ScriptSpy – Third-Party Script Intelligence

ScriptSpy is a focused script intelligence dashboard. It is not a cookie banner and not a consent wizard — those tools already exist. ScriptSpy answers one question:

“What is loading on my site, who owns it, what data does it collect, and give me a PDF I can show my lawyer.”

Two-layer detection

• Server-side scan — fetches your own pages with wp_remote_get and parses HTML with DOMDocument to extract every external script, iframe, preconnect hint, and tracking pixel. Catches statically loaded scripts.
• Browser beacon — a JavaScript beacon you can run in a real browser (logged-in admin or anonymous via signed token URL). Uses PerformanceObserver, MutationObserver, and intercepts fetch, XMLHttpRequest, and navigator.sendBeacon to capture every dynamically loaded resource — including pixels that Google Tag Manager loads after page render.

What you get

• Live dashboard with summary cards: total scripts, known/identified, require consent, unrecognized
• Per-script detail modal: owner, country, data collected, legal basis, GDPR relevance, data transfer destination, Schrems II notes, links to privacy policy and DPA
• PDF audit report (cover, executive summary, full inventory, unknown scripts list)
• CSV export
• Cookie + localStorage detection
• Scan history with diff between scans (added/removed scripts)
• Optional weekly/monthly automated scans with email reports
• Knowledge base of 70+ third-party services (Google Analytics, Meta Pixel, TikTok, Hotjar, Stripe, Intercom, etc.)

Anonymous beacon mode

GTM rules often suppress pixels for logged-in WordPress administrators. ScriptSpy generates a tokenized scan URL you can open in incognito to capture those pixels — without exposing the beacon to your real visitors.

Privacy

ScriptSpy makes no external HTTP requests except scanning your own site. No telemetry, no phone-home, no third-party API calls. The bundled knowledge base is a static JSON file shipped with the plugin.