Every embed is a guest that watches
Why it matters Most sites do not leak because their owners are careless with data. They leak because of what they embed: a font, a map, a video, a chat bubble. Each one is a small piece of someone else's code or content, and each one sees your visitors. Knowing what each guest sees is the first step to building a site that keeps your visitors' trust.
Imagine you run a cafe. You let a few helpers in: someone who arranges the flowers, someone who fixes the coffee machine, someone who takes card payments at the till. Each helper is useful. Each helper also sees who comes in, when, and what they order. Some only glance at the room; one, the card reader company, may write down every customer.
Your website is the cafe. Every embed is a helper you let in, and every helper watches.
Embed: anything your page loads from another place: a script, an image, a font, a style sheet or a whole framed page (an iframe). Your page's HTML asks for it, and the visitor's browser fetches it.
Third party: a different site from the one in the address bar. If your site is shopd.example, then fonts.example and adco.example are third parties. In Leg 1 you met this idea from the visitor's side; here you are the site owner choosing who to invite.
What every guest sees, just by being fetched
When a visitor's browser fetches anything from another server, that server learns some things for free, even if the file is a single pixel:
- the visitor's IP address (a rough location and network),
- the User-Agent (browser and system),
- the time of the visit,
- usually which site sent them, through the Referer header (this module's last lesson shows how to limit it),
- any cookies it set earlier, if the browser still sends them.
Put the same guest on thousands of sites and it can join those visits into one picture of a person. That is exactly the tracker you studied in Leg 2.
The six usual guests
| Guest | Why sites add it | What it can see |
|---|---|---|
| Web fonts | Nice typography | IP, browser, time and your site on every page view |
| Analytics | Counting visits | Every page a visitor opens, often with a long-lived ID; some tools record clicks and scrolling ("session replay") |
| Maps | Showing where you are | That this visitor looked up your address, plus cookies of the map company |
| Video players | Product videos, tutorials | The player often loads and sets cookies before anyone presses play |
| Chat widgets | Customer support | The page and everything typed into the chat box |
| Payment scripts | Taking money | Card details (that is their job), and some providers recommend loading their script on every page so their fraud checks can see how visitors move around |
None of these guests is "evil". Most are useful. The point is to choose them on purpose, knowing the price your visitors pay.
A script is a guest with your house keys
Not all embeds are equal. An image or a font is just fetched: the server sees the request and nothing more. An iframe is a separate little page in a box; it cannot read your page.
A script loaded with <script src="https://chat.example/widget.js"> is different. It runs inside your page with your page's full powers. It can read every word on the page, every form field as the visitor types, and every cookie that is not marked HttpOnly: the same powers an injected script had in Module 10. It can also load more scripts from anywhere. And its owner can change the file tomorrow without telling you.
A common misconception: "the chat widget only sees the chat". It sees whatever your page sees. If it sits on your checkout page, it can read the checkout form. Sandboxing it in an iframe, or loading it only where it is needed, is the defence.
Try it Open any site you use, then open DevTools (F12, or Cmd+Option+I on a Mac), go to the Network tab and reload. Sort by the Domain column (right-click a column header to add it). Count how many different domains appear. Every one that is not the site itself is a guest.
Recap
- Every embed is a guest: fetching it tells another server the visitor's IP, browser, time and usually your site.
- The same guest on many sites can join visits into one profile.
- Images and fonts are only fetched; an iframe is boxed off; a script runs with your page's full powers.
- Choose guests on purpose, and load each one only where it is needed.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.