Skip to article
On this page

Custom HTML tags in GTM: what is actually in them

NyXi

NyXi

6 min read

A Custom HTML tag is hand written code pasted into Google Tag Manager. It can be a pixel with no official template, a vendor script, or something nobody remembers adding. How to find out which.

If Tag Explorer returned a card that says Custom HTML, it is telling you that somebody pasted code into your Google Tag Manager container by hand. There is no vendor name attached to it and no ID on the card, because a Custom HTML tag is a blank box rather than a product. Paste your page into Tag Explorer to see this tag on your own site.

That makes it the most interesting result in any scan. Every other card names something: an analytics platform, an advertising pixel, a chat widget. A Custom HTML tag only tells you that arbitrary code is running on your pages. What that code does is a separate question, and on a site you inherited it is a question worth answering.

What it actually does

Google Tag Manager ships with built in tag types for the common platforms, and a gallery of vendor built templates for a good many more. When a vendor has neither, or when somebody wants to do something bespoke, Tag Manager offers a tag type that is simply a text field. You paste HTML or JavaScript into it, choose a trigger, publish, and that code is injected into your page whenever the trigger fires.

So a Custom HTML tag can be:

  • An advertising pixel from a platform with no official template.
  • A vendor snippet copied out of a setup guide, often years ago.
  • A small piece of bespoke code: a form submission listener, a phone number swap, a scroll tracker.
  • Structured data injected for search engines.
  • A chat, review or booking widget.
  • Something nobody at the business recognises.

All six look identical in the container file. The tag type is the same; only the contents differ.

Why it has no ID

Most tags have a settings field for their tracking ID, which is why a scan can print G-AB12CD34EF or AW-123456789 as a card title. A Custom HTML tag has no such field. Anything that identifies an account is buried in the pasted code, in whatever shape the vendor chose.

That is why these cards often show the tag type as the title with no copy button beside it. It is also why reading the code matters: the account number, the vendor, and the behaviour are all in the same block of text, and nothing separates them for you.

The trust question

Code in a Custom HTML tag runs with the full privileges of your page. It can read the content on screen, observe what a visitor types into a form, rewrite links, set cookies, and fetch further code from a server you have never heard of. None of that is unusual behaviour for a legitimate tag, which is exactly the problem: legitimate and malicious look the same from the outside.

Two practical habits keep this manageable. First, prefer an official or gallery template whenever one exists for the same job, because templates run in a sandbox with declared permissions instead of unrestricted access. Second, when a snippet loads code from an external domain, know which domain and know why. Google’s own guidance on custom templates and the permissions they declare is a useful primer on the difference.

What this looks like in Tag Explorer

Tag Explorer draws your page as a tree. Each Tag Manager container is a branch, the tags inside it are leaves underneath, and anything hard coded into the page HTML sits under DIRECT ON PAGE.

Custom HTML tags do not simply get filed under Custom and left there. The scan reads the code inside each one and compares it against a catalogue of known vendor snippets, so a pasted Meta, TikTok or StackAdapt pixel is named as that vendor, coloured as an advertising card, and given its ID where the code contains one. In other words, a lot of what looks like a nameless tag in your container comes back with a name.

Where no match is found, the card shows the type as the title and no copy button, and the Details button becomes the useful part: it gives you the actual code, which you can read yourself or hand to a developer. Copying it out with Copy tree or Copy for AI is a fast way to get a second opinion on an unfamiliar snippet.

The info icon on each card opens a short definition with the Learn more link that brought you here. Below the tree, the insights panel raises softer advisories, including odd containers, split tracking and dead tags.

Two limits matter here more than on any other tag type. The public container file never includes the human names you gave your tags, so a scan can never tell you a tag was called “Old agency pixel, do not delete”. And the tool reads the published container only, so an unpublished change in a workspace will not appear. A scan also proves a tag is installed, not that it fired: Preview mode in Tag Manager and the browser network tab prove firing.

What to do if it is missing, duplicated or dead

Missing. There is no such thing as a missing Custom HTML tag in the abstract, because the type is not a product. What goes missing is the thing it was doing. If your form conversions stopped, or a widget vanished, or structured data disappeared from your search listings, check whether a Custom HTML tag was removed or whether its trigger changed.

Duplicated. Two Custom HTML tags containing the same pixel is a real and common fault, usually because one copy is in the container and another is in the page template from an earlier install. The result is double counted conversions. Keep the copy in Tag Manager, remove the hard coded one, and re-scan to confirm only one remains.

Dead or stale. This is where Custom HTML tags accumulate. A snippet pasted years ago keeps loading long after the contract ended, the vendor changed their install method, or the account was closed. Every dead snippet is another network request on every page load and another party with code running on your site. Read each one, confirm whether the business still uses that vendor, and remove what nobody can account for.

If you have inherited a site and a container full of tags nobody can explain, run the page through Tag Explorer and open the Details view on anything unnamed. Working out what is really running on a site, then removing what should not be, is the first stage of our rebuilds and rescues work.

Frequently asked questions

Is a Custom HTML tag dangerous?

It is not dangerous by nature, but it is unrestricted. Code in a Custom HTML tag runs with the same access as any script in your page, so it can read what is on screen, watch what visitors type, add content, or load further scripts from somewhere else. That is why anyone with publish rights on your container is effectively a developer on your site.

Why does my Custom HTML tag have no tracking ID?

Because there is no fixed place for one. A Custom HTML tag is a free text field, so any ID it contains sits inside the code rather than in a labelled setting. A scan can often read an ID out of the code, and where it cannot, the tag shows its type as the title and offers no copy button. That is normal.

Should I replace Custom HTML tags with official templates?

Where an official or gallery template exists for the same vendor, yes. Templates run in a sandbox with declared permissions, they show their settings as labelled fields, and they update when the vendor updates them. A pasted snippet does none of that and quietly goes stale.

I do not recognise a Custom HTML tag on a site I took over. What now?

Read it before you delete it. Open the Details view, copy the code and check which domain it loads from, because that usually names the vendor. If nobody at the business recognises the vendor and no contract mentions it, remove it and watch for anything that breaks.

More articles