First CH Apps / Third-Party Tag Inventory
Enter your site's URL to list the analytics, advertising and social-embed tags written in its HTML, grouped by company.
Enter your own site's URL and we list the analytics, advertising and social-embed tags written in that page's HTML, grouped by company. Tags for services that have been shut down (Universal Analytics and others) are flagged as clean-up candidates, and external hosts that are not in our table are shown separately. Use it when you inherit a site, review your privacy notice, or need a sheet for asking your web agency what each tag is for.
Start with the top page. Some tags live only on the contact form or the order-complete page, so checking your main pages one by one catches more.
See a sample result (fictional site)We only count tags written in the HTML. We do not check whether data is actually sent (we do not open the page in a browser and watch the traffic).
Tags inside a tag manager (GTM and others) are invisible. If GTM is found, review its contents in GTM. Tags injected after JavaScript runs are invisible too.
Not finding a tag does not mean nothing is sent. We read only the one page you entered. Some tags sit only on form or order-complete pages.
We do not judge compliance with any law (including Japan's external transmission rules) and we do not write your privacy notice. This list is raw material for reviewing it and for asking your web agency.
Companies are counted only for services in our table (Google Analytics and a YouTube embed count as one company). Hosts not in the table are kept out of that number and listed separately.
"Typical purpose" is the general description from the provider's documentation. What your site actually uses it for is a question for whoever added it.
18 services whose role and installation we confirmed in the provider's official documentation (checked 2026-10-29). Anything else appears under "hosts not in our table".
| Service | Company | Type | Status | Source |
|---|---|---|---|---|
| Universal Analytics (UA) | Analytics | Ended 2023-07-01 | support.google.com | |
| Google Optimize | Analytics | Ended 2023-09-30 | support.google.com | |
| Google Analytics 4 (GA4) | Analytics | Active | support.google.com | |
| Google Ads (conversion tracking & remarketing) | Advertising | Active | support.google.com | |
| Google tag (gtag.js, GT- ID) | Tag manager | