This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Data protection
Why should external libraries be served from your own server?
Because every file the browser fetches from a third-party server inevitably transmits the visitor's IP address to that server in the process — before any consent, on every page visit. Many websites load script and style libraries from public content delivery servers (CDNs), often without the operator knowing: the integration comes from a template or an extension. Our check compiles an inventory of these third-party sources on the first visit to your page and names every single one in the report.
What actually happens when loading from third-party servers
A content delivery server serves files shared by many websites — script libraries, style sheets, icon fonts. Technically that's convenient, but it comes at a privacy cost: every visitor's browser connects directly to the third-party server and, in doing so, transmits its IP address, along with details like the page being visited. The operator of the delivery server is often based outside Europe. All this happens before a consent banner can even appear, since the files are needed to build the page.
Local hosting protects twice over
If the same files are on your own server, the connection to the third-party server disappears entirely — and with it the transmission of visitor data. At the same time, dependency drops: if the delivery server goes down or the file there is altered, that no longer affects your website. This second protection concerns the supply chain: a compromised third-party file would run directly in your visitors' browsers. Switching over is usually simple — the files are downloaded once and integrated like your own files; the website's behaviour doesn't change.
What the check exactly measures
The check opens your homepage in a fresh browser — with no stored cookies, no interaction with a banner — and logs every connection to third-party servers. That produces the inventory: what libraries and delivery servers get loaded on the first visit, each with its provider. The finding is a stock-take with a recommendation; it's distinct from trackers, which get their own findings. The check is a technical examination, not legal advice.
- Get the inventory from the audit report: it lists every third-party source by name.
- Download the affected libraries and integrate them from your own server — the files are identical.
- Recheck templates and extensions after switching one: many bring third-party server integrations along without asking.
- Keep an eye on updates once you're hosting locally — maintaining the files is now on you.
FAQ
Isn't a delivery server faster than your own server?
The historic speed advantage has largely disappeared: browsers now partition their cache per website, so a file already loaded elsewhere isn't reused. For individual libraries, your own server is usually just as fast.
Does loading from a delivery server require consent?
The connection transmits personal data (the IP address) to a third party before the visitor could be asked. Whether consent or another legal basis applies in a specific case is a legal assessment — the report provides the established facts for that.
How does this finding differ from the Google Fonts findings?
The mechanism is the same (a file from a third-party server, IP transmission). Fonts from third-party servers get their own finding because of well-known case law; the inventory here covers every other library and delivery server source.