Hello Support Superhero!
I’m wondering if the plugin is safe to use since it hasn’t been tested with the latest 3 major WordPress releases.
Can you please tell me if you still check the Subresource Integrity (SRI) Manager plugin for compatibility with the latest WordPress version?
BIG thank you!
]]>wp_enqueue_script('cookies','//cdn.jsdelivr.net/npm/js-cookie@2/src/js.cookie.min.js', array('jquery'));On our UAT site, the above script is successfully hashed / managed. In production, it is not. This is the only script that is not captured on one vs the other; for example the following enqueued script is managed successfully in both environments:
wp_enqueue_script('dataTables','//cdn.datatables.net/1.10.16/js/jquery.dataTables.min.js', array('jquery'));I have tried disabling the few production plugins that are different than UAT’s environment (namely, Autoptomize and WP Super Cache) and this does not seem to change anything. Any thoughts on where to look for a solution to force this js.cookie.min.js to be recognized would be great.
Hello,
I was assisting with a site that was running this plugin. The site had crashed and needed an emergency JS fix that this plugin was blocking so I disabled it to get the code live.
After that dust settled, I removed the plugin and reinstalled to try and reset the hashes but now it doesn’t find any resources and the listing in Tools is now blank. Is there something else I need to clear out? (Nothing was changed with how scripts were loaded.)
Thank you!
]]>Hi @meitar,
I have some issues after the last plugin update.
It seems my site doesn’t load any script now when SRI plugin is activated.
The Firefox console says:
None of the "sha256" hashes in the integrity attribute match the contents of the sub-resource.
Can you have a look?
]]>Hi,
Is this plugin dead? It hasn’t been updated in 7 months and doesn’t seem to be compatible with WordPress 5.5.
Can anyone suggest an alternative?
Thanks!
]]>Hi,
Installed Subresource Integrity (SRI) Manager on a fairly blank WP install and got the following:
[17-Sep-2020 07:26:02 UTC] PHP Notice: Undefined index: type in /Users/*****/Local Sites/*****/app/public/wp-content/plugins/wp-sri/wp-sri.php on line 151
[17-Sep-2020 07:26:02 UTC] PHP Stack trace:
[17-Sep-2020 07:26:02 UTC] PHP 1. {main}() /Users/*****/Local Sites/*****/app/public/wp-admin/options-general.php:0
[17-Sep-2020 07:26:02 UTC] PHP 2. require_once() /Users/*****/Local Sites/*****/app/public/wp-admin/options-general.php:10
[17-Sep-2020 07:26:02 UTC] PHP 3. require_once() /Users/*****/Local Sites/*****/app/public/wp-admin/admin.php:239
[17-Sep-2020 07:26:02 UTC] PHP 4. do_action() /Users/*****/Local Sites/*****/app/public/wp-admin/admin-header.php:116
[17-Sep-2020 07:26:02 UTC] PHP 5. WP_Hook->do_action() /Users/*****/Local Sites/*****/app/public/wp-includes/plugin.php:478
[17-Sep-2020 07:26:02 UTC] PHP 6. WP_Hook->apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:311
[17-Sep-2020 07:26:02 UTC] PHP 7. print_admin_styles() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:287
[17-Sep-2020 07:26:02 UTC] PHP 8. WP_Styles->do_items() /Users/*****/Local Sites/*****/app/public/wp-includes/script-loader.php:2018
[17-Sep-2020 07:26:02 UTC] PHP 9. WP_Styles->do_item() /Users/*****/Local Sites/*****/app/public/wp-includes/class.wp-dependencies.php:116
[17-Sep-2020 07:26:02 UTC] PHP 10. apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/class.wp-styles.php:251
[17-Sep-2020 07:26:02 UTC] PHP 11. WP_Hook->apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/plugin.php:206
[17-Sep-2020 07:26:02 UTC] PHP 12. WP_SRI_Plugin->filterTag() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:289
