Third-party scripts use async or defer

Render-blocking third-party scripts couple your page's availability to an external CDN's response time and reliability. If the CDN is slow, your page hangs for every user. If the CDN is compromised or returns a 503, your page may fail to render entirely. Independently, synchronous script loading creates a timing window during which a slow or compromised CDN script executes before your application code, with full access to the page. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) applies. OWASP A08 flags synchronous third-party script loading as a supply chain risk that combines performance impact with security exposure.

Add async or defer to every <script> tag loading from an external domain. Use async for independent scripts that do not need DOM or other scripts; use defer for scripts that must execute after parsing or in a specific order.

<!-- async: downloads in parallel, executes immediately when ready -->
<script async src="https://www.googletagmanager.com/gtag/js"></script>

<!-- defer: downloads in parallel, executes after HTML parsing -->
<script defer src="https://cdn.example.com/lib.js"></script>

In Next.js, use <Script strategy='afterInteractive'> or strategy='lazyOnload' from next/script for third-party scripts — these automatically handle async loading with framework-aware timing.