Browser & Web Performance · Senior · Question 68 of 75
Which approach to third-party scripts limits both performance and security risk the most?
- 1Load them all synchronously in
<head>so they finish early - ✓Correct answer: Inventory them, load only what's needed, pin versions with SRI where possible, and restrict them with CSP and sandboxed iframes
- 3Copy their code into your bundle without review
Explanation
Each third-party script runs with your origin's privileges and on your main thread; supply chain attacks often come through them.