Run a coverage audit on almost any commercial site and the diagnosis repeats: the code slowing it down was not written there. Analytics, a chat bubble, session replay, two marketing pixels a campaign needed in 2024—each “just one script”, together the majority of main-thread time. You cannot performance-tune other people’s code. You can only decide how much of it to carry.

The audit ritual

Quarterly, list every third-party request and ask who owns it, what decision its data changed recently, and what breaks if it vanishes. Scripts with no owner get removed—the classic result being tags for tools nobody has logged into for a year. Every survivor must justify its milliseconds.

The facade pattern

The heaviest offenders—chat widgets, video embeds—are rarely used on most visits. So do not load them; load a costume:

// A button dressed as a chat bubble. 0 KB of vendor code.
facade.addEventListener('click', () => {
  loadScript('https://widget.chat.com/loader.js')
    .then(() => openChat());
}, { once: true });

Visitors who never open chat—most of them—pay nothing. The 2% who click wait a beat, which is fair pricing. Same trick for YouTube embeds: a thumbnail and play button until intent.

“Every tag is a small tax on every visit, levied by someone who does not answer your pager.”

Exile the rest

What must run but not on your main thread, move to a worker via Partytown or your framework’s equivalent—analytics fire, the thread stays free. Load nothing render-blocking, add defer as the default posture, and put a size budget in CI so the next “just one script” triggers a conversation instead of a regression.