Thesis: RUM is not a first-paint dependency. Load the bundle after the first pointer or key, or eight seconds after load — then still wait for idle before init.
What we shipped first
A synchronous or early deferred RUM script competed with fonts and theme boot. Scores tanked. Quiet visitors who never clicked still never needed the agent on the critical path — yet we paid for it on every cold load.
The footer already said anonymous CloudWatch usage analytics. Shipping a head script that hurt Lighthouse while the copy claimed a light touch was the wrong green.
The working shape
A tiny loader listens once for pointerdown and keydown. On load, a timer fires at eight seconds if nobody interacted. The injected bundle still uses requestIdleCallback before AwsRum init. CSP must allow the RUM endpoints or the defer buys nothing.
// Defer analytics: first input, else 8s after load — not a blocking <script> in <head>
(function () {
if (window.__analyticsLoader) return;
window.__analyticsLoader = true;
var started = false;
function load() {
if (started) return;
started = true;
var s = document.createElement("script");
s.src = "/assets/rum-bundle.js";
s.defer = true;
document.body.appendChild(s);
}
window.addEventListener("pointerdown", load, { once: true, capture: true, passive: true });
window.addEventListener("keydown", load, { once: true, capture: true });
window.addEventListener("load", function () {
setTimeout(load, 8000);
});
})();
// Inside the bundle: still wait for idle before AwsRum init
// if (typeof requestIdleCallback === "function") {
// requestIdleCallback(initRum, { timeout: 2000 });
// }Checklist
- Keep RUM out of a blocking or early <head> script.
- Load on first input once, else eight seconds after load.
- Init inside the bundle on idle (with a short timeout fallback).
- Allow the RUM hosts in CSP; verify a quiet page does not fetch the agent before the timer.
- Match the footer claim: anonymous CloudWatch, no ad trackers.
Related: late font faces still swap after paint. How we deliver: methodology.
Engineering commentary only — not audit, legal, or certification advice.