container audit

GTM-KSPCPF

This container can hand execution to 27 third parties — more than 99% of the 46,522 containers we have measured. Each serves code it controls, which can change at any time.

3 custom HTML tags carrying 5 KB of JavaScript. This runs on every page the container loads on.

Tags23

Custom scripts3

Third parties27

Delivered406 KB

Versions127

What we observed

A real browser loaded chsinc.com 2 months ago and recorded every request it made. This is what happened, as distinct from what the container is configured to do. It is one page load — anything that fires only deeper in the site did not fire here.

Container loaded from googletagmanager.com — Google

Measurement sent to google-analytics.com — Google

Consent OneTrust answered its own API. Nothing measured until it was granted — no analytics or advertising hit left the page beforehand, and 3 fired afterwards. That is the outcome consent is meant to produce. 10 hosts appeared only after consent was granted. Google recorded gcs=G111 (all granted).

Third parties contacted 18 hosts — mc-c0840b6c-72fb-47b1-b4d8-bfc9-afd-ep-ddfyd7g7chd5a8ht.a02.azurefd.net, cdn.cookielaw.org, embedr.flickr.com, geolocation.onetrust.com, widgets.flickr.com, www.googletagmanager.com, privacyportal.onetrust.com, s.yimg.com, and 10 more

dataLayer events seen gtm.js, OneTrustLoaded, OptanonLoaded, gtm.dom, gtm.load

Where the data goes

Not observed — on the page we loaded, measurement went to Google and nowhere else. observed on chsinc.com More info »

Findings

Ordered by consequence. review has a concrete cost when it bites; info is real but depends on your setup. Seen is how common it is across the containers we have measured — reported separately on purpose, because common and harmless are different claims.

reviewHardcoded http:// URL (1)

1 piece of custom code reference a plain http:// address.

WhyOn an https:// page the browser blocks or upgrades these. Blocked means the tag quietly stops working; upgraded only works if that host also serves https.

CheckCheck whether the hosts below still respond over https, and update the URLs.

Seenseen in 12.8% of 46,522 containers measured

infoConsent configuration detected (1)

The container declares one or more consent signals.

WhyConsent handling is present in the container. This describes what the artifact declares; what actually happened on the page is measured separately, above.

CheckConfirm these settings match the consent policy you intend to enforce, and compare them with the before-and-after observation.

Seenseen in 44.6% of 46,522 containers measured

Third parties it can reach

Each host is a party that can execute code or receive data in a visitor's browser. Follow one to see who else loads it. More info »

Detected on

Sites observed loading this container. A container used across many hosts is a shared template; one on a single host is a bespoke build. Follow a site to see every container it loads.

chsinc.com

What this audit describes

Containers change. These findings describe one specific artifact, and you can re-fetch it to check this reading.

Container	`GTM-KSPCPF`
Published version	`127` — the identity of this configuration. It changes only when someone publishes.
Read at	2026-08-23 17:40:42 UTC (2 months ago)
Source	`https://www.googletagmanager.com/gtm.js?id=GTM-KSPCPF`
Body checksum	`1b97003bd3655ebe9a8e2a68c9b57377d8c580d954b20bdd331b7639921c667e` Evidence of the exact bytes we read, not an identity: Google varies the response per request, so re-fetching an unchanged container yields a different checksum. Compare the published version instead.

Re-audit

This reading is from 2 months ago. A container can be republished at any time, and nothing here updates on its own — a fresh read is the only way to know whether it still says this. Running it again replaces this page in place, so the link keeps working.

Re-audit GTM-KSPCPF

Check another container

Put this container under version control. Tagora exports it to a repository you own, so every change arrives as a pull request. How it works »