PHPackages                             s1syphos/kirby-sri - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. s1syphos/kirby-sri

AbandonedArchivedKirby-plugin[Utility & Helpers](/categories/utility)

s1syphos/kirby-sri
==================

Subresource integrity hashing & cache-busting static assets for Kirby

0.7.0(8y ago)12105MITPHP

Since Mar 3Pushed 4y ago1 watchersCompare

[ Source](https://github.com/S1SYPHOS/kirby-sri)[ Packagist](https://packagist.org/packages/s1syphos/kirby-sri)[ RSS](/packages/s1syphos-kirby-sri/feed)WikiDiscussions master Synced yesterday

READMEChangelog (9)Dependencies (1)Versions (4)Used By (0)

Kirby SRI
=========

[](#kirby-sri)

[![Release](https://camo.githubusercontent.com/2573f2efe41dfa294c0ebb20a2eb12be4cff9aa236e9c343f49bcc6f429be351/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f5331535950484f532f6b697262792d7372692e7376673f636f6c6f723d253232627269676874677265656e253232)](https://github.com/S1SYPHOS/kirby-sri/releases) [![License](https://camo.githubusercontent.com/e3b1a38cc4e54e7ac437580edd2fb36b3ad66a7699bff22242a66e6454e04ceb/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f5331535950484f532f6b697262792d7372692e737667)](https://github.com/S1SYPHOS/kirby-sri/blob/master/LICENSE) [![Issues](https://camo.githubusercontent.com/f5381b15383cfffca7913114bd437d3df56b21a370bf6ead4f11f4bc96448faf/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6973737565732f5331535950484f532f6b697262792d7372692e737667)](https://github.com/S1SYPHOS/kirby-sri/issues)

This plugin generates base64-encoded cryptographic hashes for your css / js files based on their content and adds them to the `integrity` attribute of their corresponding `` or `` elements. It also applies [cache-busting / fingerprinting](#cache-busting--fingerprinting).

**Table of contents**

- [1. What's SRI?](#whats-sri)
- [2. Getting started](#getting-started)
- [3. Configuration](#configuration)
- [4. Cachebusting / fingerprinting](#cache-busting--fingerprinting)
- [5. Be safe - use protection!](#be-safe---use-protection)
- [6. Credits / License](#credits--license)

What's SRI?
-----------

[](#whats-sri)

> "Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match."
>
> Source: [Mozilla Developer Network](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity)

Enter `kirby-sri`: Kirby-side generated SRI hashes for [safer CDN usage](https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/). Read more about CDN integration and Kirby in the [docs](https://getkirby.com/docs/cookbook/kirby-loves-cdn)) or over at Kirby's partner [KeyCDN](https://www.keycdn.com/support/kirby-cdn-integration/) to get started.

[![screenshot of the kirby-sri plugin](screenshot.png)](screenshot.png)

**This plugin only provides hash generation.** For usage with CDNs, refer to Kirby's official [`cdn-plugin`](https://github.com/getkirby-plugins/cdn-plugin)!

Getting started
---------------

[](#getting-started)

Use one of the following methods to install & use `kirby-sri`:

### Git submodule

[](#git-submodule)

If you know your way around Git, you can download this plugin as a [submodule](https://github.com/blog/2104-working-with-submodules):

```
git submodule add https://github.com/S1SYPHOS/kirby-sri.git site/plugins/kirby-sri

```

### Composer

[](#composer)

```
composer require S1SYPHOS/kirby-sri

```

### Clone or download

[](#clone-or-download)

1. [Clone](https://github.com/S1SYPHOS/kirby-sri.git) or [download](https://github.com/S1SYPHOS/kirby-sri/archive/master.zip) this repository.
2. Unzip / Move the folder to `site/plugins`.

Make sure the folder name is `kirby-sri`.

### Activate the plugin

[](#activate-the-plugin)

Activate the plugin with the following line in your `config.php`:

```
c::set('plugin.kirby-sri', true);

```

Kirby's built-in helper functions `css()` and `js()` will now include an `integrity` attribute alongside the matching SRI hash. If you want to activate `kirby-sri` only on specific domains, read about [multi-environment setups](https://getkirby.com/docs/developer-guide/configuration/options).

