Third Party Script Detector

Third-Party Script Detector: Audit JavaScript Trackers, Marketing Pixels & PCI-DSS Compliance

An enterprise-grade, high-performance third-party script auditor, tracker classifier, PCI-DSS v4.0.1 compliance scanner, and Core Web Vitals JavaScript performance analyzer for BrowserMesh.

Inspect, classify, and audit all external subresource scripts, marketing pixels, tag managers, and payment gateways across any webpage. Built for modern 2026 Web Architecture standards—incorporating Google Consent Mode v2, Long Animation Frames (LoAF) script execution attribution, Subresource Integrity (SRI) validation, CNAME cloaking detection, and Partytown off-main-thread Web Worker execution auditing.

The premier open-access alternative to BuiltWith ($295–$995/mo), Wappalyzer ($100–$450/mo), Ghostery, and manual browser DevTools network inspection.

📑 Table of Contents

• Overview & Value Proposition
• Why Audit Third-Party Scripts?
  • 1. Core Web Vitals & Page Speed (INP, LCP, TBT)
  • 2. Payment Security & PCI-DSS v4.0.1 Compliance
  • 3. Privacy Laws & Google Consent Mode v2
• Target Audience & Industry Solutions
• Key Features & Technical Capabilities
  • 1. 15 Comprehensive Script Categories
  • 2. 22 Automated Tracking & Payment Account Regex Identifiers
  • 3. 7 Script Loading Strategies & Lazy-Loading Detection
  • 4. PCI-DSS v4.0.1 Compliance & Security Audit
  • 5. Google Consent Mode v2 & Privacy Audit
  • 6. Long Animation Frames (LoAF) Main-Thread Attribution
  • 7. Dual-Engine Architecture (Auto / HTTP / Browser)
• Calibrated 0–100 Health Scoring Engine
• Comparison with Industry Alternatives
• Configuration Schema
• Output Specification (25 Standard Fields)
• Sample JSON Output
• Actionable Remediation Guide
• Frequently Asked Questions (FAQ)

⚡ Why Audit Third-Party Scripts?

Modern websites rely on dozens of external JavaScript vendors for analytics, advertising, customer chat, session recording, and payment checkouts. However, unmonitored third-party code introduces severe performance degradations, security vulnerabilities, and regulatory compliance risks:

1. Core Web Vitals & Page Speed (INP, LCP, TBT)

• Interaction to Next Paint (INP): Heavy tag managers (Google Tag Manager, Tealium) and unoptimized third-party widgets execute multi-millisecond tasks that hijack the browser's main thread. When users click, tap, or press keys during these long tasks, interaction response is delayed, causing poor INP scores.
• Largest Contentful Paint (LCP) & First Contentful Paint (FCP): Synchronous <script src="..."> tags located in the document <head> force the browser's HTML parser to stop dead until the remote asset is downloaded and executed.
• Total Blocking Time (TBT) & Payload Bloat: Modern e-commerce sites often accumulate 1.5 MB to 4.0 MB+ of redundant JavaScript from obsolete analytics platforms and duplicate retargeting pixels, draining mobile battery and bandwidth.

2. Payment Security & PCI-DSS v4.0.1 Compliance

• Requirement 6.4.3: Mandates that merchants maintain an explicit, authorized inventory of all scripts executing in the consumer's browser on payment checkout pages, complete with written business justifications and integrity verification.
• Requirement 11.6.1: Mandates tamper-detection mechanisms to alert security personnel whenever unauthorized scripts are injected or altered (e.g., Magecart digital skimming attacks).
• Insecure Transport: Serving payment scripts or API endpoints over unencrypted HTTP exposes credit card numbers and customer tokens to eavesdropping and man-in-the-middle (MITM) tampering.

3. Privacy Laws & Google Consent Mode v2

• EU Digital Markets Act (DMA) & GDPR Enforcement: Under DMA regulations enforced across the European Economic Area (EEA), platforms utilizing Google Ads and Google Analytics must explicitly record user consent signals (ad_user_data, ad_personalization, ad_storage, analytics_storage). Failing to transmit verified consent prevents conversion tracking and audience remarketing.
• CNAME Cloaking: Ad-tech vendors frequently bypass browser ad blockers and Safari Intelligent Tracking Prevention (ITP) by setting up first-party subdomains (e.g., metrics.example.com) that secretly forward consumer tracking data to external third parties.

