Install through Google Tag Manager

GTM needs a different snippet from every other platform. Pasting the plain <script src> tag into a Custom HTML tag does not work reliably — GTM does not consistently execute a <script src> element that carries data- attributes, so the script may load without its configuration or not load at all.

Use the version below, which builds the element in JavaScript.

The tag

1. In GTM, go to Tags → New.

2. Tag Configuration → Custom HTML.

3. Paste this, with your own site key and domain:

<script>
  (function () {
    var s = document.createElement('script');
    s.defer = true;
    s.setAttribute('data-website-id', 'ts_a1b2c3d4e5f6');
    s.setAttribute('data-domain', 'example.com');
    s.src = 'https://truestat.io/js/t.js';
    document.head.appendChild(s);
  })();
</script>

4. Triggering → All Pages.

5. Name the tag something you will recognise, then Save.

6. Submit and publish the container.

Your site's install page in the app renders this exact variant under the Google Tag Manager tab, with your key already substituted.

Trigger: All Pages, not Page View on one page

All Pages is what makes the tag fire everywhere. A trigger scoped to a URL pattern is how people end up tracking one section of their site.

If your site is a single-page app, note that GTM's "All Pages" trigger fires on the initial load only. That is fine — the TrueStat script handles subsequent route changes itself once it is loaded, so you do not need a History Change trigger. Adding one would fire the loader again and give you duplicate views.

Verify

1. Use GTM's Preview mode and load your site. The tag should show as fired.

2. Publish the container.

3. Load your live site and check the install page in the app.

If Preview shows the tag as fired but no event arrives, open DevTools → Network on your site and look for t.js and the POST to /api/events. A blocked t.js means an ad blocker; a missing POST with t.js present usually means a Content Security Policy without connect-src. See Verifying it works.

Worth knowing

GTM is itself commonly blocked. Ad blockers block googletagmanager.com at least as often as they block analytics hostnames, so installing through GTM means a visitor with a blocker loses the tag one step earlier. If you are installing through GTM specifically to be less blockable, it does the opposite — serving from your own domain is the thing that helps.

Do not install twice. If you also paste the plain tag into your site's head, every page view is recorded twice. See Duplicate events.

AI crawlers

Outside GTM's reach — it fires tags in a browser, and GPTBot and ClaudeBot never run one. No container setting changes that.

Where it happens instead depends on what your site runs on, not on GTM: a Next.js proxy, an Express middleware, a WordPress hook, a CDN worker. Server-side tracking has each.