Are your third-party scripts safe to load?
The scripts your homepage loads from other websites, and whether they come from places meant for production and are pinned with Subresource Integrity.
Why it matters
A script from another site runs with the same power as your own code. If that site is compromised or the file changes, your users run whatever it now contains. Files served straight from code repositories are meant for development, not production.
How a survey checks it
Passive check: part of every free survey.
We list the third-party scripts your homepage loads. We never download them. Well-known vendor SDKs are listed for your information.
How to fix it
- Serve libraries from your own site or a proper CDN, never from raw code repository addresses.
- Add an integrity attribute (Subresource Integrity) to scripts loaded from public CDNs, with a fixed version in the address.
- Remove scripts you no longer use. Every one is something to trust.
Prefer us to do it? Ask for a fix quote
Common questions
What is Subresource Integrity?
A hash of the exact file you expect, added to the script tag. If the file changes, the browser refuses to run it.
Do I need integrity on analytics or payment scripts?
Vendor SDKs that change often, such as Stripe.js, cannot be pinned this way and are designed to be loaded from the vendor. We do not flag those.