🎯 Target Audience & Industry Solutions

• Technical SEO Specialists & Web Performance Engineers: Identify parser-blocking scripts in <head>, high-latency tag managers (GTM, Tealium), and script payloads exceeding 1.5 MB that drag down Google Lighthouse scores and Core Web Vitals (INP, LCP, FCP).
• Payment Security & SecOps Teams (PCI-DSS v4.0.1): Fulfill Requirements 6.4.3 and 11.6.1 by generating tamper-proof script inventories on checkout pages, validating Subresource Integrity (SRI) hashes, and instantly catching plain HTTP payment gateway leaks.
• Privacy & Regulatory Compliance Officers (GDPR / DMA / CCPA / CPRA): Detect aggressive canvas and audio fingerprinting trackers, verify Consent Management Platform (CMP) presence (OneTrust, Cookiebot, CookieYes), and audit Google Consent Mode v2 DMA compliance signals.
• E-Commerce Brands & Growth Marketers: Uncover duplicate or orphaned marketing tags (e.g., multiple competing analytics suites or forgotten retargeting pixels), audit session recording tools (Hotjar, FullStory, Microsoft Clarity), and eliminate vendor script bloat.
• Frontend & Jamstack Developers: Audit script loading strategies (async, defer, module, delayed-interaction, off-main-thread), catch unoptimized third-party widgets, and profile Long Animation Frame (LoAF) main-thread execution delays.

🚀 Key Features & Technical Capabilities

1. 15 Comprehensive 2026 Script Categories

Categorizes every discovered script into one of 15 specialized categories based on 2,240+ curated entities and 3,450+ domain signatures synthesized from Google Lighthouse third-party-web, DuckDuckGo Tracker Radar, and real-world e-commerce telemetry:

• analytics: Google Analytics 4, Mixpanel, Amplitude, Plausible, Heap, Matomo, PostHog, Segment.
• advertising: Google Ads, Meta Pixel, TikTok Ads, Criteo, The Trade Desk, Taboola, Outbrain, Bing Ads.
• payment: Stripe (js.stripe.com), PayPal SDK, Razorpay, Square Web SDK, Braintree, Paddle.
• tag-manager: Google Tag Manager (GTM), Tealium, Adobe Experience Platform Launch, Segment, TagCommander.
• social: Twitter/X widgets, Facebook SDK, LinkedIn Insight Tag, Pinterest Tag, TikTok Embeds.
• customer-success: Intercom, Zendesk Web Widget, Crisp, Drift, HubSpot Live Chat, Tawk.to, Collect.chat, Gorgias.
• session-recording: Hotjar, FullStory, Microsoft Clarity, LogRocket, Smartlook, Mouseflow, ContentSquare.
• consent-provider: OneTrust, Cookiebot, CookieYes, Usercentrics, Didomi, Axeptio, Osano, Termly.
• utility: Sentry, Datadog RUM, New Relic, Bugsnag, Cloudflare Web Analytics, Loox, Swym.
• cdn: cdnjs, jsDelivr, unpkg, Google Hosted Libraries, esm.sh, AMP Project.
• hosting: Shopify CDN, Wix Static, Squarespace Assets, Webflow Assets, WordPress.com, Amazon CloudFront.
• marketing: Optimizely, VWO, Klaviyo Onsite, OptinMonster, Mailchimp, Omnisend, Poptin, Privy.
• video: YouTube Iframe API, Vimeo Player, Wistia Fast, JW Player, Vidyard.
• fraud-security: Cloudflare Turnstile, Google reCAPTCHA, hCaptcha, Fingerprint.com, PerimeterX / HUMAN Security.
• other: Unclassified or emerging third-party origins.

2. 22 Automated Tracking & Payment Account Regex Identifiers

Automatically extracts exact client, property, token, and merchant IDs directly from script attributes and inline initialization code:

• Analytics & Tags: Google Analytics 4 (G-XXXXXXXXXX), Universal Analytics (UA-XXXXX-X), Google Tag Manager (GTM-XXXXXX), Google Ads (AW-XXXXXXXXX), Google AdSense (pub-XXXXXXXXXXXXXXXX), Amplitude API Key, Mixpanel Token, Segment Write Key, Plausible Domain.
• Social & Retargeting Pixels: Meta Pixel ID (15–16 digits), Hotjar Site ID, Microsoft Clarity Project ID, TikTok Pixel ID, Pinterest Tag ID, Twitter/X Pixel ID, LinkedIn Partner ID.
• Customer Success & Error Monitoring: HubSpot Portal ID, Intercom App ID, Sentry DSN.
• Payment Gateways: Stripe Publishable Key (pk_live_..., pk_test_...), PayPal Client ID, Razorpay Key ID (rzp_live_...), Square Application ID (sq0idp-...), Braintree Token, Paddle Vendor ID.

