Guide
What a public GTM container reveals, and what it does not
A Google Tag Manager container is not a secret. When someone visits a site running GTM, their browser downloads gtm.js for that container ID — a JavaScript file containing every tag, every trigger condition, and every variable definition needed to decide what fires. It has to be public, because the browser has to be able to read it.
That file is minified and structured for a machine, not a person. A container scanner fetches it and parses those structures back into something readable. No credentials are involved at any point, because none are needed.
Four things the scanner is genuinely useful for
Auditing a site before you have access
The single most common use. A new client says they have "some analytics set up". You scan the container and can describe their entire MarTech stack in the kickoff call, before anyone has found who owns the Google account. Access requests take days; this takes seconds.
Competitive and market research
Which analytics platform, which consent management platform, which A/B testing tool, which ad pixels. Useful for positioning, for vendor evaluation ("does anyone in our category actually use this?"), and for sales research.
Verifying what is actually published
GTM shows you the workspace. The scanner shows you what is live. Those differ more often than anyone expects — a tag paused in the workspace but never republished is still firing for every visitor, and only the published container tells you that.
Finding sub-containers nobody mentioned
Containers can load other containers. Agencies do this, and so do some tag vendors. Scanning surfaces the chain, which is how you discover the second analytics platform that has been running for two years and that nobody in the room knew about.
What the scanner cannot see
It is worth being precise about the limits, because the published container is a compiled artifact rather than the source of truth you see in the GTM interface.
- Names and folders are gone. The published container carries what tags do, not what people called them. Tag identity is inferred from templates and parameters, so expect "GA4 Event" rather than "GA4 — Purchase (checkout v3)".
- Server-side containers are not readable this way. They serve no public JavaScript. Scanning only applies to web containers.
- Triggers are reconstructed, not read. Firing conditions are synthesized from the container logic. They are accurate about what causes a tag to fire, but they will not match the trigger names in the interface.
- Nothing about history. No versions, no changelog, no who-changed-what. For that you need real access and the GTM container manager.
- Nothing about runtime. The container says a tag would fire on a purchase page. Whether it actually fires, with correct parameters, past a consent banner, is a different question — see the GA4 tag debugger.
Is scanning a GTM container legal?
The scanner requests a public file from Google servers using a public identifier — exactly what every browser visiting the site does, millions of times a day. No authentication is bypassed and no private system is accessed, because the container was published to be readable by anyone.
This is the same category of activity as viewing page source or reading a robots.txt. It is also why nothing sensitive should ever live in a web container: API keys, internal endpoints, and unreleased campaign names in a GTM variable are visible to anyone who thinks to look. If you find something confidential in your own container while scanning it, that is the finding.
Scanner or audit — which do you need?
Use the scanner when
- You do not have access to the container
- You want to know what is live, not what is staged
- You are researching a prospect or competitor
- You need an answer in seconds, not after an access request
- You want to check a container from any site on the web
Use the GTM audit when
- You have Read access to the container
- You need real tag names, folders, and versions
- You want 50+ checks and a scored result
- You need Consent Mode v2 and security analysis
- The container is server-side