Third-party scripts are your biggest security and speed risk

A script tag pointing at another company's server gives that company the ability to run any code on your pages, read anything on them, and change what your customers see. That is the deal, and it is the same deal for analytics, chat, reviews and consent tools alike.

Why this is not theoretical

Card-skimming attacks work exactly this way: compromise a widely-embedded script, add a few lines that copy checkout form fields to another server, and every site using it starts leaking payment details. The sites are not breached; a supplier is, and the sites carry the consequence.

The same mechanism explains the speed problem. Each script blocks the main thread, and none of them coordinate. Ten independently reasonable additions produce one badly performing page.

Reducing the exposure

1. 01Count them. Open the network tab and list every third-party domain. On most stores the number surprises people, and several belong to tools nobody uses.
2. 02Remove what you do not use. Free, immediate, and the single highest-value item.
3. 03Keep third-party scripts off checkout. If one page must be clean, it is the one handling payment details.
4. 04Add a Content Security Policy listing the origins allowed to run scripts. It will not stop a compromised approved vendor, but it stops injection from anywhere else.
5. 05Use subresource integrity where the vendor supports a pinned version, so altered files are rejected.
6. 06Prefer server-side integrations where a choice exists. Data that never enters the browser cannot be read from it.

The vendor questions worth asking

• What does the script access, and does it read form fields?
• Can we pin a version, or does the URL always serve the latest build?
• Which sub-vendors does the script load in turn? Some load several more.
• What is the disclosure process if you are compromised?

A reasonable policy

Every third-party script needs a named owner and a reason. Review the list twice a year and remove anything nobody can justify. Most sites can drop a third of their scripts on the first pass with no loss of function, which is a rare change that improves security, speed and cost simultaneously.