Loading...
Loading...
Analytics, ad, and social pixels (Google Analytics, Meta Pixel, TikTok, and similar) load code from other origins into your page. Each one widens your attack surface, leaks visitor data and referrers to a third party, and pulls you into GDPR and ePrivacy consent obligations.
Every third-party script runs with the full privileges of your page: it can read the DOM, cookies not marked HttpOnly, form fields, and the URL. A single compromised tracker (supply-chain attack on the vendor, or a hijacked script host) becomes a Magecart-style skimmer on every page it loads. Separately from the security exposure, each pixel silently ships visitor IP, page URL, and referrer to the vendor. Under GDPR and the ePrivacy Directive, dropping those cookies or pixels before the user consents is a violation regulators have fined repeatedly, and EU DPAs have ruled standard Google Analytics transfers unlawful. WebShield inventories the third-party origins a page loads so you can see exactly who is on it; it does not block anything, and the presence of a tracker is not itself a breach.
A page has as many trust boundaries as it has distinct script origins. `google-analytics.com`, `connect.facebook.net`, and `analytics.tiktok.com` are separate origins you do not control, each able to execute arbitrary JavaScript in your document. Two response headers constrain the blast radius. `Referrer-Policy: strict-origin-when-cross-origin` (the modern browser default, but set it explicitly) strips the path and query from the `Referer` sent cross-origin, so a tracker sees `https://yourdomain.com/` instead of `https://yourdomain.com/account/reset?token=abc`. A Content-Security-Policy `script-src`/`connect-src` allowlist (CSP Level 3, per the W3C spec) names exactly which origins may load code and open connections; anything not listed is blocked, which caps how far a hijacked tag can exfiltrate. Consent gating (loading tags only after an affirmative opt-in, or via Google Consent Mode v2 defaulting to denied) addresses the legal obligation the headers do not. Proxying or self-hosting analytics (Plausible, Matomo, or a first-party GA proxy) turns a third-party origin into a first-party one, which shrinks the origin count and keeps data on infrastructure you control.
WebShield lists the distinct third-party origins a page loads (analytics, ad, and social hosts). You can reproduce that inventory locally: scrape external `src` hosts from the HTML, then confirm which get a real network connection in the browser. Runtime-injected tags (a tag manager loading more tags) only show in the live Network panel, not in the static HTML, so check both.
curl -s https://yourdomain.com | grep -oiE 'https?://[a-z0-9.-]+' | grep -viE 'yourdomain\.com' | sort -ucurl -sI https://yourdomain.com | grep -iE "referrer-policy|content-security-policy"Open DevTools (F12) > Network > filter "3rd-party requests", then reload the pageNo. WebShield audits: it inventories the third-party origins a page loads so you can see who is on it and decide what to keep. Blocking is your job, done through consent tooling, a CSP allowlist, or removing the tag.
Not by itself. The risk is cumulative attack surface plus data leakage plus consent obligations. A single well-known analytics tag is low risk; a page stacked with ad pixels, session replay, and social widgets is a real supply-chain and privacy exposure. Severity here is Low for that reason.
It turns a third-party origin into a first-party one. The browser sees requests to your own domain, so there is one fewer external party executing code and receiving data, your CSP stays tight, and adblockers stop clipping your numbers. Plausible and Matomo are built for this; GA can be proxied with more effort.
It will if the allowlist misses an origin a tag needs. GA4, for instance, beacons to both `google-analytics.com` and a regional `region1.google-analytics.com`. Stage with `Content-Security-Policy-Report-Only`, read the violation reports to find every origin, then enforce.
Applied the configuration change? Run a live scan to confirm the vulnerability is patched.