Google Tag Gateway: serve Google's tags from your own website
Better Loader serves GTM from your own subdomain. Google Tag Gateway goes one step further: GTM and the Google tag load from a path on your website itself, such as www.example.com/Tg7Kq2mXab/. It is Google's own route, switched on in your Cloudflare account or another CDN, and SGTM.space guides you through it and checks that it works. This lesson covers what it changes, how to set it up and what it leaves as it is.
Advanced 10 min read Version 1.9, updated October 3, 2026
On this page
What you will learn
- Explain what Google Tag Gateway changes compared with your tagging subdomain.
- Set it up in Cloudflare or wherever your website is served, with a measurement path blockers do not match.
- Keep GTM starting once, after your consent defaults.
- Let Better Loader hand GTM over to it, and check that it works.
Before you start
01 What the gateway changes
Your CDN forwards one path on your website, the measurement path, to Google. GTM, the Google tag and the requests they send then use that path on your own domain instead of googletagmanager.com and Google's other hosts.
- The scripts come from your website's own domain, not from a subdomain that is a CNAME to another host. Blockers that follow DNS records (Brave, uBlock Origin in Firefox, AdGuard) cannot tell them apart from your site.
- The Google tag sends its Google Ads conversions through the path, and its Google Ads page pings too while ads consent is not granted, so they reach Google through your domain.
What it does not change: GA4 keeps sending to your tagging subdomain through server_container_url, where Request Proxy disguises the hits. A GA4 hit that goes through the gateway still carries v=2&tid=G- in its address, which Request Proxy does not rewrite there, so keep the server container URL from lesson 3. The gateway itself sets no cookies: neither Google's nor Cloudflare's documentation has it answer with an HTTP Set-Cookie. Google's cookies are still set by JavaScript, which Safari keeps for 7 days at most, with or without the gateway. Only cookies a server sets from your site's own address live longer there (lesson 4).
02 Set it up where your website is served
- 1 On Add-ons, click Enable on the Google Tag Gateway card. Its settings page opens with a suggested Measurement path.
- 2 In step 1, Settings, confirm the Website domain and the Measurement path and click Save and check. Until the gateway is set up where your website is served, the check does not pass yet.
Step 2 of the add-on's page asks where your website is served and shows the setup for that host, with your path and tag filled in. Choose your host here to see what it involves.
- 1 In Google Tag Manager, open Admin, then Google tag gateway, choose Cloudflare, sign in, select your website's domain and complete the setup. You can also turn it on directly in the Cloudflare dashboard. You need the Super Administrator, Administrator or Zaraz Admin role in Cloudflare.
- 2 In the Cloudflare dashboard, open Google tag gateway, then Configure Google tag gateway, and set the measurement path to the one you saved in SGTM.space. Leave Set up tag off.
- Your website must be proxied through Cloudflare (orange cloud) for the gateway to answer on its domain.
- The Cloudflare setting covers the whole zone, subdomains included, with one tag. Turn it on only in your own website's zone.
Why Set up tag stays off
Cloudflare adds its own small loader to every page in the zone. With Set up tag off, that loader only fetches the gateway script, and Better Loader's snippet on your page starts GTM once, after your consent defaults.
With Set up tag on, Cloudflare also starts GTM at the very top of the page, before your consent defaults, and a second time when your snippet starts it too. That breaks the order lesson 6 sets up. The settings page warns you when a check sees it, and the tracking scanner reports it.
- 1 In step 2, choose Vercel and the file for your framework: Next.js, or Other frameworks for Vite, SvelteKit, Nuxt, Astro, a static site and the rest.
- 2 Save the file where the page says, in the root of your project. Next.js runs only one such file: if your project already has one, move the function into it.
- 3 Commit and deploy. Vercel runs the file for the measurement path only, before your pages.
- 1 In step 2, choose Netlify. The page gives you an Edge Function with your path and tag filled in.
- 2 Save it where the page says, in your site's base directory. Netlify finds it there on its own, with no
netlify.tomlentry. - 3 Commit and deploy. Netlify runs the function for the measurement path only, before your site.
- 1 Add a rule to your property for the measurement path, with the Origin Server behavior pointing at the address step 2 shows under Forward to and Forward Host Header set to Origin Hostname.
- 2 Add the Content Targeting (EdgeScape) behavior to that rule, so Google gets the visitor's location, then deploy the new version.
- 1 Create a request condition for the measurement path, and a host
fps.googwith that condition and Override host set tofps.goog. - 2 Add the VCL snippet from Google's guide in both
vcl_missandvcl_pass, with the tag and path from step 2, then activate the service.
