Does Installing Google Tag Manager Compromise Server Security?
-
Greetings MOZ community!!!
Both my hosting company and developer have told me that in order to install Google Tag Manager it is necessary to disable the rule securing against malicious i-frame attacks in Mod Security and that this would leave the site (we operate on a virtual private server and out hosting company is InMotion Hosting) extremely vulnerable to attack.
I can't believe that Google would write code that could allow potential security issues? Is this true?
Does anyone know of a way to install GTM while maintaining site security?
What functionality will we lose if we choose to stick with the old version of Google Analytics rather than upgrade?
Thanks everyone!!!
Alan -
And to be clear - you CAN run the newer Universal version of Google Analytics without needing to use Tag Manager. There are some management advantages to running Analytics from within Tag Manager, especially if you are managing a large number of other tracking tools in it as well, but it is not required in order to run Universal.
If you want a terrific Analytics plugin for WordPress that handles Universal really well, have a look at Google Analyticator. It also allows easy implementation of event tracking, and you can even customise the snippet manually for additional capabilities if you wish. (I always add config to track pagespeed for 100% of pageviews, for example).
Hope that helps?
Paul
-
No it won't unless your GTM account compromised.
-
Alan,
i would have to say they don't know what they are talking about. Mod_sec is in a sense like an ip black list, if no one ever changes it, it is pretty ineffective in terms of security. I would imagine that inmotion is running a configuration that they have been running for 5 years with no updates. Mod_sec is an old module that there really was a time when it was more useful, but apache has been updated and php to be pretty secure by itself.
On another note, I develop pretty much exclusively in Prestashop and Prestashop is a partner with inmotion hosting. Inside Prestashop is a method to disable mod_sec that runs on inmotion's servers. They don't seem to have an issue with that. Here is a screenshot of it, http://screencast.com/t/gDqO9a8axf
I would think you can safely disable it, but at the same time I would still install a wordpress security plugin just to keep wordpress safe, it has a lot of security holes.
-
Thanks your response Lesley!!
Not worried about my password being hacked by very concerned about disabling Mod Security as both my developer and the hosting company have told me that could cause major security risks.
At the same time I have have not seen any documentation about sites running GTM ever getting hacked. Our site runs on Wordpress in a virtual server environment. Are you saying that disabling Mod Security in this environment is not going to increase risks of getting hacked in a major way? It is really strange as tech support at InMotion Hosting strongly advised against disabling Mod Security. At the same time I would like the more advanced features available with GTM.
Thoughts??
Thanks, Alan
-
There is an inherit risk with everything you do. Putting a webpage up itself can put you at risk for being hacked. But as for GTM, the risk is very low, but the burden is all on your shoulders. If someone gains access to your GTM they can execute malicious code on your site, yes. But the only way they are going to gain access to the account is because of bad security practices for who ever has or sets the passwords. If you use a weak password, someone might can guess it. Or if you use open publicly accessible networks, someone can grab it that way. I would suggest turning two factor identification on in your Gmail account and following good password practices. Don't use the same password for any other service, make a strong password, don't email the password to other people, things like that.
As for mod_sec, it is more of a problem for most cases than it is good for any more, in my opinion. A lot of web applications need it totally disabled to run correctly, or major parts of it. Also if no one is actively monitoring it and adding to it, it is pretty much useless.
Here is a great comic on setting your password to a strong one. http://xkcd.com/936/
Got a burning SEO question?
Subscribe to Moz Pro to gain full access to Q&A, answer questions, and ask your own.
Browse Questions
Explore more categories
-
Moz Tools
Chat with the community about the Moz tools.
-
SEO Tactics
Discuss the SEO process with fellow marketers
-
Community
Discuss industry events, jobs, and news!
-
Digital Marketing
Chat about tactics outside of SEO
-
Research & Trends
Dive into research and trends in the search industry.
-
Support
Connect on product support and feature requests.
