Third-Party Scripts Auditor

Audit a public web page for third-party scripts, stylesheets, iframes, and other external resources in one API call. Returns per-resource classification by known provider, render-blocking flags, missing Subresource Integrity (SRI), non-HTTPS sources, known advertising and tracking scripts, a readiness score, letter grade, and recommendations. Built for performance engineers, security teams, privacy and compliance auditors, and site migration QA.

Use cases

• Performance engineers - identify render-blocking scripts and stylesheets slowing first paint and Core Web Vitals
• Security teams - spot third-party scripts missing Subresource Integrity and loaded over insecure http://
• Privacy and compliance auditors - detect known advertising and tracking scripts for GDPR, CCPA, and consent reviews
• Site migration QA - verify that third-party dependencies survive CMS template changes, replatforming, and CDN cutovers
• Frontend platform teams - monitor which known providers (Google Analytics, Facebook Pixel, Stripe, HubSpot) load on key pages

Input

Field	Type	Required	Default	Description
startUrl	string	yes	-	Public page URL to audit
timeoutSeconds	integer	no	10	Per-request timeout (3-30 seconds)
maxHtmlBytes	integer	no	1048576	Maximum HTML body size to download and parse (16 KB - 2 MB)

Example input

{
  "startUrl": "https://example.com",
  "timeoutSeconds": 10,
  "maxHtmlBytes": 1048576
}

Output

A single dataset item with the full audit:

Field	Type	Description
inputUrl	string	The URL provided as input
finalUrl	string	Final URL after redirects
https	boolean	Whether the final response was served over HTTPS
resourceCount	integer	Total number of resources found (scripts, stylesheets, iframes)
firstPartyCount	integer	Number of first-party external resources
thirdPartyCount	integer	Number of third-party external resources
byType	object	Count of resources grouped by tag type (script, link:stylesheet, link:preload, iframe)
byProvider	object	Count of third-party resources grouped by known provider name
resources	array	Per-resource analysis (see below)
issues	array	Aggregated issue descriptions across all resources
score	integer	Third-party scripts readiness score (0-100)
grade	string	Letter grade (A+, A, B, C, D, E, F)
checkedAt	string	ISO 8601 timestamp
recommendations	array	Actionable recommendations for improving third-party script posture

resources array

Each entry contains:

Field	Type	Description
tag	string	HTML tag type (script, link, iframe)
rel	string | null	The rel attribute for link tags (null otherwise)
src	string	The src or href attribute value (empty string for inline scripts)
origin	string | null	Resolved origin (protocol + host) of the resource, or null if unresolvable
host	string | null	Resolved hostname of the resource, or null if unresolvable
provider	string	Known provider name, "First-party", "Inline", or "Unknown"
thirdParty	boolean	Whether the resource loads from a different registrable domain than the page
renderBlocking	boolean	Whether the resource blocks HTML parsing or first paint
hasSri	boolean	Whether an integrity (SRI) attribute is present
https	boolean | null	Whether the resource uses HTTPS (null for inline or relative)
tracker	string | null	Known advertising/tracking provider name if detected, otherwise null
module	boolean	Whether a script uses type="module"
issues	array	Issue descriptions for this specific resource
recommendation	string | null	Fix recommendation for this resource (null when well-formed)

Grading scale

Score range	Grade
95-100	A+
85-94	A
75-84	B
65-74	C
50-64	D
30-49	E
0-29	F

Scoring starts at 100 when no resources are found, or 60 plus bonuses for no trackers, no render-blocking resources, no missing SRI, and no insecure sources. Penalties subtract for trackers, render-blocking scripts, missing SRI on third-party resources, insecure http:// sources, and total issue count.

