Setting up Measurebase: the complete guide
Server-side tagging has a reputation for being complicated. With Measurebase it is about fifteen minutes of actual work, and this guide walks through all of it in order: account, domain, DNS record, tracking script, power-ups, the proof that it works, and the monitoring that keeps it working. Each step says what to do and what you should see.
Before you start
Have these three ready:
- Access to your DNS providerTo add one A record for your tagging subdomain
- A GTM web containerThe container your site loads, GTM-XXXXXXX
- A GTM server containerConnect Tag Manager or paste its config
1Create your account
Sign in with Google, or sign up with your email address and verify it with one click. There is no plan to pick and nothing to configure yet. On the Accounts screen, click Add account and name it; every new account starts on the Free plan.
Working for several clients? An Agency account manages multiple client accounts from one dashboard (Partner › Clients). You invite a client by email or by their GTM container ID, the client approves the link, and the agency never touches the client's own billing.
2Add your domain
Go to Domains › + New domain and fill in:
- Name: a label you will recognise, such as "Main website".
- Domain: your main domain, for example yoursite.com. A leading www. is stripped, and Measurebase checks that the domain is valid and has a DNS zone.
- Tagging subdomain: a prefix such as
mbase, giving mbase.yoursite.com. Avoidsst,sgtmand other words ad blockers recognise. - Server container: connect Google Tag Manager or paste the config (below).
- Region: Amsterdam, Netherlands (EU), fixed.
Connect Tag Manager or paste the config. Measurebase needs to know which server container to host. Connect Google Tag Manager: sign in with Google in the dialog, pick the account and the web and server containers, and Measurebase reads the server container config itself. Google grants read access to your containers plus edit access limited to Measurebase's own workspace, and the tracking audit can then inspect both containers (section 7). Paste the config: in GTM, Admin › Container settings › Manually provision tagging server, copy the config string. You can connect Tag Manager later from the domain's settings page, and disconnect it at any time.
Tracking setup and first audit. With Tag Manager connected, the dialog asks what this domain should measure and which e-commerce data layer your shop pushes (or none), and offers a first audit: it reads the live containers, crawls the site and checks routing, consent, duplicates and alignment. With a pasted config, the first audit runs tonight once DNS is in place.
Domain limits per plan: 1 on Free and Solo, 3 on Growth, 5 on Scale, 10 on Business, custom on Enterprise.
3Add the DNS record
The new domain's Settings page shows exactly one A record. Add it at your DNS provider with the Name and Value shown, then click Verify DNS now. Once DNS has propagated, usually within minutes, a certificate is issued automatically and the status changes from Pending to Active.
Check it yourself: open https://mbase.yoursite.com (your tagging subdomain) in a browser tab. If it loads without an error or certificate warning, DNS and the certificate are in place; otherwise wait a few minutes and try again.
More than one setup on a domain? Add the same main domain again with a different tagging subdomain. Each setup is independent and counts toward your plan's domain limit.
4Install the tracking script and remove the old one
Open the domain and click Generate script. Enter your web container ID (GTM-XXXXXXX). You get the Enhanced script: a masked loader path with a ?mb= parameter that ad blockers and privacy filters do not recognise. Enhanced Ad Blocker Protection is on by default for new domains and the Enhanced script carries it, so every follow-up request is masked too. A site on several subdomains keeps "All sites" for one snippet everywhere; generate a separate snippet under "For which site" only for a subdomain with its own web container or its own Same-Origin Tracking address.
You get two snippets, like regular Tag Manager: the head snippet as high as possible in <head>, the body snippet directly after the opening <body> tag.
Remove your old snippet
If standard Google Tag Manager was running before, remove its old pair completely: the <script> block in <head> and the <noscript><iframe> in <body>. Old and new side by side fire every tag twice and quietly double your numbers; it is the most common data problem you can give yourself.
googletagmanager.com/gtm.js?id=GTM-XXXXXXX<head>googletagmanager.com/ns.html?id=GTM-XXXXXXX<body>mbase.yoursite.com/AWqBDp0Nqj.js?mb=XXXXXXX<head>mbase.yoursite.com/AWqBDp0Nqj.html?mb=XXXXXXX<body>Someone else installing it? Use Send instruction email in the Generate script panel: they receive both snippets with the install and test steps.
Point the Google tag at your domain. In your web container, the Google tag's server_container_url must be your tagging subdomain. The web container guide shows where, and the audit checks it every night.
5Choose your power-ups
All power-ups live on the domain's Power-ups page. Each is optional and reversible; none is needed for basic tracking.
