What third parties does my website load?

What a third party actually gets

The exposure varies enormously by resource type, and the distinction is worth internalising because it determines how much a given inclusion should worry you.

The first row is the one to take seriously. A third-party script is not "on" your page in the sense of a picture — it is running as your page, with everything that implies. If that provider is compromised, your site is compromised, and their security posture is now yours.

Finding them all

In a browser

Open devtools, the Network tab, reload, and sort by Domain. Everything that is not your own origin is a third party. Do this on several page types — the homepage rarely loads what the checkout page does.

From the HTML

curl -sL https://example.com \
  | grep -oE '(src|href)="https?://[^"]+' \
  | sed -E 's|.*//||; s|/.*||' \
  | sort -u

That lists origins referenced in the initial HTML. It will miss anything injected later by JavaScript, which is precisely how tag managers work — so treat it as a floor, not a total.

Why the list grows without anyone deciding

• Tag managers. One container tag, and thereafter marketing can add vendors without touching your codebase. This is the single largest source of unknown third parties.
• Vendors loading vendors. A chat widget that loads its own analytics, which loads a session recorder. Your one decision became three.
• Embeds. A video, a map, a social post — each brings its own stack.
• Abandoned experiments. An A/B tool trialled two years ago whose snippet is still in the template.

What each one costs you

• Privacy and legal exposure. Under GDPR-style regimes, most third parties in this list require consent before loading. Loading them before consent — or loading ones nobody documented — is the common compliance failure.
• Performance. Each new origin means a DNS lookup, a TCP connection and a TLS handshake before a single byte arrives.
• Security. Your attack surface is the union of every provider's. Supply-chain compromises of analytics and widget vendors are a recurring event, not a hypothetical.
• Availability. A render-blocking third-party script that hangs will hang your page.

Cleaning it up

1. Inventory what is actually loading, across several page types rather than just the homepage.
2. For each origin, name the person or team who needs it. Anything with no owner goes.
3. Self-host what can be self-hosted — fonts especially, which are a pure request-log leak for no benefit.
4. Load anything non-essential after consent, not before.
5. Add Subresource Integrity to third-party scripts where the vendor supports stable versioned URLs.
6. Re-inventory quarterly. The list regrows.

Step three alone often removes a third of the list, and self-hosted fonts are usually faster as well as more private.