How to Audit Third-Party Scripts on Your Website
Tag managers, pixels, chat widgets, and review apps accumulate until they slow every page. Learn how to inventory third-party scripts, measure what each costs, decide what to remove or defer, and stop them piling up again.
Short answer: list every external script your pages load, find an owner for each, measure its cost in bytes, main-thread time, and requests, and ask whether anyone uses what it provides. Remove the unused, defer the non-essential until after the page is interactive, and load heavy widgets only on interaction. Then add a rule that nothing new goes in without an owner and a review date.
Table of Contents
Why Scripts Accumulate
Every script was added for a reason. A campaign needed a pixel. Someone trialled a heatmap tool. An app was installed and uninstalled, leaving its snippet. A tag manager made adding a tag a two-minute job with no engineering review.
Nobody removes them, because nobody knows which are still needed, and removal carries a risk that adding never seemed to.
What They Cost
| Cost | Detail |
|---|---|
| Download | Bytes competing with your own content |
| Main-thread time | Parsing and running, which blocks interaction, worst on slow phones (low-end Android) |
| Connections | Each new domain needs DNS, connection, and TLS setup |
| Chains | A script that loads another script that loads three more |
| Layout shift | Widgets that inject content (CLS) |
| Reliability | If the vendor is slow or down, a blocking script stalls your page |
| Privacy | Each vendor receives visitor data, with consent and contract implications |
| Security | A compromised third-party script runs with full access to your page |
| Money | Subscriptions nobody uses (tool sprawl) |
The security and privacy rows are not hypothetical. A script on your checkout page can read what is typed there. Fewer vendors is a smaller risk.
The Audit
1. Inventory.
Open your main page types (home, product or feature, checkout or signup) in browser developer tools. In the network panel, filter to scripts and group by domain. Note every third-party domain. Do this in a private window, after accepting consent, so consent-gated scripts load.
Check three places for sources:
- The page HTML and templates.
- The tag manager, including paused and legacy tags.
- Apps and plugins on your platform, including uninstalled ones that left code behind.
2. Record each one.
| Field | Example |
|---|---|
| Script and vendor | Review widget |
| Purpose | Show product reviews |
| Owner | Marketing, a named person |
| Pages loaded on | All |
| Pages needed on | Product pages |
| Transfer size | From the network panel |
| Main-thread time | From a performance recording |
| Loads other scripts? | Yes, three |
| Sets cookies or collects data? | Yes |
| Consent category | Marketing |
| Last time anyone used its output | Unknown |
| Monthly cost |
3. Measure.
Run a performance recording with processor throttling. The summary by third-party domain shows which scripts consume main-thread time. To isolate one script's effect, block its domain in developer tools and reload.
4. Ask the owner two questions. What decision did this tool inform in the last three months? What breaks if it is removed?
A script with no owner and no answer is a removal candidate.
Remove, Defer, or Keep
| Finding | Action |
|---|---|
| No owner, no use | Remove |
| Duplicate of another tool | Remove one |
| Pixel for a channel you no longer advertise on | Remove |
| Needed on some pages only | Load only there |
| Useful but not needed for first interaction | Defer until after load or idle |
| Heavy widget (chat, video, map) | Load on interaction with a lightweight placeholder |
| Needed early (consent manager) | Keep, load efficiently |
| A/B testing script that hides the page while it loads | Reconsider; it delays every visit |
Loading patterns:
<!-- Does not block HTML parsing -->
<script src="https://example-vendor.com/widget.js" async></script>For a chat or video widget, show a static button or thumbnail, and load the real script when it is clicked. Most visitors never use it, and none of them pay for it.
Remove one thing at a time, and watch for a week. Check that the conversions, reports, and features that depended on it still work. Keep a log so a change can be reversed.
After each removal, compare real-user LCP and INP for the affected pages (performance).
The Analytics Script Itself
A behavior analytics tool is a third-party script, and should be held to the same standard. Questions to ask of any vendor, including DeepSync:
- Does it load asynchronously?
- How large is it, and does it load more on demand?
- What does it do on the main thread?
- What does it send, and to where (what a tracking script sends)?
- Does it respect consent before recording?
DeepSync's script loads asynchronously and records nothing before consent by default (do analytics scripts slow your site?). One practical point: a tool that combines recordings, heatmaps, funnels, and error tracking replaces several separate scripts, which is a reduction in itself. Whether that holds for you depends on what you currently run. Measure before and after.
If you use a Content Security Policy, the audit doubles as your allow-list review (CSP for analytics scripts).
Keeping It Clean
- Every script has a named owner and a review date.
- Tag manager changes need a second person's approval.
- A performance budget: a maximum third-party script weight per page.
- Audit twice a year, and after every campaign ends.
- Remove trial tools when the trial ends.
- Document it. The inventory table is the document.
Block one domain and reload
In developer tools, block a single third-party domain and compare the page's load. Seeing a second disappear makes the case better than any report.
Key Takeaways
- Scripts accumulate because adding is easy and removing is nobody's job.
- Inventory, find owners, measure cost, ask what each is used for.
- Remove the unused; defer or load on interaction the rest.
- Require an owner and review date for every new script.
Conclusion
Every script on your page is something you are asking each visitor's phone to do. Keep the ones that earn it.
Frequently Asked Questions
Related articles
Stay in the loop
Get the latest insights on product analytics and user behavior delivered to your inbox.
