Third-Party Request Auditor
Most pages quietly contact a dozen other companies before you click anything. This loads the page in a real browser and lists every one of them — who they are, what they collect, and which ones nobody meant to leave behind.
Loads the page in headless Chromium, so JavaScript-injected trackers are included.
Takes 10–30 seconds — a real page load, not a source-code scan.
How this is measured, and what it misses. We open the page once in a
real browser with no cookies, no logged-in session, and no interaction — nothing is
clicked and no consent banner is answered. Every network request the page makes is
recorded. That catches trackers injected by other scripts, which a source-code scan
cannot see. It will not catch tags that only fire after consent is accepted,
after scrolling, on a click, or on a later page in a single-page app.
Read the result as a floor, not a total.
🏢 Who The Page Contacted
Grouped by company, because one company often uses several domains.
📋 Every Third-Party Domain
The raw list, sorted by request count. In HTML means the domain is written in the page source; injected means a script added it at runtime.
WHY IT MATTERS
Every Extra Company Is A Decision Someone Made
A third-party request is not just a performance cost, though it is that too — each new domain means a DNS lookup and a TLS handshake before a single byte of content arrives. It is also a disclosure. When a page loads a script from another company, that company receives the visitor's IP address, the page they are on, and usually a cookie that recognises them next time. It can also run arbitrary code in the page, which means it can read the DOM, watch form fields and reach anything the page itself can reach. That is the reason a forgotten analytics tag from a campaign three years ago is worth finding: it still executes, still reports, and nobody is checking what it does any more. The most valuable line in a report like this is usually not the tracker you expected — it is the domain you cannot account for at all.
What else can you check?
These tools all work on the same connection and address data — pick whichever question you actually have.
Want to see the full path to a site?
DNS, redirects, every hop, the CDN, TLS and the origin server.
Want to know your public IP?
See your IPv4 and IPv6 addresses, location, ISP and ASN.
Want to check your tower & route?
Live ping, speed, DNS, traceroute and a map of nearby points.
Want to ping from around the world?
Real latency from real probes across 12 countries, live on a map.
Want to locate any IP address?
City, region, country and coordinates for any public IP.
Want to know if an IP is risky?
Proxy, VPN, Tor, hosting and abuse-report indicators.
Want to know if you're blacklisted?
Check an address against major spam and abuse DNSBLs.
Want to know who owns an IP?
Network owner, ASN, CIDR range and abuse contact.
Want to explore an AS number?
Announced prefixes, BGP neighbours and registry details.
Want to test your connection speed?
Measure real download, upload, ping and jitter.
Want to see what changed?
Word-level diff between two blocks of text or code.
Want to know if a DNS change is live yet?
Compare answers from five independent public resolvers.
Want to verify a domain's nameservers?
Direct authoritative checks, glue records and SOA serials.
Want to check a domain's DNSSEC setup?
DNSKEY, DS records, signature expiry and real validation.
Want to see the hop-by-hop path to a server?
A real traceroute from a genuine probe anywhere in the world.
Want to know if a server port is open?
A real TCP connection attempt - open, closed or filtered.
Want to measure latency to a server?
Real connect timing - min/avg/max, jitter and connection loss.
Want a clean URL slug from a title?
Real transliteration, stop words and batch mode.
Want to find and replace across a document?
Regex, capture groups and a live preview before you commit.
Want to find the invisible character?
Code points, escapes, bytes and hidden-character detection.
Want to escape text for HTML?
Minimal, named or numeric entities, attribute-safe.
Want to strip emoji cleanly?
Whole clusters - no half-flags or stray modifiers left.
Want to spot repeated words?
Frequency, density and accidental doubles like "the the".
Want to know if a URL is cached?
Two requests prove whether your CDN is really caching it.
Want to see what a site knows about you?
Storage, cookies, tokens and what your browser actually cached.
Want to run that check on any site?
One-click bookmarklet reads storage and tokens where they live.
Third-Party Request Auditor FAQ
Why does this find more than other scanners?
Because it runs the page instead of reading it. A tool that parses HTML sees one Google Tag Manager tag; a browser sees GTM plus everything GTM then loads, which is often ten or more further companies. Those are the ones that matter.
Is a high count automatically bad?
No. A payment provider, a consent banner and a CDN are all third parties and all legitimate. What matters is whether each one is accounted for. We separate trackers from infrastructure for exactly this reason.
What does "unrecognised" mean?
That the domain isn't in our catalogue — nothing more. It is not a verdict of safe or unsafe. We would rather say we don't know than guess at an owner, and an unrecognised domain on your own site is the thing most worth investigating.
Why is the byte count approximate?
We total the Content-Length each server declares. Responses that stream without declaring a length are counted as zero, so the real figure is somewhat higher. We'd rather undercount visibly than estimate.
Does it accept the cookie banner?
No. It loads the page as an anonymous first-time visitor and touches nothing. Anything that fires only after consent is accepted will not appear here, which is why the count is a floor rather than a total.
Can I audit a page behind a login?
Not with this tool — it loads pages as an anonymous visitor with no session. For a logged-in page, the Site Storage Inspector bookmarklet runs inside your own browser where your session already exists.