SRI Shield

It is a browser security feature. Each script or stylesheet tag carries a hash of the file's expected content. Before using the file, the browser checks that its content still matches the hash, and blocks it if it does not.

No. SRI confirms that a file matches a hash; it does not decide whether the file is trustworthy. SRI Shield trusts each file's content the first time it is hashed and asks you to approve every later change. Review changes before approving them, and keep using your other security measures.

No. Every feature is available through settings screens in your WordPress dashboard, and the plugin works with safe defaults.

CSS and JavaScript assets that are enqueued through WordPress, whether they are local, on a CDN, or on another remote service. Scripts and stylesheets added to pages in other ways (hard-coded tags or JavaScript injection) are not given integrity attributes.

No. The scanner analyzes the HTML your server returns and does not run JavaScript, so assets injected at runtime are not detected.

Yes. SRI Shield can hash remote assets via secure HTTP requests when the URL is accessible from your server. If a file cannot be reached or verified, it is left without an integrity attribute rather than causing an error. Cross-origin SRI also requires the CDN to send CORS headers.

Only when the Process Admin Assets setting is enabled. It is off by default.

Not while files are unchanged. If a protected file changes and the change has not been approved yet, browsers refuse that file, which can affect the features that depend on it until you review the change.

Hashes are stored and reused, so files are not re-hashed on every visit. A local file is hashed again only when its modification time or size changes.

SHA-384. It is strong, widely supported, and the default. SHA-256 and SHA-512 are also available if you have a specific reason to change it.

Use Re-check Hashes on the Dashboard. New assets are enrolled, unchanged assets keep their hash, and changed assets are flagged for review. It never replaces a trusted hash.

On a page, it means the integrity attribute does not match the content currently served, so browsers refuse the file. For a stored hash record, it means the file changed after its hash was trusted. The change appears under Hash Records > Changes Awaiting Review. If you made or expected the change (for example by updating the plugin that ships the file), approve the new hash. If you did not expect it, treat it as a possible security issue and investigate before approving anything.

The file probably changed, and browsers are refusing it because its trusted hash no longer matches. Open Hash Records, review the change, and approve the new hash if the change is expected. If you need the file to load before you can review it, Exclude it temporarily (it then loads without an integrity attribute) and re-include it after review.

SRI Shield fetches the file again and confirms that its content still produces the proposed hash you reviewed; if not, nothing is approved. Approval then makes the new hash trusted. It records that you accept the new content — it does not verify that the content is safe.

The file could not be reached when it was first hashed. Confirm the file's address is correct and the service is available, then use Re-check. If it still cannot be verified, exclude it.

New files are enrolled automatically the first time they are served. Updated versions of files that were already enrolled need your review on the Hash Records screen. Run a scan to confirm the results.

Check that Email Notifications is switched on, that the recipient address is valid, and that your site is able to send email. Use Send Test Email on the Notifications screen to confirm delivery.

Only Administrators. The plugin's menus are hidden from all other roles, and hash changes can only be approved by users who can manage site options.

Yes. Any excluded file can be re-included at any time from the Hash Records screen.

Reset Cache clears cached lookups and failed-asset records so they are retried. Trusted hashes and pending reviews are kept on purpose: deleting them would let the next page load trust the current content of a changed file without review. To stop adding an integrity attribute to a file, exclude it. Deleting the plugin removes all of its data.

When you deactivate it, integrity attributes are no longer added and your files are served normally. When you delete it, the plugin runs its uninstall cleanup, which removes its database tables and options.

Yes. SRI Shield supports Multisite activation, works on each site in the network individually, and cleans up after itself if removed.

Yes. See the "Developer Filters and Actions" section for the available filters and actions.

When opening a support request, please include:

• What you were doing when the issue occurred
• The exact wording of any message or status shown by the plugin
• Any relevant file address shown on the Hash Records or Scanner screens
• Whether you recently changed your theme, plugins, or site files