URL: /cloud/third-party/vendor-count

---
title: "Third-party vendor count: how many companies load code on your site"
description: "The site loads code or beacons from many distinct third-party companies, or one sensitive page loads too many. Thresholds are untuned defaults."
---

<Note>**Cloud rule.** The `third-party/*` rules run in cloud audits only. They are not part of the local `squirrel audit`, and a cloud audit includes them once the scan is switched on for your organization's plan; an audit without the scan has no Third parties section and none of these rules appear. The scan never charges credits. It reads at most 8 pages per audit, so a finding is about those pages, not the whole site. See [Third-party rules](/cloud/third-party).</Note>

## Why the number matters

Every third-party company on a page can read what the page shows its visitors and, for a script, change it. The more companies, the larger the surface for a compromise, the heavier the page, and the longer the list in your privacy notice. A sign-in or checkout page is where that surface matters most.

## What squirrel checks

squirrel counts distinct COMPANIES, not technologies: three Google tags are one company seeing the visitor. A vendor with no known company counts under its own name. The count is taken over the sampled pages (at most 8). The rule emits two checks.

- `vendor-count` reports the site-wide count. Message: `18 third-party companies (24 vendors) seen across 8 pages (over 15): <names>`. Over 10 companies is an info note, over 15 a warning, over 25 an error. Each boundary is exclusive: exactly 10 passes. It lists up to 50 vendors as items. At 10 or fewer it passes with `12 third-party companies (14 vendors) seen across 8 pages.`
- `too-many-on-sensitive-page` fails when a single sensitive page loads more than 5 companies, whatever the site total. It is emitted only when the sample includes a sensitive page; it passes with `No sensitive page loads more than 5 third-party companies.` otherwise.

The issue made from `too-many-on-sensitive-page` is rated at least high.

Sensitive means a page whose URL path says it is a sign-in, sign-up, checkout, cart, payment, billing, wallet or account page (see [how a sensitive page is decided](/cloud/third-party#how-a-sensitive-page-is-decided)).

### The numbers are defaults

The thresholds (10, 15 and 25 companies for the site, 5 for one sensitive page) are untuned defaults chosen before real scans were measured. They will move once they are tuned on a corpus of audits, so treat a warning or an error here as a prompt to look, not a verdict. The count is also limited by the sample: a site with 30 companies spread over pages the audit did not sample reads lower.

## How to fix it

Remove tags nobody uses, load heavy vendors only where they are needed, and keep sign-in and checkout pages to the vendors they depend on: payment, captcha and sign-in providers. A tag manager makes the list invisible in your templates, so audit what it publishes as well.

| | |
|---|---|
| **Rule** | `third-party/vendor-count` |
| **Category** | [Third-party](/cloud/third-party), part of [Security](/rules/security) |
| **Scope** | Site (cloud audits only) |
| **Severity** | warning (info above 10 companies, error above 25) |
| **Weight** | 1/10 |

## Enable / disable

Cloud audits do not read `squirrel.toml`, so these rules cannot be switched off there. They run whenever the audit includes the third-party scan, and report as skipped when the scan could not run.