Every SMB site we audit has 5-15 third-party scripts running in the browser: analytics, chat widgets, ad pixels, tag managers, email-capture popups, social-proof widgets, A/B test platforms. Each one adds JavaScript to the page; collectively they often double the site’s total JS weight. The owner-team rarely knows what’s running. Here’s the audit pattern we run and the third-party-script policy we enforce on FH client sites.

Step 1: take inventory

Open Chrome DevTools → Network → JS filter. Reload the page. List every JS file from a domain other than your own. For a typical SMB site we audit, this list is 8-15 entries. Most aren’t justifiable when you actually look at each one.

The common offenders

Google Tag Manager loading 10 child tags, half of which are obsolete.
Chat widgets (Intercom, Drift, Tidio): 200-500KB each.
Analytics (GA4 + Facebook Pixel + LinkedIn Insight + Hotjar + ...): 30-80KB each.
A/B test platforms (Google Optimize legacy, VWO, Convert): 50-150KB each.
Social-proof popups (Proof, Fomo): 30-80KB.
Form-builder embeds (Typeform, JotForm): 100-300KB.
Calendar embeds (Calendly): 200KB.
Video embeds (YouTube): heavy on initial load.

Step 2: classify each script

For each script, three questions:

What does this actually do for the business right now?
Is it producing measurable value? (Tracked conversions, captured leads, etc.)
Could we get the same value with less weight or with a server-side equivalent?

Step 3: remove the dead ones

Every audit finds at least one script that’s no longer used. A Facebook Pixel installed for a campaign that ended 18 months ago. An old A/B testing tool. A chat widget from a vendor the client doesn’t pay for anymore. These are pure cost. Remove them.

Step 4: defer the rest

Anything that doesn’t need to fire on initial page load should be deferred.

Chat widgets: lazy-load on first scroll past 50%, or after 5 seconds idle.
Email-capture popups: same.
Analytics: load with `strategy="afterInteractive"` in Next.js Script component.
Tag manager: the same.
Video embeds: load only when the user actively starts the video.

// Deferred chat widget
import Script from "next/script";

export function ChatWidget() {
return (
<Script
src="https://widget.intercom.io/widget/APP_ID"
strategy="lazyOnload"
/>
);
}

Step 5: replace heavy with light

Calendly embed (200KB) → link to your Calendly URL (0KB).
Typeform embed (200KB) → native HTML form + server action (0KB extra).
YouTube embed → lite-youtube-embed (3KB) or static thumbnail link.
Hotjar / FullStory (heavy) → smaller alternative (Microsoft Clarity is free and 10x lighter).
GA4 + GTM + Pixel + LI Insight + ... → consolidate via server-side conversion firing (see SSTagging post).

Step 6: write a policy and enforce it

After the audit, document a third-party script policy. ‘New third-party scripts require a documented business justification and a measurement plan for value.’ Without this, the script count grows back to its original size within a year of every audit.

The hidden cost of third-party scripts

Initial JS weight (the obvious one).
Main-thread blocking on parse — even a deferred script blocks the main thread when it eventually runs.
Third-party domain DNS lookups + TCP handshakes — every new domain adds 30-100ms.
Failed scripts that retry forever in the background.
Privacy and consent overhead — every third-party script needs disclosure under GDPR/CCPA/AIA.
Failure modes: a third-party CDN being slow makes your site appear slow.

Server-side alternatives when they exist

Conversion tracking can move server-side (server actions firing to GA4 MP API and Meta CAPI). Email capture can use native HTML forms. A/B testing can run at the edge with Cloudflare Workers. Many third-party use cases have lower-weight server-side alternatives in 2026.

The before/after on a recent FH audit

One FH client site (pre-engagement): 14 third-party scripts, 1.8MB of total JS, LCP 3.4s. After audit + remediation: 4 third-party scripts (GA4, Cloudflare Turnstile, Cookiebot, Plausible), 380KB total JS, LCP 1.4s. The audit identified $0/month of value being produced by 10 of the 14 scripts. Removal saved 2 seconds of LCP and zero dollars of marketing performance.

Vendor scripts that won’t self-defer
Some vendor scripts (especially older chat widgets and legacy ad platforms) actively resist being deferred — they try to load immediately and ignore async/defer hints. The fix is sometimes to vendor a wrapper script that you control which decides when to load the actual third-party script. More work; sometimes worth it.

How this lands across FH client work

Every FH client engagement starts with a third-party script audit. Median outcome: 40-60% reduction in third-party script weight. Conversion-tracking moves server-side; chat widgets get deferred or removed; analytics gets consolidated. The result is a site that loads faster, costs less to serve, and remains compliant with privacy regulation. If your site has more than 5 third-party scripts and you’re not sure they all earn their place, book a consultation — the audit is a half-day engagement with measurable performance lift.

Frequently asked questions

Why are third-party scripts the biggest performance problem?

Because they are added casually, run on the same thread as your code, and nobody owns their weight. A tag added for a campaign three years ago is still loading on every page, and no dashboard reports it, so the cost accumulates invisibly.

What does the audit actually involve?

Listing every third-party request the page makes, what each one weighs, who asked for it, and whether anything still uses it. The last two questions are the ones nobody has answered, and they usually remove more weight than any optimization.

How much weight does a typical audit remove?

Often around half the JavaScript budget on a site that has never done one, because the list contains duplicates, abandoned tools, and tags for campaigns that ended. That is not optimization so much as deleting things nobody wanted.

Which scripts are the usual offenders?

Chat widgets, tag managers loading many child tags, advertising and remarketing pixels, session recording tools, and social embeds. Each is defensible alone; the problem is that they arrive one at a time and are never revisited together.

What if a script is genuinely needed?

Load it later. Deferring until after the page is interactive, or until a user action requires it, keeps the function and removes it from the critical path. A chat widget that loads when someone clicks the chat button costs nothing to the other ninety-nine percent of visitors.

Does a tag manager help or hurt?

Both. It centralizes control, which is genuinely useful, and it makes adding tags so easy that nobody counts them. A container with twenty tags is a performance problem wearing a governance solution, and only an audit of what is inside reveals it.

How do I decide what to remove?

Ask who would notice. For each script, name the person or report that depends on it. Anything with no answer goes, and the answer is missing far more often than teams expect, particularly for analytics and testing tools added during a past project.

Is it safe to just delete them?

Remove them in one change with a note of what was removed, then watch for a week. The risk is a script quietly feeding a report someone reads monthly. Removing with a record makes restoring trivial, and keeping everything because something might depend on it is how the problem started.

How should new scripts be added?

With an owner, a stated purpose, and a review date. That small friction is what stops the list growing forever, and it turns the question at review time from what does this do into whether the person who wanted it still needs it.

Do these scripts affect anything other than speed?

Yes: privacy obligations, consent requirements, and security exposure, since each one executes code you do not control on every page. The performance cost is the visible part of a broader question about what is running on your site.

How often should this be repeated?

Annually, and after any campaign that added tags. The list regrows because adding is easy and removing requires someone to ask. An annual audit keeps the accumulation to a year's worth rather than a decade's.

What is the fastest version of this?

Load the page, list the third-party requests, and ask who owns each one. That is an afternoon and it usually produces the largest single performance improvement available to a site that has never done it.