---
title: "Host everything yourself for privacy · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/privacy/third-party-scripts
updated: 2026-10-20
licence: "All rights reserved"
---

# Host everything yourself for privacy

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Privacy](https://agentwranglers.se/playbook/website/privacy)
- Rule: Avoid third-party scripts. Host what you need yourself, so visitors' data does not go to other companies.
- How: Host fonts, scripts and images yourself. Remove tag managers and embeds you can replace. Keep `default-src 'self'` in the Content Security Policy, so fonts, images and requests stay on your own origin. Allow scripts as [the CSP rule](https://agentwranglers.se/playbook/website/security/content-security-policy) says. A script you must load from elsewhere follows [load third-party scripts with integrity checks](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/third-party-scripts).
- Check: A browser test loads every page and collects the origin of each request. Only your own origin appears, plus any listed in the privacy policy.

Example:

```http
Content-Security-Policy: default-src 'self'; img-src 'self' data:; frame-ancestors 'none'
```

```css
@font-face {
  font-family: "Inter";
  src: url("/fonts/inter.woff2") format("woff2");
  font-display: optional;
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/privacy/third-party-scripts`.

- Previous: [Treat the privacy signal as a no](https://agentwranglers.se/playbook/website/privacy/global-privacy-control)
- Next: [Ask before embedded content uses cookies](https://agentwranglers.se/playbook/website/privacy/storage-access-api)
- [Privacy](https://agentwranglers.se/playbook/website/privacy)