URL: /cloud/third-party/tag-manager-on-sensitive-page

---
title: "Tag manager on a sensitive page: who can publish code to sign-in and checkout"
description: "A tag manager loads on a sign-in, checkout, wallet or account page, so anyone who can publish a tag can run code there."
---

<Note>**Cloud rule.** The `third-party/*` rules run in cloud audits only. They are not part of the local `squirrel audit`, and a cloud audit includes them once the scan is switched on for your organization's plan; an audit without the scan has no Third parties section and none of these rules appear. The scan never charges credits. It reads at most 8 pages per audit, so a finding is about those pages, not the whole site. See [Third-party rules](/cloud/third-party).</Note>

## What it is

A tag manager is a script that loads other scripts, configured in a dashboard rather than in your code. On a sensitive page that makes the dashboard part of the page's attack surface: anyone with publish rights, or anyone who takes over an account that has them, can run code on your sign-in or checkout without a deploy or a code review.

## What squirrel checks

For each sampled sensitive page (a page whose URL path says it is a sign-in, sign-up, checkout, cart, payment, billing, wallet or account page (see [how a sensitive page is decided](/cloud/third-party#how-a-sensitive-page-is-decided))), the rule looks for a vendor the catalogue tags as a tag manager.

- `tag-manager-on-sensitive-page` warns once per page and vendor. Message: `https://example.com/checkout (checkout page) loads the tag manager Example Tag Manager`.
- `tag-manager-on-sensitive-page` passes with `No tag manager loads on a sensitive page.` otherwise.

The rule cannot see what the manager publishes, so it flags that the door exists, not that anything bad came through it. Sensitivity comes from the URL path only, and only sampled pages are checked. The issue is rated high only when the same audit also found a vendor on a sensitive page that the catalogue rates as a concern (the rating is internal and never shown).

## How to fix it

Serve sign-in and checkout without the tag manager, or use a separate, locked-down container for those pages that carries only what they need. Limit who can publish, require review and two-factor authentication on the account, and keep an audit log of changes.

| | |
|---|---|
| **Rule** | `third-party/tag-manager-on-sensitive-page` |
| **Category** | [Third-party](/cloud/third-party), part of [Security](/rules/security) |
| **Scope** | Site (cloud audits only) |
| **Severity** | warning |
| **Weight** | 1/10 |

## Enable / disable

Cloud audits do not read `squirrel.toml`, so these rules cannot be switched off there. They run whenever the audit includes the third-party scan, and report as skipped when the scan could not run.