Yes, partly. MDN says Subresource Integrity works with script elements and with link elements whose rel is stylesheet, preload or modulepreload. It does not cover every resource type, so images, fonts loaded by CSS and requests made by scripts need other controls.
What MDN lists
MDN's Subresource Integrity page says you can use SRI with script elements and with link elements whose rel attribute value is stylesheet, preload or modulepreload. You add an integrity attribute whose value is one or more hashes, each prefixed with sha256, sha384 or sha512 and a dash, followed by the Base64 hash.
For cross-origin files, the vendor server must send CORS headers and your tag needs the crossorigin attribute. MDN explains that requests with integrity metadata made in no-cors mode will always fail, because allowing them could let an attacker learn about a resource's contents.
Why stylesheets matter on a store
A stylesheet is code in a sense that matters. It can hide a field, move a button over another one, or change what a shopper sees at checkout. A compromised third-party stylesheet is a quieter attack than a script, but it can still harm trust and conversions.
On a store, common cross-origin stylesheets include font loaders, widget styles and framework files from a public host.
What to hash
| Resource | SRI supported | Note |
|---|---|---|
| Third-party script | Yes | Needs a pinned file and CORS |
| Third-party stylesheet | Yes | Same requirements |
| Preloaded script or stylesheet | Yes, with the link element | Hash must match the later use |
| Module preload | Yes | Applies to module files |
| Images | Not in this list | Use other controls |
| Requests a script makes itself | Not through this attribute | Use a Content Security Policy |
How the browser picks a hash
If you list more than one hash, MDN says the browser uses only the strongest algorithm present. SHA-256 is weakest, then SHA-384, then SHA-512. The resource loads if the computed value matches any of the listed values for that algorithm. Providing several hashes lets you carry an old and a new version through a transition.
Making it manageable
- List cross-origin scripts and stylesheets on your key pages.
- For each one, check if the vendor offers a versioned URL.
- Add integrity and crossorigin to the tag.
- Test with the browser console open; a failed hash shows as a blocked request.
- Plan the update routine from who updates the SRI hash when a vendor ships a new script.
Enforcing it across the site
MDN documents the Integrity-Policy header, which can require integrity metadata for loaded scripts or stylesheets and block those without it. It is listed as limited availability, so check browser support. Our post on what the Integrity-Policy header is explains when to use it.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how ongoing checks catch a change after you first approved something.
Where Safeguard fits
Safeguard's SBOM and dependency scanning covers packages in your build, and a free scan is at gold.safeguard.sh/scan. Integrity attributes for third-party files are set in your page templates.
Quick check
Can I hash a stylesheet from a public host?
Yes, if the host sends CORS headers and the file never changes at that URL. Use a versioned address.
What happens if the hash does not match?
The browser refuses to load the file and reports a network error.
Sources
Last reviewed: 19 October 2026.
