Your website is not one thing arriving from one place. A single page view can pull in a dozen separate files from a dozen separate companies: the fonts, the analytics, the chat bubble, the cookie banner, the map, the booking widget, the thing that makes the pictures fade in. Each one is a connection from your visitor’s browser to somebody else’s server.
Most website owners have never seen that list. It is worth seeing once.
The one we found on our own site
While going through our own pages this week we found a script that was contacting an outside company on every single page view. Nine separate requests, one of them checking whether the visitor was signed in to that company’s service.
It was not malicious and nothing was being sold. It was a leftover: an editing tool, useful to whoever builds a site, completely useless to anybody visiting one. It had simply never been switched off. Every visitor to those pages had their address and browser passed to a company that had no reason to receive them, for a feature none of them could use.
We removed it, checked the pages afterwards to be sure nothing depended on it, and nothing did. That is the shape this usually takes - not a scandal, just something nobody looked at. Which is exactly why it is worth looking.
What a third-party script actually is
When your page loads, your visitor’s browser does what the page tells it to. If the page says "fetch this file from another company", the browser goes and fetches it - and in doing so hands that company the visitor’s IP address, what browser and device they are on, and which page of yours they were looking at. That happens before the visitor clicks anything and whether or not they ever use the feature the script provides.
That is not a loophole; it is how the web works, and it is how the useful things work too. The question is never "are there third parties" - there always are. It is whether you know which ones, and whether each one is still earning its place.
Why it is worth knowing
- Your privacy policy should be true. If it lists two companies and your pages contact six, the document is wrong - and it is the one page a cautious customer actually reads.
- Things left running tend to stay running. A tool added for a campaign two years ago is usually still loading for every visitor long after anyone stopped reading its reports.
- Every extra connection is a thing that can go wrong. If one of those companies has a bad morning, the slow part of your page is the part you did not choose.
- You cannot decide what you cannot see. Most owners have never been shown the list, so the decision has never actually been made.
How to see your own list in five minutes
Three ways, in order of how little you need to know.
- Our free check. Put your address into the free website audit. Among other things it looks at what your pages load and how your server is set up, and reports it in plain words.
- Your own browser. Open your site, press F12, click the Network tab, reload the page. You will see every file the page fetched and which company it came from. Sort by the domain column and read the names. Anything that is not your own address came from somewhere else.
- Ask whoever built it. "Please send me the list of third-party services the site loads, and what each one is for." Any developer can answer that in ten minutes, and the answer is worth keeping.
What to keep and what to cut
A simple test: does a visitor get anything from this, or do only you?
- Keep what the visitor uses. The map that shows them where you are. The booking widget. The payment provider. The chat window, if somebody actually answers it.
- Keep what you genuinely read. One analytics tool you look at is worth more than three you installed and forgot. If you have not opened a dashboard in six months, that is your answer.
- Cut the leftovers. Tools from finished campaigns, builder and editor scripts, anything added "to try" and never reviewed. These are the ones that cost everybody something and return nothing to anyone.
- Be deliberate about the rest. Session recording and heat mapping are genuinely useful, and they also watch people quite closely. That is a decision worth making on purpose rather than by default.
The honest part about speed
You will read that removing third-party scripts makes a site dramatically faster. We wanted to know by how much, so we measured it properly on our own site - the page loaded five different ways, twice each, on a throttled connection, with different combinations switched off.
The results contradicted each other. Removing two tools scored worse than removing one. Removing everything scored worse than removing one. In other words the difference between one run and the next was larger than the difference the tools made, which means the effect was too small to see through the noise - on that site, on that day.
So we kept them. The reason to tidy up what your pages load is that you should know what your visitors are handed and your privacy policy should be true. Speed may come with it and may not. Anyone promising you a specific improvement before measuring your site is guessing, and you are entitled to ask what they measured.
What to do about the ones you keep
- Write them into your privacy policy by name. What each one is, what it collects, why it is there. It takes an afternoon once.
- Load them after the page, not before it. Anything that is not needed to draw the page should not be allowed to delay it. That is a one-line change your developer will recognise.
- Review the list once a year. Put it in the calendar next to the domain renewal. Five minutes, and it stops the slow accumulation that got you here.
None of this requires you to become technical. It requires somebody to look once, write down what is there, and decide. If you would rather that was simply handled, it is part of what a care plan covers - along with the less visible housekeeping like keeping the software underneath your site current.