Third-party script tax

Every tag you paste in from someone else (analytics, session replay, chat widget, ad network, A/B testing, consent banner, embedded video) runs its JavaScript on the same single main thread as your app. If it also lives on an origin the browser has not talked to yet, you pay a DNS lookup and a TLS handshake before a byte of it arrives. That connection cost is per origin, not per tag: ten tags served from one host reuse the same connection, while three tags on three hosts cost three handshakes. The tax lands mostly on responsiveness: long tasks, a bad INP, buttons that ignore the first tap. Injected banners and iframes add layout shift on top.

The fix is mostly subtraction. Inventory what is actually loading (Chrome DevTools by domain, or the third-party section of a Lighthouse report), and make each vendor justify its milliseconds. What survives gets loaded politely: 'async' or 'defer', never a synchronous script in the head; a facade for anything heavy and interactive, meaning you render a lightweight fake (a static chat button, a YouTube thumbnail via lite-youtube) and only load the real embed on click. Set a third-party byte budget in CI so the tag list cannot quietly double.

The gotcha: this is the part of your page you cannot fix and cannot pin. A vendor can ship a slower script on a Tuesday with no deploy from you, and a tag manager makes it worse by letting marketing add vendors that inject further vendors. Also, the tax barely shows in a fast lab run on a desktop connection; it shows up in field data, on phones, where the users are.