Chrome DevTools Sources: Find Every Tag on a Page

Ask a client which tags run on their site and you get the GTM container. Ask the browser and you get the truth: the container, plus the hard-coded Meta Pixel from 2021, the second GA4 snippet a plugin added, and a heatmap vendor whose contract ended last year.

The Sources panel is how you ask the browser. It lists every file the page loaded, grouped by the domain that served it, and lets you search all of them at once. Once you have found the script you care about, it is also a debugger: you can format minified code, log what a line receives without editing it, and pause only on the event you are chasing.

This guide covers both halves — inventory and debugging — with sample use cases at the end. The examples run against the Google Merchandise Store in Chrome 156.

How to open it#

• Press F12 (Mac: Cmd+Option+I) and click the Sources tab.
• Or press Ctrl+Shift+P (Mac: Cmd+Shift+P) to open the Command Menu, type Show Sources, and press Enter.
• From anywhere in DevTools, Ctrl+Shift+F (Mac: Cmd+Option+F) opens the search drawer across every loaded file.

Open Sources, press Ctrl+Shift+F and search for GTM- — every container reference on the page, across every file.

Inventory every tag on the page#

The Page tab in the left sidebar groups loaded files by origin: googletagmanager.com, connect.facebook.net, bat.bing.com, snap.licdn.com, and whichever vendors nobody remembers adding. It is the fastest tag inventory there is, and it includes tags hard-coded outside GTM — which a container export never shows you.

Read it top to bottom and sort each origin into one of three buckets:

• Expected and in GTM. Your container and the vendors it loads.
• Expected but hard-coded. Snippets pasted into the theme or added by a CMS plugin. These keep firing during a migration to GTM unless someone removes them.
• Unknown. A domain nobody on the call recognises. Every one is a privacy question as well as a tracking one.

Iframes appear as their own entries in the tree with their own origins, so embedded checkouts and booking widgets — and the tags inside them — are visible too.

Search across all scripts#

Ctrl+Shift+F searches every loaded file, including inline scripts in the HTML. The search drawer supports case-sensitive and regex modes. Useful searches for tracking:

• GTM- finds every container referenced anywhere.
• G- (with case-sensitive on) finds GA4 measurement IDs; a regex such as G-[A-Z0-9]{8,} cuts the false positives.
• fbq( finds Meta Pixel calls; gtag( finds direct gtag calls outside GTM.
• dataLayer.push finds every place the site pushes events — the quickest way to see whether purchase is pushed by the site or built inside the container.

A second, unexpected measurement ID is a duplicate-tracking bug waiting to be found. Click any result to open the file at that line.

Make minified code readable#

Most tracking code is minified into one enormous line. Click the { } (Pretty print) button at the bottom of the editor and Chrome formats it into readable, indented code. Breakpoints and logpoints then work on the formatted lines, which is what makes the next section practical.

Debug tracking code without editing it#

Logpoints#

Right-click a line number → Add logpoint, and enter an expression such as 'push', arguments. Every time that line runs, the expression is printed to the Console — without pausing, and without editing the file. It is the clean way to watch a site's own tracking helper (trackEvent(name, params), say) and see exactly what each call passes.

Conditional breakpoints#

Right-click a line number → Add conditional breakpoint, such as event === 'purchase'. The page pauses only for the case you care about, instead of on every one of the 40 events that pass through the same helper. When paused, the Scope pane shows every variable's value and the Call stack shows what called it.

Event listener breakpoints#

In the debugger sidebar, Event Listener Breakpoints → Mouse → click pauses on the next click before any handler runs. Step through with F11 and you see exactly which scripts react to the click, in order. If execution never reaches GTM's handler, something earlier stopped the event — the same problem the Elements panel's Event Listeners tab helps you spot from the outside.

XHR/fetch breakpoints#

The XHR/fetch Breakpoints pane pauses when a request URL contains a string you set. Enter collect?v=2 and the page pauses just before a GA4 hit is sent with fetch or XHR, with the full call stack of what triggered it. Hits sent with navigator.sendBeacon do not trigger it — for those, use the Initiator tab in the Network panel.

Snippets and the Ignore List#

• Snippets. Sources → Snippets stores scripts you can run on any page with Ctrl+Enter. Save the dataLayer push logger and the container-ID check from the Console guide as snippets and you never retype them. Snippets persist in your Chrome profile across sites.
• The Ignore List. Settings → Ignore List excludes scripts from stepping and from call stacks. Add your browser extensions and framework bundles so stepping through a click lands in tracking code instead of React internals. You can also right-click a file in the tree → Add script to ignore list.

To change a script rather than debug it — remove a duplicate snippet, rewrite a dataLayer.push — use Local Overrides, which now lives in our Network guide: override content and headers.

Use cases#

Pre-migration tag audit#

A client is moving everything into GTM and wants to know what exists today.

1. Load the home page, a product page, and the checkout with DevTools open on Sources.
2. List every origin in the Page tree for each page — checkout pages often load payment and fraud vendors the home page does not.
3. Ctrl+Shift+F for fbq(, gtag(, _linkedin_partner_id, uetq and ttq to find hard-coded calls. Each result outside googletagmanager.com is a tag that has to be rebuilt in GTM and removed from the theme.

GA4 reports double page views#

1. Search G-[A-Z0-9]{8,} with regex on. Two different files containing the same measurement ID — say the GTM container and an inline gtag('config', …) in the HTML — is a duplicate install.
2. Confirm it: two page_view hits with the same tid in the Network panel, each with a different initiator.

The purchase event is pushed with the wrong currency#

1. Search dataLayer.push and open the result in the checkout bundle; pretty-print it.
2. Add a logpoint on the push line with 'purchase', JSON.stringify(arguments[0]) — or a conditional breakpoint with arguments[0].event === 'purchase'.
3. Complete a test order. The logged object shows whether the site supplies currency; if it comes from a variable, the Scope pane on the breakpoint shows where the wrong value was read.

Which script sends the mystery hit?#

1. In XHR/fetch Breakpoints, add collect?v=2.
2. Click the element that sends the unexpected event. When the debugger pauses, the Call stack names the script — your container, a hard-coded snippet, or a vendor that forwards events to GA4.

A vendor nobody owns#

1. Spot an unknown origin in the Page tree, such as a session-replay domain.
2. Ctrl+Shift+F for that domain to find what loaded it — a GTM Custom HTML tag shows up inside gtm.js, a theme snippet inside the HTML.
3. Take it to whoever owns privacy. Session-replay and fingerprinting vendors also belong in your consent mode setup.

How Tagfire helps#

The Sources panel answers "what is on this page today?" Tagfire's GTM audit answers the container side permanently — paused tags, never-fired tags, Custom HTML risks, missing consent gates — and the Tag Debugger captures every hit the page sends as you browse, including hits from tags outside GTM, so duplicates are flagged without a single breakpoint.