Third-party scripts auditWhat it checks and how to fix it

What it checks

Lists the scripts the page loads from other domains and sorts them into analytics, advertising, social, CDN and other. It warns when more than three of them load without async or defer (render-blocking) or when there are more than ten in total, and passes otherwise.

Why it matters

Every third-party script is code you do not control running on your page with full access to it. Each one adds DNS lookups, connections and download time, and a synchronous one stops the page from rendering until that other server answers: if it is slow or down, so is your site. They also widen the attack surface (a compromised vendor script can skim forms) and often send visitor data to companies your privacy policy does not mention.

How to fix it

Start by listing what each script is for and removing the ones nobody uses any more. Then load the rest without blocking the page:

<!-- Blocks rendering until the vendor answers -->
<script src="https://widget.example-vendor.com/widget.js"></script>

<!-- Runs after the HTML is parsed, in order -->
<script src="https://widget.example-vendor.com/widget.js" defer></script>

<!-- Runs as soon as it arrives, in any order: fine for analytics -->
<script src="https://analytics.example-vendor.com/a.js" async></script>

Warm up the connection to vendors you keep:

<link rel="preconnect" href="https://widget.example-vendor.com" crossorigin>

Libraries served from a public CDN (jQuery, Bootstrap...) are usually better bundled with your own assets. If you do keep them on a CDN, pin the version and add Subresource Integrity:

<script src="https://cdn.jsdelivr.net/npm/lib@1.2.3/dist/lib.min.js"
        integrity="sha384-..." crossorigin="anonymous" defer></script>

Load heavy widgets such as chat, video or maps only when the visitor interacts with them.