/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Subresource Integrity (SRI) Manager

Subresource Integrity (SRI) Manager

By Meitar

Security & Privacy / Security Scanning & Malware Protection

Subresource Integrity (SRI) Manager Review - In-Depth Analysis

Enhance your site's security by adding Subresource Integrity (SRI) attributes to third-party resources. Protect against JavaScript DDoS attacks with ease.

Performance Overview

WPS Score

6.47/10

User Rating

2.9/5 (based on 11+ reviews)

Active Installations

800+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

5 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

This WordPress plugin allows you to easily add a Subresource Integrity (SRI) declaration to any third-party content your pages load. The standards-based integrity attribute is a defense-in-depth best practice that is becoming standard in browsers.

The plugin automatically detects third-party resources, such as JavaScript libraries, and generates a SHA-256 hash of the content. It remembers this hash until the plugin is uninstalled or the hash is deleted from the admin interface, modifying your page's script and link elements on-the-fly. This ensures that the specific library you are using is the one being loaded by your visitors' web browsers.

Using this plugin can significantly reduce the likelihood that visitors to your site will be coerced into participating in an HTTP DDoS attack. For more information, see "An introduction to JavaScript-based DDoS" by Nick Sullivan.

Future versions of this plugin will offer an easy-to-use interface for site administrators to maintain a customized list of resource hashes and trigger on-demand integrity checks of these resources.

This plugin is still in its early stages. Feature requests and patches are welcome! Please provide a test case with your patch. See the tests subdirectory for unit tests.

If you like this plugin, please consider making a donation for your use of the plugin or contributing directly to my Cyberbusking fund. Your support is appreciated!

Other Notable Features

Here are a few other notable features of this free Subresource Integrity (SRI) Manager plugin.

Mitigation

Security

Subresource Integrity

FAQ

If you’re a site administrator, you can manually exclude specific resources by their URL from the Subresource Integrity Manager screen under Tools → Subresource Integrity Manager.

If you’re a plugin or theme author, you can use the option_wp_sri_excluded_hashes filter hook to dynamically whitelist assets. Please only do this for assets that are truly personalized, that is, only for assets whose URL is always the same but whose content is different for each user or page load.

For example, to ensure that the URL at https://example.com/personalized_content is never checked for integrity with SRI attributes, use the following PHP code:

function example_never_add_integrity_checking( $items ) {     $items[] = 'https://example.com/personalized_content';     return $items; } add_action( 'option_wp_sri_excluded_hashes', 'example_never_add_integrity_checking' );

Learn more about this filter hook.