Custom loader (ad-blocker bypass)
Run the whole tag stack - GTM, GA4, Meta, TikTok - through your own domain, so blocklists never see a vendor hostname.
Ad blockers match hostnames: googletagmanager.com, facebook.com,
analytics.tiktok.com are on every easylist. The custom loader moves the
entire tag stack onto your first-party tracking domain, so a blocker scanning
the network tab finds no third-party request to match.
How it works
Your first-party tracking domain (see First-party domain) already CNAMEs at the PixelFox ingest origin. The same host now also serves proxied vendor assets under short paths, and every vendor URL inside the served JavaScript is rewritten to your domain:
| Path on your domain | Serves | Upstream |
|---|---|---|
/sg.js?c=GTM-XXXX | GTM container loader | googletagmanager.com/gtm.js?id=GTM-XXXX |
/sx.js?c=G-XXXX | gtag loader | googletagmanager.com/gtag/js?id=G-XXXX |
/sp.js | Meta Pixel | connect.facebook.net/en_US/fbevents.js |
/tt.js | TikTok Pixel | analytics.tiktok.com/i18n/pixel/events.js |
/a/c | GA4 collect (pass-through) | google-analytics.com/g/collect |
/s/p | Meta pixel calls (pass-through) | facebook.com/tr |
/t/e | TikTok collect (pass-through) | analytics.tiktok.com/api/v2/pixel/collect |
Script bodies are cached (1h, shared across all sites on the origin); collect
calls are never cached. ?c= is the obfuscated form of ?id= — no GTM or
measurement id pattern appears in a URL a blocker can fingerprint.
Enable it
The opt-in is the first-party domain itself: /v1/config reports
custom_loader: true exactly when your site has one, and the SDK then sources
every vendor tag from your domain automatically. No code change.
Prefer explicit control? Any of these work:
<!-- script attribute -->
<script src="https://t.yourstore.com/signals.min.js"
data-signals-key="sig_live_…"
data-signals-custom-loader="true" defer></script>// manual init
signals.init({ apiKey: "sig_live_…", customLoader: true });WordPress: Settings → PixelFox → Custom loader (with an online-mode site and your first-party domain set as the Ingest host in Advanced).
What still needs the vendor domains
Consent Mode v2 and Google's own consent checks read from first-party storage, not vendor domains — they keep working. Two known limits, inherent to static rewriting of minified vendor bundles:
- A few GTM data endpoints (
/static/service_worker, preview/debug URLs) are constructed by string concatenation and cannot be rewritten reliably. They 404 first-party, which degrades nothing a blocker would not have blocked anyway. - GTM Preview/Debug mode is not proxied — use it against the real container URL, then switch the transport back.
Verification
Open your storefront with an ad blocker active (uBlock Origin, AdGuard) and
watch the network tab: every tag request should go to
t.yourstore.com/sg.js, t.yourstore.com/sp.js, etc. — zero requests to
googletagmanager.com, facebook.com or tiktok.com. Conversions still
arrive in your dashboard and at your destinations with the same event_id
deduplication as always; only the transport moved.