Data on third party entities and their impact on the web.

This document is a summary of which third party scripts are most responsible for excessive JavaScript execution on the web today.

1. Goals
2. Methodology
3. npm Module
4. Updates
5. Data
   1. Summary
   2. How to Interpret
   3. Third Parties by Category
      1. Advertising
      2. Analytics
      3. Social
      4. Video
      5. Developer Utilities
      6. Hosting Platforms
      7. Marketing
      8. Customer Success
      9. Content & Publishing
      10. CDNs
      11. Tag Management
      12. Consent Management Provider
      13. Mixed / Other
   4. Third Parties by Total Impact
6. Future Work
7. FAQs
8. Contributing

1. Quantify the impact of third party scripts on the web.
2. Identify the third party scripts on the web that have the greatest performance cost.
3. Give developers the information they need to make informed decisions about which third parties to include on their sites.
4. Incentivize responsible third party script behavior.
5. Make this information accessible and useful.

HTTP Archive is an initiative that tracks how the web is built. Every month, ~4 million sites are crawled with Lighthouse on mobile. Lighthouse breaks down the total script execution time of each page and attributes the execution to a URL. Using BigQuery, this project aggregates the script execution to the origin-level and assigns each origin to the responsible entity.

The entity classification data is available as an npm module.

const {getEntity} = require('third-party-web')
const entity = getEntity('https://d36mpcpuzc4ztk.cloudfront.net/js/visitor.js')
console.log(entity)
//   {
//     "name": "Freshdesk",
//     "homepage": "https://freshdesk.com/",
//     "category": "customer-success",
//     "domains": ["d36mpcpuzc4ztk.cloudfront.net"]
//   }

Due to a change in HTTPArchive measurement which temporarily disabled site-isolation (out-of-process iframes), all of the third-parties whose work previously took place off the main-thread are now counted on the main thread (and thus appear in our stats). This is most evident in the change to Google-owned properties such as YouTube and Doubleclick whose complete cost are now captured.

A shortcoming of the attribution approach has been fixed. Total usage is now reported based on the number of pages in the dataset that use the third-party, not the number of scripts. Correspondingly, all average impact times are now reported per page rather than per script. Previously, a third party could appear to have a lower impact or be more popular simply by splitting their work across multiple files.

Third-parties that performed most of their work from a single script should see little to no impact from this change, but some entities have seen significant ranking movement. Hosting providers that host entire pages are, understandably, the most affected.

Some notable changes below:

Google Ads clarified that www.googletagservices.com serves more ad scripts than generic tag management, and it has been reclassified accordingly. This has dropped the overall Tag Management share considerably back down to its earlier position.

Almost 2,000 entities tracked now across ~3,000+ domains! Huge props to @simonhearne for making this massive increase possible. Tag Managers have now been split out into their own category since they represented such a large percentage of the "Mixed / Other" category.

Huge props to WordAds for reducing their impact from ~2.5s to ~200ms on average! A few entities are showing considerably less data this cycle (Media Math, Crazy Egg, DoubleVerify, Bootstrap CDN). Perhaps they've added new CDNs/hostnames that we haven't identified or the basket of sites in HTTPArchive has shifted away from their usage.

Across top ~4 million sites, ~2700 origins account for ~57% of all script execution time with the top 50 entities already accounting for ~47%. Third party script execution is the majority chunk of the web today, and it's important to make informed choices.

Each entity has a number of data points available.

1. Usage (Total Number of Occurrences) - how many scripts from their origins were included on pages
2. Total Impact (Total Execution Time) - how many seconds were spent executing their scripts across the web
3. Average Impact (Average Execution Time) - on average, how many milliseconds were spent executing each script
4. Category - what type of script is this

This section breaks down third parties by category. The third parties in each category are ranked from first to last based on the average impact of their scripts. Perhaps the most important comparisons lie here. You always need to pick an analytics provider, but at least you can pick the most well-behaved analytics provider.

Unsurprisingly, ads account for the largest identifiable chunk of third party script execution.

These scripts are part of advertising networks, either serving or measuring.

