Third-party vendor count: how many companies load code on your site

Why the number matters

Every third-party company on a page can read what the page shows its visitors and, for a script, change it. The more companies, the larger the surface for a compromise, the heavier the page, and the longer the list in your privacy notice. A sign-in or checkout page is where that surface matters most.

What squirrel checks

squirrel counts distinct COMPANIES, not technologies: three Google tags are one company seeing the visitor. A vendor with no known company counts under its own name. The count is taken over the sampled pages (at most 8). The rule emits two checks.

• vendor-count reports the site-wide count. Message: 18 third-party companies (24 vendors) seen across 8 pages (over 15): <names>. Over 10 companies is an info note, over 15 a warning, over 25 an error. Each boundary is exclusive: exactly 10 passes. It lists up to 50 vendors as items. At 10 or fewer it passes with 12 third-party companies (14 vendors) seen across 8 pages.
• too-many-on-sensitive-page fails when a single sensitive page loads more than 5 companies, whatever the site total. It is emitted only when the sample includes a sensitive page; it passes with No sensitive page loads more than 5 third-party companies. otherwise.

The issue made from too-many-on-sensitive-page is rated at least high.

Sensitive means a page whose URL path says it is a sign-in, sign-up, checkout, cart, payment, billing, wallet or account page (see how a sensitive page is decided).

The numbers are defaults

The thresholds (10, 15 and 25 companies for the site, 5 for one sensitive page) are untuned defaults chosen before real scans were measured. They will move once they are tuned on a corpus of audits, so treat a warning or an error here as a prompt to look, not a verdict. The count is also limited by the sample: a site with 30 companies spread over pages the audit did not sample reads lower.

How to fix it

Remove tags nobody uses, load heavy vendors only where they are needed, and keep sign-in and checkout pages to the vendors they depend on: payment, captcha and sign-in providers. A tag manager makes the list invisible in your templates, so audit what it publishes as well.

Rule	third-party/vendor-count
Category	Third-party, part of Security
Scope	Site (cloud audits only)
Severity	warning (info above 10 companies, error above 25)
Weight	1/10

Enable / disable

Cloud audits do not read squirrel.toml, so these rules cannot be switched off there. They run whenever the audit includes the third-party scan, and report as skipped when the scan could not run.