https://securoxen.io/assets/what-your-site-leaks-to-third-parties-DJWpU-bi.js

1import{j as e}from"./index-0qbe4j-K.js";import{P as s}from"./prose-CP3GO64z.js";import{L as i}from"./react-vendor-CuqwDvgQ.js";function r(){return e.jsxs(s,{children:[e.jsx("p",{children:"Almost nobody knows how many companies their website talks to. You added analytics, a font, a chat widget, an error tracker and a payment script - five decisions, each reasonable on its own. Each of those scripts can load more scripts. The number of parties receiving data about your visitors is usually larger than the number of vendors you think you have."}),e.jsx("p",{children:"You can find out exactly, in about ten minutes, without installing anything."}),e.jsx("h3",{children:"Capture what actually happened"}),e.jsxs("p",{children:['Open your site in a browser, open DevTools, and go to the Network tab. Tick "Preserve log", reload, and use the page the way a visitor would - click around, submit a form, log in if that is part of the journey. Then right-click anywhere in the request list and choose'," ",e.jsx("strong",{children:"Save all as HAR"}),"."]}),e.jsx("p",{children:"A HAR file is a complete recording of that session: every request, every header, every cookie, and often response bodies. That is exactly why it is useful, and exactly why you should be careful with it - a HAR from a logged-in session contains your session token. Do not paste one into a random online viewer, and delete it when you are done."}),e.jsxs("p",{children:["Drop it into the ",e.jsx(i,{to:"/tools/har-analyzer",children:"HAR File Analyzer"}),". It parses the file in your browser, lists every third-party host with request counts, and flags credentials or personal data travelling somewhere they should not."]}),e.jsx("h3",{children:"Four things worth looking for"}),e.jsxs("ul",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Hosts you do not recognise."})," Third-party scripts load their own dependencies. A tag manager is frequently the entry point for a dozen destinations nobody on your team chose deliberately."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Credentials sent cross-origin."})," An ",e.jsx("code",{children:"Authorization"})," header or a cookie going to a domain that is not yours is a genuine incident, not a tidiness issue. Usually it is a misconfigured SDK or an over-broad cookie domain."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Personal data in query strings."})," URLs are logged everywhere - your server, intermediate proxies, the recipient's analytics, and the ",e.jsx("code",{children:"Referer"})," header sent to the next site. An email address in a URL has a much wider blast radius than one in a POST body."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Plain HTTP."})," Rare now, but a single ",e.jsx("code",{children:"http://"})," request on an otherwise secure page is readable and modifiable by anyone on the network path."]})]}),e.jsx("h3",{children:"Why the query-string case is the one that bites"}),e.jsxs("p",{children:["Say a signup flow redirects to ",e.jsx("code",{children:"/[email protected]"}),". That address is now in your access logs, your CDN's logs, any analytics on the page, and - because browsers send the current URL as the ",e.jsx("code",{children:"Referer"})," on outbound requests - potentially in the logs of every third party whose script runs on that page."]}),e.jsx("p",{children:"Nobody decided to share it. It leaked because of where it was put. Identifiers belong in a POST body or a server-side session, not in a URL."}),e.jsx("h3",{children:"Turning the audit into fixes"}),e.jsxs("ol",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Remove what you do not use."})," The fastest privacy improvement is usually deleting a script someone added for a campaign that ended two years ago."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Self-host what you can."})," Fonts are the common example: serving them yourself removes a third party from every single page view."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Constrain the rest with a Content-Security-Policy."}),' A CSP turns "any script can load anything" into an explicit allowlist, so a compromised dependency cannot quietly add a sixth destination. Build one with the'," ",e.jsx(i,{to:"/tools/csp-builder",children:"CSP Builder"}),", then check the rest of your headers with the ",e.jsx(i,{to:"/tools/security-headers",children:"Security Headers Grader"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Re-run the capture."})," An audit you do once is a snapshot; the value is in comparing before and after, and repeating it after any dependency change."]})]}),e.jsx("h3",{children:"The same problem in reverse"}),e.jsxs("p",{children:["Links you send carry tracking too. A URL copied from a marketing email or a social app often includes ",e.jsx("code",{children:"utm_*"})," parameters, ",e.jsx("code",{children:"fbclid"}),", or a click identifier that ties the recipient's visit back to you. Strip them with the"," ",e.jsx(i,{to:"/tools/link-cleaner",children:"Link Cleaner"})," before sharing - it is a small habit, and it is the same principle: know what is riding along with the thing you are sending."]})]})}export{r as default};