External resources without Subresource Integrity: what it is, why it matters, and how to fix it
External scripts or stylesheets are loaded without Subresource Integrity (SRI) attributes, making them vulnerable to supply-chain attacks if the CDN or third-party host is compromised.
Where this fits: security in SEO
Why external resources without subresource integrity hurts your rankings
Without SRI, if an attacker compromises a CDN or third-party host, they can inject malicious code into your site. SRI ensures that browsers only execute resources whose content matches a cryptographic hash you specify, protecting against tampered files.
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site.
How to fix it
Add integrity and crossorigin attributes to all external script and link tags. Generate the hash using the sha384 algorithm and include the crossorigin='anonymous' attribute.
<script src="https://cdn.example.com/lib.js" integrity="sha384-abc123..." crossorigin="anonymous"></script>Frequently asked questions
What does "External resources without Subresource Integrity" mean?
External scripts or stylesheets are loaded without Subresource Integrity (SRI) attributes, making them vulnerable to supply-chain attacks if the CDN or third-party host is compromised.
Why does external resources without subresource integrity matter for SEO?
Without SRI, if an attacker compromises a CDN or third-party host, they can inject malicious code into your site. SRI ensures that browsers only execute resources whose content matches a cryptographic hash you specify, protecting against tampered files.
How do I fix external resources without subresource integrity?
Add integrity and crossorigin attributes to all external script and link tags. Generate the hash using the sha384 algorithm and include the crossorigin='anonymous' attribute.
How serious is this issue?
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects external resources without subresource integrity on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by external resources without subresource integrity, and hands you a ready-made fix task.
Check my site free