The fix, in one snippet
curl -s https://example.com | grep -oE '<script[^>]+src="[^"]+"'Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now parses the homepage and lists every <script src> whose host lies outside the page's registrable domain, grouped by host. For each it records the loading attributes (async, defer, type="module"), whether an integrity attribute is present, and whether the URL is HTTPS. It separately counts inline scripts and recognises tag-management loaders (Google Tag Manager, Adobe Launch, Segment) with a note that these can inject further scripts that the static HTML does not show. The check never fails; it produces an inventory for you to review and flags an unusually long list (more than ten distinct hosts) for attention. The individual security properties are scored elsewhere: hashes in subresource-integrity, known-vulnerable versions in outdated-javascript-library, and HTTP loads in mixed-content.
Why it matters
A script tag is a full delegation of trust. Every third-party script can read the DOM, including form fields as they are typed, read cookies that are not HttpOnly, make requests with the user's credentials, and load further scripts of its own choosing. The supply-chain incidents of the last decade almost all ran through this door: the 2018 Ticketmaster breach came via a customer-support chat script, the British Airways card skimming via a modified third-party library, and the 2024 polyfill.io takeover via a domain sale. There is a privacy dimension as well: each host on the inventory receives the visitor's IP address, user agent and the referring URL, and can set its own cookies, which matters for consent obligations. None of this argues for zero third parties; it argues for knowing exactly which ones you have and why. The tracking guide and the SRI guide cover both angles.
How to fix it
Work through the inventory. Remove anything no one can name an owner for. Self-host libraries that do not need to update on their own, and pin the rest with SRI. Then constrain what remains with a Content-Security-Policy that lists only those hosts (or, better, uses nonces with 'strict-dynamic'):
Content-Security-Policy: script-src 'self' https://www.googletagmanager.com https://js.stripe.com; object-src 'none'; base-uri 'none'nginx: add_header Content-Security-Policy "..." always;; Apache: Header always set Content-Security-Policy "...". Give a script only the loading behaviour it needs and no more:
<script src="https://cdn.example.com/widget/2.4.0/widget.js"
integrity="sha384-..." crossorigin="anonymous" defer></script>Isolate untrusted embeds (chat, comments, ads) in a sandboxed iframe rather than a script tag, so they cannot touch the parent page. Gate marketing tags behind consent so they do not load until the visitor agrees. Cloudflare Zaraz and similar server-side tag managers move analytics and marketing tags off the browser entirely, which removes them from the inventory. Revisit the list whenever a team adds a tool; it tends to grow quietly.
Where this fits
Third-party script inventory is check 10 of 10 that the website vulnerability scanner runs under page content and javascript, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Password field autocomplete (info), where password fields on the page either try to disable autocomplete, which browsers ignore and password managers dislike, or lack the autocomplete tokens that let password managers fill and generate credentials safely. An attacker who has that does not need this, so it is the better use of the same hour.
Found in the same scan
The website vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Certificate chain and hostname validation, where the certificate presented for this hostname did not validate: The chain does not reach a trusted root, an intermediate is missing, the name does not match, or the certificate is self-signed or expired, and Exposed .env configuration file, where a .env configuration file is served from the web root. A single run of website vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Third-party script inventory (info severity)
Scanner check id: external-scripts-inventoryThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 02, 2026
How Online Tracking Works: Cookies, Pixels, Fingerprints and Data Brokers
Tracking is the business of linking your visits across sites into a profile. Each technique from third-party cookies to fingerprinting...
Read the guide
8 min read · Updated Sep 02, 2026
Subresource Integrity (SRI): Protecting Your Site From a Compromised CDN
When a page loads a script from a CDN, it trusts that CDN completely. Subresource Integrity pins the script to a hash so a tampered file...
Read the guide