內容簡介
ScriptSpy 是一個專注於第三方腳本智慧的儀表板，幫助網站擁有者了解其網站上載入的所有外部腳本及其擁有者，並提供法律所需的報告文件。此外掛不僅能夠分析靜態和動態載入的資源，還能生成詳細的報告，確保網站的合規性。
【主要功能】
• 伺服器端掃描，提取所有外部腳本
• 瀏覽器信標，捕捉動態載入資源
• 生成 PDF 審核報告，包含法律相關資訊
• 提供 CSV 匯出功能
• 自動化掃描及電子郵件報告選項
• 支援 70 多種第三方服務的知識庫
外掛標籤
開發者團隊
② 後台搜尋「ScriptSpy – Third-Party Script Intelligence」→ 直接安裝（推薦）
原文外掛簡介
ScriptSpy is a focused script intelligence dashboard. It is not a cookie banner and not a consent wizard — those tools already exist. ScriptSpy answers one question:
“What is loading on my site, who owns it, what data does it collect, and give me a PDF I can show my lawyer.”
Two-layer detection
Server-side scan — fetches your own pages with wp_remote_get and parses HTML with DOMDocument to extract every external script, iframe, preconnect hint, and tracking pixel. Catches statically loaded scripts.
Browser beacon — a JavaScript beacon you can run in a real browser (logged-in admin or anonymous via signed token URL). Uses PerformanceObserver, MutationObserver, and intercepts fetch, XMLHttpRequest, and navigator.sendBeacon to capture every dynamically loaded resource — including pixels that Google Tag Manager loads after page render.
What you get
Live dashboard with summary cards: total scripts, known/identified, require consent, unrecognized
Per-script detail modal: owner, country, data collected, legal basis, GDPR relevance, data transfer destination, Schrems II notes, links to privacy policy and DPA
PDF audit report (cover, executive summary, full inventory, unknown scripts list)
CSV export
Cookie + localStorage detection
Scan history with diff between scans (added/removed scripts)
Optional weekly/monthly automated scans with email reports
Knowledge base of 70+ third-party services (Google Analytics, Meta Pixel, TikTok, Hotjar, Stripe, Intercom, etc.)
Anonymous beacon mode
GTM rules often suppress pixels for logged-in WordPress administrators. ScriptSpy generates a tokenized scan URL you can open in incognito to capture those pixels — without exposing the beacon to your real visitors.
Privacy
ScriptSpy makes no external HTTP requests except scanning your own site. No telemetry, no phone-home, no third-party API calls. The bundled knowledge base is a static JSON file shipped with the plugin.
