When convenient

Your page runs code from 2 outside companies

Your page loads code from companies other than your own, which is normal for almost every website. Analytics, chat, payment and booking tools all work this way. The job is to recognize each name on the list, remove leftovers you no longer use, and look into anything nobody on your team can explain.

Time to fix: About 20 minutes to review the list.Who fixes it: You, for recognizing the services you signed up for. Your developer or marketing agency, for anything they added.Updated September 27, 2026

How EverThread tells a customer

Your page runs code from 2 outside companies. Scripts load from cdn-stat-track.example, js.pixel-farm.example.

Skim the list. Recognize them all? Acknowledge this and we stay quiet unless the list changes. Anything unfamiliar, ask your developer.

What it means

Many website features come as a small piece of code from another company: Google Analytics, a Facebook pixel, a live chat box, a booking calendar, a review widget, a cookie banner, a payment button. Your page tells the visitor's browser to fetch that code from the company's own servers.

EverThread lists every outside address your page actually loaded code from, if it is not your own domain or on your watch list. Seeing a list here is not a problem in itself. It is a chance to confirm that everything on it is something you chose.

Why it matters

Outside code runs with the same power as your own. It can read what visitors type into forms and change what the page shows. That is fine for a trusted provider, and it is also why card skimmers try to get their code onto checkout pages.

Trusted code can also go bad. In 2024, a free script address used by many sites, polyfill.io, changed owners and began serving harmful code to sites that still loaded it. Sites that had removed old, unused scripts were not affected. Keeping this list short and familiar is simple protection.

How to check your own site

Go through the addresses in the alert one by one and match each to a service you use. Common, expected ones include www.googletagmanager.com and www.google-analytics.com (Google Analytics and Tag Manager), connect.facebook.net (Meta pixel), js.stripe.com (Stripe), www.gstatic.com and www.google.com (reCAPTCHA and other Google tools), and cdnjs.cloudflare.com, cdn.jsdelivr.net or unpkg.com (shared code libraries).
Your platform may appear too: cdn.shopify.com for Shopify, addresses ending in squarespace.com for Squarespace, and static.parastorage.com for Wix. These are expected.
If a name is unfamiliar, search the web for it. A real vendor has a website and help pages explaining its code. Ask your developer or agency, who may have added it for you.
Look harder at anything that imitates a well-known name with an extra word or an unusual ending, looks like random letters, appeared without anyone changing the site, or only shows up on checkout or login pages.
To see the list yourself, open your browser's developer tools (right-click, Inspect), go to the Network tab, choose the JS filter, and reload. Right-click a column heading to add a Domain column.

How to fix it

Any website

If you recognize every name, acknowledge the finding in your EverThread dashboard. We stay quiet unless the list changes.
If some belong to tools you stopped using, such as an old chat widget or a trial analytics tool, remove their code. Unused scripts add risk and slow the page for no benefit.
If nobody can identify a name after searching and asking around, treat it as a possible break-in. The obfuscated script guide covers what to check and how to clean up.

Google Tag Manager

If www.googletagmanager.com is on your list, other scripts may be added through it rather than through your site. Sign in to Tag Manager and review the tags in your container.
Remove tags you no longer use, and check the user management settings under Admin so only people you know have access.

WordPress

Plugins add most outside scripts. To find which plugin adds a given address, deactivate plugins one at a time on a test copy of your site and reload the page.
Also check header and footer code plugins, theme settings and the Customizer, where tracking code is often pasted.

Shopify, Squarespace, Wix and other hosted builders

Installed apps and marketing integrations add most outside scripts. Review them and remove any you no longer use.
Check custom code too: the theme code on Shopify (especially theme.liquid) and Customer events under Settings, Code Injection on Squarespace, and Custom Code on Wix. Menu names change, so search the help center if needed.
After removing an app, check the theme. Some older apps leave their code behind.

Cloudflare

Cloudflare can add its own scripts, for example static.cloudflareinsights.com for Web Analytics and challenges.cloudflare.com for Turnstile. These are expected if you use those features.

What to send your developer

The check lists script hosts requested during a real page load that are neither the page host nor on the allowlist, so it includes scripts injected at runtime by tag managers or other scripts. Keep the list short, pin versions, add Subresource Integrity to static library files, and enforce a Content-Security-Policy script-src allowlist. Start in report-only mode.

// In the browser console, after the page loads:
[...new Set(performance.getEntriesByType('resource').filter(r => r.initiatorType === 'script').map(r => new URL(r.name).hostname))]

Content-Security-Policy-Report-Only: script-src 'self' https://www.googletagmanager.com https://js.stripe.com

Common questions

Do I need to remove all of these?

No. Most websites need a few outside scripts to work. Keep the ones you use and trust, and remove the rest. A shorter list is easier to keep an eye on.

Why is EverThread telling me about normal things?

Because only you know which services you chose. We show the list once so you can confirm it. After you acknowledge it, we only speak up if the list changes, which is exactly when it is worth a look.

Can a script I trust become harmful?

Yes, rarely. A vendor can be hacked, or a script address can change hands, as happened with polyfill.io. Removing scripts you no longer use and loading code only from vendors you actively work with keeps that risk small.

Do these scripts affect privacy rules?

Often. Analytics, advertising and pixel scripts usually set cookies or collect visitor data, and in many places that requires telling visitors or asking for consent. This is not legal advice, so check the rules that apply to your business.