Setting Up Google Tag Manager: Why Most Installs Are Broken
Two months ago I audited an ecommerce brand spending EUR 14,000 a month on Google and Meta. Their developer confirmed Google Tag Manager was installed. GA4 showed traffic. Conversions appeared in Google Ads. Everything looked fine on the surface.
It was not fine. The GTM snippet was loading inside a deferred script bundle, which meant the container initialized two to four seconds after the DOM loaded. On mobile, roughly 18 percent of sessions ended before the container fired. GA4 was under-counting sessions. Google Ads was under-counting conversions. Smart Bidding had been optimizing against a data set that missed nearly one in five visitors for three months.
The install was not missing. It was wrong. And "wrong" is harder to catch than "missing," because wrong still produces data -- just less of it, silently.
This is the guide I wish every developer and marketer read before they install Google Tag Manager on a website. Not a quick-start walkthrough. A canonical reference for setting up Google Tag Manager so that every tag fires, every session counts, and every downstream platform gets clean data.
Before You Touch Code: Create the Container
If you do not already have a GTM account, start at tagmanager.google.com. Google's official setup guide walks through the account creation flow. The key decisions:
Account: One per company or client. The account is an organizational wrapper, not a technical entity.
Container: One per domain (in most cases). Choose "Web" as the target platform. Each container gets a unique ID in the format GTM-XXXXXXX. This ID is what connects your website to the container's tags, triggers, and variables. If you are not sure what this ID means or where it appears, I covered it in detail in Google Tag Manager ID: What It Means and How to Find It.
Container naming: Use a clear, descriptive name -- example.com - Web is better than Marketing Tags. When you manage multiple containers across brands or environments, naming discipline saves hours of confusion. I wrote a full framework for this in Google Tag Manager Best Practices: Naming & Governance.
Once the container is created, GTM presents the installation snippet. Two blocks of code. Do not skip either one.
The Two-Part Snippet: What Each Piece Does
The google tag manager install snippet has two parts, and both are required. Google's developer documentation is explicit about this.
Part 1 -- the <script> block. This inline JavaScript creates the dataLayer array, pushes a gtm.start timestamp, and asynchronously loads your container's JavaScript from Google's CDN. The async attribute means it does not block HTML parsing, but the earlier the browser encounters it, the sooner it starts downloading.
<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-XXXXXXX');</script>
<!-- End Google Tag Manager -->
Part 2 -- the <noscript> iframe. This provides a fallback for environments where JavaScript is disabled. It fires a single pageview-like hit via an iframe.
<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-XXXXXXX"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) -->
Replace GTM-XXXXXXX with your actual container ID.
Where to Place the Snippet: The Only Rule That Matters
Google's documentation says: the <script> goes "as high in the <head> of the page as possible." The <noscript> goes "immediately after the opening <body> tag."
This is not a suggestion. It is the single most important decision in the entire install. I dedicated a full post to it -- Google Tag Manager Snippet: Head vs Body Placement -- because the number of sites that get this wrong is staggering. The short version:
- If the snippet loads late, your Page View trigger fires late, and you miss sessions from visitors who bounce before the container initializes.
- If Consent Mode v2 defaults need to set before any Google tag fires, a late-loading container means consent commands arrive after tags have already attempted to run. That is a compliance problem in GDPR markets.
- If conversion tags fire late on a fast page, the user may navigate away before the tag executes. Your Google Ads conversion tracking under-reports, and Smart Bidding pulls back on campaigns that were actually working.
The only exception to "as high as possible in <head>" is the consent default command itself. If you use Consent Mode v2, the gtag('consent', 'default', {...}) call must come before the GTM snippet. Everything else goes after.
How to Install Google Tag Manager by Platform
The principle is the same everywhere: <script> in <head>, <noscript> after <body>. The mechanics differ by platform.
| Platform | Where to add the snippet | Notes |
|---|---|---|
| Raw HTML | Paste directly into <head> and after <body> | Simplest case. No abstraction layer. |
| WordPress | Child theme functions.php via wp_head (priority 1) and wp_body_open | Avoid plugins when possible. Full guide. |
| Shopify | theme.liquid, top of <head> and right after <body> | Shopify tracking guide. |
| Webflow | Project Settings > Custom Code > Head Code and Body Code | Webflow guide. |
| Squarespace | Settings > Advanced > Code Injection > Header | No <body> access; <noscript> is unavailable. Squarespace guide. |
| Wix | Settings > Custom Code > Head and Body - start | Wix guide. |
| Next.js | Root layout via @next/third-parties/google | Component handles both parts. Next.js guide. |
Each platform has its own pitfalls. WordPress caching plugins strip inline scripts. Shopify theme updates move the snippet. Squarespace does not expose the <body> tag at all. If you are on one of these platforms, read the platform-specific guide linked above before you paste anything.
Verifying the Installation
Installing the snippet is not the last step. It is the first. You need to verify the container actually loads, loads once, and loads in the right place.
Step 1: View page source
Load your site in an incognito window. Right-click, View Page Source. Search for your container ID. You should find it exactly twice -- once in the <head> script, once in the <body> noscript. Zero means the install failed. One means a part is missing. Three or more means you have duplicates.
