Security Headers Checker / Headers

Integrity-Policy: require Subresource Integrity on scripts

Integrity-Policy: blocked-destinations=(script) tells the browser to refuse any script that does not carry an integrity attribute. A changed file from a compromised CDN then fails to load instead of running.

What to send

Integrity-Policy-Report-Only: blocked-destinations=(script)

Start with the Report-Only form to see which scripts lack integrity, add SRI hashes to them, then send Integrity-Policy. Scripts that change on their own (some analytics tags) cannot use SRI, which is why our checker shows the files without integrity and the grade does not count them.

# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header Integrity-Policy-Report-Only "blocked-destinations=(script)" always;

Common mistakes

• Enforcing before every script has an integrity attribute: those scripts stop loading.