Auto SRI
Automatically adds Subresource Integrity (SRI) to external scripts/styles and safely excludes Google reCAPTCHA and Google Fonts.
Use with caution
Auto SRI works, but test it on a staging site before relying on it in 2026. It runs on 500+ sites and was last updated 6 months ago, and scores 48/100 on our health check.
- Small user base (500+ active installs)
- Very few reviews so far
- Only tested up to WordPress 6.8 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Auto SRI stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| csp | #21 |
| integrity | #97 |
| performance | >100 |
| security | >100 |
| SRI | #2 |
Version adoption
Share of active sites per release.
About Auto SRI
From the official readme · v2.3Description
Auto SRI automatically adds Subresource Integrity (SRI) attributes to scripts and styles loaded from external sources.
This improves security, protects against tampering, and enables strict Content Security Policy (CSP) setups.
Features
- ✔ Adds SRI to all external
<script>and<link>tags - ✔ Supports WordPress-enqueued assets and raw HTML tags
- ✔ Supports async, defer, crossorigin, and multiline script tags
- ✔ Caches all hashes for performance
- ✔ Excludes admin panel (wp-admin) to prevent conflicts
- ✔ Automatically skips non-SRI-compatible providers:
- Google reCAPTCHA
- Google Fonts (fonts.googleapis.com / fonts.gstatic.com)
- WordPress.com widgets (widgets.wp.com)
- Dynamic concatenated resources
- Dynamic script loaders and runtime-inserted scripts
- ✔ Safe for Elementor, WooCommerce, CookieYes, Jetpack, GoDaddy hosting, etc.
Why some scripts are excluded
This plugin automatically excludes:
- Google reCAPTCHA (
google.com/recaptcha) - Google Fonts stylesheets (
fonts.googleapis.com) - Google Fonts font files (
fonts.gstatic.com) - WordPress.com widgets (
widgets.wp.com) - Dynamic concatenated resources (
/_static/??) - Other dynamic inline loaders (CookieYes, wsimg, ywxi, etc.)
Want to whitelist a dynamic provider? Contact us at izafirsk@gmail.com.
* Other dynamic inline loaders (CookieYes, wsimg, ywxi, etc.)
Want to whitelist a dynamic provider? Contact us at izafirsk@gmail.com.
These exclusions prevent:
- CORS failures
- Integrity mismatch blocking
- Google reCAPTCHA from breaking
- Google Fonts from disappearing
- Layout shifts caused by blocked assets
Installation
- Upload the plugin to
/wp-content/plugins/auto-sri
Frequently asked questions
Does this plugin apply SRI in the WordPress admin panel?
No. The plugin automatically skips the WordPress admin panel (wp-admin) to prevent any conflicts with admin scripts and ensure smooth backend operation.
Why are some scripts not receiving SRI?
Scripts from Google reCAPTCHA, Google Fonts, wsimg, ywxi, and other dynamic sources cannot support SRI because their content changes on every request. This plugin intelligently detects those sources and safely skips them.
Does this affect performance?
No. SRI hashes are computed once and stored in the WordPress options table.
Does this break Elementor or CookieYes?
No. This plugin is fully compatible and tested against common dynamic script loaders.
Does this plugin help with CSP?
Yes — it allows you to safely enforce: For excluded domains, you should whitelist them in your CSP.
Changelog
Version bump to 2.3.
2.3
- Version bump to 2.3
2.2
- Updated support section with a cleaner PayPal button and improved copy
2.1
- Improved settings page UX with clearer instructions
- Added “Settings” link to the plugin action links on the plugins page
2.0
- Added settings page to allow user-defined URL exclusions
- Refactored exclusion logic for better maintainability (Unit tested)
1.9
- Added admin panel exclusion – SRI no longer applies in wp-admin
- Added exclusion for WordPress.com widgets (widgets.wp.com)
- Added exclusion for dynamic concatenated resources (/_static/??)
- Fixed integrity mismatch errors for dynamic content
- Improved compatibility with WordPress.com features
1.8
- Fixed prefixing issues to comply with WordPress standards
- Improved security by preventing direct file access
- Excluded development assets from release package
- Example of SRI added to external script tags in the page source
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Auto SRI alternatives
All csp plugins →
FAQ
Auto SRI: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 8, 2026
Is Auto SRI free?
Yes. Auto SRI is free to download and use from the official WordPress.org plugin directory.
Is Auto SRI safe to use in 2026?
Auto SRI works, but test it on a staging site before relying on it in 2026. It runs on 500+ sites and was last updated 6 months ago, and scores 48/100 on our health check.
How many websites use Auto SRI?
Auto SRI is active on 500+ WordPress websites and has been downloaded 2,929 times since it launched in December 2025. It was downloaded 359 times in the last 30 days.
Does Auto SRI work with WordPress 7.1?
Auto SRI is officially tested up to WordPress 6.8.11, while the latest release is 7.1.3. It may still work, but try it on a staging site first.
When was Auto SRI last updated?
The latest version, 2.3, was released on April 13, 2026 (6 months ago).
Who makes Auto SRI?
Auto SRI is developed and maintained by zfir.
What are the best alternatives to Auto SRI?
The most popular alternatives to Auto SRI are Headers Security Advanced &… (90K+ installs), Content Security Policy Man… (2K+ installs) and GD Security Headers (1K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