Step 2: Browser console check
Open DevTools (F12), go to the Console tab, type google_tag_manager, and press Enter. You should see an object with your container ID as a key. If you see undefined, the container is not loading. If you see two container IDs, you have a duplication problem.
Step 3: GTM Preview mode
In your GTM workspace, click Preview and enter your site URL. The Tag Assistant panel should connect and show the Container Loaded event. Walk through your key pages and conversion flows. Confirm that each tag fires on the correct trigger with the correct parameters.
Step 4: Check through caching
If your site uses a CDN or caching layer, purge the cache and reload. I have seen installs that work on a fresh page load but disappear once the cache rebuilds -- typically because a caching plugin deferred or stripped the inline script.
For a deeper verification workflow, I built a full checklist in Google Tag Manager Checker: Tools and a Debug Checklist.
Five Mistakes That Break an Otherwise Correct Install
These are ranked by how often I encounter them in audits.
1. Duplicate container loading
The same container ID installed via a CMS plugin and a manual snippet. Every tag fires twice. GA4 doubles pageviews. Conversion counts inflate. Smart Bidding trains on fiction.
2. Snippet placed inside a deferred script bundle
Build tools like Webpack or Vite sometimes sweep the GTM snippet into a deferred or async bundle. The container loads seconds late. Sessions that end before the container initializes are lost entirely.
3. No data layer initialization before the snippet
If your site pushes events to the dataLayer before the GTM snippet creates it, those events are lost. The fix: initialize the dataLayer array before the GTM snippet with a simple <script>window.dataLayer = window.dataLayer || [];</script>. I explain why this matters in What Is a Data Layer and Why Tracking Breaks Without One.
4. Consent Mode defaults loading after the container
In GDPR markets, consent defaults must be established before the container loads. If the consent banner script loads after GTM, tags fire before consent state is set. This is both a legal risk and a data quality issue.
5. Container published with no tags
The container is on the site, the snippet is in the right place, but nobody published the container workspace. GTM loads an empty container. No tags fire. No errors. The install looks correct in every diagnostic check except Preview mode, where the tag list is blank.
What to Configure Inside the Container After Installation
Setting up Google Tag Manager does not end with the snippet. A container with no tags is just an empty JavaScript file loading on every page. At minimum, you need:
- A Google Tag with your GA4 Measurement ID, firing on All Pages. This sends pageviews to GA4.
- Conversion tags for your key actions -- purchases, form submissions, sign-ups -- fired by triggers that match actual user behavior.
- Consent Mode v2 defaults if you serve users in the EU or UK.
- A properly structured data layer pushing ecommerce and custom events in the format your analytics platform expects. I covered the mechanics in The GTM Data Layer: How to Push Events the Right Way.
If you handle meaningful ad spend, a server-side container running on your own subdomain recovers sessions lost to ad blockers and extends cookie lifetimes beyond Safari ITP's seven-day cap on JavaScript-written cookies.
When to Call in Help
I wrote this guide to cover the canonical install. But "correct install" and "trustworthy tracking" are not the same thing. The install gets the container on the page. What happens inside the container -- tag configuration, trigger logic, variable mappings, consent handling, data layer architecture -- determines whether the data reaching GA4, Google Ads, and Meta is accurate.
If your numbers do not match your backend, if your conversion counts look inflated or deflated, or if you are spending real money on campaigns optimized against data you cannot verify, that is not a DIY problem. That is a tracking audit. I will tell you exactly what is broken and what to fix first.
FAQ
How do I install Google Tag Manager on my website?
Create a GTM account and container at tagmanager.google.com, then paste the two-part snippet into your site. The script block goes as high as possible inside the head tag, and the noscript iframe goes immediately after the opening body tag. Verify the install by checking page source for your container ID and using GTM Preview mode.
Do I need both parts of the Google Tag Manager snippet?
Yes. The script block in the head loads the container for users with JavaScript enabled, which is the vast majority of traffic. The noscript block after the body tag provides a fallback for environments where JavaScript is disabled. Omitting the noscript block does not break tracking for most visitors, but including it follows Google's official installation requirements.
What happens if I put the GTM snippet in the wrong place?
If the script block loads too late in the page, tags fire late and you miss sessions from visitors who leave before the container initializes. On mobile, where page speed directly affects bounce rates, a late-loading container can silently under-count a significant share of sessions and conversions.
Can I install Google Tag Manager without a developer?
On platforms like Webflow, Wix, and Squarespace, you can paste the snippet into the custom code settings without touching source files. On WordPress, a plugin like Google Site Kit can handle the install. On custom-coded sites or JavaScript frameworks, you typically need a developer to ensure the snippet is placed correctly and not bundled or deferred by build tools.
How do I know if Google Tag Manager is working correctly?
View your page source and confirm the container ID appears in the head script and body noscript. Type google_tag_manager in the browser console to verify the container loaded. Then use GTM Preview mode to walk through your key pages and confirm that each tag fires with the correct trigger and parameters. If tags appear but send wrong data, the problem is inside the container configuration.
Not sure your tracking is actually trustworthy? Get in touch -- I will audit your setup and tell you exactly what is broken and what to fix first.