Why the Siteimprove Analytics Script Does Not Support SRI
Summary
For this reason, Siteimprove does not provide SRI hashes for the hosted Analytics script, and it is not possible to use SRI with the standard third-party hosted implementation.
Overview
Some customers' security scanning tools flag the Siteimprove-hosted Analytics script for lacking a Subresource Integrity (SRI) hash. SRI is a browser security feature that allows developers to include a cryptographic hash in a <script> tag so the browser can verify the resource has not been tampered with.
Why SRI is not supported for the Siteimprove-hosted script
The Siteimprove Analytics script (siteimproveanalytics.com/js/siteanalyze_*.js) is a dynamically updated, third-party hosted resource. Because Siteimprove continuously pushes updates to this script (bug fixes, new features, tracking improvements), the content — and therefore the cryptographic hash — changes with each release. An SRI hash tied to one version would cause the browser to block the script entirely after any update, breaking Analytics tracking.
Alternative: Self-hosting
Customers who require SRI validation for compliance or security policy reasons may choose to self-host the script. When the script is served from the customer's own domain, they can generate and apply an SRI hash to the locally hosted file. However, please note:
- Self-hosting is not officially supported by Siteimprove.
- The customer takes full responsibility for keeping the script up to date (see Impact section above).
- The SRI hash must be regenerated and updated every time the script is manually updated.** If update is to update screenshots, please attach screenshots with no markings.
Related Article
Did you find it helpful? Yes No
Send feedback