Insights · Field note · Growth and AI visibility
Third-party tags as an unmanaged attack surface
Every script loaded from another domain runs with the page’s privileges. Most sites cannot say who added theirs or what they do.
A third-party tag is a script the page loads from someone else’s server. It executes in the visitor’s browser with the same access as the site’s own code: it can read forms, capture keystrokes, alter the page and send data anywhere. Marketing sites accumulate dozens over years, added by agencies and tools that have since departed. They slow the page, leak visitor data and, if the vendor is compromised, become the site’s compromise. The tag inventory is where performance, privacy and security work begin, and it almost always ends with removals.
In detail
What the evidence shows.
What a tag can do
Anything the page can. Read what the visitor types into a form before it is submitted. Modify content. Load further scripts from further domains. Send data to endpoints nobody reviewed. A tag manager makes adding them easy and makes the inventory invisible, because the page source shows one script that loads the rest.
How they accumulate
A campaign needs a pixel. An agency installs its tool. A chat vendor is trialed and never removed. A heatmap is added for a redesign that shipped two years ago. Each had a reason once; nobody owns it now. In our audits (first-hand: David Selakovic) the inventory regularly surprises the people responsible for the site.
The security and privacy cost
A compromised vendor script is a supply chain attack on every site that loads it, and payment and intake forms are the usual target. For regulated practices, tags sending visitor behavior to advertising platforms are disclosures. A content security policy that lists allowed sources explicitly is the control, and it cannot be written until the inventory exists.
The procedure
Capture every script from real visits. List vendor, purpose, owner, data flow and performance cost. Classify, decide, remove, confirm removal, document what was measured before and how it is measured now, and set the rule that new tags require an entry. The tag inventory worksheet covers it; see security hardening of the marketing stack.
Sources
Primary references.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days