Compare three lists: the vendors you pay, the scripts your pages actually load, and the tags inside your tag manager and theme files. Any script with no current vendor behind it is a leftover. Remove it, because an abandoned vendor domain can be re-registered by someone else.
Why leftover tags are worse than they look
A script tag keeps working long after the contract ends. Your page still asks the vendor's server for code on every visit, and the browser still runs whatever comes back with the same privileges as your own code.
The OWASP Third Party JavaScript Management Cheat Sheet names the specific failure. If the domain hosting a third-party script expires because the company is gone or the project was abandoned, a malicious actor can re-register the domain and publish malicious code. Your store never changed. The tag you forgot about did the damage.
A store that has run for a few years usually carries a trail of these: an old A/B testing tool, a retired live chat, a short-lived affiliate network, a review widget from a redesign.
Where leftovers hide
| Location | What to look for | Who usually owns it |
|---|---|---|
| Tag manager container | Paused or old tags that were never deleted | Marketing |
| Theme or template files | Hard-coded script tags from a past agency | Engineering |
| Checkout and order confirmation templates | Conversion pixels from retired ad channels | Marketing and engineering |
| Platform app settings | Embedded app snippets still enabled | Store admin |
| Old landing pages | Campaign pages with their own tags | Marketing |
Steps to find them
- Export your vendor list from finance or procurement: everything with an active subscription that touches the site.
- Load your home page, a product page, the cart, checkout and the order confirmation page with the browser developer tools open. In the network tab, filter to scripts and list every domain that is not yours.
- Open your tag manager and list every tag, including paused ones.
- Search your theme and template repositories for script tags and for the domains from step 2.
- Match each domain to a vendor and an owner. Mark anything with no match as a candidate for removal.
Do this on the pages that matter most first. A forgotten tag on the checkout page carries more risk than one on a blog post.
Removing a tag without breaking the page
Do not delete everything in one release. Remove candidates in small groups, starting with those on the highest risk pages. After each group, load the page again and confirm the domain no longer appears in the network tab, and that nothing else on the page depends on it.
If the tag lives in a tag manager, delete it rather than pausing it. A paused tag is still part of the container and can be switched on by anyone with publish access. If the tag is hard-coded in a theme, remove it through your normal pull request and review path so the change is recorded.
Keep a short note of what you removed, the date and the owner who agreed. That record answers the later question of why a tag disappeared.
Check the vendors you keep
For vendors you still use, ask a second question: is their domain and hosting still maintained? A vendor that has gone quiet, stopped answering support or stopped shipping updates is a candidate for replacement before the domain ever lapses.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a component that was clean on one day can change status later without any change on your side.
Where Safeguard fits
Safeguard's SBOM and dependency scanning covers the packages in your storefront build. It does not read the tags in your tag manager, so treat the steps above as a separate, regular review. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is a paused tag in a tag manager safe?
Not fully. It is still in the container and can be switched on by anyone with publish access. Delete tags you no longer need.
How often should we look for leftover tags?
Run the comparison after every vendor cancellation and at least once a quarter, and always before your busiest sales period.
Sources
Last reviewed: 19 October 2026.
