Deep dive into third-party performance
summary
HTTP Archive queries, browser devtools and RUM data show the median site has 37% third‑party requests, p50 reveals eight sync scripts, and RequestMap visualises tag graphs that call other tags; cnn.com shows 191 third‑party requests and a 19s first CPU idle (4.6s when EU consent blocks trackers). Real incidents include a 30% overnight conversion drop from a third‑party update, a 1.6s unload delay from beforeunload handlers, a 650k‑error spike, 26% more revenue after removing a review widget, and ~0.2% sites with cryptominers. Subresource Integrity is scarce CSP reports give observability.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:53Third-parties?
- 8:55Fancy a super power?
- 12:34sync is still king(!)
- 13:45Beware your script loading strategy
- 14:44Tag managers allow for this
- 16:24the missing revenue
- 16:52The discovery
- 19:11Subresource Integrity
- 20:22Incident 3: the "performance" tool
- 24:59the review provider
- 26:34The defense
- 28:12the malicious ads TS ALLE
- 29:15Content Security Policy CEFITS ALLE
- 30:12the crypto miner
- 31:32Many compromised services...
- 31:53CryptoMiner Use
- 33:56the "optimisation"
- 36:18Evaluate performance
- 36:41Use the platform
related talks
05mThe Performance Of Others
46mChaperones and curfews: minimising 3rd party impact
52mIt’s My (Third) Party, and I’ll Cry if I Want To
41mIt’s My (Third) Party, and I’ll Cry if I Want To
47mIt’s My (Third) Party, and I’ll Cry if I Want To
56mThird Party Scripts
47mIt's My (Third) Party and I'll Cry If I Want To
14mOptimizing Third-Party Loading in Next.js