Your delivery stack can be perfect and your pages still slow, because a third of their weight answers to other people’s infrastructure. Third-party content is the performance surface teams control least and audit least, which is exactly backwards given its share of the waterfall.
Measuring the actual tax
Attribution first: Resource Timing per third-party origin (bytes, duration, blocking behavior), long-task attribution for their JS execution, and the counterfactual measurement that settles arguments, load the page with each vendor blocked and diff the metrics. The findings pattern is stable across audits: a few tags carry real product value, several duplicate each other, and a tail of zombies survives from campaigns and teams that no longer exist. Nobody defends the zombies; nobody had measured them either.
Containment engineering
For the tags that stay: async and defer as table stakes, so nothing third-party blocks parsing; facade patterns for heavy embeds (a thumbnail impersonates the video player until interaction summons the real one); resource-hint discipline (preconnect the critical vendor, never the tail); timeout and error isolation so a vendor’s outage degrades their widget rather than your page; and, increasingly, first-party proxying through your edge, serving vendor scripts from your own hostname with your own caching and your own kill switch. The edge turns out to be the natural sandbox warden.
The edge-proxying pattern deserves elaboration because it converts governance into infrastructure: routing vendor scripts through your own delivery layer gives you cache control over their assets (many update rarely and cache terribly by default), a uniform kill switch per vendor, real observability instead of opaque cross-origin timing, and insulation from vendor CDN incidents, their outage becomes your stale-served copy. The trade is responsibility: you now operate their delivery, must respect their update cadence, and should verify licensing permits it. For the handful of tags on your critical path the trade is usually decisively worth it, and it is one more instance of this series’ standing pattern: pull the things you depend on into the layer you control.
Governance or entropy
Tags accrete because adding one is a marketing ticket while removing one is an engineering investigation. The working governance: a tag registry with owner, purpose and measured cost per entry; a byte-and-blocking budget per template that new tags must fit; expiry dates that force renewal decisions; and quarterly counterfactual re-measurement feeding the review. Estates with the registry hold third-party weight flat for years; estates without it re-run the archaeology audit every eighteen months and act surprised each time.
In practice
Run the counterfactual audit this quarter: block each third-party origin in turn on a representative page, record the metric deltas, and take the resulting ranked list to whoever owns each tag. The conversation changes when the cost is a number, most zombie tags die on contact with their own measurements, and the survivors inherit budgets. It is the highest-leverage performance meeting most organizations have never held.
Third-party audits here deliver the counterfactual table and the registry template. The zombie list is always longer than expected.