(Third) Party Planning: Be careful who you invite!
From a customer’s point of view, your website’s digital experience is one of the most important investments you can make for them. They are your revenue stream, your fiercest critic and the reason you exist.
One great way you can improve your digital experience is by using third-party providers. Many of these providers will help you win more business, provide cool features, gather better data and much more. You need to consider the type of third-party your business needs that are going to improve your revenue conversion and whether that return justifies the investment and perhaps, most importantly, that implementing the new third-party doesn’t damage your well-earned reputation for an excellent user experience (if you have one!).
When we talk about helpful third-parties, they come in many forms. From Marketing, Advertising, Analytics, Application Performance Monitoring, Helper Libraries, Fonts, Image Libraries, Social, Customer Success Tools, AI, Big Data Collection, Video, Hosting, Payments and Content Delivery Networks to name but a few, all are very valuable to your business but the costs of implementing them can soon add up in more ways than one.
Every single third-party has a weight, a latency, a footprint on your website performance. Some are amazing, some are awful, some are a mixture of both and you MUST understand this. We have seen websites with over 80 third-party providers many of which are causing detrimental impacts for very little ROI compared to the impact they are having on the overall performance of the site and in turn the digital experience which has direct revenue impacts.
According to Neil Patel: 47% of internet users actually expect a web page to load in 2 seconds or less with 53% of people abandoning a website that takes longer than 3 seconds to load, so getting this right is paramount, therefore the size, speed, and location of third-party files are very important. Below are a few things to consider when thinking about third-party performance:
- Ask for evidence of how the third-party is loaded on to your site: How many files, how big are they, where are they from and which other businesses use their product so you can monitor their usage.
- Any third-party you load should be doing so on average in less than 200ms unless they have a very good reason for not doing so and that reason is accepted by your business.
- Anything big should be left to the very end of your load process, for example, live chat tools find themselves at the back of the queue as they are very bulky due to the fact they interact heavily with the customer and give you great added benefits.
- Consider how many third-parties you are loading in versus your CPU idle time. You want your page to be mostly idle by 4.7 seconds at the very most (Google define this as ‘Fast’), by definition, this leaves you space for up to 20 fast functional third-parties, any more and you risk damaging your digital experience.
For more details on techniques to ensure your third party loads fast: Google Developer Tools
One of the world’s most potent hacking groups Magecart directly targets not only you but your third-parties to look for weaknesses in your supply chain, so having lots of third-parties would increase the likelihood of attack due to the increase in potential attack vectors.
An example of this was Adverline whose advertising retargeting scripts was directly compromised, then loaded on to numerous websites providing ticketing and flight booking services as well as self-hosted retail websites stealing customers payment details. 277 business
More often than not, most third-parties have excellent security records, they are strong businesses who have spent time and budget ensuring they are a very trustworthy source. However, many are new businesses or businesses who do not understand the risks. Yes, they have great products but they are an issue to your overall security and reputation so you need to understand how much of a risk they pose.
- Ask your third-party providers what security and privacy policies they have and what is their response protocol to a data breach, including whether you are insured at their end if the worst were to happen.
- Look at implementing Content Security Policies, however, these are still quite difficult to manage in fast-paced businesses, marketing will not be exactly delighted!
- Monitor all the calls coming out of your website to suspicious untrusted destinations.
- Ensure you have an appropriate response protocol if either you or your business are compromised by a third-party.
In conclusion, why do you need to be careful when inviting third-party providers onto your website?
- They may have detrimental performance impacts which actually reverse the ROI they were supposed to bring, so understanding how you may be impacted is fundamental.
- They may be a potential security risk, which, if exploited could damage your reputation so ensure you put in practical monitoring measurements and response protocols.
- They might be a GDPR or privacy issue dependent on the data they collect but that’s another blog for another day.
- They can change their files without you knowing which means they are unpredictable and/or could have unintended consequences which are difficult to manage so you need to monitor this over time.
With RapidSpike you can interrogate your third-parties and overall performance using our Intelligent Page Monitors (IPMs) and continuous google lighthouse audits which will help you improve the performance of your website, and in turn, your digital experience.