The Enhanced GTM loader script
Generate script gives you the Enhanced loader: a GTM snippet that loads your web container through your tagging subdomain from a masked path, instead of from googletagmanager.com.
How the Enhanced loader works
The Enhanced script uses a masked loader path unique to your domain, with your container ID passed as a ?mb= query parameter:
https://mbase.yoursite.com/AWqBDp0Nqj.js?mb=XXXXXXXNothing in that address says "gtm", so ad blockers and browser privacy filters have no fixed pattern to match. It replaces your old GTM snippet entirely: do not run both at the same time, or every tag fires twice.
Ad blocker protection, built in
Enhanced Ad Blocker Protection is on by default for new domains, and the Enhanced loader carries it itself, so there is no extra tag to install. It rewrites every request the container fires after the page loads into the same masked format, so ad blockers can't fingerprint them by their usual fixed paths. Requests are decoded back to normal before they reach your server container, so nothing changes on the receiving end. You can switch it off under Power-ups.
Server container setup
The loader needs a Google Tag Manager: Web Container client in your server container, with your web container ID listed under Allowed Container IDs. Without this client, the browser loads the script but events are not accepted.
The standard pattern, as a fallback
A domain that has no masked loader address yet gets the standard pattern instead, still served from your tagging subdomain:
https://mbase.yoursite.com/gtm.js?id=GTM-XXXXXXXGenerate script picks it automatically in that case. Once the domain has its loader address, generate the script again to move to the Enhanced loader.