The scripts your website loads without asking you
Picture a farm supply shop whose website takes eight seconds to load on a phone. The owner paid for a redesign last year. The developer said the site was optimized. But every page loads a chat widget the shop never uses, two different analytics scripts, a Facebook pixel from a campaign that ended in 2021, and a heatmap tracker from a marketing agency the shop stopped working with. Each script makes a request to a different server. Each request adds delay. The shop does not know the scripts are there because they do not appear as visible elements on the page. They run in the background, and they send data about every visitor to companies the shop has never heard of.
Most small business websites load scripts that no one asked for and no one monitors. A developer adds Google Analytics. A marketing consultant adds a tracking pixel. Someone tries a chat widget for a month and forgets to remove it. Each script stays in the page template forever. No one reviews the list. No one checks whether the data is being used. The scripts accumulate, and the page gets slower.
How to see what your site is loading
Open your website in a browser. Right-click anywhere on the page and choose Inspect or Inspect Element. A panel opens at the bottom or side of the window. Click the tab labeled Network. Reload the page. The panel fills with a list of every file the page requested. Each row is a file. The list includes images, stylesheets, fonts, and scripts. Look at the Domain column. Any domain that is not your own is a third party resource.
Scripts usually have names that end in .js. Look for domains like googletagmanager.com, facebook.net, hotjar.com, zdassets.com, and intercom.io. Each one is a service. Google Tag Manager loads tracking scripts. Facebook.net loads the Facebook pixel. Hotjar records visitor sessions. Zdassets is Zendesk chat. Intercom is a customer messaging platform. If you see a domain you do not recognize, search for it. The search results will tell you what service it belongs to.
Write down every third party script. For each one, answer three questions. Do you have an account with this service? Do you log in and use the data it collects? If the script stopped loading tomorrow, would you notice? If the answer to all three is no, the script should be removed.
What each script costs
Every script has a performance cost and a privacy cost. The performance cost is the time it takes to download and execute the script. A typical chat widget adds 200 to 400 kilobytes and delays page rendering by one to two seconds. A tracking pixel adds 50 to 100 kilobytes and makes several additional requests to load fonts and images. If your page loads five third party scripts, you are adding a megabyte of data and three to five seconds of delay. On a slow mobile connection, that is the difference between a visitor who waits and a visitor who leaves.
The privacy cost is harder to see but just as real. Every script sends data to a third party server. That data usually includes the visitor's IP address, browser type, operating system, screen resolution, referring page, and every page they visit on your site. Some scripts record mouse movements, clicks, and scroll depth. Some scripts build a profile that follows the visitor across websites. Your visitors do not see a list of who is collecting their data. They assume you are in control. If a script sends their information to a data broker, that is on you.
The short list of scripts worth keeping
Most small business websites need one analytics script and nothing else. Google Analytics or a privacy focused alternative like Plausible or Fathom will tell you how many visitors you get, where they come from, and which pages they view. That is enough to answer the questions that matter. You do not need heatmaps unless you are running experiments and changing the site based on what you learn. You do not need a chat widget unless someone is monitoring it during business hours and responding in under a minute. You do not need a Facebook pixel unless you are running Facebook ads and optimizing based on conversion data.
If you are not sure whether a script is still in use, remove it and wait a week. If no one notices, it was not doing anything. If someone needs it back, you can add it again. The default should be nothing. Every script should justify its presence.
Where this sits in hosting and care
When I take over hosting for a site, one of the first things I do is audit third party scripts. I make a list, confirm which ones are still needed, and remove the rest. I also check that any remaining scripts are loading asynchronously so they do not block page rendering. That work is part of the migration process. For sites on a Care plan, I review third party scripts every six months and flag any new ones that appear. If a plugin or a theme adds a script without asking, I catch it before it becomes permanent. The goal is a page that loads only what it needs and sends visitor data only where you intended.