Should this third-party script run on your website?

A third-party script executes code from another organization inside your visitor’s browser and page context. Its value may be real, but so are its privileges and costs. Admission should be an explicit product decision, not the default result of a vendor supplying a snippet.

Write down the user value and data path

Name the task the script enables, which pages need it, what data it receives or can observe, when it loads, what consent condition applies, and who owns the vendor relationship. If the same outcome is available through a link, server-side integration, static embed, or delayed interaction, compare those lower-privilege routes.

Review four kinds of cost

• Performance: network connections, JavaScript parsing and execution, layout changes, and main-thread contention.
• Privacy: identifiers, page context, form behavior, storage, onward sharing, retention, and international processing.
• Security: code changes outside your release process, compromised suppliers, broad DOM access, and injected dependencies.
• Resilience and accessibility: blocked scripts, provider outages, keyboard and screen-reader behavior, focus changes, and content unavailable without the embed.

Reduce privilege and scope

Load only where needed, delay non-essential code, use consent gates where required, apply a restrictive Content Security Policy, and sandbox frames when the feature permits it. Set performance budgets and monitor vendor changes. OWASP recommends inventorying third-party scripts, assessing providers, applying controls such as CSP and Subresource Integrity where applicable, and maintaining an incident response plan.

Set removal criteria

Record an owner, review date, measurable purpose, fallback, and the conditions that trigger removal. If no one can explain whether the script still creates value, what it sends, or how to disable it during an incident, it should not retain permanent browser access.

Kiwi can help audit and implement website integrations. Cookie consent, lawful basis, vendor contracts, and jurisdiction-specific privacy conclusions require qualified legal and privacy review.