Adds visitor location, device, bot and AI signals as request headers, readable through GTM's Request Header variable
Master toggle plus 21 header toggles, all on by default
Re-issues recognised first-party marketing cookies with their full lifetime, past Safari's 7-day cap (on Safari together with Same-Origin Tracking)
Master toggle plus per-cookie toggles by vendor, all on by default
Recovers ad-platform click IDs that Safari and Brave strip from landing URLs, plus cookie-based recovery
Backup parameter names for Google and Microsoft, five toggles for Meta, TikTok, Pinterest, ChatGPT and LinkedIn
Masks every visitor IP before it reaches your server container (IPv4 last octet, IPv6 beyond /48)
One toggle
Keeps your office, agency and QA traffic out entirely
One toggle plus a list of IPs or ranges
Enhanced Ad Blocker Protection
Rewrites ongoing requests into the same masked format as the loader, so blocklists cannot fingerprint fixed paths such as GA4's /g/collect
On by default; its page shows whether masked requests arrive
Serves tagging from a path on your own site (example.com/mb), so Safari keeps cookies for their full lifetime and there is no separate hostname to block
One forwarding rule on your hosting or the WordPress and Shopware plugins, then a live check
Makes every hit read as fully consented, to verify tag firing without clicking through your own banner
One toggle; testing only
Adds each purchase's profit to the event, so Google Ads and Meta can bid on margin
Cost prices from a feed, a file or your shop; enabled per account on request
🚫 Auto Grant Consent is for testing only
Left on, the page warns ever more insistently and after 24 hours monitoring opens an alert. Turn it off as soon as you are done testing; it should never be on in production.
6The proof: your first hit
The install is done when all five of these are true:
- The domain's status is Active, not Pending (still Pending: DNS has not propagated, see Troubleshooting).
- You fired a real hit: open your site in a normal or incognito tab and click around, or send a test event from GTM preview mode.
- The request log shows a new row with a green 200. Nothing yet? Click Refresh on the logs page; it pulls the logs on demand.
- Your server container's preview mode shows the request arriving and your tags firing.
- With Enhanced Ad Blocker Protection on, its page says Working with the time of the last masked request. "Waiting for the first masked request" means your site does not load the Enhanced script yet.
All five? Your server-side tracking is live. The rest of this guide keeps it that way.
7The tracking audit
The audit runs every night for every active domain, nothing to switch on: more than 40 checks on routing, tag health, deduplication, Consent Mode, the alignment between web and server container, and the install itself (loader, DNS, HTTPS). With Tag Manager connected it also inspects your live containers and can propose fixes and place them in a separate "Measurebase" workspace in your container; it never publishes, you review and publish in GTM. Every audit includes a site crawl by a real browser that lists every script and pixel loading outside GTM; measurement hits are blocked inside that browser, so nothing reaches your reports.
Errors open an alert per domain, and warnings do so the first time they appear, through the channels in the next section. Need a fresh result after a change? Queue a manual audit from the dashboard, up to five per domain per day. All checks and how fixes work: the tracking audit.
8Alerts
No-data threshold: per domain, under Settings › Monitoring, "Alert me if no data for" between 1 and 168 hours (24 by default). Raise it for a quiet B2B site, lower it for a busy shop. New domains get a short settling-in period first.
Slack: up to three channels per account via Settings › Add to Slack, a normal OAuth flow. Every connected channel receives every alert; a domain alert names the domain, an account-wide alert (quota) names the account. Email goes to the account owner by default. More in how Measurebase monitors your domains.
9Infrastructure check: CDN, caching and CSP
Most sites need nothing here. Walk through it once if your site sits behind a CDN or sends a strict Content-Security-Policy.
- CDN in front of your site (Cloudflare, Fastly and the like): keep the tagging subdomain's record out of the proxy as a plain "DNS only" record so traffic reaches Measurebase directly. If it must go through the proxy, disable caching for exactly that hostname.
- Caching: the loader script may be cached briefly; the collect requests must always reach Measurebase live. A broad "cache everything under this path" rule must not catch your tagging traffic.
- Content-Security-Policy:
script-src,connect-srcandimg-srcmust allow your tagging subdomain. A wildcard such as*.yoursite.comusually covers it; a policy with exact hostnames silently blocks the loader until the subdomain is added.
🛟 The safety net
If one of these slips through after go-live, the monitoring catches it: that is what the no-data and error-rate alerts are for.
10Troubleshooting
| Symptom | Likely cause and fix |
|---|---|
| Numbers look doubled | The old GTM snippet still runs next to the new one. Remove it completely (section 4). |
| Attribution resets on Safari or iOS | Check Cookie Keeper is on for the vendor's cookie you care about; toggles are per cookie. On Safari, cookies from the tagging subdomain still last 7 days until you serve tagging from your own domain with Same-Origin Tracking. |
| Traffic vanishes, especially in Firefox, Safari or Brave | An ad blocker or privacy filter catches your requests. Make sure the site loads the Enhanced script and that Enhanced Ad Blocker Protection is on; its page shows whether masked requests arrive. |
| The request log shows many 400s | Read the Status badge, not only the code: a Pending badge on a GA4 or gtag request is marked "No data lost" and is a normal retry. Only Error rows mean a real failure. |
| A domain stays Pending | DNS has not propagated or does not match the record on the Settings page. Re-check Name and Value, wait a few minutes, click Verify DNS again. |
| An unfamiliar domain appears as a referer | The foreign traffic check at work: someone reused your snippet elsewhere. Track it down at the source. |
| Tracking stops and a banner says it is paused | You hit your plan's request quota for this cycle. Upgrade, wait for the next cycle, or turn on auto-upgrade under Billing. |
| Auto Grant Consent was left on | Turn it off under Power-ups. Past 24 hours, expect the alert Measurebase already opened about it. |