A controlled test found that adding just six apps to a Shopify store increased page load time from 2.2 seconds to 7.3 seconds. That is not six bad apps. That is six ordinary, popular apps doing exactly what apps do.
One click. That is all it takes.
Need customer reviews on your homepage? There is a plugin for that. Want a live chat bubble in the corner? There is an app for that. Analytics, pop-ups, booking forms, social media feeds, cookie banners, sliders, countdown timers. One click to install. Problem solved.
Except it is not.
WordPress alone has over 60,000 plugins in its directory. Shopify's app store has thousands more. Every one of them promises to add functionality to your website. None of them tell you what they take away.
The average US business website runs 20 to 21 WordPress plugins. The average Shopify store runs 6 to 10 apps. Most business owners have no idea what those plugins are doing to their website behind the scenes. They installed them, the feature appeared, and they moved on.
What actually happens when you install one
Every plugin you install adds code that runs in your visitor's browser. That code has to be downloaded from an external server, parsed, and executed before your visitor can use the page.
When a visitor lands on your website, their browser makes a request to your server. Your server responds with the HTML. The browser reads the HTML, finds your CSS and JavaScript, and downloads those too. That is the normal process.
Now add a chat widget. The browser sees the chat widget's script tag, so it opens a connection to the chat company's server. It waits for a DNS lookup. It waits for the connection. It downloads the script. It parses and executes it. The script then downloads its own CSS, its own fonts, its own images, and potentially its own additional JavaScript files.
One plugin. Four to six additional network requests. Anything from one to five hundred kilobytes of additional code. And all of it competing with your actual website for your visitor's bandwidth, CPU, and attention.
Now multiply that by fifteen.
The numbers nobody shows you
According to the HTTP Archive, 92 percent of web pages load at least one third-party resource. The median desktop page makes 83 third-party requests. The 1,000 most visited websites in the world, sites like Google, Amazon, and Facebook, each make 129 per page. They can absorb that because they have dedicated engineering teams and global infrastructure. Your five-page business website running on shared hosting cannot. Our blog What a five-page website actually involves (and why "it's only five pages" misses the point) explains what a small site done properly looks like.
44 percent of the JavaScript delivered to your visitor's browser during page load is never even executed. Nearly half of it does nothing. It is downloaded, parsed, and thrown away.
Individual scripts can be enormous. Zendesk's chat widget alone weighs around 500 kilobytes compressed and 2.3 megabytes uncompressed. A single YouTube embed blocks the browser's main thread for 4.5 seconds on 10 percent of mobile sites. One misconfigured Google Tag Manager tag was found to add 3.1 seconds to a page's load time.
Every one of these scripts was added with a single click.
Your visitor's phone is not your laptop
When you test your website, you probably open it on your laptop or desktop computer. It loads quickly. Everything works. You move on.
Your customers are not using your laptop. Most of them are on their phones. And their phones process JavaScript three to four times slower than your computer does.
A script that executes in 50 milliseconds on a MacBook Pro takes over 400 milliseconds on a mid-range Android phone. A script that is barely noticeable on desktop becomes a visible delay on mobile. And the gap is getting worse, not better. The performance difference between flagship phones and budget devices grew in 2024.
Mobile phones also suffer from thermal throttling. As the CPU works harder to execute all those plugin scripts, the phone heats up. When it heats up, the processor slows itself down to avoid damage. The more scripts you load, the slower each one runs.
53 percent of mobile visitors abandon a website that takes longer than three seconds to load. Your plugins are not just slowing your site down. They are driving your customers away.
The WordPress plugin problem
WordPress powers roughly 40 percent of the web. Its plugin ecosystem is its greatest strength and its biggest weakness. Our blog Why we don't use WordPress (and when you should) explains why we chose a different approach.
Most plugins register their CSS and JavaScript files globally, which means they load on every single page of your site whether that page needs them or not. Your contact form plugin loads its stylesheets and scripts on your homepage, your about page, your blog, and every other page. Your gallery plugin loads its carousel library on pages that have no gallery. Your SEO plugin injects frontend JavaScript even though most of its work happens in the admin dashboard.
A single poorly coded plugin can add 50 or more database queries to every page load. Ten lightweight plugins can be outperformed by one badly written one. And most business owners have no way to tell the difference.
Page builders like Elementor and Divi are among the heaviest plugins of all, generating layers of unnecessary HTML, CSS, and JavaScript on every page. Our blog Your Web Designer Used a Page Builder explains what they do to your website's code.
WordPress disclosed 7,966 plugin vulnerabilities in 2024. That is 22 new security flaws every single day. 96 percent of all WordPress security vulnerabilities were in plugins, not in WordPress itself. By mid-2025, the number had already risen to over 11,000.
The Shopify app problem
Shopify store owners face a different version of the same problem.
In a controlled test of 340,000 stores, adding just six apps to a clean Shopify theme increased page load time from 2.2 seconds to 7.3 seconds. Six ordinary, popular apps. That is a five-second penalty.
78 percent of Shopify store owners do not realise that their apps are the primary cause of their slow performance. They blame their theme, their hosting, or their internet connection. They do not think to look at the apps they installed over the past two years.
Shopify has a unique problem. When you uninstall a Shopify app, the app itself is removed but the code it injected stays behind. JavaScript files, CSS assets, and Liquid snippets remain in your theme, loading on every page, slowing your site down, even though the app that created them is gone. They are ghost scripts. Most store owners have no idea they exist.
