Add Subresource Integrity to third-party scripts on Shopify

Why it matters

If a CDN or vendor serving your scripts is compromised, the altered file runs on your pages with full access to them. An integrity hash makes the browser refuse any file that differs from the one you approved.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: open Online Store, Themes, Edit code and find the third-party script and link tags you added to layout/theme.liquid or snippets with fixed-version URLs; compute their hashes as in the generic steps.
2. Stage 2: add integrity and crossorigin="anonymous" to those tags and check the console. Scripts injected by Shopify or by apps cannot be changed from the theme.

<script src="https://cdn.jsdelivr.net/npm/package@1.2.3/dist/package.min.js"
        integrity="sha384-PASTE_THE_HASH_HERE"
        crossorigin="anonymous" defer></script>

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Mixed content and SRI check
• Load scripts, styles and frames over HTTPS
• Load images and media over HTTPS
• Make forms submit over HTTPS