Every script tag is a company you trusted
What an external script can actually do on your page.
The permission you granted
A third-party script runs with the same access as your own code. It can read the page content, watch what users type into forms, read any cookie not marked HttpOnly, and make requests as your site.
That is not a criticism of any particular provider — it is what a script tag means. It is worth knowing the list, and worth the list being shorter.
Subresource Integrity
An integrity hash makes the browser refuse a file that does not match exactly, so a compromised or accidentally-changed CDN file simply does not run.
It requires a versioned URL. Analytics and chat widgets update their script continuously and therefore cannot support it — for those, SRI is not an option and the question becomes whether you trust the provider enough.
<script src="https://cdn.example.com/lib@1.2.3/lib.js" integrity="sha384-..." crossorigin="anonymous"></script>
The one rule worth keeping
Never put a third-party script on a page with a password field or a payment form. If you must have analytics on those pages, use a tool that does not capture input.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site