Tag Detector
See every tracking tag on a page — including the ones fired from inside Google Tag Manager — with IDs, placement, duplicates and what to fix.
Not detected (common tags)
Third-party hosts & scripts
How to Use Tag Detector in 3 Steps
Scan a page
Enter the URL and press Scan. The HTML is fetched (directly or through a public relay), and by default the page’s Google Tag Manager container and up to ten first-party scripts are read too, so tags set up inside GTM are found — most detectors stop at the HTML.
Read the report
Tags are grouped by purpose with their IDs (GTM-…, G-…, AW-…, pixel IDs), where they load — head, body, via GTM, in a script — and whether external scripts are async. Issues call out duplicate IDs, hard-coded tags that should live in GTM, legacy Universal Analytics and missing consent management.
Export
Download the report as Markdown for a client, JSON for a pipeline or CSV for a spreadsheet; Copy copies the Markdown.
Tag Detector — Frequently Asked Questions
How is this different from other tag detectors?
Most tools only grep the HTML. This one also fetches the GTM container JavaScript and the page’s own scripts, extracts measurement and pixel IDs, and tells you whether each tag is hard-coded or fired through GTM — the questions an audit actually asks. And it runs in your browser.
Why might a tag be missing from the results?
Static scanning cannot see tags that are injected only after cookie consent, loaded by server-side GTM, or added by scripts that themselves load other scripts at runtime. Tags on pages behind a login are also out of reach. Treat the result as “what a first visitor’s browser receives”.
Can I scan a competitor?
The tool reads only what any visitor’s browser downloads — public HTML and scripts. Use it responsibly and respect site terms.
What do the placement labels mean?
head / body: hard-coded in the page. via GTM: found only inside the container, i.e. managed through Tag Manager. script: found inside a first-party JavaScript file. noscript: the fallback pixel image/iframe.
Does it detect Consent Mode?
It flags whether a consent default exists and which CMP is present; for the full Consent Mode v2 checklist use the companion Consent Mode Checker.
Is my input sent anywhere?
No. Everything is computed by JavaScript in your browser tab. Nothing is uploaded, logged or stored by Toolity.
Why does fetching sometimes fail — and what is the relay?
Browsers block JavaScript from reading other websites directly (CORS). The tool first tries a direct request; when the site forbids it, the URL only is sent to a public read-only relay (allorigins.win, then codetabs.com) that fetches the page and returns its HTML. The relay sees the URL you typed, nothing else — Toolity has no server and keeps no record. If the relay is busy or the site blocks bots, paste the page source instead: that path is 100% local.