Example output

{
  "inputUrl": "https://example.com",
  "finalUrl": "https://example.com/",
  "https": true,
  "resourceCount": 3,
  "firstPartyCount": 1,
  "thirdPartyCount": 2,
  "byType": {
    "script": 3
  },
  "byProvider": {
    "Google Tag Manager": 1,
    "jsDelivr": 1
  },
  "resources": [
    {
      "tag": "script",
      "src": "https://www.googletagmanager.com/gtag/js?id=G-XXX",
      "origin": "https://www.googletagmanager.com",
      "host": "www.googletagmanager.com",
      "provider": "Google Tag Manager",
      "thirdParty": true,
      "renderBlocking": false,
      "hasSri": false,
      "https": true,
      "tracker": null,
      "module": false,
      "issues": ["missing Subresource Integrity (integrity attribute)"],
      "recommendation": "Add an integrity attribute (SRI hash) to third-party scripts to prevent CDN tampering."
    },
    {
      "tag": "script",
      "src": "https://cdn.jsdelivr.net/npm/lib@1.0.0/lib.min.js",
      "origin": "https://cdn.jsdelivr.net",
      "host": "cdn.jsdelivr.net",
      "provider": "jsDelivr",
      "thirdParty": true,
      "renderBlocking": false,
      "hasSri": true,
      "https": true,
      "tracker": null,
      "module": false,
      "issues": [],
      "recommendation": null
    },
    {
      "tag": "script",
      "src": "/app.js",
      "origin": "https://example.com",
      "host": "example.com",
      "provider": "First-party",
      "thirdParty": false,
      "renderBlocking": false,
      "hasSri": false,
      "https": "relative",
      "tracker": null,
      "module": false,
      "issues": [],
      "recommendation": null
    }
  ],
  "issues": [
    "script https://www.googletagmanager.com/gtag/js?id=G-XXX: missing Subresource Integrity (integrity attribute)"
  ],
  "score": 82,
  "grade": "B",
  "checkedAt": "2026-08-06T12:00:00.000Z",
  "recommendations": [
    "1 third-party script/stylesheet(s) missing Subresource Integrity. Add integrity hashes to protect against CDN tampering."
  ]
}

Known providers detected

The actor classifies resources from commonly seen providers, including: Google Analytics, Google Tag Manager, Google Fonts, Google Ads, YouTube, Facebook, Meta Pixel, X (Twitter), Hotjar, Microsoft Clarity, HubSpot, Stripe, Cloudflare, Bootstrap CDN, unpkg, jsDelivr, LinkedIn, TikTok, Pinterest, Amazon, Salesforce, Marketo, Zendesk, Intercom, Segment, Sentry, Datadog, Mixpanel, Amplitude, FullStory, Plausible, Matomo, and TikTok Pixel. Unknown third-party hosts are reported as "Unknown".

Known trackers flagged

The actor flags scripts from known advertising and tracking domains, including: Google Ads (DoubleClick, googleadservices, googlesyndication), Meta Pixel, TikTok Pixel, LinkedIn Insight, X (Twitter) Ads, Microsoft Ads (Bing), Criteo, Taboola, Outbrain, Yandex Metrica, and Baidu Ads.

Issues checked per resource

Tag	Issue	Why it matters
script	render-blocking (no async/defer)	Blocks HTML parsing and slows first paint
script	missing Subresource Integrity	CDN tampering could inject malicious code
script	integrity requires crossorigin	SRI hash is ignored unless crossorigin is also set
script	insecure http:// source	Mixed-content warnings and MITM risk
link	render-blocking stylesheet	Blocks first paint until CSS downloads
link	missing Subresource Integrity	CDN tampering could inject malicious CSS
link	integrity requires crossorigin	SRI hash is ignored unless crossorigin is also set
link	insecure http:// stylesheet	Mixed-content warnings and MITM risk
iframe	missing loading="lazy"	Eager iframes defer layout and cost network
iframe	insecure http:// source	Mixed-content warnings and MITM risk

Security

• Only public HTTP/HTTPS URLs are accepted
• SSRF protection: localhost, private IPv4/IPv6, and DNS-resolving-to-private IPs are blocked
• URLs with embedded credentials are rejected
• Redirects are manually revalidated before following (max 3)
• HTML body is capped at maxHtmlBytes to prevent oversized responses
• No browser automation, no proxies, no cookies stored

Pricing

Pay per event:

Event	Price
Actor start	$0.005
Page audited	$0.01

A single-page audit costs approximately $0.015.

FAQ

What is a third-party script? Any script, stylesheet, or iframe loaded from a different registrable domain than the page itself. The actor compares the last two labels of the hostnames (for example, cdn.example.com and www.example.com both count as first-party because they share the example.com suffix).

How is this different from the HTTP Security Headers Auditor? The HTTP Security Headers Auditor inspects response headers like Content-Security-Policy, HSTS, and X-Frame-Options. This actor parses the HTML body to identify which third-party scripts, stylesheets, and iframes the page actually loads, classify them by provider, and flag per-resource issues such as render-blocking, missing SRI, and known trackers.

How is this different from the Mixed Content Auditor? The Mixed Content Auditor looks for insecure http:// subresources on an HTTPS page. This actor additionally classifies providers, flags render-blocking scripts and stylesheets, detects missing SRI, and identifies known advertising and tracking scripts.

Does the actor execute the scripts or render the page? No. The actor fetches the HTML once, parses it with a lightweight scanner, and reports what it finds. It does not run JavaScript, so dynamically injected scripts are not detected. Use a browser-based actor for that.

Can I audit multiple pages in one run? This actor audits one page per run. For bulk audits, schedule multiple runs.

Does the actor follow redirects? Yes, up to 3 redirects. Each redirect target is revalidated for SSRF safety before it is followed.