Skip to content

Investigate global Stripe.js and iframe injection on Drupal pages

Problem

  • Stripe.js is being loaded on every Drupal page, including pages without any Stripe-related forms.
  • A Stripe-controlled iframe (__privateStripeMetricsController...) is injected globally across all pages.
  • This behavior suggests Stripe is initialized site-wide rather than conditionally.
  • Loading Stripe globally may:
    • Introduce unnecessary third-party requests and performance overhead.
    • Expand the surface area for external tracking or telemetry collection.
  • There is concern that Stripe may collect user-related data (e.g., device, session, or behavioral signals) even when no payment interaction occurs.

Expected Behavior

  • Stripe.js should only be loaded on pages where payment functionality is explicitly required.
  • Stripe-related iframes should only be present during active payment flows.
  • No Stripe scripts or resources should be loaded on unrelated pages.
  • Any third-party data collection should be minimized and limited to strictly necessary contexts (e.g., payment processing).