v138 · security · http

SRI Migration Assistant

Paste your page HTML, detect every <script> and <link> tag missing an integrity attribute, generate the header, and export patched markup. Simulates the Chrome 138 Integrity-Policy roll-out workflow: report-only → fix → enforce.

Step 1 — paste or load HTML

The three-phase rollout:
  1. Report-only: Deploy Integrity-Policy: require-sri-for=script; report-to=my-endpoint. Reports flood in for any script loaded without integrity=. Nothing is blocked.
  2. Fix: Add integrity to every flagged tag using this tool or your build pipeline.
  3. Enforce: Switch to Integrity-Policy: require-sri-for=script (no report-only). Any script without a valid hash is blocked.

see also