CDN. There's a higher likelihood that a user of your site would have it cached, considering how popular Bootstrap is, and if it doesn't bother you that you're serving traffic through and directing users to a third-party.<p>Consider using Subresource Integrity [1][2] to pin a particular checksum to the particular version served from the CDN, for some extra assurance that the CDN is delivering correct file. This, of course, only works if you link to a static file that's unlikely to change, and not, say, 'bootstrap-latest.css'.<p>[1] <a href="https://www.w3.org/TR/2016/REC-SRI-20160623/" rel="nofollow">https://www.w3.org/TR/2016/REC-SRI-20160623/</a><p>[2] <a href="https://www.w3.org/TR/2016/REC-SRI-20160623/#use-casesexamples" rel="nofollow">https://www.w3.org/TR/2016/REC-SRI-20160623/#use-casesexampl...</a>