[17-Sep-2020 07:26:02 UTC] PHP Notice: Trying to access array offset on value of type null in /Users/*****/Local Sites/*****/app/public/wp-content/plugins/wp-sri/wp-sri.php on line 151
[17-Sep-2020 07:26:02 UTC] PHP Stack trace:
[17-Sep-2020 07:26:02 UTC] PHP 1. {main}() /Users/*****/Local Sites/*****/app/public/wp-admin/options-general.php:0
[17-Sep-2020 07:26:02 UTC] PHP 2. require_once() /Users/*****/Local Sites/*****/app/public/wp-admin/options-general.php:10
[17-Sep-2020 07:26:02 UTC] PHP 3. require_once() /Users/*****/Local Sites/*****/app/public/wp-admin/admin.php:239
[17-Sep-2020 07:26:02 UTC] PHP 4. do_action() /Users/*****/Local Sites/*****/app/public/wp-admin/admin-header.php:116
[17-Sep-2020 07:26:02 UTC] PHP 5. WP_Hook->do_action() /Users/*****/Local Sites/*****/app/public/wp-includes/plugin.php:478
[17-Sep-2020 07:26:02 UTC] PHP 6. WP_Hook->apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:311
[17-Sep-2020 07:26:02 UTC] PHP 7. print_admin_styles() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:287
[17-Sep-2020 07:26:02 UTC] PHP 8. WP_Styles->do_items() /Users/*****/Local Sites/*****/app/public/wp-includes/script-loader.php:2018
[17-Sep-2020 07:26:02 UTC] PHP 9. WP_Styles->do_item() /Users/*****/Local Sites/*****/app/public/wp-includes/class.wp-dependencies.php:116
[17-Sep-2020 07:26:02 UTC] PHP 10. apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/class.wp-styles.php:251
[17-Sep-2020 07:26:02 UTC] PHP 11. WP_Hook->apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/plugin.php:206
[17-Sep-2020 07:26:02 UTC] PHP 12. WP_SRI_Plugin->filterTag() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:289
[17-Sep-2020 07:26:02 UTC] PHP Notice: Undefined variable: url in /Users/*****/Local Sites/*****/app/public/wp-content/plugins/wp-sri/wp-sri.php on line 169
[17-Sep-2020 07:26:02 UTC] PHP Stack trace:
[17-Sep-2020 07:26:02 UTC] PHP 1. {main}() /Users/*****/Local Sites/*****/app/public/wp-admin/options-general.php:0
[17-Sep-2020 07:26:02 UTC] PHP 2. require_once() /Users/*****/Local Sites/*****/app/public/wp-admin/options-general.php:10
[17-Sep-2020 07:26:02 UTC] PHP 3. require_once() /Users/*****/Local Sites/*****/app/public/wp-admin/admin.php:239
[17-Sep-2020 07:26:02 UTC] PHP 4. do_action() /Users/*****/Local Sites/*****/app/public/wp-admin/admin-header.php:116
[17-Sep-2020 07:26:02 UTC] PHP 5. WP_Hook->do_action() /Users/*****/Local Sites/*****/app/public/wp-includes/plugin.php:478
[17-Sep-2020 07:26:02 UTC] PHP 6. WP_Hook->apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:311
[17-Sep-2020 07:26:02 UTC] PHP 7. print_admin_styles() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:287
[17-Sep-2020 07:26:02 UTC] PHP 8. WP_Styles->do_items() /Users/*****/Local Sites/*****/app/public/wp-includes/script-loader.php:2018
[17-Sep-2020 07:26:02 UTC] PHP 9. WP_Styles->do_item() /Users/*****/Local Sites/*****/app/public/wp-includes/class.wp-dependencies.php:116
[17-Sep-2020 07:26:02 UTC] PHP 10. apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/class.wp-styles.php:251
[17-Sep-2020 07:26:02 UTC] PHP 11. WP_Hook->apply_filters() /Users/*****/Local Sites/*****/app/public/wp-includes/plugin.php:206
[17-Sep-2020 07:26:02 UTC] PHP 12. WP_SRI_Plugin->filterTag() /Users/*****/Local Sites/*****/app/public/wp-includes/class-wp-hook.php:289
[17-Sep-2020 07:26:02 UTC] PHP Notice: Undefined variable: url in /Users/*****/Local Sites/*****/app/public/wp-content/plugins/wp-sri/wp-sri.php on line 170
[17-Sep-2020 07:26:02 UTC] PHP Stack trace:WP Config:
### wp-core ###
version: 5.5.1
site_language: en_US
user_language: en_US
timezone: +00:00
permalink: /%postname%/
https_status: true
multisite: false
user_registration: 0
blog_public: 1
default_comment_status: open
environment_type: production
user_count: 1
dotorg_communication: true
### wp-paths-sizes ###
wordpress_path: /Users/*****/Local Sites/*****/app/public
