Back to notes

June 15, 2026 · 5 min read

A Third-Party Script Audit Found Six Scripts Nobody Could Explain

We asked every team which scripts on the site were theirs. Six scripts had no owner, no documentation, and in one case no obvious purpose at all.

AuditsPerformance

A page speed complaint led to a script audit, and the script audit led somewhere more interesting than slow page loads. Of the twenty-eight third-party scripts loading on the client's main landing page, six had no clear owner when we asked around.

What 'no owner' actually meant

Two were from a marketing tool trial that had ended eighteen months earlier — the trial expired, nobody removed the tag, and the script kept loading and quietly failing every request since, adding latency for zero functional benefit. One was a heatmap tool a former employee had installed for a single project and never removed. One was, as far as we could determine after a week of digging, loading analytics for a completely different company — plausibly a leftover from a shared GTM container template someone had copied without stripping the original tags.

Every unexplained script on a site is slowing something down for a benefit that, by definition, nobody can currently name.

What it cost

Combined, the six orphaned scripts added roughly 400ms to time-to-interactive on a mobile connection — not catastrophic individually, but a meaningful chunk of a page speed budget being spent on nothing, while the team had been chasing image compression and font loading for the same gain.

  • We removed all six after confirming with each relevant team that nothing currently depended on them — a two-week confirmation window with monitoring, just in case.
  • A GTM container audit is now a standing quarterly task, not a one-time cleanup, because new orphans accumulate the same way the original six did.
  • Every new third-party tag now requires a named owner and a removal date or review date logged at the time it's added, specifically to prevent trial-period tags from going permanent by neglect.
  • The mystery analytics script turned out to confirm the shared-template theory — the GTM export it came from still had the original company's container ID embedded in a variable name.

Page speed audits usually start by looking at what's slow. This one found more value looking at what was running that nobody could explain, which turned out to be the same six scripts that had been quietly inflating load time the whole time.