The hidden cost of third-party scripts
Nobody decides to have twenty-three third parties on their website. It happens one reasonable choice at a time. Marketing needs a tag for the campaign. Support wants a chat widget. A developer adds a font service. Someone embeds a video. Each decision made sense; nobody has looked at the total since.
Then you run an audit and meet the sum of it, a list of domains your pages contact that's longer than anyone in the building can explain.
A third-party script is any code your pages load from a domain you don't run. Analytics, tag managers, fonts, embedded maps and video, chat, A/B testing, ad and marketing pixels all count. The key property is in the name. It's code you don't control, and it runs on your visitors' devices under your reputation. When it changes, you don't get a pull request. You often don't get an email.
Each one bills you in three currencies.
- The first is speed. Third-party scripts are consistently among the heaviest things on a page, and the least under your control. They add megabytes, hog the main thread (that's your INP suffering), and sometimes block rendering entirely while the browser waits on a server in another jurisdiction. The cruel part is that you can optimise your own code perfectly and still fail your Core Web Vitals because of a tag someone added in 2023 for a campaign that ended in 2024.
- The second is privacy, and with it the law. Every third party your page contacts learns something about your visitor: their IP address, what page they're on, often much more. If it sets cookies or tracks before consent, then under the GDPR and the ePrivacy rules you have a compliance problem, and it carries your name, not the vendor's. This kind of problem hides well. The tracker rarely sits on the homepage anyone checks. It sits on a campaign landing page, added in a hurry and never re-tested. This is why every Webperf Cloud plan includes a cookie and third-party audit, and why Webperf Audit runs the privacy check on every page.
- The third is resilience. A third party is a dependency. It can slow down and take your page with it. It can be acquired, change owners and change behaviour. And it can be compromised, in which case your visitors receive malicious code from your pages. Frameworks like NIS2 now expect organisations to actively manage supply-chain risk of this kind.
We didn't know it was there
has stopped being an answer.
Three questions per third party
You don't fix this with heroics; you fix it with an inventory and three blunt questions per entry:
- What is it, and who owns the decision? If nobody in the organisation can say why a script is there, that's your answer already.
- What does it cost? Bytes, blocking time, data shared, pages affected. An audit gives you these numbers per third party, including how widely each one appears across your site.
- What would we lose if it left? Weigh that squarely against the cost. A chat widget used by 0.4% of visitors but loaded by 100% of them is a bad trade on most sites.
Then act, in order of preference. * Remove what nothing would miss. * Replace what has a lighter or EU-hosted alternative (self-hosted fonts instead of a font CDN, privacy-respecting analytics instead of the default). * Defer what must stay, so it loads after your content instead of in front of it. * And gate anything that tracks behind real consent.
Keep the third-party list from growing back
The inventory you just cleaned is a snapshot; the pressure that created it is permanent. Two habits keep it under control:
- Continuous auditing. New third parties show up in your regular test results the week they're added, while the person who added them still remembers why.
- A one-line policy: every new script needs a named owner and a review date. That single rule prevents most of the sediment.
Your third-party list is one of the few places where performance, privacy and security point at the same to-do list. Shortening it is the rare fix that pays out three times.
The cookie and third-party audit is included in every plan, and it lists exactly who your pages are talking to. See the plans, or email hello@webperf.cloud.