You have not approved half the scripts running on your site

A third-party script you approved often loads another, which loads a third. HTTP Archive measurements put the median depth of these inclusion chains at three. In other words, most third parties present on a page bring others that nobody validated.

The phenomenon is large: more than nine pages in ten load at least one third party. And the recent trend is clear, the number of distinct vendors is falling slightly while the number of requests they send is rising. Fewer names, more traffic per name.

In a large B2B business, the mechanism is organizational before it is technical. Marketing adds a tracking tool, sales an automation platform, customer service a chat widget, compliance a consent manager, a vendor a testing tool. Each addition is justified on its own. Nobody owns the sum.

Two consequences follow. The page slows down, which affects your buyers on a mobile connection as much as at a desk. And your risk surface extends to vendors you do not know exist, which becomes an issue when a client sends you a security questionnaire.

Consent management makes the reading harder still. Some of these scripts only fire after the visitor accepts, so measurements taken without accepting understate the real load. Always test in both states, otherwise you are optimizing a page nobody sees.

The inventory nobody owns

Two lists exist in your organization and they do not match. The list of tools you pay for, held by finance. And the list of domains actually called by your pages, which nobody holds.

The gap between the two is the work. It regularly contains replaced tools whose code was never removed, campaigns finished two years ago, and vendors of vendors.