Subresource Integrity (SRI)

Subresource Integrity (SRI) helps a website verify that a fetched resource matches the file the developer intended to load. A page can specify a cryptographic hash in an `integrity` attribute on an eligible script or stylesheet reference. The browser calculates a hash of the received content and refuses to use the resource when the required check fails. This protects against some cases of altered third-party assets, such as a compromised file hosted on a content delivery network.

SRI is particularly suitable for versioned resources whose content does not change unexpectedly. If a CDN publishes a different file under the same URL, a previously stored hash can block it until the site updates the hash deliberately. MDN notes that cross-origin SRI loads require suitable CORS handling, commonly combined with a `crossorigin` attribute.

The control has limits. SRI is not a malware scanner, does not vet the business behavior of an approved script, and does not protect every type of external content. A service-business site embedding a booking widget still needs vendor review, least-privilege access, updates, and monitoring. Developers should test failure behavior so a blocked script does not silently disable the site’s contact or appointment functions.