# require-sri-for (/en/docs/web-security/policies/content-security-policy/directives/require-sri-for)



The `require-sri-for` Content Security Policy (CSP) directive would have forced
[Subresource Integrity (SRI)](/en/docs/web-security/other/subresource-integrity)
checks on scripts and stylesheets, blocking any that lacked an `integrity`
attribute. It never shipped to a stable browser and was abandoned.

<Callout type="error" title="Deprecated">
  `require-sri-for` never shipped to stable; it existed only behind an experimental Chrome flag and was abandoned over compatibility risk (too many pages would break once the requirement turned on). The design was folded into the [Integrity-Policy](/en/docs/web-security/policies/integrity-policy) header, which is the replacement.
</Callout>

Use the replacement instead:

```http
Integrity-Policy: blocked-destinations=(script)
```

## What you should do instead [#what-you-should-do-instead]

Use the [Integrity-Policy](/en/docs/web-security/policies/integrity-policy)
header, which took over the same goal: requiring SRI on the resources a page
loads. The example above blocks scripts that lack integrity metadata.

Delete `require-sri-for` from any policy that still carries it; it has no
effect in any browser. To add the `integrity` attributes themselves, our
[SRI guide](/en/docs/web-security/other/subresource-integrity) covers the
mechanics, and the [SRI generator](/tools/sri-hash) computes the hashes
for you.

## Why it was removed [#why-it-was-removed]

`require-sri-for` only ever ran behind an experimental flag in Chrome and never
reached stable in any browser. It was abandoned over compatibility risk: too
many pages would break the moment the requirement turned on. The design was
later folded into the `Integrity-Policy` header, which ships with a
report-only variant so sites can measure breakage before enforcing.

## Browser support [#browser-support]

No browser supports `require-sri-for`. It existed only behind an experimental
Chrome flag and was never shipped by Firefox or Safari. The
[Integrity-Policy](/en/docs/web-security/policies/integrity-policy) header is
the supported way to require SRI.

## See also [#see-also]

* [Integrity-Policy](/en/docs/web-security/policies/integrity-policy), the header that replaced it
* [Subresource Integrity](/en/docs/web-security/other/subresource-integrity)
* [Directives index](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives)
* [Generate SRI hashes](/tools/sri-hash) with the SRI generator

## Sources [#sources]

* [Chrome Platform Status, require-sri-for](https://chromestatus.com/feature/5635811978510336)
* [MDN, Integrity-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Integrity-Policy)