Skip to content
Tracking SOP

Server-Side GTM (Stape) Setup

From a blank account — GTM server container, Stape, Own CDN, DNS, Cloudflare Rules, and the loader-URL swap.

Step 1 — Create the Server container in GTM

  1. 1.tagmanager.google.com → Admin → Create Container.
  2. 2.Target platform: Server (not Web).
  3. 3.Name it clearly (e.g., yourdomain.com - Server).
  4. 4.Inside it → Admin → Container Settings → copy the Container Configuration string shown.

Step 2 — Create the Stape account and container

  1. 1.stape.io/sign-up — use the same Google account as GTM admin access.
  2. 2.Dashboard → Create container.
  3. 3.Server location: select "Regional only," not "Global multi-zone" — Global requires a paid Business-tier plan and will silently block free-tier creation. Pick the specific region closest to the target audience.
  4. 4.Paste the Container Configuration string from Step 1.

Step 3 — Add the custom domain, with Own CDN

  1. 1.In the container → Add custom domain.
  2. 2.Subdomain name: avoid words like "gtm," "tracking," "ad," or "analytics" — these get pattern-matched by ad blockers (data is a safe, proven choice).
  3. 3.CDN option: toggle "Add CDN" ON, then select "Own CDN" (not "Stape Global CDN," not leaving it off). Own CDN is what makes the sGTM subdomain share the same IP as the main website — what actually extends first-party cookie lifespan past Safari/Firefox’s ITP truncation.
  4. 4.Connection method: manual DNS, not the one-click Entri auto-connect.
  5. 5.Leave "Use A records instead of CNAME" toggled off (keep default CNAME) unless the specific DNS provider restricts duplicate CNAME records.

Step 4 — Add the DNS record (the proxy-status gotcha)

  1. 1.Add the exact CNAME record Stape displays, in Cloudflare DNS.
  2. 2.Critical, easy to get backwards: proxy status must be ON (orange cloud) for this specific record — the opposite of what "keep proxy off" would suggest for most other DNS verification records. Own CDN’s entire mechanism depends on Cloudflare actively proxying this subdomain.

Step 5 — Three Cloudflare Rules required for Own CDN (Custom filter expression, hostname contains the sGTM subdomain)

  1. 1.Configuration Rule → SSL/TLS section → set to Full.
  2. 2.Request Header Transform Rule → Modify request headers → Set static → Header name X-From-Cdn, Value cf-stape (Stape’s own setup wizard labels this "Add static Request Header" — easy to not realize it’s a Cloudflare Rule, not something configured inside Stape itself).
  3. 3.Cache Rule → Cache eligibility → Bypass cache (tracking requests must never be cached).
  4. 4.(Optional, SEO hygiene) Response Header Transform Rule → Set static → Header name X-Robots-Tag, Value noindex, nofollow.

Step 6 — Wait for verification

  1. 1.Domain status will show "Verifying" or "Pending" immediately — expected, not a failure. Typically resolves within a few hours, occasionally up to 72. Don’t chase an instant status change.

Step 7 — Connect the Server container to the verified domain

  1. 1.GTM (Server container) → Admin → Container Settings → Server container URLs → Add URL → enter https://your-subdomain.yourdomain.com (no trailing slash).

Step 8 — Connect the Web container (two separate pieces, easy to do only half)

  1. 1.Transport URL: a server_container_url Configuration Parameter on the GA4 - Configuration tag — tells your tags where to send their data.
  2. 2.Loader URL (separate, actual site-code change): tells the page itself where to load the GTM container script from. Edit the base GTM snippet in the site’s layout — both the <script> loader (j.src=) and the <noscript> fallback (<iframe src=) — changing www.googletagmanager.com to the server-side subdomain in both places. Requires corresponding CSP updates (script-src, connect-src, frame-src).
  3. 3.Skipping the loader swap means tags still correctly route data server-side, but the base script itself remains easily identifiable/blockable by ad blockers — the loader swap is what actually makes the setup ad-blocker-resistant, not just server-routed.

Server-Side GTM Hosting — Stape Plan Gotcha

  1. 1.When creating a container, the server location selector defaults to (or offers) "Global multi-zone" — requires a paid Business-tier subscription, silently blocks free-tier creation with a vague error if selected. Select "Regional only" and pick the specific region closest to the target audience.