Related Questions
-
Unsolved Google Analytics (GA4) recommendations for SEO analysis?
Guides on Moz and elsewhere mostly refer to Google Analytics' Universal Analytics (UA). However, UA is being replaced with GA4, and the interface, options, and reporting are very different. Can you recommend a clear, thorough, and effective walkthrough of how to set up useful SEO reports in GA4? Is there a simple tool you recommend that will help connect historical data from UA to GA4 when GA4 is the only option available? If there's no simple tool, what values do you recommend retaining from UA for effective historical reporting? How would you use them? At minimum for reporting, I'd want to show month-to-month changes and year-to-year changes (in percentages and in real numbers) for the following: all site visits all organic visits organic visits as a percentage of all site visits organic visits that led to a specific goal completion organic visits that led to any goal completion Thanks in advance for your help!
Reporting & Analytics | | Kevin_P1 -
Goal Totals in Google Analytics
How do I get a cumulative tally of all the goals reached in google analytics? I've been using the percentages currently, but I was wondering if there was an easier way. Thanks
Reporting & Analytics | | OOMDODigital0 -
If I install google Analytics, that can affect my SEO.?
I purchased a site that has a lot of Backlinks and when I started to make changes like installing google analytics! i suspect the performance in search engine was getting worst because of that, so I removed.
Reporting & Analytics | | pparma
Now I'm trying MOZ and needs GA, should I install it again??
Maybe it analyces the backlinks and tells google, I don't know, is that possible?0 -
500 errors and impact on google rankings
Since the launch of our newly designed website about 6 months ago, we are experiencing a high number of 500 server errors (>2000). Attempts to resolve these errors have been unsuccessful to date. We have just started to notice a consistent and sustained drop in rankings despite our hard sought efforts to correct. Two questions... can very high levels of 500 errors adversely effect our google rankings? And, if this is the case, what type of specialist (what are they called) has expertise to investigate and fix this issue. I should also mention that the sitemap also goes down on a regular basis, which some have stated is due to the size of the site (>500 pages). Don't know if they're part of the same problem? Thanks.
Reporting & Analytics | | ahw0 -
Analytics tagging parameters effect on site SEO
One of the effective tools used in analytics tagging is the use of analytics parameters that starts with '?' or '#'. Example on site tagging: Main link: www.domainname.com./category/sub-category/ www.domainname.com./category/sub-category/?lid=topnav www.domainname.com./category/sub-category/?lid=sidenav All three links link to the same landing page, with an extra parameter. Using email or campaign tagging: www.domainname.com./category/sub-category/ www.domainname.com./category/sub-category/?utm_source=launch&utm_medium=email&utm_term=html&utm_content=getscoop&utm_campaign=hwdyrwm2012 With that we create many tagged links based on the campaign internal strategy. How do these effect indexing, and link juice? How do thy effect SEO in general?
Reporting & Analytics | | RAPPLA0 -
Conflicting Analytics: Getclicky vs. Google Analytics
Removal of an old getclicky code (and installation of new tracking code) from my site after some changes resolved inaccuracies in my page view/bounce rate information. Prior to adding the correct getclicky code, getclicky was showing 95% plus bounce rate on my site. I knew this was wrong because GA showed around 40%. Ironically, now that my getclicky account is working (showing a 30% bounce rate), GA bounce rate is steadily climbing. Is it best to just stick with one analytics account so that the codes don't conflict? Is it possible to have two accurate analytics accounts at the same time?
Reporting & Analytics | | JSOC0 -
Ideas Why Our Google News Traffic Disappearing?
The traffic to our major market newspaper website from Google News has dropped nearly 100% in the past ten days. Any ideas why might be happening?
Reporting & Analytics | | wlis990 -
Google Webmaster Backlinks
How can I view/download all my backlinks in google webmaster ? Currently when I try to download or view it shows only "Top 14 domains linking to" information and not ALL the links.. Any thoughts?
Reporting & Analytics | | krishru0