Front Sentinel / free tools

SRI checker

Check which scripts and stylesheets a page loads from other hosts, whether they carry Subresource Integrity hashes, and whether those hashes still match. Missing hashes come with a ready integrity value. Free, no sign-up.

Check SRI

What Subresource Integrity does

Subresource Integrity (SRI) lets a page say exactly which file it expects. You add a hash of the file to the tag:

<script src="https://cdn.example.com/lib@1.4.2/lib.min.js"
        integrity="sha384-…" crossorigin="anonymous"></script>

The browser downloads the file, hashes it and refuses to run it if the hash differs. A CDN or vendor that gets compromised can then break your page, but can't run its code in it. The rules are in the W3C specification and MDN's guide.

Why dApp teams care

A dApp frontend asks users to sign transactions, so any script running in it can change what they sign. In June 2024 the polyfill.io domain, loaded by many sites as a plain <script> tag, started serving malicious code after it changed owners. An integrity hash makes the browser refuse a file that changed. polyfill.io served different code to different browsers, so it could not be pinned at all, which is why the other half of the advice is to self-host such files.

How this check works

It loads the page over HTTPS, reads <script src>, stylesheets, modulepreload and script/style preload links, downloads files from other hosts (and any file with an integrity attribute), and compares hashes the way a browser does: only the strongest algorithm listed counts. For files without a hash it shows the sha384 of the file served right now.

Limits: it sees the HTML only, so code injected at runtime isn't listed. A hash only works for a fixed file: pin a version in the URL first. Files that a vendor updates in place at the same URL, such as most analytics snippets, will break under SRI; self-host them or accept the risk knowingly.

To compute a hash by hand:

curl -s https://cdn.example.com/lib.min.js | openssl dgst -sha384 -binary | openssl base64 -A

Know when your frontend changes

Front Sentinel watches the scripts your frontend serves, its DNS, registrar statuses and new certificates, and sends alerts to Telegram, email or webhooks. It reads only public data and never asks for keys or registrar access.

Monitor a domain free   Registry lock checker