third-party is compromised, attackers can modify the scripts your site loads, injecting malicious code that runs on your users' browsers. SRI provides a cryptographic guarantee that the script content matches what you expected. Supply chain attacks on JavaScript libraries are increasingly common.
How do I fix external scripts missing integrity hash?
Add integrity and crossorigin attributes to external script tags. Generate the hash using the sha384 algorithm. Update the hash whenever the script version changes.
How serious is this issue?
This is a low-severity issue: a polish item. Fix it in batches during scheduled maintenance; the win is cumulative quality, not a step change. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects external scripts missing integrity hash on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by external scripts missing integrity hash, and hands you a ready-made fix task.
Check my site free