Setting Up Google Tag Gateway on Cloudways Without CloudFlare OAuth

Custom WordPress development

Sometimes it’s not all about web development and web design, there are times we have to look at other specialisms that fall within our industry of custom web development and support, like looking into Setting Up Google Tag Gateway on Cloudways Without Cloudflare OAuth.

There is a great feature on Cloudways, the home of WordPress specific server setups, that allows an extended caching and firewall setup along with a number of other beneficial features that this post is not based around so for now, I will move on. We did happen to notice one small issue on a Google Product that is not used often, at least not that I have seen in my time at Wibble, where the default setup flow in Google Tag Gateway pushes you toward a “Sign in to Cloudflare” button, but since Cloudways manages the Cloudflare account on your behalf, you don’t have the access needed to complete that OAuth flow.

Here’s how we worked around it using a simple Nginx proxy.

The Problem: Setting Up Google Tag Gateway

Google Tag Gateway is designed to route GTM scripts and conversion data through your own first-party domain rather than googletagmanager.com.

So the standard url is:

www.googletagmanager.com/gtag/

and the Google Tag Gateway relies on:

www.example.com/gtag/

This helps bypass ad blockers, Safari’s Intelligent Tracking Prevention (ITP), and other browser privacy restrictions that block third-party tracking.

The standard setup requires either:

• Signing into Cloudflare via OAuth inside GTM, or
• Cloudflare Enterprise with manual rule creation

On Cloudways, neither of these are straightforward. Cloudways manages the Cloudflare account centrally, meaning you don’t have direct access to create Origin Rules or Transform Rules — and the OAuth login won’t work because the account isn’t yours to authenticate with.

The Solution: Nginx Proxy

While Cloudways allows for SSH access, this setup is restricted, but you can reach out to your Cloudways account manager or support team and they can apply the this upcoming rule on your behalf. This will allow Nginx to proxy GTM requests through your own domain, achieving exactly the same result as the Cloudflare setup, just at the server level instead of the network edge.

The Nginx Config

Add the following to your site’s Nginx configuration:

location /gtm/ {
    proxy_pass https://gtm-npsl4pq.fps.goog/gtm/;
    proxy_set_header Host gtm-npsl4pq.fps.goog;
    proxy_pass_request_headers on;
    proxy_ssl_server_name on;
}

Replace gtm-npsl4pq with your own Gateway ID (found in GTM → Admin → Google Tag Gateway).

Update the GTM Snippet

Once the proxy is in place, update the GTM snippet in your theme to point to your own domain instead of Google’s. Change the j.src line in both the <head> and <body> tags:

Head snippet:

<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'/gtm/?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-XXXXXXX');</script>
<!-- End Google Tag Manager -->

Body noscript tag:

<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="/ns.html?id=GTM-XXXXXXX"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) -->

Using a relative URL (/gtm/) rather than hardcoding the full domain keeps things clean and portable.

Watch Out for Breeze Cache

If the site uses the WordPress Breeze plugin (Cloudways’ own caching tool), be aware that Breeze can intercept and locally cache the GTM script — serving it from /wp-content/uploads/breeze/google/ instead of routing through your proxy. This will mask whether the Gateway is actually working.

Temporarily deactivate Breeze when testing, and consider excluding the /gtm/ path from Breeze’s caching rules permanently.

How to Verify It’s Working

1. Health Check URLs

Visit these URLs directly, both should return ok:

• https://example.com/gtm/healthy
• https://example.com/gtm/?validate_geo=healthy

2. Network Tab

Open DevTools → Network tab → filter by gtm. The GTM script request should show:

https://example.com/gtm/?id=GTM-XXXXXXX

Not googletagmanager.com/gtag/.

3. Collect Requests

Filter the Network tab by “collect” and submit a form on the site (if you have a form set to collect). The collect requests should show your own domain:

https://example.com/gtm/gs/ccm/collect?...

A common misconception is that these collect requests are browser-only and that the data isn’t actually reaching Google. The 200 or 204 status codes tell a different story. These are responses from the Google Tag Gateway itself confirming successful receipt of the data. After that, it’s just a case of allowing time for the data to appear in your reporting.

Conclusion

The NGINX Proxy a straightforward workaround that gets the job done without needing Cloudflare dashboard access. Useful for any Cloudways setup where the Cloudflare account is managed centrally and direct access isn’t available.

Here at Wibble, our support and development teams work together to help businesses maintain websites that are reliable, scalable, and built for long-term growth. If you’re considering updates or improvements to your site, get in touch with the team to discuss the best approach for your website.