wordpress_size: 43.02 MB (45106351 bytes)
uploads_path: /Users/*****/Local Sites/*****/app/public/wp-content/uploads
uploads_size: 7.95 MB (8340075 bytes)
themes_path: /Users/*****/Local Sites/*****/app/public/wp-content/themes
themes_size: 1.63 MB (1706636 bytes)
plugins_path: /Users/*****/Local Sites/*****/app/public/wp-content/plugins
plugins_size: 48.32 MB (50670715 bytes)
database_size: 3.47 MB (3637248 bytes)
total_size: 104.39 MB (109461025 bytes)
### wp-active-theme ###
name: Twenty Twenty (twentytwenty)
version: 1.5
author: the WordPress team
author_website: https://www.ads-software.com/
parent_theme: none
theme_features: core-block-patterns, widgets-block-editor, wc-product-gallery-zoom, wc-product-gallery-lightbox, wc-product-gallery-slider, woocommerce, post-thumbnails, automatic-feed-links, custom-background, custom-logo, title-tag, html5, align-wide, responsive-embeds, customize-selective-refresh-widgets, editor-color-palette, editor-font-sizes, editor-styles, widgets, menus, editor-style
theme_path: /Users/*****/Local Sites/*****/app/public/wp-content/themes/twentytwenty
auto_update: Disabled
### wp-plugins-active (6) ###
Advanced Custom Fields PRO: version: 5.9.1, author: Elliot Condon, Auto-updates disabled
Contact Form X: version: 2.0, author: Jeff Starr, Auto-updates disabled
Gutenberg: version: 9.0.0, author: Gutenberg Team, Auto-updates disabled
Subresource Integrity (SRI) Manager: author: (undefined), version: 0.3.0, Auto-updates disabled
WooCommerce: version: 4.5.2, author: Automattic, Auto-updates disabled
WordPress Importer: version: 0.7, author: wordpressdotorg, Auto-updates disabled
### wp-plugins-inactive (3) ###
Query Monitor: version: 3.6.4, author: John Blackbourn, Auto-updates disabled
Query Monitor Extend: version: 1.0, author: Caleb Stauffer, Auto-updates disabled
Show Current Template: version: 0.3.4, author: JOTAKI Taisuke, Auto-updates disabled
### wp-media ###
image_editor: WP_Image_Editor_Imagick
imagick_module_version: 1691
imagemagick_version: ImageMagick 6.9.11-24 Q16 x86_64 2020-07-18 https://imagemagick.org
file_uploads: File uploads is turned off
post_max_size: 1000M
upload_max_filesize: 300M
max_effective_size: 300 MB
max_file_uploads: 20
imagick_limits:
imagick::RESOURCETYPE_AREA: 24 GB
imagick::RESOURCETYPE_DISK: 9.2233720368548E+18
imagick::RESOURCETYPE_FILE: 6144
imagick::RESOURCETYPE_MAP: 24 GB
imagick::RESOURCETYPE_MEMORY: 12 GB
imagick::RESOURCETYPE_THREAD: 1
gd_version: bundled (2.1.0 compatible)
ghostscript_version: not available
### wp-server ###
server_architecture: Darwin 17.7.0 x86_64
httpd_software: Apache/2.4.43 (Unix)
php_version: 7.4.1 64bit
php_sapi: fpm-fcgi
max_input_variables: 4000
time_limit: 1200
memory_limit: 256M
max_input_time: 600
upload_max_filesize: 300M
php_post_max_size: 1000M
curl_version: 7.54.0 LibreSSL/2.6.5
suhosin: false
imagick_availability: true
pretty_permalinks: true
htaccess_extra_rules: false
### wp-database ###
extension: mysqli
server_version: 8.0.16
client_version: mysqlnd 7.4.1
### wp-constants ###
WP_HOME: undefined
WP_SITEURL: undefined
WP_CONTENT_DIR: /Users/*****/Local Sites/*****/app/public/wp-content
WP_PLUGIN_DIR: /Users/*****/Local Sites/*****/app/public/wp-content/plugins
WP_MAX_MEMORY_LIMIT: 256M
WP_DEBUG: true
WP_DEBUG_DISPLAY: false
WP_DEBUG_LOG: true
SCRIPT_DEBUG: true
WP_CACHE: false
CONCATENATE_SCRIPTS: undefined
COMPRESS_SCRIPTS: undefined
COMPRESS_CSS: undefined
WP_LOCAL_DEV: undefined
DB_CHARSET: utf8
DB_COLLATE: undefined
### wp-filesystem ###
wordpress: writable
wp-content: writable
uploads: writable
plugins: writable
themes: writable
mu-plugins: writable
Hey,
I’ve installed the plugin but I still can’t pass the test on https://observatory.mozilla.org/.
