How it works
Once a day, we list every host your page loads scripts from and compare the list with what we have seen before. A script from a host that never appeared before is the typical sign of a Magecart-style attack, where a card skimmer is injected into a checkout page, or of a compromised tag manager or plugin.
New hosts join the baseline after one alert, so you are only told once. We also warn about scripts loaded from public CDNs without Subresource Integrity (an integrity attribute). Without it, a compromised CDN can serve your visitors anything.
Statuses
| Status | Meaning |
|---|---|
| OK | No new script hosts, and CDN scripts have integrity hashes. |
| Warning | A new script host appeared, or a CDN script has no integrity hash. |
By default you are notified of warnings and failures.
What to do
- A new host you added: nothing to do; it is now part of the baseline.
- A host you don't recognise: find what loads it, such as a plugin, a tag manager container or injected code. Remove it, and rotate the credentials of anyone who could change the site.
- No integrity hash: add
integrityandcrossorigin="anonymous"to the script tag. Most CDNs show the hash next to the URL. Or serve the file from your own domain.