Third-party scripts audit

A third-party scripts audit is a one-time review of all external scripts and tags on the site (analytics systems, ad pixels, chats and widgets, A/B tools, maps, fonts, tags in Google Tag Manager and similar): an inventory as complete as possible — what is there, from whom, why and where; the impact on speed and rendering (heavy and render-blocking scripts, duplicate counters); what data the scripts send and where (overlap with privacy); whether they fire before consent; whether there are unknown, forgotten or potentially unsafe scripts and supply-chain risks (you do not control external code); the load order and options to defer or load asynchronously. Honestly about the main point: this is diagnosis and prioritized recommendations, not removal, tag-manager configuration or development — making changes is separate work, by us or by your team. And it is not a guarantee of speed-up or security: speed also depends on hosting, images, markup and the backend, so the effect of changes is verified by measurement, not by promising "we will speed it up by X%". Honestly about the method: the inventory is made via a scan and load analysis, and some scripts that are injected dynamically or only under certain conditions can be missed — for completeness, access to the tag manager and code is needed. Honestly about security: we flag suspicious, unknown and risky scripts, but this is not a full security audit and not a penetration test — a deep security review is done by specialized experts. Legal questions about the data the scripts send go to a lawyer (see the privacy audit). It is a snapshot in time: scripts and tags change. An important boundary: this is a third-party scripts audit; broad personal-data work is separate (a privacy audit — for example, if a store sends customer data to a third-party CRM, whether that is lawful is its question), and a full security review is done by specialized experts. If there are almost no third-party scripts, there is almost nothing to assess and you most likely do not need the audit. Picture this: instead of "the site is slow and it is unclear why" you get a list: two counters of the same system, a forgotten pixel from a long-closed campaign, a chat that loads first and blocks rendering, and one script that sends data to an unfamiliar domain — with a plan of what to remove and what to defer. The base price starts from 12,000 ₽ (this is a manual inventory and load analysis with a prioritized plan, not an automated report); it depends on the number of scripts and the complexity of the site.

• The site is slow and it is unclear which scripts are to blame.
• You do not know what third-party scripts you have and why.
• You suspect forgotten pixels, duplicate counters or extra tags.
• You are concerned about what data third-party scripts send and where.

• An inventory of scripts and tags: what, from whom, why, where
• Impact on speed and rendering (heavy, render-blocking, duplicates)
• What data the scripts send and where; firing before consent
• Unknown, forgotten and potentially unsafe scripts
• Supply-chain risks (uncontrolled external code)
• Load order, deferred and asynchronous loading
• A prioritized plan: remove, defer, replace
• What to fix technically and what to ask a lawyer / security expert

• A clear picture of which third-party scripts are present and how they affect the site
• Priorities: what to remove, defer or replace first
• Visibility of forgotten, duplicate and risky scripts
• Clarity on what is technical, what is privacy and what is a security question

• We clarify the site and goals and collect access to the site and the tag manager (without access only a partial scan-based review is possible)
• We scan and analyze the scripts: loading, data, duplicates, risks
• We prepare the inventory and a prioritized plan and review it with you

• Will the site become faster after the audit?

  The audit itself does not speed it up. Speed depends on more than scripts (also hosting, images, markup, the backend). We show which scripts slow things down and give a plan, but the effect of changes is verified by measurement; "we will speed it up by X%" cannot be promised, and making changes is separate work.

• Do you check script security?

  We flag suspicious, unknown and risky scripts and external-code risks, but this is not a full security audit and not a penetration test — a deep review is done by specialized experts. Legal questions about the data go to a lawyer.

• Will you remove extra scripts and configure the tags?

  No, that is separate work. The audit gives an inventory and a prioritized plan: what to remove, defer or replace. Making the changes and configuring the tag manager are done separately or by your team.