If they can modify the content on a website, they can modify the content hashes on the index page. I suppose you could put the content hashes on an https page...
>> Could you not solve 1 by having an HTTPS index page with content hashes?
> I suppose you could put the content hashes on an https page...
Aren't these the same thing?
Yes, I meant using https for a subsection instead of the entire page as a solution, my comment reluctantly recognising the parents solution as valid.
If they can modify the content on a web site, they can modify the data hosted on the site, in place.