Govt sites are as bad as news"papers" these days. Packed with trackers, and their PDFs should be opened only in a virtual machine that can be immediately trashed after reading. Most of them have zero if not negative budget for IT and security.

In addition to traditional anti-virus/malware, I use these extensions (and have to tune them regularly) for web sites: NoScript, Privacy Badger, DuckDuckGo, and uBlock Origin. I regularly see 20-50 trackers and other bad boys on govt sites, and 50-100 or more on "news" sites. The web sites will *usually* work for basic information (do you Really Need those random stock images?) with most of that blocked, but occasionally there's one that's just obnoxious about it (think WSJ & NYT & WaPo).