Have you ever checked whether a "polyfill.io" tag, added years ago by a web agency, is still lingering on your website? Caution is especially warranted for sites where "nothing has been touched since launch" or "the original agency relationship has ended." polyfill.io, which was the epicenter of a massive supply chain attack in 2024, is still prompting reports of suspicious dialogs shown to users on sites that kept the original tags (Zenn).
A single line of <script src="https://cdn.polyfill.io/...">, once casually embedded, can harm your site's visitors without operators even realizing it. This is a textbook example of the hidden danger common to external scripts: code that was safe when installed transforms into an attack vector years down the road. In this article, breaking down technical jargon as much as possible, we outline (1) what actually happened, (2) how to check if your site is at risk, and (3) priority actions when issues are found, all from the viewpoint of project commissioners and site operators.
What was polyfill.io in the first place? (What happened)
polyfill.io was a popular CDN service used worldwide that delivered "polyfills"—compatibility code designed to make modern web features run on older browsers. Countless websites used it simply by inserting a single line of <script src="...">.
However, in 2024, operational ownership of this domain transferred to a third party, and the served code was modified to inject malicious behavior such as unauthorized redirects. Websites using the service suddenly found themselves distributing code that redirected visitors to dangerous destinations—without having changed anything on their own end. This is a classic "supply chain attack," where a trusted external distribution source is compromised, triggering a chain reaction of harm.
Although organizations worldwide urged everyone to stop loading it at the time, many neglected sites still retain those legacy tags in 2026, leading to ongoing reports of real-world harm like the suspicious dialogs mentioned earlier.
Why this happens on "your company's site"
Websites do not run solely on code written in-house. CDNs, tag managers, analytics, chat widgets, advertising, web fonts, various SDKs—modern websites rely on loading numerous "external scripts."
In every single case, you are executing code managed by third parties directly on your website. If the provider is compromised or the domain is sold, the consequences hit your site visitors directly. What makes it even more troublesome is that tags often linger after the person who added them leaves the company or web development agencies change hands, leaving behind tags whose creator and purpose are unknown. These "neglected tags" become breeding grounds for security threats.
Relying on external services is not inherently bad. The problem is leaving them completely unmonitored after installation. We saw the exact same pattern previously with supply chain countermeasures for WordPress plugins (GH Media).
How to check for yourself whether your site is at risk
Before hiring experts, there are checks that site operators can run themselves.
- Search the page source: Open your site, right-click on the page, and select "View page source." Search the displayed code using
Ctrl/Cmd + Fforpolyfill.io. If it matches, immediate action is required. - Inspect the list of loaded domains: Open browser developer tools (F12) -> go to the "Network" tab, and reload the page to see the list of external domains being loaded. Check whether there are any domains you do not recognize.
- Audit legacy tags: Inventory any tags you can think of—such as unused analytics, advertising, or chat widgets—to see if they are still lingering.
If your checks reveal that "polyfill.io remains" or "unrecognized domains are being loaded," do not leave them unaddressed. Conversely, if you cannot tell on your own, having a specialist audit your external scripts is the safest route. For foundational defenses, Web Security Basics (GH Media) is also a helpful reference.
What happens if left unaddressed — Sites that should check immediately
The urgency of external script risks varies greatly depending on the nature of your website.
| Sites that should check immediately | Sites with low urgency |
|---|---|
| Corporate sites running for several years or more | Recently launched sites with minimal external tags |
| E-commerce, member portals, or inquiry forms handling personal data | Sites publishing static informational content only |
| Sites embedding numerous advertising and analytics tags | Sites with centralized tag management |
| Sites where web development agencies have changed | Sites where all tags are tracked internally |
| Sites where brand reputation and trust are core to business | Disposable sites used for prototyping |
Particularly for sites handling personal information, compromised external scripts could allow submitted details to be stolen, meaning the damage goes far beyond "the site looks a bit odd."
Priority order of actions when found
- Immediately: Remove tags from dangerous or defunct domains like polyfill.io. If that functionality is absolutely required, switch to a secure alternative (such as self-hosting the scripts in-house).
- Next: Audit and remove unused tags. The fewer tags you have, the smaller your attack surface and the faster your pages load.
- Permanently: Implement Content Security Policy (CSP) to restrict loaded external scripts to pre-approved sources, adopt Subresource Integrity (SRI) to verify that code has not been tampered with, and incorporate regular audits into your operations. While CSP and SRI sound technical, they are essentially an "allowlist" and "fingerprint verification."
Because handling these permanent countermeasures entirely in-house can be demanding, outsourcing to external professionals becomes a practical option from this point on.
Cost ballpark when hiring professionals
Knowing how much it costs is naturally a primary concern before placing an order. While these are general guidelines, typical market rates are as follows:
| Service scope | Estimated cost |
|---|---|
| Spot audit (single-site inventory + report) | From 300,000 yen |
| Remediation implementation (removal of unnecessary tags + CSP/SRI rollout) | From 600,000 yen |
| Ongoing maintenance (monthly audits & monitoring) | From 50,000 yen/month |
A major security incident caused by compromised external scripts can easily reach millions of yen when factoring in recovery, compensation, and restoring lost trust. Compared to that, the cost of audits and preventative measures is a well-justified investment.
When hiring an external vendor, confirming the following points will provide peace of mind:
- Scope of the audit (target domains, subdomains, number of pages)
- Response speed for notification and isolation upon detecting anomalies (including nights and holidays)
- Pre-verification that implementing CSP will not break existing ads or analytics
- Availability of monthly reports, as well as handover of registries and configurations (whether you can continue internal operations)
Conclusion
The resurgence of the polyfill.io issue highlights the obvious reality: external scripts loaded by your site mean executing third-party code on your own domain. Start by checking whether outdated, high-risk tags like polyfill.io remain on your site, and audit any unnecessary tags. Adding CSP, SRI, and regular inspections on top of that will prevent sudden future disasters before they occur. A site renewal is an ideal opportunity to thoroughly review all external dependencies (Corporate Site Renewal Guide).
Whether you are "concerned about tags installed long ago," "wanting to clean up external scripts during a redesign," or "looking to protect trust in your e-commerce or membership site," we can share an audit strategy and priorities for your site in a free 30-minute consultation. No sales pitch attached.