3. 7 Script Loading Strategies & Lazy-Loading Detection

Audits script execution architecture across 7 distinct strategies to identify performance bottlenecks:

• async: Script executed asynchronously without blocking HTML parsing.
• defer: Script executed in document order after full HTML parsing.
• module: Modern ES Module (type="module") with native deferred execution.
• delayed-interaction: Lazy-loaded tracker activated on user interaction (data-src, data-rocket-src, type="text/rocketlazyloadscript").
• off-main-thread: Script executed in a background Web Worker via Partytown (type="text/partytown").
• blocking: Synchronous <script src="..."> inside <head> causing parser blocking and Core Web Vitals degradation.
• inline: Embedded <script> block without an external src. (Non-executable data elements such as <script type="application/ld+json"> and <script type="speculationrules"> are strictly filtered out).

4. PCI-DSS v4.0.1 Compliance & Security Audit

Evaluates critical security controls required for modern payment processing:

• Payment Script Security (Requirements 6.4.3 & 11.6.1): Audits payment gateways for insecure HTTP transport. Any payment script served over plain HTTP triggers an immediate Critical PCI-DSS Breach with a strict score ceiling capped at 39 (Grade F).
• Subresource Integrity (SRI): Verifies integrity="sha384-..." attributes on all shared public CDNs (cdnjs, jsDelivr, unpkg) to protect against upstream supply-chain poisoning.
• Mixed Content Alerts: Identifies insecure HTTP scripts executing on HTTPS origins.

5. Google Consent Mode v2 & Privacy Audit

Audits regulatory compliance across EU/UK DMA and GDPR standards:

• Consent Management Platform (CMP): Automatically identifies leading CMPs (OneTrust, Cookiebot, CookieYes, Usercentrics, Didomi, Axeptio, Osano, Termly) via scripts, inline APIs, and DOM container elements.
• Google Consent Mode v2 Signals: Extracts default signals for ad_storage, analytics_storage, ad_user_data, and ad_personalization, plus wait_for_update latency.
• CNAME Cloaking Detection: Flags tracking domains configured on first-party subdomains (e.g. metrics.example.com, analytics.example.com) to bypass browser tracking protections.

6. Long Animation Frames (LoAF) Main-Thread Attribution

• Leverages the modern W3C Long Animation Frames API in browser audit mode to capture main-thread execution durations of third-party scripts.
• Detects long animation frames exceeding 50ms that lead to layout thrashing, dropped rendering frames, and degraded INP scores.

7. Dual-Engine Architecture (auto / http / browser)

• HTTP Mode: Lightning-fast static fetch (~200ms) with desktop Chrome headers and redirect tracking.
• Browser Mode: Full Playwright Chromium execution with network byte tracking, synthetic user interactions (scroll, mousemove, click) to trigger delayed trackers, and LoAF telemetry.
• Auto Mode (Default): Attempts rapid HTTP fetch first; automatically escalates to stealth Chromium if Tag Managers (GTM, Tealium), dynamic client-rendered SPAs (React, Next.js), or bot protections are detected. Protected by strict deadline timeouts to ensure zero pipeline hangs.

🏆 Calibrated 0–100 Health Scoring Engine

Every webpage audited receives a calibrated composite Health Score (0–100) and a corresponding Letter Grade (A, B, C, D, E, F) based on an objective, weighted rubric:

Grade Distribution

• Grade A (90–100): Pristine / Excellent — Zero blocking scripts, fully secured payment gateways, SRI on CDNs, and active consent configuration.
• Grade B (80–89): Healthy — Fast loading with minor third-party weight or non-critical unminified tags.
• Grade C (70–79): Needs Improvement — Multiple unoptimized scripts, partial render-blocking tags, or missing SRI hashes.
• Grade D (50–69): Poor — Heavy script bloat (>1.5 MB), unclassified trackers, or multiple parser-blocking head scripts.
• Grade E (40–49): High Risk — Multiple severe vulnerabilities, invasive fingerprinting, or failing Core Web Vitals.
• Grade F (0–39): Critical / Failing — Insecure payment transport, active PCI-DSS breach, or severe security exposure.

