Title: ScriptSpy – Third-Party Script Intelligence Author: Avo Avetisyan Published: 2026 年 9 月 3 日 Last modified: 2026 年 9 月 3 日 --- 搜尋外掛 ![](https://ps.w.org/scriptspy/assets/banner-772x250.png?rev=3680357) ![](https://ps.w.org/scriptspy/assets/icon-256x256.png?rev=3680357) # ScriptSpy – Third-Party Script Intelligence 由 [Avo Avetisyan](https://profiles.wordpress.org/loyaltyoverroyalty/) 開發 [下載](https://downloads.wordpress.org/plugin/scriptspy.1.0.2.zip) * [詳細資料](https://tw.wordpress.org/plugins/scriptspy/#description) * [使用者評論](https://tw.wordpress.org/plugins/scriptspy/#reviews) * [安裝方式](https://tw.wordpress.org/plugins/scriptspy/#installation) * [開發資訊](https://tw.wordpress.org/plugins/scriptspy/#developers) [技術支援](https://wordpress.org/support/plugin/scriptspy/) ## 外掛說明 ScriptSpy is a focused script intelligence dashboard. It is **not** a cookie banner and **not** a consent wizard — those tools already exist. ScriptSpy answers one question: **“What is loading on my site, who owns it, what data does it collect, and give me a PDF I can show my lawyer.”** #### Two-layer detection * **Server-side scan** — fetches your own pages with `wp_remote_get` and parses HTML with `DOMDocument` to extract every external script, iframe, preconnect hint, and tracking pixel. Catches statically loaded scripts. * **Browser beacon** — a JavaScript beacon you can run in a real browser (logged- in admin or anonymous via signed token URL). Uses `PerformanceObserver`, `MutationObserver`, and intercepts `fetch`, `XMLHttpRequest`, and `navigator.sendBeacon` to capture every dynamically loaded resource — including pixels that Google Tag Manager loads after page render. #### What you get * Live dashboard with summary cards: total scripts, known/identified, require consent, unrecognized * Per-script detail modal: owner, country, data collected, legal basis, GDPR relevance, data transfer destination, Schrems II notes, links to privacy policy and DPA * PDF audit report (cover, executive summary, full inventory, unknown scripts list) * CSV export * Cookie + localStorage detection * Scan history with diff between scans (added/removed scripts) * Optional weekly/monthly automated scans with email reports * Knowledge base of 70+ third-party services (Google Analytics, Meta Pixel, TikTok, Hotjar, Stripe, Intercom, etc.) #### Anonymous beacon mode GTM rules often suppress pixels for logged-in WordPress administrators. ScriptSpy generates a tokenized scan URL you can open in incognito to capture those pixels— without exposing the beacon to your real visitors. #### Privacy ScriptSpy makes no external HTTP requests except scanning your own site. No telemetry, no phone-home, no third-party API calls. The bundled knowledge base is a static JSON file shipped with the plugin. ## 螢幕擷圖 [⌊Main dashboard: summary cards, filters, and the results table with owner, category, data collected and GDPR level for every script.⌉⌊Main dashboard: summary cards, filters, and the results table with owner, category, data collected and GDPR level for every script.⌉[ Main dashboard: summary cards, filters, and the results table with owner, category, data collected and GDPR level for every script. [⌊Script detail: owner, country, data collected, legal basis, data transfer destination, Schrems II note, and every page the script was found on.⌉⌊Script detail: owner, country, data collected, legal basis, data transfer destination, Schrems II note, and every page the script was found on.⌉[ Script detail: owner, country, data collected, legal basis, data transfer destination, Schrems II note, and every page the script was found on. [⌊Scan in progress: server scan percentage, live browser-beacon status, and the anonymous scan URL.⌉⌊Scan in progress: server scan percentage, live browser-beacon status, and the anonymous scan URL.⌉[ Scan in progress: server scan percentage, live browser-beacon status, and the anonymous scan URL. [⌊Diff between two scans - scripts added and removed.⌉⌊Diff between two scans - scripts added and removed.⌉[ Diff between two scans – scripts added and removed. [⌊PDF audit report: executive summary and full script inventory.⌉⌊PDF audit report: executive summary and full script inventory.⌉[ PDF audit report: executive summary and full script inventory. [⌊Scan history with per-scan PDF and CSV export, plus diff against the previous scan.⌉⌊Scan history with per-scan PDF and CSV export, plus diff against the previous scan.