Is Google Tag Manager Safe on Payment Pages?

Transcript

Google Tag Manager is secure as a platform. The risk on a payment page is who can publish to it, because anyone who can publish a container can run code on your checkout. Script Monitoring is one tag, first in the head, that records every script your container actually loads, in every session. A tag manager exists to inject JavaScript without a deploy. That's the product working as designed. So publish access is the ability to ship code to your checkout, with none of the review a real deploy gets. It's abused two ways: a phished account with publish rights, or an over-permissioned agency or insider account. Either way the script loads from the tag manager's own domain, which is on every allowlist and in every CSP. And what gets published is rarely one script. A tag loads a vendor script, which loads its own dependencies, which can load more. The container shows the first link. The browser runs all of it. So the container is a list of intentions, not a record of what ran. Monitor the page itself. And for 6.4.3, everything your container loads belongs in the inventory. Harden it. Enforce MFA on every account. Keep publish rights to a short list of named people. Require a second person to approve a publish. Audit accounts quarterly. Separate the checkout container. And restrict Custom HTML tags. The safest position is no container on the checkout. If that's not workable, use a separate payment-page container, with a short publish list and an approval step. Agencies keep publish rights long after an engagement ends, so check. An attacker doesn't need your container. A different one, loaded as a sub-request, still reads as Google. On Pro, the GTM container allowlist approves the containers your site may load, and blocks any other before it runs. Script Monitoring is free for 1,000 page views a month, with 6.4.3 & 11.6.1 included. Pro, with the GTM container allowlist, starts at $99 a month. Start for free at scriptmonitoring.com.