What's the right way to prioritize which third-party scripts to keep versus cut when a performance audit flags too many running simultaneously?

Build the inventory from three places, not one

The app list in Shopify admin is not the inventory. Scripts reach a storefront by at least three routes, and an audit that checks one route always undercounts.

1. Theme app embeds and hardcoded tags in the theme files, including anything a previous agency left behind.
2. Web pixels registered through Customer Events, app or custom.
3. Tags injected by a tag manager, which is one entry in your inventory and often a dozen in the browser.

Uninstalled apps are the fourth route and the one that pays fastest. An app removed from the admin frequently leaves its theme snippet in place, still loading, owned by nobody.

Score every script on two axes

"Measured cost" means a number from a lab profile: main-thread time attributed to that origin, and whether it blocks render or first interaction. Not a guess, and not the vendor's own claim about being lightweight.

"Named owner" means a person, not a team. If the answer to "who decides whether this stays" is a department, the script has no owner.

The sign-off rule that makes the cut stick

Every script gets one accountable name before the audit starts. The rule we use: no owner, no script. A tag whose owner has left the company is cut by default, and the burden is on anyone who objects to claim it.

Then the decision rights split cleanly. The performance owner decides what the budget is. The script owner decides whether their script fits inside it. Nobody gets to override the budget by escalating, because a budget that can be escalated past is a suggestion.

This is the part that fails most often. Our third-party script governance record names it as a build trap in exactly those terms: thresholds get argued about, and a budget nobody agreed to is a build failure everyone learns to override (Deploi decision record, September 2026).

Order of operations

1. Inventory across all three routes, plus orphaned snippets from uninstalled apps.
2. Profile the three templates that matter: home, the top collection, the top PDP.
3. Assign owners. Do this before showing anyone the cost numbers, so the claiming is honest.
4. Cut the no-owner tier in a preview theme, then publish.
5. Move what survives to Customer Events where the vendor supports it, so it runs in the worker or iframe sandbox rather than on the main thread (per Shopify developer docs, September 2026).
6. Set the budget and gate it. Shopify's report covers the last 90 days with event annotations for installs and theme updates (per Shopify, September 2026), which is enough to catch a regression after the fact but not enough to prevent one. Prevention is a pre-publish review.
7. Re-profile at week two. App-injected scripts land in the theme without a deploy, so a CI gate alone misses the most common way tags arrive.

When NOT to cut

• Consent and privacy scripts. They are load-bearing for a legal obligation and they are not a performance negotiation.
• Anything in the checkout path you have not traced end to end in a preview theme. Our own decision record flags deleting a script that a checkout or consent flow silently depended on as a named trap.
• Attribution scripts mid-campaign. Cut them between flights, or you will spend the next quarter arguing about whether the channel or the audit moved the number.
• The last script a senior stakeholder personally requested, until you have the profile number in hand. Go in with evidence or do not go in.

On buying monitoring

Calibre's Starter plan is $75 per month with 5,000 real-user sessions and 5,000 synthetic tests, Team is $150 per month (verified September 2026). SpeedCurve's Starter plan starts at $90 per month and Growth at $576 per month, both metered on top by RUM page views and synthetic checks, with Enterprise custom (per speedcurve.com/pricing, September 2026). Annual billing saves 20%. Both add a script to the page you are trying to keep light, which is an irony worth budgeting for rather than pretending away.