Third-Party Script Inventory

Store Positioning

Store title: Third-Party Script Inventory

Short description: Inventory third-party scripts, pixels, analytics tags, and external dependencies on a website.

SEO title: Third-Party Script Inventory — technical SEO, web, and domain audit

SEO description: Inventory third-party scripts, pixels, analytics tags, and external dependencies on a website. Use it to find crawlability, indexability, security, metadata, and page-quality issues with evidence-backed rows and audit reports.

Categories: SEO_TOOLS

Keywords: third, party, script, inventory, web audit, web/domain audit

Fixed-Inclusive PPE Pricing

This actor uses pay-per-event pricing. Event prices include Apify platform usage; users are not expected to pay a separate platform-usage pass-through charge for the configured pricing model.

• Tier: W1 — Web/domain audit
• Primary event: resource-inspected at $0.00490 base
• Default max charge: $10.00
• Store discounts: FREE/BRONZE base, SILVER discounted, GOLD deepest approved discount

Event set:

• actor-start: base $0.00500, GOLD $0.00400. Third Party Script Inventory: charged when actor start is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
• resource-inspected: base $0.00490, GOLD $0.00392. Third Party Script Inventory: charged when resource inspected is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
• resource-record-extracted: base $0.00372, GOLD $0.00298. Third Party Script Inventory: charged when resource record extracted is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
• finding-emitted: base $0.00372, GOLD $0.00298. Third Party Script Inventory: charged when finding emitted is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
• audit-report-generated: base $0.05000, GOLD $0.04000. Third Party Script Inventory: charged when audit report generated is completed. The price includes Apify platform usage; no separate usage pass-through is intended.

Public Task Concepts

• Extract Third-Party Script rows from supplied public inputs
• Inventory Third-Party Script fields across a capped sample
• Normalize Third-Party Script evidence for delivery
• Flag missing Third-Party Script data before delivery
• Export Third-Party Script records with source URLs

Inventory third-party scripts, pixels, analytics tags, and external dependencies from supplied page snapshots.

This actor is snapshot-first by default: it analyzes HTML supplied in the input and does not launch a browser or fetch URLs unless fetchUrls is explicitly set to true. That keeps default Apify Store checks fast, deterministic, and low-cost.

What It Finds

• External script tags, inline scripts, tracking pixels, iframes, and stylesheet dependencies.
• Vendor classifications for Google Tag Manager, Google Analytics, Meta Pixel, Segment, Hotjar, Cookiebot, OneTrust, Sentry, New Relic, Intercom, Stripe, and common CDN sources.
• First-party versus third-party dependency counts.
• Analytics, marketing, tag-manager, consent, CDN, monitoring, support, payments, and unknown categories.
• New, removed, and unchanged external URLs compared with a previous dependency snapshot.
• Risk signals such as marketing trackers, unknown third-party dependencies, missing SRI, and large third-party surfaces.

Input Example

Set maxChargeUsd to a finite run budget. It defaults to $10; the actor stops before paid work or withholds uncharged reports when the next event would exceed the cap.

{
  "targets": [
    {
      "sourceId": "home-page",
      "sourceUrl": "https://example.com",
      "html": "<script src=\"https://www.googletagmanager.com/gtm.js?id=GTM-TEST\"></script><script src=\"https://cdn.segment.com/analytics.js/v1/demo/analytics.min.js\"></script><script src=\"https://connect.facebook.net/en_US/fbevents.js\"></script><script src=\"/assets/app.js\"></script>",
      "previousExternalUrls": [
        "https://www.googletagmanager.com/gtm.js?id=GTM-OLD"
      ]
    }
  ],
  "fetchUrls": false,
  "includeReport": true,
  "maxTargets": 1
}

Output

Each dataset item represents one page snapshot:

{
  "sourceId": "home-page",
  "status": "fail",
  "severity": "high",
  "dependencyHealthScore": 38,
  "thirdPartyResourceCount": 3,
  "trackerResourceCount": 3,
  "vendorNames": ["Google Tag Manager", "Meta Pixel", "Segment"],
  "thirdPartyDomains": ["cdn.segment.com", "connect.facebook.net", "www.googletagmanager.com"],
  "riskSignalCodes": ["marketing-trackers-present", "third-party-scripts-without-sri"],
  "recommendations": ["Confirm marketing pixels are consent-gated and documented in your privacy notice."]
}

When includeReport is enabled, the actor also writes:

• THIRD_PARTY_SCRIPT_RESULTS.json
• THIRD_PARTY_SCRIPT_SUMMARY.json
• THIRD_PARTY_SCRIPT_REPORT.md

Optional Live Fetch

Set fetchUrls to true and provide urls to fetch HTML and response headers with Node fetch. This path is capped by maxTargets, fetchTimeoutMs, and maxHtmlBytes. It still does not run a browser, execute JavaScript, click banners, or inspect dependencies loaded after client-side execution.

Use supplied snapshots when you need deterministic QA, before/after release comparison, or output from your own browser testing stack.

Limitations

• Static HTML cannot see dependencies loaded later by JavaScript, tag managers, consent banners, or user interaction.
• This actor does not provide legal advice, privacy-law compliance certification, or vendor-risk approval.
• Unknown vendor classification means the domain was not in the built-in pattern map, not that it is safe or unsafe.
• Browser rendering and post-consent dependency comparison are intentionally deferred from the default path.

Safe Use

Scan only pages you are authorized to test. Avoid uploading user-specific HTML or sensitive tokens. Redact private query strings and identifiers before submitting snapshots.