Configuration
-------------

[](#configuration)

Change `kirby-sri` options to suit your needs:

OptionTypeDefaultDescription`plugin.kirby-sri.algorithm`String`sha512`Defines the cryptographic [hash algorithm](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) (currently the allowed prefixes are `sha256`, `sha384` and `sha512`).`plugin.kirby-sri.crossorigin`String`anonymous`Defines [crossorigin attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_settings_attributes).`plugin.kirby-sri.fingerprinting`Boolean`true`Optionally enables / disables fingerprinting.Cache-busting / Fingerprinting
------------------------------

[](#cache-busting--fingerprinting)

[Same old, same old](https://www.keycdn.com/support/what-is-cache-busting/). If anyone comes up with a solution how subresource integrity and cache-busting / fingerprinting could be achieved by different plugins (as all of them modify Kirby's built-in helper functions `css()` and `js()`), feel free to open a PR! Otherwise, follow the next steps:

### Apache

[](#apache)

If you're using [Apache](http://httpd.apache.org/) as your webserver, add the following lines to your `.htaccess` (right after `RewriteBase`):

```
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.+)\.([0-9]{10})\.(js|css)$ $1.$3 [L]

```

### NGINX

[](#nginx)

If you're using [NGINX](https://nginx.org/en/) as your webserver, add the following lines to your virtual host setup:

```
location /assets {
  if (!-e $request_filename) {
    rewrite "^/(.+)\.([0-9]{10})\.(js|css)$" /$1.$3 break;
  }
}

```

**Note: SRI hash generation & cache-busting are not applied to external URLs!**

Be safe - use protection!
-------------------------

[](#be-safe---use-protection)

**Always use https:// URLs** when loading subresources from a CDN, otherwise they might get blocked:

> Mixed content occurs when initial HTML is loaded over a secure HTTPS connection, but other resources (such as images, videos, stylesheets, scripts) are loaded over an insecure HTTP connection. This is called mixed content because both HTTP and HTTPS content are being loaded to display the same page, and the initial request was secure over HTTPS. Modern browsers display warnings about this type of content to indicate to the user that this page contains insecure resources. [Google Developers](https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content)

Credits / License
-----------------

[](#credits--license)

`kirby-sri` was inspired by Kirby plugins [cachebuster](https://github.com/getkirby-plugins/cachebuster-plugin) (by Kirby team members [Bastian Allgeier](https://github.com/bastianallgeier) and [Lukas Bestle](https://github.com/lukasbestle)) as well as [fingerprint](https://github.com/iksi/kirby-fingerprint) (by [Iksi](https://github.com/iksi)). It is licensed under the [MIT License](LICENSE), but **using Kirby in production** requires you to [buy a license](https://getkirby.com/buy). Are you ready for the [next step](https://getkirby.com/next)?

Special Thanks
--------------

[](#special-thanks)

I'd like to thank everybody that's making great software - you people are awesome. Also I'm always thankful for feedback and bug reports :)

###  Health Score

28

—

LowBetter than 54% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity14

Limited adoption so far

Community12

Small or concentrated contributor base

Maturity55

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 97.9% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~6 days

Total

3

Last Release

2979d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/5933072731cd628e1ef2bdc59bc81da16dac859145a3be2dc5c83aab9095179b?d=identicon)[S1SYPHOS](/maintainers/S1SYPHOS)

---

Top Contributors

[![S1SYPHOS](https://avatars.githubusercontent.com/u/12161504?v=4)](https://github.com/S1SYPHOS "S1SYPHOS (46 commits)")[![yoanmalie](https://avatars.githubusercontent.com/u/3357171?v=4)](https://github.com/yoanmalie "yoanmalie (1 commits)")

---

Tags

cache-bustingcdnfingerprintingkirbykirby-cmskirby-pluginphpprotectionsafetysrisubresource-integrity

### Embed Badge

![Health badge](/badges/s1syphos-kirby-sri/health.svg)

```
[![Health](https://phpackages.com/badges/s1syphos-kirby-sri/health.svg)](https://phpackages.com/packages/s1syphos-kirby-sri)
```

###  Alternatives

[rainlab/blog-plugin

Blog plugin for October CMS

17257.7k](/packages/rainlab-blog-plugin)[rainlab/builder-plugin

Builder plugin for October CMS

17147.2k1](/packages/rainlab-builder-plugin)[pfefferle/wordpress-activitypub

The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.

5671.4k1](/packages/pfefferle-wordpress-activitypub)[civicrm/civicrm-drupal-8

Open source constituent relationship management for non-profits, NGOs and advocacy organizations.

18238.1k2](/packages/civicrm-civicrm-drupal-8)[mediawiki/semantic-glossary

A terminology markup extension with a Semantic MediaWiki back-end

1352.4k](/packages/mediawiki-semantic-glossary)[humanmade/lottie-lite

A lightweight Lottie Animations Extension for WordPress

374.3k](/packages/humanmade-lottie-lite)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)