As digital advertising evolves, businesses and users alike have become increasingly concerned about privacy, transparency, and website security.
Retargeting technology is often associated with aggressive tracking practices, excessive data collection, or scripts that negatively impact website performance. However, not all retargeting solutions operate in the same way.
At PiXGaming, our retargeting infrastructure was developed with a strong focus on security, controlled execution, and minimal impact on both websites and users. The purpose of our script is not to collect personal information or interfere with website functionality. Instead, it serves as a secure delivery mechanism that enables retargeting campaigns to operate within a controlled and isolated environment.
Understanding the Script Structure
The implementation itself is straightforward and intentionally lightweight from the website owner’s perspective, the script is implemented on the Google Tag Manager, giving oversight and security. The script looks like this:
The script is loaded asynchronously, meaning it does not block or delay the rendering of the website. This allows the page to continue loading normally while the retargeting functionality initializes independently in the background.
For operators and development teams, this is particularly important because maintaining website performance and user experience remains a priority.
How the Script Operates
Before analysing each component individually, it is important to understand the complete structure of the retargeting script and what its primary role is within the browser environment. At first glance, scripts like this can appear highly technical or difficult to interpret for non-developers.
However, when examined line by line, the functionality becomes straightforward: the script simply verifies that the website is running in a secure HTTPS environment, creates a sandboxed iframe, and loads an isolated safe-frame endpoint designed for retargeting delivery.
The implementation is intentionally minimal, lightweight, and separated from the visible website interface, allowing retargeting services to operate without interfering with page content, user interaction, or website performance. Below is the full script that will be broken down and explained in detail throughout the following sections.
(function () {
(function () {
var a = document.body;
if (“https:” === document.location.protocol) {
var b = document.createElement(“iframe”);
b.setAttribute( “sandbox”, “allow-scripts allow-same-origin” );
b.setAttribute( “src”, “https://scripts.prdredir.com/safeframe” );
b.setAttribute(“frameborder”, 0);
b.setAttribute(“height”, 1);
b.setAttribute(“width”, 1);
b.style.setProperty(“position”, “fixed”, “important”);
b.style.setProperty(“height”, “1px”, “important”);
b.style.setProperty(“width”, “1px”, “important”);
b.style.setProperty(“left”, “-1px”, “important”);
b.style.setProperty(“top”, “-1px”, “important”);
a.appendChild(b);
}
})();
})();
The Script in More Detail
Once executed, the script creates a secure iframe environment within the browser. This iframe loads content from https://scripts.prdredir.com/safeframe
The iframe is only initialized when the website is running under HTTPS, ensuring the functionality operates exclusively within encrypted and secure browser sessions.
Additionally, the iframe is sandboxed using browser-level restrictions:
sandbox="allow-scripts allow-same-origin"
Sandboxing is a critical security measure. It isolates the iframe from the surrounding website environment and restricts what the embedded content is allowed to access or execute. This separation helps ensure that the retargeting layer operates independently without interfering with the core website infrastructure.
What the Script Does Not Do
One of the most important aspects to clarify is what the script is not designed to do. The implementation does not contain any unctionality intended to:
- Collect passwords or payment information
- Read private form submissions
- Capture keystrokes
- Extract personal messages or emails
- Scrape visible page content
- Modify the website’s interface or functionality
- Access sensitive account information
From a technical analysis perspective, the script’s role is limited to creating and managing a secure isolated execution environment for retargeting delivery.
Why the Iframe Is Invisible
The iframe is configured to operate silently in the background using minimal dimensions:
height=”1″
width=”1″
The iframe is also positioned outside the visible viewport with these settings:
left: -1px;
top: -1px;
This approach ensures that the implementation does not interfere with the visual layout of the website, user navigation, responsive elements, or front-end functionality.
For end users, the browsing experience remains unchanged. For website operators, this means the retargeting infrastructure can function without disrupting design consistency or site performance.
The Importance of HTTPS Enforcement
Before the iframe is created, the script validates whether the website is running over HTTPS:
if ("https:" === document.location.protocol)
This guarantees that the retargeting environment only operates under encrypted browser connections. HTTPS is a fundamental security standard that protects communication between websites and visitors, reducing the risk of interception or manipulation during transmission.
By enforcing HTTPS execution, the script aligns with modern browser security practices and industry standards.
Why Asynchronous Loading Matters
The script uses asynchronous loading through the async attribute.
This ensures that the retargeting functionality does not block other website resources from loading.
In practical terms, asynchronous execution helps:
- Preserve website speed and responsiveness
- Prevent render-blocking behaviour
- Reduce impact on page performance metrics
- Maintain a smoother browsing experience for users
For operators working in highly competitive industries such as iGaming, performance optimisation is essential for both SEO and conversion rates.
A Simplified Explanation for Non-Technical Readers
For readers without a technical background, the easiest way to understand the script is to think of it as a secure isolated container operating separately from the website itself.
It does not read private user information or interact with sensitive website content. Instead, it provides a controlled environment where retargeting technology can function safely without interfering with the website or its visitors.
The implementation is intentionally designed to remain unobtrusive, secure, and operationally efficient.
Technical Overview for IT and Security Teams
From a technical standpoint, the script performs the following sequence of actions:
- Confirms the website is operating over HTTPS
- Dynamically creates a browser iframe
- Applies sandbox security restrictions
- Loads a secure isolated endpoint
- Sets minimal iframe dimensions
- Positions the iframe outside the visible viewport
- Appends the iframe to the document body
Based on the visible implementation, there are no observable mechanisms related to:
- Credential harvesting
- Keylogging
- Session replay
- Form interception
- DOM scraping
- Sensitive data extraction
- Intrusive browser fingerprinting
Privacy, Compliance, and Brand Safety
Modern digital advertising requires a balance between marketing performance and responsible implementation practices. At PiXGaming, our retargeting infrastructure was developed with that balance in mind.
By operating within isolated browser environments and avoiding intrusive interaction with website content, the implementation supports a more controlled and privacy-conscious approach to retargeting services.
For partners and operators, this contributes to:
- Reduced operational risk
- Cleaner implementation standards
- Improved brand safety
- Better compatibility with modern browser security expectations
Final Considerations
Retargeting technology does not need to come at the expense of website security, user experience, or responsible implementation practices.
PiXGaming’s retargeting script was designed to operate within a secure and isolated framework, focused on stability, controlled execution, and minimal impact on website infrastructure and without access to databases or any data that can identify a player.
Its purpose is limited to enabling retargeting functionality within a sandboxed environment while maintaining compatibility with modern security standards and operational best practices.
For more information, please get in contact and we are more than happy to sit down and show you behind the curtains.
