Counting third-party scripts: how many foreign hosts the HTML loads

The check counts script tags from foreign domains in the delivered HTML and flags five privacy-relevant embeds. From 11 "to review", from 21 critical.

What we check

In the HTML: the scan collects every <script src> in the delivered HTML and keeps those whose host sits on a different domain than the page; subdomains of your own domain count as your own, protocol-relative URLs count as well. Up to 10 foreign scripts means "ok", up to 20 "to review", above that critical. None at all means a note, because that can also mean everything is inline or loaded dynamically.

On top, the scan checks five embeds that are privacy-relevant regardless of the count: Google Fonts from fonts.googleapis.com, embedded Google Maps, YouTube embeds without the nocookie domain, Adobe Fonts from use.typekit.net and the Vimeo player. If it finds one, the line reads at least "to review" and names it. It never becomes critical because of that; the legal assessment belongs in consulting, not in an automated verdict.

What the scan cannot see: scripts a tag manager or another script loads later, inline code, and anything that only comes after interaction.

Why it matters

Every script from a foreign domain is a request that sends the visitor's IP address to a third party before anyone consents. With a pixel that is the familiar case; with a font, a map or a video it is the same process, just without anyone thinking of it as tracking. And the number itself tells the state of the template. Twenty foreign scripts directly in the HTML mean twenty places where someone built something in past the tag manager, without a consent trigger and without an owner. Cleaning up starts with counting.

Common causes

Tools were added over years and never removed, chat widgets, heatmaps, and A/B tests from finished projects keep running.
Every marketing platform got its own script instead of running through the tag manager.
Embeds (video, maps, social) pull in whole script families nobody planned for.
Agency changes: the new tags arrived, the old ones stayed in.

The fix

The five named embeds first: host fonts locally, put maps and videos behind a two-click solution or on the nocookie variant, replace Typekit with self-hosted files. Then the inventory: note a purpose and an owner for every remaining script; whatever has neither goes. No purpose, no script. Marketing tags into the tag manager with consent triggers, the rest off the critical path with async or defer; the number after the clean-up is rarely the goal, the list is.

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

The scan reports Google Fonts as a finding. Wasn't that settled long ago?

Since the Munich ruling of 2022 everyone knows, and still every third site we scan loads its fonts from fonts.googleapis.com. The request sends the IP address to Google before any banner appears. The line therefore reads at least "to review", even if the site has only three external scripts otherwise. Host the fonts locally, done.

We have 14 external scripts, all from the tag manager. Does that count?

No, and that is the limit of the check. It counts script tags in the delivered HTML; what the container inserts afterwards it does not see. 14 external scripts directly in the HTML, on the other hand, mean 14 embeds someone wrote into the template that no consent trigger knows about. That is the real finding, not the number.

Why do our own bundles not count?

Because the scan compares the domain, not the spelling. A script from www.your-domain.com on your-domain.com is your own, even when embedded with an absolute URL. Until August 2026 it was different; the scan reported 26 of a site's own WordPress bundles as critical foreign scripts. Since then the apex domain is what counts.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint