DocAccessible
Checking account
Documentation
All documentation

Website monitoring

Tag managers and client-only script installation

Understand why Google Tag Manager and runtime-only injection cannot complete secure website verification, and move the tag to a supported global template.

For
Analytics teams, web governance owners, and frontend developers
Typical time
10 minutes plus the supported installation change
Open website installation

Before you start

  • The generated DocAccessible installation code
  • Access to identify how the current tag is injected
  • A web owner who can change the CMS, theme, or server-rendered layout

Procedure

Step by step

  1. Confirm whether the tag is runtime-only

    Open View page source and search for data-site-key. If it appears only in the Elements panel after Google Tag Manager, useEffect, or another loader runs, the installation cannot prove domain control.

  2. Choose the platform's server-rendered method

    Use the CMS global Footer or Body - end field, active theme, asset manager, static index.html, or shared server layout instead.

  3. Paste the exact generated tag

    Copy the code from DocAccessible Installation and publish it once through that supported method. Do not wrap it in another client-side tag loader.

  4. Remove the duplicate runtime tag

    After the new source-visible installation is live, disable the Google Tag Manager or component-injected copy so each page runs only one instance.

  5. Verify source and connection

    Open a public page, confirm the key in its original source, reload once, and return to DocAccessible for Script connected status.

Why runtime-only injection fails verification

A tag manager executes after a browser loads the page. DocAccessible deliberately performs a separate server-side fetch of the reported URL and requires the exact script tag and key in that returned HTML. This prevents a browser Origin header or an injected request from being treated as ownership proof.

The browser may send a discovery report from a runtime tag, but the website remains unverified and protected operations stay unavailable.

Supported replacements

Choose the installation route that owns the public source. The tag can remain asynchronous and does not need to block rendering.

When policy allows only a tag manager

Ask the web platform owner to approve one source-visible global script with the documented service origin and site key. If governance cannot permit a server-rendered installation, secure website verification cannot complete and website monitoring should remain disconnected rather than weakening ownership checks.

  • Share the exact generated tag and the data-collected explanation from Installation.
  • Document script-src, connect-src, and img-src requirements for security review.
  • Confirm that the script does not collect cookies, form values, visitor identity, or full page content.
  • Keep the approved installation in the site's release and change-management record.

Official Google Tag Manager reference

Google documents custom tags as browser-executed container behavior. That remains useful for analytics workflows, but it does not change DocAccessible's source-visible ownership requirement.

Related guides