How the outside services check works

Most websites load code from other companies: analytics, chat widgets, payment forms, fonts, script libraries from a public CDN. Every one of those scripts runs with the same power as your own code. If the company behind it is hacked or sold, the script on your page can change overnight. That is what happened in 2024, when the polyfill.io service was taken over and used to send malicious code to the sites that loaded it.

What it reads

The <script> and <iframe> tags on your home page and up to two linked pages, already fetched for other checks. It makes no requests of its own, and it does not download the outside scripts.

What it reports

• A script from a compromised CDN: your page loads a script from a domain known to have served malicious code, such as polyfill.io or the related domains the security firm Sansec named in its 2024 research (bootcss.com, bootcdn.net, staticfile.org, staticfile.net).

Every other outside service is listed in your report's attack-surface section, so you can see at a glance who else runs code on your pages. Being on that list is not a finding.

What it cannot see

• Scripts that other scripts add after the page loads, such as tag managers that pull in further tools. Only the tags in the page itself are read.
• Whether an outside service you use is trustworthy today. The check only knows about services with a published record of abuse.
• Pages the home page does not link to.

What to do with the result

For a compromised CDN, ask your developer to remove the script tag today, and to serve the library from your own site or a maintained CDN instead. For the rest of the list, it is worth asking once a year whether each service is still needed: every outside script you drop is one less company that can change your pages.