A landing page with no third parties before consent

Until 12 October, before a visitor read a word, microsaaskit.dev fetched IBM Plex from Google Fonts, Font Awesome from a CDN, Tailwind as a script that compiled the styles in the browser, and Google Analytics. We rebuilt the last version before the change and loaded its home page in headless Chrome: on a first visit it made 11 requests to five other hosts without asking, not counting the Google Analytics request, which our run blocked.

What we changed

Google Analytics now loads only after the visitor chooses “Allow analytics”. “Decline” sits next to it in the same size and style, and “Cookie settings” in the footer reopens the banner. The fonts come from the site: two IBM Plex families in the latin and latin-ext subsets, 14 files the build copies from Fontsource. Lucide outline icons and Simple Icons brand marks replaced Font Awesome, inlined as one SVG sprite per page; the build fails if a page uses an icon the sprite lacks. Tailwind is compiled at build time.

The same day, the page became two static pages, English at / and Slovenian at /sl/, linked with hreflang, with / as the x-default; sitemap.xml lists both alternates of every page. The factory floor is drawn by JavaScript; without it, its text is only a JSON block. llms.txt gives a crawler that does not run JavaScript the same facts in Markdown, generated from the same en.json and factory-data.js as the page.

The request list

The source is not the proof; the browser's request list is. We loaded /, /sl/ and both privacy notices on the live site, and the news pages from a local build, in headless Chrome with a fresh profile and no consent, and recorded every request through the DevTools protocol. Every request went to the page's own origin, 7 to 16 per page. The Slovenian pages also fetched the latin-ext font files, for č, š and ž.

On the local build we then clicked “Allow analytics”. Two hosts appeared: one serves the Google tag script, the other the collection endpoint, with one request each per page. After “Decline” under “Cookie settings”, the _ga cookies were gone and the reloaded page again requested only its own origin.

For a team building on the toolkit: a consent banner is a claim, and the request list is its test. Before a product's landing page goes live, load it with a fresh browser profile and no consent, and read the hosts. If the page draws its content with JavaScript, generate a plain-text version from the same source, as llms.txt is here.