Skip to content
sGTM.space

Google tag gateway: serve Google's tags from your own website

Better Loader serves GTM from your own subdomain. Google tag gateway goes one step further: GTM and the Google tag load from a path on your website itself, such as www.example.com/Tg7Kq2mXab/. It is Google's own route, switched on in your Cloudflare account or another CDN, and SGTM.space guides you through it and checks that it works. This lesson covers what it changes, how to set it up and what it leaves as it is.

Advanced 10 min read

On this page

What you will learn

  • Explain what Google tag gateway changes compared with your tagging subdomain.
  • Switch it on in Cloudflare with a measurement path blockers do not match.
  • Keep GTM starting once, after your consent defaults.
  • Use it with Better Loader, or with the gateway snippet without it, and check that it works.

Before you start

  • A container on a paid plan, with GA4 sending to your tagging subdomain (lesson 3).
  • Your website proxied through your own Cloudflare account (orange cloud), or another CDN or load balancer that supports Google tag gateway.
  • Ideally Better Loader already running (lesson 8).

01 What the gateway changes

Your CDN forwards one path on your website, the measurement path, to Google. GTM, the Google tag and the requests they send then use that path on your own domain instead of googletagmanager.com and Google's other hosts.

  • The scripts come from your website's own domain, not from a subdomain that is a CNAME to another host. Blockers that follow DNS records (Brave, uBlock Origin in Firefox, AdGuard) cannot tell them apart from your site.
  • The Google tag sends its Google Ads pings through the path, so they reach Google through your domain.

What it does not change: GA4 keeps sending to your tagging subdomain through server_container_url, where Request Proxy disguises the hits. A GA4 hit that goes through the gateway still carries v=2&tid=G- in its address, which Request Proxy does not rewrite there, so keep the server container URL from lesson 3. The gateway itself sets no cookies: neither Google's nor Cloudflare's documentation has it answer with an HTTP Set-Cookie. Google's cookies are still set by JavaScript, which Safari keeps for 7 days at most, with or without the gateway. Only cookies a server sets from your site's own address live longer there (lesson 4).

02 Switch it on in Cloudflare

  1. 1 On Add-ons, click Enable on the Google tag gateway card. Its settings page opens with a suggested Measurement path.
  2. 2 In Google Tag Manager, open Admin, then Google tag gateway, choose Cloudflare, sign in, select your website's domain and complete the setup. You can also turn it on directly in the Cloudflare dashboard. You need the Super Administrator, Administrator or Zaraz Admin role in Cloudflare.
  3. 3 In the Cloudflare dashboard, open Google tag gateway, then Configure Google tag gateway, and set the measurement path to the suggested one. Leave Set up tag off.
  4. 4 Back in SGTM.space, confirm the Website domain and the Measurement path and click Save and check.
  • Your website must be proxied through Cloudflare (orange cloud) for the gateway to answer on its domain.
  • The Cloudflare setting covers the whole zone, subdomains included, with one tag. Turn it on only in your own website's zone.
  • Not on Cloudflare? The gateway also runs on other CDNs and load balancers. Set it up with the same measurement path by following Google's guide for yours, linked under Not on Cloudflare? on the settings page.

03 Leave Set up tag off

Cloudflare adds its own small loader to every page in the zone. With Set up tag off, that loader only fetches the gateway script, and the snippet already on your page (your own or Better Loader's) starts GTM once, after your consent defaults.

With Set up tag on, Cloudflare also starts GTM at the very top of the page, before your consent defaults, and a second time when your snippet starts it too. That breaks the order lesson 6 sets up. The settings page warns you when a check sees it, and the tracking scanner reports it.

04 With Better Loader: keep your snippet

With Better Loader on, nothing changes on your site. The gateway serves the web GTM container Better Loader loads, so there is no tag ID to enter. Once a check confirms the gateway answers, Better Loader loads GTM through it on your website's domain.

  • Better Loader sees Cloudflare's injected loader and does not load GTM twice.
  • If the gateway fails or a blocker stops it, Better Loader loads GTM itself.
  • On other domains that use this container, Better Loader loads GTM as before.
  • Request Proxy, Cookie Extender, Bot Filtering and Request Enricher keep working on your tagging subdomain.

05 Without Better Loader: the gateway snippet

Keep your GTM snippet, but load it from the gateway path instead of googletagmanager.com. After Save and check, the settings page gives you your snippet. Put it as high in the <head> as possible on every page, in place of your current GTM snippet:

html 
<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'?l='+l:'';j.async=true;j.src=
"/Tg7Kq2mXab/"+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer',"GTM-XXXXXXX");</script>
<!-- End Google Tag Manager -->
  • It loads the bare path, without ?id=GTM-…: the gateway already knows your tag, and blocklists match a visible tag ID.
  • There is no noscript version.
  • Request Proxy and Cookie Extender need Better Loader, so they do not run with this snippet. Bot Filtering and Request Enricher keep working on your tagging subdomain.

06 Check that it works

  1. 1 On the settings page, check that the status says the gateway serves your tag on your address, or with Better Loader that Better Loader loads GTM through it.
  2. 2 Open your site in a normal window (not GTM Preview) with DevTools on the Network tab. GTM should load from https://www.example.com/Tg7Kq2mXab/, and Google Ads requests should go to that path too.
  3. 3 Check that GA4 hits still go to your tagging subdomain, such as k7q2x.example.com.
  4. 4 Run the free tracking scanner on your site. It recognises the gateway, checks its path against uBlock Origin's rules and reports Set up tag if it is on.

A few requests still go straight to Google, by design: the Google tag sends its consent signal to Google's own servers, and once ads consent is granted, some cookie-matching requests too. No gateway has an address for them.

  • The measurement path has at least seven characters and an uppercase letter.
  • Set up tag is off in Cloudflare.
  • GTM loads from your website's own domain.
  • GA4 hits still go to your tagging subdomain.
  • The add-on's status shows the gateway answering.

Frequently asked questions

Does the gateway replace my tagging subdomain?

No. The gateway serves Google's scripts and Google Ads pings from your website. GA4 hits keep going to your server container on your tagging subdomain, where your server tags, Request Proxy and the other add-ons work.

Why do some requests still go to Google?

The Google tag sends its consent signal and, once ads consent is granted, some cookie-matching requests to Google's own domains. It has no gateway address for them, so neither the gateway nor Request Proxy can move them. Your Ads measurement itself goes through your own domain.

How do I turn it off again?

Turn the add-on off in SGTM.space and switch Google tag gateway off in Cloudflare or your CDN too, or your pages keep downloading GTM twice. If your site uses the gateway snippet, put your previous GTM snippet back first.

Related features

Ready to put it into practice?

Deploy a server GTM container on your own domain in a few minutes. The Free plan needs no card.

Create a free account