Third-party scripts without integrity

Why it matters

If the CDN serving this script is compromised, the attacker runs code on your site.

How to fix it

Self-host the script or add an integrity= hash and crossorigin attribute.

How we test it

Passive — runs in the free check, looks only at what a browser can see.