The Portfolio Page

A portfolio claims not to use third-party tracking. Audit its saved HTML source and classify the external services a visitor's browser would contact.

Objective

By completing this module, you will be able to:

extract and normalize hostnames from HTML resource URLs; and
distinguish content delivery, analytics, interaction, and profiling risks.

Before you begin

Download the HTML artifact and open it as text. Review View the original page source and Change a URL safely.

Concepts

External stylesheets, images, scripts, analytics, and widgets can send visitor requests to third parties. A hostname identifies the receiving service, while the path often suggests its purpose. Not every external host creates the same risk: a profiling service can connect visits across contexts more directly than a static asset host.

A browser page branches to content, analytics, interaction, and profiling hosts. Each request can carry different data, subject to browser policy.

Loading a page can trigger requests to several hosts. Assets, analytics events, interaction data, and profiling identifiers have different purposes and disclosure implications. Inspect destination, initiator, and the data actually sent. Cookie, referrer, and other browser policies affect each request; a hostname alone does not prove that tracking occurred. All hosts here are synthetic.

Suggested tools

Text editor or source viewer: Search for https://, src=, and href=.
Hostname inventory: A handwritten table is sufficient; record each host, resource type, likely purpose, and privacy impact.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Open the saved HTML in an editor and search for src= and href=. For https://assets.workshop.example/theme.css, the hostname is assets.workshop.example; the path is /theme.css. Keep subdomains, remove scheme/path for your host inventory, and read nearby element attributes to infer purpose.

Investigation

Observe

List every unique external hostname in the source. Group hosts by fonts or content, measurement, error reporting, comments, tag management, or profiling.

Form a hypothesis

Which hosts receive audience-measurement or interaction requests? Which service could build the strongest profile of visitors and therefore creates the largest source risk?

Test carefully

Submit hostnames one at a time. Do not visit the synthetic external URLs; all needed evidence is present in the downloaded source.

Progressive hints

Hint 1

Search the source for absolute URLs and make a unique-host list.

Hint 2

Focus on the analytics script, the embedded interaction provider, and the script whose path suggests visitor profiling.

Hint 3

The story-critical answer is the hostname of the profiling script, without its scheme or path.

Troubleshooting and reset

Open the downloaded file in a text editor if a browser renders it. Submit only the hostname unless the station accepts the full URL. A subdomain is a distinct host, so preserve it exactly.