📊 Comparison with Industry Alternatives

⚙️ Configuration Schema

📋 Output Specification (25 Standard Fields)

Each audit record strictly adheres to the 25-field schema contract:

💡 Sample JSON Output

{
  "url": "https://example-shop.com/",
  "domain": "example-shop.com",
  "statusCode": 200,
  "status": "healthy",
  "healthScore": 88,
  "grade": "B",
  "totalScriptsCount": 12,
  "thirdPartyScriptsCount": 7,
  "firstPartyScriptsCount": 5,
  "blockingScriptsCount": 0,
  "totalTransferBytes": 482000,
  "thirdPartyTransferBytes": 315000,
  "categories": {
    "analytics": 2,
    "advertising": 1,
    "payment": 1,
    "tag-manager": 1,
    "social": 0,
    "customer-success": 1,
    "session-recording": 0,
    "consent-provider": 1,
    "utility": 0,
    "cdn": 0,
    "hosting": 0,
    "marketing": 0,
    "video": 0,
    "fraud-security": 0,
    "other": 0
  },
  "entities": [
    "Google Analytics",
    "Google Tag Manager",
    "Intercom",
    "Meta Pixel",
    "OneTrust",
    "Stripe"
  ],
  "scripts": [
    {
      "url": "https://js.stripe.com/v3/",
      "domain": "js.stripe.com",
      "hostType": "external",
      "entity": "Stripe",
      "category": "payment",
      "strategy": "async",
      "transferBytes": 45000,
      "hasSri": false,
      "fingerprintRisk": 1,
      "isInHead": true,
      "isMixedContent": false,
      "isPaymentScript": true
    }
  ],
  "trackingAccounts": {
    "ga4": ["G-XYZ1234567"],
    "googleTagManager": ["GTM-ABC999"],
    "facebookPixel": ["123456789012345"],
    "stripePublishableKey": ["pk_live_51TestKeyStripeLive99"]
  },
  "fingerprintingRisk": {
    "maxRisk": 1,
    "highRiskCount": 0,
    "details": []
  },
  "securityAudit": {
    "sriComplianceRate": 100,
    "cdnScriptsCount": 0,
    "sriSecuredScriptsCount": 0,
    "insecureHttpScriptsCount": 0,
    "mixedContentAlerts": [],
    "paymentScriptsAuditedCount": 1,
    "paymentSecurityStatus": "secure"
  },
  "loadingPerformance": {
    "asyncPercentage": 86,
    "deferPercentage": 14,
    "modulePercentage": 0,
    "blockingPercentage": 0,
    "delayedInteractionPercentage": 0,
    "offMainThreadPercentage": 0
  },
  "privacyCompliance": {
    "cmpDetected": true,
    "cmpName": "OneTrust",
    "consentModeV2": {
      "enabled": true,
      "signals": {
        "ad_storage": "denied",
        "analytics_storage": "denied",
        "ad_user_data": "denied",
        "ad_personalization": "denied"
      },
      "waitForUpdateMs": 500
    },
    "globalPrivacyControlActive": true,
    "cookieTrackingCount": 3,
    "cnameCloakedTrackersCount": 0,
    "gdprDmaRiskLevel": "low"
  },
  "recommendations": [
    "Google Consent Mode v2 properly configured with DMA signals.",
    "100% of third-party scripts loaded asynchronously or deferred."
  ],
  "topVendors": [
    { "entity": "Google Tag Manager", "scriptsCount": 2, "transferBytes": 110000 },
    { "entity": "Stripe", "scriptsCount": 1, "transferBytes": 45000 }
  ],
  "rawScripts": [
    "https://js.stripe.com/v3/",
    "https://www.googletagmanager.com/gtm.js?id=GTM-ABC999"
  ],
  "audit": {
    "healthScore": 88,
    "grade": "B",
    "deductions": [],
    "warnings": [],
    "bonuses": [
      { "reason": "100% of third-party scripts loaded asynchronously or deferred", "points": 5 },
      { "reason": "Google Consent Mode v2 properly configured with DMA signals", "points": 5 }
    ],
    "topSiteIssues": []
  },
  "error": null
}

🛠️ Actionable Remediation Guide

When this plugin highlights performance deductions or security warnings, follow these engineering best practices:

1. Eliminate Parser-Blocking Head Scripts:
   • Add async or defer attributes to all external scripts in <head>.
   • Never load non-critical marketing widgets (chatbots, feedback surveys, retargeting pixels) synchronously in document <head>.
2. Move Heavy Third-Party Scripts Off the Main Thread:
   • Adopt Partytown (type="text/partytown") to execute resource-heavy analytics and tag managers inside a background Web Worker.
   • Delay user-intent widgets (such as Live Chat or Review carousels) until first user interaction (scroll, click, or keydown).
3. Enforce Subresource Integrity (SRI) on Public CDNs:
   • When loading libraries from shared CDNs (cdnjs, jsDelivr, unpkg), always append cryptographic integrity hashes (e.g., integrity="sha384-..." crossorigin="anonymous").
4. Fulfill PCI-DSS v4.0.1 Compliance on Checkout Pages:
   • Remove all unnecessary marketing tags, session recorders, and social widgets from checkout pages.
   • Maintain the JSON output of this plugin as your authoritative Requirement 6.4.3 written script inventory.
   • Ensure all payment scripts (js.stripe.com, PayPal SDK) load exclusively over TLS HTTPS.
5. Implement Google Consent Mode v2:
   • Deploy an IAB TCF v2.2 certified CMP before firing any Google tags.
   • Set default consent states to 'denied' before firing Google Tag Manager or GA4 tags.

❓ Frequently Asked Questions (FAQ)

What are third-party scripts and how do they hurt website performance?

Third-party scripts are external JavaScript files hosted on third-party domains (such as Google, Meta, Stripe, Cloudflare, or Intercom) embedded into a website to provide analytics, advertising, customer support, video playback, or payment processing. They hurt website performance by blocking the browser's HTML parser when placed synchronously in <head>, swelling total page weight, and executing long computational tasks that cause UI lag and degraded Core Web Vitals.

How do third-party scripts affect Core Web Vitals and INP?

Third-party JavaScript libraries execute on the browser's main thread. When a script runs long tasks (> 50ms), it blocks user input handling, directly degrading Interaction to Next Paint (INP) and Total Blocking Time (TBT). Furthermore, synchronous <script> tags located in document <head> block the HTML parser, hurting First Contentful Paint (FCP) and Largest Contentful Paint (LCP). This detector flags render-blocking tags and uses Long Animation Frames (LoAF) telemetry to highlight heavy offenders.

How does this plugin satisfy PCI-DSS v4.0.1 Requirements 6.4.3 and 11.6.1?

Under PCI-DSS v4.0.1 Requirement 6.4.3, merchants must maintain an explicit, written inventory of all scripts executing in the consumer’s browser on payment checkout pages, confirm script business justification, and verify integrity. Under Requirement 11.6.1, tamper-detection mechanisms must catch unauthorized script alterations. This plugin automatically generates the complete script inventory, identifies payment processors, checks Subresource Integrity (SRI), and verifies that zero payment scripts are exposed over insecure HTTP.

What is CNAME Cloaking and how is it detected?

CNAME cloaking is a tracking practice where third-party tracker endpoints are mapped to a first-party subdomain (e.g., analytics.yourdomain.com pointing to a third-party analytics provider) to evade browser privacy protections and ad blockers. The detector inspects subdomains against known cloaked tracker signatures (sgtm, track, metrics, analytics, data) and flags potential first-party CNAME cloaks for privacy review.

How does Google Consent Mode v2 verification work?

Under the EU Digital Markets Act (DMA), advertisers using Google services must transmit verified user consent. Google Consent Mode v2 introduces two mandatory parameters: ad_user_data and ad_personalization (in addition to ad_storage and analytics_storage). This plugin inspects the webpage DOM, inline scripts, and dataLayer events to confirm whether Consent Mode v2 is configured, which signals are active (granted vs denied), and whether an IAB TCF v2.2 certified CMP is active.

What is Subresource Integrity (SRI) and why is it critical?

Subresource Integrity (SRI) is a W3C security standard that enables browsers to verify that resources fetched from third-party Content Delivery Networks (CDNs like cdnjs, jsDelivr, or unpkg) have not been maliciously modified or compromised. By specifying a cryptographic hash in the integrity attribute (e.g., integrity="sha384-..."), browsers will reject scripts if an attacker compromises the CDN host.

What is Partytown and how does off-main-thread execution work?

Partytown is an open-source library that relocates resource-intensive third-party scripts (such as Google Tag Manager, Facebook Pixel, or Mixpanel) into a background Web Worker. By running scripts off the main thread, the browser's UI thread remains responsive to user interactions, eliminating INP degradation and Total Blocking Time (TBT). This detector flags scripts configured with type="text/partytown" and awards bonus health score points.

Can this plugin replace BuiltWith and Wappalyzer?

Yes. While BuiltWith ($295–$995/month) and Wappalyzer ($100–$450/month) focus primarily on broad technology stack detection, BrowserMesh Third-Party Script Detector provides deeper JavaScript-specific auditing: 15 specialized script categories, 22 extracted tracking/payment account IDs, PCI-DSS compliance checks, Google Consent Mode v2 verification, SRI audits, and 0–100 performance health scoring—at zero licensing cost and with full programmatic API support.