8.7 percent of Shopify stores run duplicate apps that do the same job. Nearly 6,000 stores simultaneously run both Klaviyo and Mailchimp. Two email platforms doing the same thing, both loading their scripts on every page.
One fashion retailer reduced their app count from 15 to a consolidated stack. Their speed score improved from 32 to 58. Load time dropped from 4.2 seconds to 2.1 seconds. Mobile conversion rate increased by 31 percent, adding an estimated $15,000 in monthly revenue.
The tag manager trap
Google Tag Manager is meant to solve this problem. It consolidates your tracking scripts into a single container so you do not need to edit your website's code every time marketing wants to add a new pixel.
In practice, it often makes the problem worse.
GTM starts small. An empty container is around 28 kilobytes. But it accumulates 3 to 5 new tags per campaign with near-zero removal. After two or three years of active marketing, a typical container holds 40 to 60 tags. Many of those tags belong to campaigns that ended years ago. They still fire on every page load.
Because GTM makes adding tags so easy, it removes the natural friction that used to exist between marketing and development. Anyone with GTM access can add a tracking pixel without a developer reviewing the performance impact. One misconfigured tag was found to increase page load time from 3.4 seconds to 6.5 seconds. A single tag.
The inclusion chains go deeper than most people realise. Third-party scripts load other third-party scripts, which load yet more third-party scripts. The HTTP Archive found that the median inclusion chain is 3.4 levels deep. The maximum observed depth was 2,930 levels. Your website is running code you never installed, loaded by code you forgot you installed, from companies you have never heard of.
It is not just speed. It is security.
Every third-party script on your website runs with the same privileges as your own code. It can read form inputs, access cookies and session tokens, modify the page, and send data to any server it chooses.
In June 2024, the popular Polyfill.io service was compromised. A new owner began injecting malicious JavaScript that redirected mobile visitors to betting and scam websites. Over 380,000 websites were affected, including Warner Bros, Hulu, and Mercedes-Benz. None of those companies installed the malicious code. They had installed a legitimate script years earlier, and the script was silently replaced.
In the British Airways breach, just 22 lines of malicious JavaScript, injected through a compromised third-party script, stole the payment details of 380,000 customers. Ticketmaster was fined £1.25 million by the ICO after a compromised supplier loaded malicious code on their website for four months.
These are not theoretical risks. Third-party breaches now account for 30 percent of all security incidents. Every plugin you install is a door you are leaving open for someone else to walk through.
That annoying cookie banner
You know the one. You land on a website and before you can read a single word, a banner slides up asking you to accept cookies. You click accept because you have no real choice, and you move on. Every website seems to have one.
Did you notice you did not see one when you arrived on this page? We are not breaking the law. We just do not need one.
Under UK GDPR and PECR, any technology that stores or retrieves information on a user's device requires informed, specific consent before it fires. Google Analytics sets cookies. Facebook Pixel sets cookies. Most chat widgets set cookies. If your website loads these scripts, you need a cookie consent banner. If it does not, you do not.
There is an irony here. Cookie consent banners are themselves third-party scripts. They load their own JavaScript, their own CSS, and their own tracking to record consent choices. The tool you installed to comply with privacy law is itself adding weight to your page and contacting external servers. Our blog Is your website GDPR compliant? covers the full picture of what the law actually requires.
Remove the tracking scripts and you remove the need for the banner. The page loads faster, the experience is cleaner, and your privacy compliance is simpler. No banner. No pop-up. No annoyed visitor clicking accept for the hundredth time today.
What this page loads
This website does not load a single third-party tracking script.
No Google Analytics. No Facebook Pixel. No Hotjar. No chat widget. No social media embed. No cookie consent popup.
We use Vercel Analytics, which is cookieless, collects no personal data, and adds less than one kilobyte to the page. It tells us which pages people visit and where they came from. That is all we need.
The page you are reading right now loaded from one domain. Ours. Your browser did not contact Google, Meta, Hotjar, Intercom, Cookiebot, or any of the other dozens of companies that most websites silently share your visit with.
That is not a limitation. It is a choice. And it is one of the reasons this site scores 100 on Google PageSpeed.
The bottom line
Plugins and apps make adding features easy. That is their appeal and their danger. Every one is a trade-off between convenience and performance, between functionality and speed, between a feature your business wants and a cost your customers pay.
Most websites do not have a speed problem. They have a plugin problem. The solution is not a faster server or a better hosting plan. It is fewer scripts, loaded more carefully, doing only what is genuinely needed.
Audit what you have. Remove what you do not use. Question whether each remaining plugin is worth the seconds it adds. And if you are building a new site, start with zero and only add what you can justify.
How we can help
Every website we build at BIG MOUTH starts with zero third-party scripts and stays as close to that number as possible. When functionality is needed, we build it natively rather than bolting on a plugin that loads its code on every page.
If your current website is buried under years of accumulated plugins, apps, and tracking scripts, we can audit it. We will tell you exactly what is running, what it is costing you in speed and security, and what you can safely remove. Often the fastest improvement you can make to an existing website is not adding something new. It is taking something away.
Whether you need a clean rebuild or just want to know what your plugins are doing to your performance, we are here to help.