Site Google Tag Gateway

Serves a Google tag from the site's OWN domain — Google tag gateway / first-party mode — for a website hosted here. A reserved measurement path on the customer's domain is reverse-proxied at the edge to Google's gateway, so the tag and its requests are first-party: no third-party host, no third-party cookie, and ad blockers and browser tracking protection no longer cut the measurement.

WHY THIS TOOL EXISTS: Google's own setup offers two routes. One asks you to sign into Cloudflare from GTM and grant access to the zone — impossible on a hosted site, because the DNS zone lives in the Opus Growth Cloudflare account and handing a customer a role there would expose every other customer's zone. The other is a manual reverse proxy, which is what this does, at the edge, in seconds, with no access to share. action: 'status' (default) shows the current setup and runs Google's own health check; 'set' turns it on; 'remove' turns it off. tag_id is the Google tag or container id the gateway was created for (G-XXXXXXX, GT-XXXXXXX, AW-XXXXXXX, DC-XXXXXXX or GTM-XXXXXXX), shown in GTM > Admin > Google tag gateway. path is the measurement path, one segment, default /metrics; it MUST be a path the site does not already use, and the tool refuses if a real page answers there. After 'set' the tool verifies https://yourdomain<path>/healthy, which Google expects to read "ok", so you know it works before telling anyone. Then enter that same path in GTM. Requests are proxied with Host rewritten to the gateway, cookies and query strings passed through untouched, visitor country forwarded for geo, and caching off. confirm=false previews.