⌉[ Scan history with per-scan PDF and CSV export, plus diff against the previous scan. [⌊Settings: scan depth, scheduled scans, email reports and excluded domains.⌉⌊Settings: scan depth, scheduled scans, email reports and excluded domains.⌉[ Settings: scan depth, scheduled scans, email reports and excluded domains. ## 安裝方式 1. Upload the `scriptspy` folder to `/wp-content/plugins/`. 2. Activate via Plugins menu in WordPress. 3. Go to Tools ScriptSpy. 4. Click **Start new scan**. 5. Open the anonymous scan URL in an incognito window and browse a few pages so the beacon can capture dynamically loaded scripts. 6. Return to the dashboard, review results, download PDF or CSV. ## 常見問題集 ### Does this replace a cookie consent banner? No. ScriptSpy detects and reports — it does not block scripts or show banners to visitors. Use it alongside a consent platform. ### Will it slow down my site? The server scan runs in batches via WP-Cron, not on visitor requests. The browser beacon is injected only for logged-in admins or visitors carrying a valid scan token— never for normal traffic. ### Can it detect server-side conversion APIs (e.g., Meta Conversions API)? No. Server-to-server calls are invisible to client-side detection by design. ScriptSpy lists known server-side endpoints in its knowledge base for awareness but cannot confirm whether they fire. ### Why are some pixels missing from the report? Many GTM containers exclude logged-in WordPress administrators from firing pixels. Use the **anonymous scan URL** in an incognito browser to capture those pixels. ### Does the PDF require any external libraries? The plugin bundles TCPDF 7 (via Composer) and the Helvetica core font definitions it needs. If TCPDF is unavailable for any reason, ScriptSpy falls back to a styled HTML report download. ## 使用者評論 這個外掛目前沒有任何使用者評論。 ## 參與者及開發者 以下人員參與了開源軟體〈ScriptSpy – Third-Party Script Intelligence〉的開發相關工作。 參與者 * [ Avo Avetisyan ](https://profiles.wordpress.org/loyaltyoverroyalty/) [將〈ScriptSpy – Third-Party Script Intelligence〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/scriptspy) ### 對開發相關資訊感興趣？ 任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/scriptspy/)、查看 [SVN 存放庫](https://plugins.svn.wordpress.org/scriptspy/)，或透過 [RSS](https://plugins.trac.wordpress.org/log/scriptspy/?limit=100&mode=stop_on_copy&format=rss) 訂閱[開發記錄](https://plugins.trac.wordpress.org/log/scriptspy/)。 ## 變更記錄 #### 1.0.2 * Fixed: inline-detected scripts (Google Analytics, Meta Pixel, Intercom and others recognised from inline snippets) showed a knowledge base id where the domain belongs. They are now labelled “inline script”. * Fixed: the Google Analytics 4 measurement endpoint (`/g/collect`) was not in the knowledge base, so GA4 traffic captured by the browser beacon was counted as unrecognized. * Fixed: long privacy policy and page URLs overlapped the following line in the PDF script inventory. * Knowledge base updated to v1.0.1. #### 1.0.1 * Upgraded bundled TCPDF to 7.0.7 (now requires PHP 8.2+). * Generic CDN hosts are now classified through the bundled knowledge base instead of a hard-coded list. * Browser beacon is enqueued through `wp_enqueue_scripts`. * Hardened scan-token validation, CSV export and settings sanitization. #### 1.0.0 * Initial release. * Two-layer detection: server-side DOMDocument scan + browser beacon. * Anonymous tokenized beacon mode for capturing pixels GTM hides from admins. * PDF and CSV export. * Cookie and localStorage detection. * Scan history and diff. * Bundled knowledge base of 70+ third-party services. ## 中繼資料 * 版本 **1.0.2** * 最後更新 **2 週前** * 啟用安裝數 **少於 10 次** * WordPress 版本需求 ** 6.0 或更新版本 ** * 已測試相容的 WordPress 版本 **7.1** * PHP 版本需求 ** 8.2 或更新版本 ** * 語言 * [English (US)](https://wordpress.org/plugins/scriptspy/) * 標籤: * [audit](https://tw.wordpress.org/plugins/tags/audit/)[compliance](https://tw.wordpress.org/plugins/tags/compliance/) [GDPR](https://tw.wordpress.org/plugins/tags/gdpr/)[privacy](https://tw.wordpress.org/plugins/tags/privacy/) [scripts](https://tw.wordpress.org/plugins/tags/scripts/) * [進階檢視](https://tw.wordpress.org/plugins/scriptspy/advanced/) ## 評分 這個項目尚無任何評論記錄。 [撰寫評分](https://wordpress.org/support/plugin/scriptspy/reviews/#new-post) [查看全部使用者評論](https://wordpress.org/support/plugin/scriptspy/reviews/) ## 參與者 * [ Avo Avetisyan ](https://profiles.wordpress.org/loyaltyoverroyalty/) ## 技術支援 使用者可在技術支援論壇提出意見反應或使用問題。 [檢視技術支援論壇](https://wordpress.org/support/plugin/scriptspy/)