Most of the code running on a typical business site was written by companies that have never heard of the business. Analytics, advertising pixels, chat widgets, review embeds, heatmaps, and consent banners arrive as a line of JavaScript pasted into the header, and each one is a request to a server nobody in the building controls. Audits routinely find third-party code accounts for the majority of a page’s total weight, and it is almost always the part nobody has looked at. The site itself gets optimised, compressed, and cached. The borrowed code goes untouched from the day it was pasted in.

The Weight of a Tag Manager

A tag container is a loader for everything placed inside it. A typical container is 100KB to well over 500KB depending on how many tags accumulated. Those tags fire in sequence once it arrives.

Testing eight tags through a container added around three seconds on a fast mobile connection and up to ten seconds on a slow one. The cost comes from the dozen tags inside it that nobody has removed since 2021. Containers also let marketing changes go in without a developer. That convenience is why nobody keeps a record.

The Cost of a Single Pixel

Individual tracking pixels add between 200 and 600 milliseconds each. Four of them running together is a second and a half of delay before a visitor sees anything useful, and most sites run more than four. The pattern is cumulative and invisible. Nobody adds four pixels at once. Marketing adds one for a campaign in March, another for a trial in June, and the campaign ends without anybody removing the code. One audit cut third-party JavaScript from 1.2MB to 280KB and gained 1.4 seconds on the main content metric, plus 320 milliseconds on interaction delay.

The Limits of Server Side Fixes

A capable server absorbs some of this. Object caching, HTTP/2, and a decent connection reduce the time spent fetching the page itself, and hosting plans for wordpress with proper caching will make the first byte arrive faster.

None of that touches third-party requests. Those go directly from the visitor’s browser to somebody else’s server, so the page can be served in 200 milliseconds and still take five seconds to become usable. This is the point most owners misunderstand when a speed test result and their own phone disagree.

Main Thread Blocking and Interaction Delay

The browser does its work on a single main thread. Parsing HTML, running JavaScript, and responding to clicks all queue on the same line, one task at a time.

When a third-party script occupies that thread for 300 milliseconds, a click during that window does nothing until the script finishes. This is what the interaction metrics measure, and analytics scripts, chat widgets, and ad code are the usual causes.

The visitor experiences it as a button that ignored them, and taps it again, which produces two of whatever the button did. On a checkout that means two orders. The support email arrives before the analytics report does.

Browser Level Tracker Blocking

Some of this cost buys nothing at all. Firefox blocks third-party cookies by default through its tracking protection, and Safari does the same. On those browsers your tracking script downloads, executes, and then fails to record anything useful.

The proportion is large enough to matter. A site with a quarter of its visitors on privacy-protecting browsers is paying the full speed cost for three quarters of the data, and no dashboard shows that trade. The figure is worth calculating once. Take the share of your visitors on Firefox and Safari, and treat that percentage of every tracking script’s cost as pure waste.

Cookie Replacements and Additional Scripts

The replacement technologies add scripts of their own. Browsers declaring war on cookies prompted a decade of alternative identity schemes, most of which require their own script on the page. The rules keep changing as well. Plans to block tracking cookies on Chrome were delayed repeatedly and eventually dropped, which means many sites now run the old tracking code and the replacement code together, having added the second without ever removing the first. Nobody is going to send an email telling you a tag has become useless.

Legal Exposure From Analytics

Speed is not the only cost of a third-party script. Regulators in several European countries hold that sending visitor data to overseas analytics services breaches data protection law. Google Analytics users could face fines over exactly that transfer.

For a small business every third-party script is a supplier relationship. It costs load time, it creates a data obligation, and neither appears on an invoice.

An Audit Method

Open the network tab, sort by domain, and list everything not served from your own site. For each entry, name the person who would notice if it disappeared tomorrow. Anything without a name comes off. The exercise takes 20 minutes and the answer is usually that three or four scripts were installed by somebody who left the company.

Then check what remains for loading order. Analytics, chat, and review widgets almost never need to run before the page renders, and moving them to load after the content removes their delay without removing their function. A chat widget that appears 400 milliseconds later has lost nothing a customer will notice.

Two further habits keep the list short. Set a calendar reminder every quarter to repeat the audit, and require that any new tag comes with an owner and an end date. Campaign pixels in particular should be removed when the campaign stops, and almost none of them are. The end date is the part that does the work, because it converts a deletion nobody owns into a task with a date on it.

One Afternoon of Deletions

Book three hours, open the network tab, and remove every third-party script that no longer has an owner. Most sites lose between four and nine of them in a single sitting, gain a second or more of load time, and lose no capability anybody was using. The next person to add a tag will ask what the rule is. That is the point at which the problem stops recurring.