Third-Party Risk Surface
45 points total
Analyzes your site's third-party dependencies — external scripts, tracker presence, Subresource Integrity coverage, external resource domain count, mixed content, and risky/outdated libraries.
Checks
| Check | Weight | What it measures |
|---|---|---|
Subresource Integrity (SRI) thirdparty_subresource_integrity | 25 pts | Measures the proportion of external scripts with integrity and crossorigin attributes. |
Mixed Content thirdparty_mixed_content | 10 pts | Detects resources loaded over HTTP on HTTPS pages (active and passive mixed content). |
Risky Library Detection thirdparty_risky_library_detection | 10 pts | Scans for known vulnerable libraries, EOL frameworks, and high-risk dependencies (e.g. polyfill.io). |
External Script Count thirdparty_external_script_count | info | Counts distinct external script sources. Informational — not scored. |
Tracker Presence thirdparty_tracker_presence | info | Identifies analytics and advertising tracker scripts. Informational — not scored. |
Resource Domain Count thirdparty_resource_domain_count | info | Counts distinct external domains contacted by the page. Informational — not scored. |
Pass / Warn / Fail Logic
Subresource Integrity (SRI)
Pass if all eligible scripts have SRI; warn on partial coverage; fail if none.
Mixed Content
Pass if no mixed content; warn on passive (images/media); fail on active (scripts/styles).
Risky Library Detection
Pass if no risky libraries; warn on outdated versions; fail on known vulnerabilities or compromised supply chain.
External Script Count
Informational only (weight 0). Generates advisory findings based on count thresholds.
Tracker Presence
Informational only (weight 0). Generates advisory findings.
Resource Domain Count
Informational only (weight 0). Generates advisory findings based on domain count.
Findings & How to Fix Them
These are the specific findings RedScore may report for this category, along with remediation guidance.
no_sriAdd Subresource Integrity (SRI) for static third-party scripts where hashes are stable. Some providers (for example Google Tag Manager) serve dynamic JavaScript where SRI is not applicable — those are excluded from the SRI score denominator when detected.
active_mixed_contentImmediately update all script, stylesheet, and iframe references to use HTTPS.
polyfill_io_detectedImmediately remove all references to polyfill.io. Self-host polyfills or use a trusted CDN alternative.
eol_framework_detectedMigrate from Angular.js to a maintained framework (Angular 2+, React, Vue, Svelte).
minimal_sriImplement Subresource Integrity for all external scripts. Generate SHA-384 hashes for each script and add integrity and crossorigin attributes.
vulnerable_library_detectedUpdate vulnerable libraries to patched versions recommended by the vendor.
excessive_external_scriptsLarge number of external script sources detected. This increases supply-chain attack surface. Consider consolidating or self-hosting where feasible.
extensive_trackingSignificant number of tracking scripts detected, expanding the third-party script surface area. Each is a supply-chain dependency. Audit periodically for unused scripts.
excessive_external_resourcesLarge number of external resource domains contacted. Each is a trust dependency that could be compromised or go offline. Consider consolidating where feasible.
partial_sriAdd integrity and crossorigin attributes to the remaining external script tags. Your build tool or CDN provider can generate the correct hashes.
passive_mixed_contentUpdate all resource URLs to use HTTPS. Most CDNs and image hosts support HTTPS.
moment_js_detectedConsider migrating from Moment.js to a modern date library (date-fns, Luxon, Day.js).
high_external_scriptsElevated number of external script sources. Each is a supply-chain dependency — review whether all are still needed and ensure SRI coverage.
moderate_external_scriptsModerate number of external script sources detected. Each external source is a supply-chain dependency. Ensure SRI hashes are present where possible.
ad_trackers_presentAdvertising or tracking scripts detected. These expand the third-party script surface area. Ensure disclosure and consent where required.
standard_analytics_presentStandard analytics scripts detected. Each third-party script is a supply-chain dependency that could be compromised. Ensure SRI hashes are applied where supported.
high_external_resourcesElevated number of external resource domains. Each domain is a trust dependency. Self-host static assets where feasible to reduce contacts.
moderate_external_resourcesModerate number of external resource domains contacted. This is common for modern sites; ensure SRI is applied to script resources.