These scripts measure or track users and their actions. There's a wide range in impact here depending on what's being tracked.

These scripts enable social features.

These scripts enable video player and streaming functionality.

These scripts are developer utilities (API clients, site monitoring, fraud detection, etc).

These scripts are from web hosting platforms (WordPress, Wix, Squarespace, etc). Note that in this category, this can sometimes be the entirety of script on the page, and so the "impact" rank might be misleading. In the case of WordPress, this just indicates the libraries hosted and served by WordPress not all sites using self-hosted WordPress.

These scripts are from marketing tools that add popups/newsletters/etc.

These scripts are from customer support/marketing providers that offer chat and contact solutions. These scripts are generally heavier in weight.

These scripts are from content providers or publishing-specific affiliate tracking.

These are a mixture of publicly hosted open source libraries (e.g. jQuery) served over different public CDNs and private CDN usage. This category is unique in that the origin may have no responsibility for the performance of what's being served. Note that rank here does not imply one CDN is better than the other. It simply indicates that the scripts being served from that origin are lighter/heavier than the ones served by another.

These scripts tend to load lots of other scripts and initiate many tasks.

IAB Consent Management Providers are the 'Cookie Consent' popups used by many publishers. They're invoked for every page and sit on the critical path between a page loading and adverts being displayed.

These are miscellaneous scripts delivered via a shared origin with no precise category or attribution. Help us out by identifying more origins!

This section highlights the entities responsible for the most script execution across the web. This helps inform which improvements would have the largest total impact.

1. Introduce URL-level data for more fine-grained analysis, i.e. which libraries from Cloudflare/Google CDNs are most expensive.
2. Expand the scope, i.e. include more third parties and have greater entity/category coverage.

This can be for one of several reasons:

1. The entity does not have references to their origin on at least 50 pages in the dataset.
2. The entity's origins have not yet been identified. See How can I contribute?

Total Occurrences is the number of pages on which the entity is included.

The HTTP Archive dataset includes Lighthouse reports for each URL on mobile. Lighthouse has an audit called "bootup-time" that summarizes the amount of time that each script spent on the main thread. The "Average Impact" for an entity is the total execution time of scripts whose domain matches one of the entity's domains divided by the total number of pages that included the entity.

Average Impact = Total Execution Time / Total Occurrences

Lighthouse's bootup time audit attempts to attribute all toplevel main-thread tasks to a URL. A main thread task is attributed to the first script URL found in the stack. If you're interested in helping us improve this logic, see Contributing for details.

Verify that the origins in data/entities.js are correct. Most issues will simply be the result of mislabelling of shared origins. If everything checks out, there is likely no further action and the data is valid. If you still believe there's errors, file an issue to discuss futher.

Only about 90% of the third party script execution has been assigned to an entity. We could use your help identifying the rest! See Contributing for details.

A huge thanks to @simonhearne and @soulgalore for their assistance in classifying additional domains!

The domain->entity mapping can be found in data/entities.js. Adding a new entity is as simple as adding a new array item with the following form.

{
    "name": "Facebook",
    "homepage": "https://www.facebook.com",
    "category": "social",
    "domains": [
        "*.facebook.com",
        "*.fbcdn.net"
    ],
    "examples": [
        "www.facebook.com",
        "connect.facebook.net",
        "staticxx.facebook.com",
        "static.xx.fbcdn.net",
        "m.facebook.com"
    ]
}

The logic for attribution to individual script URLs can be found in the Lighthouse repo. File an issue over there to discuss further.

This is now automated! Run yarn start:update-ha-data with a gcp-credentials.json file in the root directory of this project (look at bin/automated-update.js for the steps involved).

This README is auto-generated from the templates lib/ and the computed data. In order to update the charts, you'll need to make sure you have cairo installed locally in addition to yarn install.

# Install `cairo` and dependencies for node-canvas
brew install pkg-config cairo pango libpng jpeg giflib
# Build the requirements in this repo
yarn build
# Regenerate the README
yarn start

The web code is located in www/ directory of this repository. Open a PR to make changes.