Language Switcher Hooks

WordPress Filters relating to the language switcher scripts served by the Weglot CDN

When your project uses a switcher template, Weglot loads the corresponding script from cdn.weglot.com:

<script id="weglot-switcher-underline_edge-js" src="https://cdn.weglot.com/switchers/underline_edge.812411f0d5ee3549e026c42e4ccb6166888df6a4.min.js"></script>

Subresource Integrity on the switcher scripts, and the filter that disables it, are available since Weglot 6.3. Earlier versions render the script tag without an integrity attribute.

Integrity of the scripts served by the CDN

The long hexadecimal string in the filename is a cache-busting identifier. It tells the CDN which build to serve, and it lets that file be cached forever — the CDN answers with cache-control: public, max-age=31536000, and a new build always gets a new filename. It does not let the browser verify the bytes it received.

That verification is what Subresource Integrity (SRI) provides, and Weglot enables it for you. Alongside each template hash, https://cdn.weglot.com/switchers/versions.json publishes a SHA-384 digest:

{
  "name": "underline_edge",
  "hash": "812411f0d5ee3549e026c42e4ccb6166888df6a4",
  "integrity": "sha384-CZNjAG4i1RQE7vG/pwnVcrKXI07L/LiE1Yh74wEJ7apQRJDDTLqMguiMHo+rSxTf"
}

The plugin reads that digest and renders it on the tag, together with the crossorigin attribute SRI requires:

<script integrity="sha384-CZNjAG4i1RQE7vG/pwnVcrKXI07L/LiE1Yh74wEJ7apQRJDDTLqMguiMHo+rSxTf" crossorigin="anonymous" id="weglot-switcher-underline_edge-js" src="https://cdn.weglot.com/switchers/underline_edge.812411f0d5ee3549e026c42e4ccb6166888df6a4.min.js"></script>

The browser then hashes the file it downloaded and refuses to execute it if the digest does not match. You do not have to configure anything — this is on by default.

The digest is only attached when the build your project points to is the one currently published in versions.json. A project pinned to an older template build gets no integrity attribute, because the digest would belong to a different file and the browser would reject a perfectly legitimate script.

weglot_switcher_sri_enabled

Disables the integrity and crossorigin attributes on the switcher scripts.

Argument	Type	Description
$enabled	bool	true by default. Return false to disable SRI.
$handle	string	Handle of the script being rendered

SRI fails closed: when the digest does not match the bytes received, the browser drops the script entirely and falls back to nothing — the language switcher simply does not appear, and the only trace is a message in the browser console.

In practice this happens when something between Weglot and the browser rewrites the script after the tag has been generated. Front-end optimization plugins that proxy or re-serve external scripts from their own domain are the usual cause.

Use case

Turn it off everywhere:

<?php

add_filter( 'weglot_switcher_sri_enabled', '__return_false' );

Or only for a given template, keeping the protection on the others:

<?php

add_filter( 'weglot_switcher_sri_enabled', function ( $enabled, $handle ) {
    return 'weglot-switcher-default' !== $handle;
}, 10, 2 );

Only reach for this filter if you have confirmed in the browser console that a switcher script is being blocked for an integrity mismatch. Disabling SRI removes the guarantee that the script executed by your visitors is the one Weglot published.