How to review third-party scripts before adding them

A third-party script should earn its place on a website. Analytics, chat, maps and advertising tools can add useful features, but they may also affect loading, privacy and security. Review what the script does, who controls it and how you would remove it before adding it to every page.

Define the need and the owner

Write down the user or business problem the script solves. Could the task be handled with an existing tool or a simpler link? Name a person who owns the account, checks the service and approves changes. A script without an owner is likely to remain after its purpose has gone.

List the pages where it is needed. A booking widget may belong on a booking page, not across the entire site. Limiting where code runs can reduce both page weight and the amount of visitor data exposed to that service.

Examine data and permissions

Ask what information the script receives or can access, where it sends data and whether it sets cookies or identifiers. Have the person responsible for privacy review any consent or notice requirements. The ICO's data protection by design guidance supports considering these questions at design time.

A script running in a page can interact with its content. Ask how the supplier secures and updates the code, and whether your team can control where it loads. Avoid giving a new tool more access than its task requires. OWASP's software supply-chain guidance treats third-party dependencies as a continuing risk to manage, not a one-off installation decision.

Test speed and failure behaviour

Measure representative pages before and after adding the script. Check mobile loading and whether the main task still works if the external service is slow or unavailable. A chat widget should not prevent a form from loading, and analytics should not block a purchase.

Ask whether the service can be delayed until needed, and test any change to ensure it still functions. Keep a record of the script's purpose, account owner, renewal date and removal instructions.

Revisit what is installed

Review third-party scripts after campaigns and at renewal. Remove unused tags, duplicate analytics and accounts nobody owns. Retest important journeys after an update. A small, documented set of purposeful scripts is easier to understand and maintain than a collection inherited from past projects.

Frequently asked questions

Are third-party scripts always unsafe?

No. They can provide valuable functions. Review need, data access, supplier practices and failure behaviour so the decision is proportionate.

Does loading a script only on one page help?

Often. It limits exposure and performance cost to the page where the feature is needed, provided the site's behaviour is tested.

Who should approve a new marketing tag?

The business owner of the goal, technical maintainer and privacy lead where relevant should understand its data use and effect on the site.