Third-party scripts are house guests

View the source on most business websites and you’ll find a party you didn’t know you were hosting.

There’s a chat widget nobody has staffed in years, still cheerfully offering to help. A pixel from an ad campaign that ended two agencies ago. An A/B testing tool for a test that concluded, a heatmap service from a free trial someone forgot to cancel, two font providers, an old tag manager living inside a new tag manager, and a file called tracker-v2.min.js that no current employee can explain.

Every one of them is a house guest. And every guest, however polite, uses the bathroom, eats out of the fridge, and leaves the lights on.

What guests cost

Speed, first. Each script is code your visitor’s phone has to download, parse, and execute before or alongside your actual content, and some of them invite friends: one tag quietly loads three more, and the page you built to load in a second now takes five on a weak connection in a parking lot. You optimized your images for nothing.

Privacy, second. These guests don’t stay in the guest room. They watch who comes to your door, note what visitors look at, and phone home about it. People didn’t agree to that; they agreed to visit you. Whatever those scripts collect gets collected under your name, on your domain, and increasingly under laws that consider it your responsibility.

Reliability, third. When a third-party service has a bad day, your site has a bad day. Their outage becomes your blank page, and their security problem becomes your security problem.

A guest with a key can lose the key.

The audit

Once or twice a year, walk through the house. It takes an afternoon, and it goes like this:

1. List every third-party script the site loads. Not the ones you think it loads; the ones it actually loads. Open the browser’s network tab and let the page run.
2. For each one, ask three questions. Who invited it? What job does it do today? Who looks at what it produces?
3. Anything with no owner and no current job gets removed. Removed, not “commented out to be safe.”
4. Wait two weeks and see who complains. In our experience: almost nobody, almost ever. The dashboards those scripts were feeding were usually screensavers anyway.
5. Reinvite the survivors properly. Load them late, load them politely, and document each one somewhere with a name next to it.

That last step is the one that matters. A script with a written owner and a written reason is a guest. A script without either is a squatter, and squatters accumulate, because adding one is a two-minute favor to somebody in marketing and removing one requires a meeting.

Tag managers deserve a special mention here, because they were sold as the fix and became the side door. The pitch was control: one container, everything in one place. In practice, a tag manager lets anyone with a login invite new guests without ever talking to the people who maintain the house, which is how a site ends up hosting scripts its own developers have never heard of. Audit the container with the same suspicion as the source code. It’s where the party actually happens now.

Why the house fills up

None of these scripts arrived through negligence. Each one solved a real problem for a real person on a real Tuesday. The campaign needed a pixel. Sales wanted chat. Somebody read that heatmaps were insightful. Every individual invitation was reasonable, which is exactly why nobody ever felt the moment the house crossed from lived-in to crowded.

That’s the trap with accumulation generally, and it’s why the audit has to be a calendar event rather than a mood. You will never wake up feeling like today’s the day to count your scripts. The site doesn’t send you a notification when it gets slow; it just quietly starts losing the people who visit it, one impatient thumb at a time.

Good guests have two qualities: a reason to be there and a departure date. Your website deserves the same standard as your guest room.

It’s your house. Check who’s in it.