- 1 Add an origin for the address step 2 shows under Forward to, protocol HTTPS only.
- 2 Add a behavior for the measurement path on that origin: all HTTP methods, cache policy CachingDisabled and origin request policy AllViewerExceptHostHeader. Move it above all others and wait for the distribution to deploy.
- 1 In your external Application Load Balancer, add a backend service with an Internet network endpoint group for the address step 2 shows under Forward to, protocol HTTPS, with the custom request headers the page lists.
- 2 Add a routing rule that sends the measurement path to that backend.
Any CDN, load balancer or web server that can forward a path to another server can run the gateway. Step 2 gives you the values for your website:
- An origin or backend for the address under Forward to, sent as its Host header, with all cookies and the query string.
- The visitor's location on every request:
X-Forwarded-CountryRegion(for exampleUS-CA), orX-Forwarded-CountryandX-Forwarded-Region. - A route for the measurement path to that origin, ahead of your site's default rule.
Then click Check now under Status on the add-on's page. The check decides for every host.
03 Better Loader hands GTM to the gateway
The add-on requires Better Loader, so your site keeps Better Loader's snippet and needs no gateway snippet. The gateway serves the web GTM container Better Loader loads, so there is no tag ID to enter. Once a check confirms the gateway answers, Better Loader loads GTM through it on your website's domain.
- Better Loader sees Cloudflare's injected loader and does not load GTM twice.
- If the gateway fails or a blocker stops it, Better Loader loads GTM itself.
- On other domains that use this container, Better Loader loads GTM as before.
- Request Proxy, Cookie Extender, Bot Filtering and Request Enricher keep working on your tagging subdomain.
04 Check that it works
- 1 On the settings page, check that the status says the gateway serves your tag on your address and that Better Loader loads GTM through it.
- 2 Open your site in a normal window (not GTM Preview) with DevTools on the Network tab. GTM should load from
https://www.example.com/Tg7Kq2mXab/, and before you accept ads cookies the Google Ads ping should go to that path too. - 3 Check that GA4 hits still go to your tagging subdomain, such as
k7q2x.example.com. - 4 Run the free tracking scanner on your site. It recognises the gateway, checks its path against uBlock Origin's rules and reports Set up tag if it is on.
Some requests still go straight to Google, by design: once ads consent is granted, the Google tag sends its Google Ads page pings, the consent signal included, and the requests that go with them to Google's own domains such as www.google.com and ad.doubleclick.net, where Google reads its own cookies. With Google signals on in GA4, its requests go to Google's domains too. No gateway has an address for them, Cloudflare's included. Google Ads conversions keep going through the path.
- The measurement path has at least seven characters and an uppercase letter.
- Set up tag is off in Cloudflare.
- GTM loads from your website's own domain.
- GA4 hits still go to your tagging subdomain.
- The add-on's status shows the gateway answering.
05 Turn it off again
Turn the add-on off in SGTM.space: it goes off at once, and Better Loader stops loading GTM through the gateway. Then remove the gateway where you set it up, or your pages keep downloading GTM twice.
With the Cloudflare connection, tick Also switch Google Tag Gateway off in Cloudflare when you switch the add-on off, or click Switch off in Cloudflare on the add-on's page at any time. Without it, switch Google Tag Gateway off in the Cloudflare dashboard for your website's zone.
Delete the file you added for the gateway from your project, or take the gateway part out of your own file if you merged it there, then redeploy.
Delete the Edge Function you added for the gateway from your project, then redeploy.
Delete the rule that forwards the measurement path to Google, then deploy the new version.
Delete the condition, the host and the VCL snippet for the measurement path, then activate the service.
Delete the behavior for the measurement path and its origin, then wait for the distribution to deploy.
Delete the routing rule for the measurement path and its backend service.
Delete the route that forwards the measurement path to Google, then publish the change.
Then click Check on the add-on's card on the Add-ons tab: it tells you whether the path still answers.
Frequently asked questions
Does the gateway replace my tagging subdomain?
No. The gateway serves Google's scripts and Google Ads pings from your website. GA4 hits keep going to your server container on your tagging subdomain, where your server tags, Request Proxy and the other add-ons work.
Why do some requests still go to Google?
Once ads consent is granted, the Google tag sends its Google Ads page pings, the consent signal included, and the requests that go with them to Google's own domains, where Google reads its own cookies, and Google signals sends its requests there too. The tag has no gateway address for them, so neither the gateway nor Request Proxy can move them. The gateway carries Google Ads conversions, and the page pings sent before or without ads consent.
Related features
Ready to put it into practice?
Deploy a server GTM container on your own domain in a few minutes. The Free plan needs no card.
Create a free account