I’ve tested it on this website https://neoredesign.wpengine.com/. I’ve deactivaded every plugins (except yours..), switched to a default theme, but the error is still showing up.
Any idea on how to resolve this ?
Thank you very much ??
]]>Hi
I am using SRI plugin with a template that uses Power Builder. When I activate SRI plugin, I get the following error message when editing a page or post:
net::ERR_INCOMPLETE_CHUNKED_ENCODING 200 (OK)
Does anyone have an idea what I can do to get the plugin working with power builder?
Thanks in advance!
NJoyLife
Hi,
When Subresource Integrity (SRI) Manager Plugin is active then the scripts of WPML-Plugin do not work correctly. The problem is described in following WPML support thread: https://wpml.org/forums/topic/no-wpml-options-in-design-menus/
Can you cooperate with the WPML authors to solve this problem?
Best regards
]]>Can this be extended to include sha384 instead of the default sha256?
It seems that this is more common these days.
Seems hardcoded at sha256. Is it just as simple as changing those texts since PHP supports it?
]]>I GET SUCH ERROR IN INSPECT ELEMENT
Failed to find a valid digest in the ‘integrity’ attribute for resource ‘https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C700%2C700italic&ver=4.9.4’ with computed SHA-256 integrity ‘CZInxx2oSIUpOsI1Q3pOtYyMlzN19L34lNxdbUMkB48=’. The resource has been blocked.
I use CDN enabler (https://www.ads-software.com/plugins/cdn-enabler/) to put all CSS/JS resources of my site to an external CDN. (The CDN is configured to load the resources from source site on the first request then cache them forever, so the plugin just works by replacing every resource URL’s hostname part.) Thus I need SRI for every resource. Can you add an option for this?
]]>Hello,
Thank you for this plugin. I am having trouble getting it work with my CDN. After some research online, I included the following header on my site:
Access-Control-Allow-Origin "*"
I also set my CDN (cloudfront) to forward the CORS header to the CDN. But on the Subresource Integrity Manager screen the message is “no hashes known.” Would appreciate help!
Thank you!
]]>Hi
Your plugin is great but it is not finding all of the external resources, I have at least 2 that have not been identified.
So when I test with Observatory by Mozilla I get a negative score. Why is it not finding the other 2? How can we fix it?
Cheers
Colin
]]>Hi Meitar,
First let me say that your plugin is awesome and works great. It easily adds the SRI to all the external resources.
With that said I am having issues with some resources in particular. I think I pinpointed the problem to the resources from fonts.googleapis.com/css?
I think this because my fonts no longer display correctly and I receive the following console message:
None of the “sha256” hashes in the integrity attribute match the content of the subresource
My javascripts all seem to be ok.
I can send link to website if needed.
]]>Hi,
i would really like to use this plugin, but it doesn’t seem to work with WP 4.7.1. , because I can’t see any “integrity” tags in the page source. Or am I doing sth. wrong? I just installed it and did nothing else. Also no hash is logged at all.
Because my site is just local for testing right now, I can send a link.
Thanks in advance,
zash
Hi,
Thanks for developing such a wonderful plugin but after installation this plugin is not working for the files servered from cdn.
please help.
regards,
deepak
SRI Manager does not seem to do anything. In the source code of my website, I have for example the following script, which I think should have a hash:
<script type="text/javascript" src="//use.typekit.net/dui2emy.js"></script>
Did I overlook something?
]]>How does one add an exclusion? From the Tools section, the URL/Hash/Exclude are there. I see “No hashes known”. But I can’t see any way to add anything.
]]>see https://developers.google.com/fonts/docs/technical_considerations.
When using the standard stylesheet method of including google fonts the integrity data doesn’t match and the fonts are not loaded. I believe this is because fonts.googleapis.com attempts to optimize the stylesheet on a per-user basis, so each user can receive a different file.
Tested on 4.4 running twentyfifteen in chrome and firefox.
]]>Hi Maymay,
I was just wondering if you are still supporting this project? Thank you!
Jason
]]>