Third-party scripts: the performance cost of every tag

Analytics, chat, heat maps, ads, embeds: each tag is code from another server on every page. What each costs in speed and how to keep the list short.

3 minread 687words last updated

The short answer

Analytics, a chat widget, a heat map tool, an ad pixel, a review badge, a font service, a video embed, a tag manager holding a dozen more: each is code from another company’s server, loaded on every page, running on every visitor’s device. Each costs a connection, a download, parsing and execution, and most go on to make further requests of their own. The costs compound. On many business websites the tags weigh more and run longer than everything the developers built, and the visitor pays for it most at the worst moment: when they tap something and the page is busy running someone else’s script.

What one tag costs

CostWhat happensVisible effect
ConnectionA new server to look up, connect to and negotiate encryption withDelay before anything from it arrives
DownloadThe script itself, often large, often not cachedBandwidth, especially on mobile
Parse and executeThe visitor’s device runs the code on the main threadDelays rendering and blocks interaction
Secondary requestsThe script loads more scripts, images and dataMore of all the above
Ongoing workListeners, polling, session recordingContinuous main-thread cost while the page is open
Layout and paintInjected banners, badges and widgetsLayout shift, repaints

Keeping the list short

  1. Inventory every tag, including those inside tag managers: name, purpose, owner, who reads its output, last decision it informed.
  2. Remove tags with no owner, no reader or no decision. This is usually a third of the list on a mature site.
  3. Consolidate overlapping tools: two analytics, three pixels, a heat map nobody opens.
  4. Load late what remains: after the page is interactive, after consent where required, on interaction for chat and embeds.
  5. Self-host fonts and any library that can be bundled.
  6. Measure the field data before and after; the interaction and largest-content numbers usually move visibly.
  7. Gate additions: a new tag needs an owner, a purpose and a performance check before it ships.

What a lean site looks like

One privacy-respecting analytics tool, loaded after the page is interactive. Fonts self-hosted. Chat and embeds loaded on interaction. No tag manager, or one with a short, owned list. A content security policy that lists exactly which third-party servers the page may talk to, which doubles as the inventory. The result is a site whose speed is decided by its own code and images, which the team controls, rather than by a dozen vendors, which nobody does.

What this means for you

Every tag on your site is a decision to make your pages slower for a purpose. Make the decisions explicit: inventory, owner, purpose, load timing. Remove what nobody uses, load the rest late and after consent, self-host what you can. The site gets faster in the numbers search engines use, visitors stop waiting on scripts they never asked for, and the consent banner starts telling the truth.

Written by the CivSec S.M.A.R.T team

We build and run websites, software and AI systems for businesses. We write about what we see in that work, in plain language, and we update articles when things change.

Last checked . Spotted something outdated? Tell us.

Frequently asked questions

Marketing says every tag is necessary. How do we decide?

Ask three questions per tag: who looks at its data monthly, what decision it changed in the last quarter, and what it costs the visitor in milliseconds. Tags with no owner or no decision behind them go. The rest are loaded as late as possible. A large part of the list can go without anyone noticing.

Does a tag manager solve this?

It makes adding tags easier, which is the opposite of the problem. It can help by centralising consent and loading rules, but a tag manager with years of accumulated tags is the most common source of slow business sites. Audit what is inside it before assuming it helps.

Do fonts and embeds count as third-party scripts?

Fonts from a third-party service cost connections and delay text rendering; self-hosting them removes both. Video and social embeds are among the heaviest third-party loads on the web; load them only when the visitor interacts. Both belong on the same inventory as the tracking tags.

Sources

  1. web.dev: Optimize third-party JavaScript (accessed 2026-09-11)