How to See What Scripts a Website Uses (5 Free Ways)

The average website loads far more JavaScript than its owner realizes. Analytics, a tag manager, an ad pixel or three, a chat widget, a heatmap tool, a consent banner, a payment script, plus whatever each of those decided to load on its own. Many were added years ago by someone who has since left.

Knowing exactly which scripts run on your pages matters for four reasons: they slow the site down, they decide what personal data leaves the browser, they're a favorite target for attackers, and when one quietly disappears (your analytics, say) you lose data you can't get back.

This guide shows five free ways to see every script a website uses, how to tell what each one is, and how to keep the list under control.

Why the scripts on your site matter#

Speed. Third-party scripts are one of the most common reasons pages are slow. Each one adds requests, downloads and work for the browser's main thread, which delays the moment visitors can actually use the page.

Privacy and consent. Every tracking script sends data somewhere. If a pixel loads before your visitor accepts cookies, or a tool you removed from your privacy policy is still running, that's a compliance problem you can't see by looking at the page.

Security. Scripts run with full access to the page, including forms and checkout fields. Attacks that inject card-skimming code into a site (often called Magecart attacks) work precisely because nobody notices one extra script. That's why PCI DSS v4.0 requirement 6.4.3, in force since March 31, 2025, asks merchants to keep an inventory of the scripts on their payment pages and justify each one. Check with your payment provider which requirements apply to your setup.

Broken tracking. The opposite problem: a theme update or a tag manager change removes your analytics or conversion pixel, and nothing errors. You find out weeks later when a report shows a cliff. (We covered that in Google Analytics not tracking.)

5 ways to see what scripts a website uses#

1. Use a free script checker#

The fastest option. MyKavo's free Script Detector takes a URL and lists the scripts the page loads, separates first-party from third-party, and names common services such as Google Analytics, Google Tag Manager, Meta Pixel, Stripe, Hotjar, Intercom and HubSpot. No signup.

One limitation to know about, for this and any tool that reads the page's HTML: scripts that a tag manager injects later, after the page has loaded, don't appear in the HTML. Use method 3 to catch those.

2. View the page source#

Right-click the page and choose View page source (or press Ctrl+U, Cmd+Option+U on a Mac), then search for <script. You'll see every script tag in the HTML the server sent, with its src address.

Like method 1, this shows the original HTML, not what was added afterwards by JavaScript. On a site using Google Tag Manager you may see only the tag manager itself, while it loads ten more scripts behind it.

3. Use your browser's DevTools Network tab#

This is the complete picture, because it shows what the browser actually downloaded.

1. Open DevTools (F12, or Cmd+Option+I on a Mac) and go to the Network tab.
2. Click the JS filter.
3. Reload the page.

Every JavaScript file the page loaded appears in the list, including the ones injected by a tag manager. Two columns are especially useful:

• Domain (right-click the column header to add it) groups scripts by who serves them.
• Initiator shows what caused each script to load. It's how you discover that the chat widget loaded three other scripts of its own.

Scroll down the page and click around too. Some scripts only load on scroll, on interaction, or after consent is given.

4. Run PageSpeed Insights or Lighthouse#

PageSpeed Insights (or Lighthouse inside Chrome DevTools) includes a diagnostic for third-party code. It lists the third-party providers on the page, how much each one transferred, and how much time it blocked the main thread. It's the best way to see which scripts actually cost you speed.

5. Check your tag manager#

If you use Google Tag Manager, the scripts it loads are configured as tags in your container. Open the container, review every tag and its trigger, and use Preview mode to see which tags fire on a given page. Old tags for tools you no longer pay for are surprisingly common.

How to tell what a script is#

The script's address usually gives it away. Some of the most common:

For anything you don't recognize, search the domain. If you still can't find who owns it or why it's there, treat it as a priority to investigate, not something to ignore.

Run a script audit in 30 minutes#

1. List every script on your key templates: homepage, a product or service page, a blog post, checkout or your main form. Use the Network tab so you catch injected scripts.
2. Name an owner for each. Who added it, and which team uses its data?
3. Remove what nobody needs. Old A/B testing tools, ad pixels for campaigns that ended, heatmaps nobody opens.
4. Check consent. Tracking scripts should wait for consent where your rules require it. Reload with cookies declined and confirm they don't load.
5. Check payment pages separately. Keep checkout as lean as possible, and keep the inventory your payment compliance requires.
6. Re-check after every change to your theme, plugins, apps or tag manager.

Keep watching, because scripts change on their own#

A script audit is a snapshot. Scripts change without a deploy: a tag manager container gets published, a plugin update adds its own tracker, a third-party vendor starts loading something new, or a theme change drops your analytics tag.

MyKavo loads the pages you monitor in a real browser on every scan, so it sees scripts added by tag managers too, and compares them against your approved baseline. You get an alert when a third-party script is removed (like your analytics or payment script) or when an unknown third-party script appears, with the before and after.

The bottom line#

Every script on your site affects its speed, privacy, security or data. Use a script checker for a quick list, the DevTools Network tab for the complete picture, and PageSpeed Insights to see what each one costs. Audit them regularly, remove what nobody needs, and watch for changes.

See what's running on any page with the free Script Detector, then start free with MyKavo to hear the day a script appears or disappears.