Free tool · No signup

Third-party script audit

Each outside script slows your page, and many share visitor data. See which third parties your site calls, what each one costs and which you could drop.

No signup · Results in ~40 seconds · Nothing stored except the shareable report

What we check and why

What we look at

Third parties are any services loaded from a domain that is not yours: Google Analytics and Tag Manager, advertising pixels, Google Fonts, YouTube and Maps embeds, chat widgets, booking tools, review badges and CDNs for libraries. We combine two views of them.

Performance: Lighthouse's third-party summary with each entity's transfer size and main-thread blocking time, and the share of JavaScript that comes from outside your domain.
Privacy: the third-party hosts contacted on a first visit, trackers recognised among them, cookies set before consent, Google Fonts loaded from Google's servers and video or map embeds.

Why third parties deserve scrutiny

Every third party adds a DNS lookup, a connection and code you do not control. A chat widget or an embedded video can weigh more than the rest of your page together, and a slow tag can delay interaction for every visitor. When a provider has an outage or changes its code, your site changes with it.

Privacy matters at least as much. Under the GDPR and ePrivacy rules, scripts that store or read identifiers on the visitor's device for non-essential purposes generally need prior consent, and loading a resource from a third party discloses the visitor's IP address to that provider. In 2022 the Regional Court of Munich held that embedding Google Fonts from Google's servers without consent violated a visitor's rights.

Reducing the list

Go through the table and ask of each entry: do we still use this, does it bring clients, and could it load later or locally? Self-host fonts, replace YouTube and Maps embeds with a click-to-load preview, remove old pixels from campaigns that ended, and load chat widgets only after interaction or consent.

Keep a short register of the services that remain, what data they receive and which consent category they belong to. That makes your cookie banner accurate and your privacy policy easier to keep up to date.

Questions to ask each vendor

For every third party you keep, ask the provider whether it sets cookies or identifiers, where it processes data, whether it offers an EU hosting option and whether a data processing agreement is available. Their answers decide whether the script belongs in the necessary, analytics or marketing category of your consent banner, and what you need to say in your privacy policy.

Frequently asked questions

Is loading Google Fonts from Google illegal?

A 2022 Munich court decision found it unlawful without consent in the case before it. It is not an EU-wide ruling, but self-hosting fonts avoids the question entirely and is usually faster.

Does a CDN for jQuery count as a third party?

Yes. Public CDNs receive visitors' IP addresses and are another dependency. Bundling or self-hosting the file is simple.

How do you identify trackers?

We match the contacted hosts against a list of known analytics, advertising and session-recording services, and look at cookies and storage set during the visit.

Can I keep YouTube videos on my site?

Yes. Use a preview image that loads the player only on click, or YouTube's privacy-enhanced mode combined with consent, to avoid loading it for everyone.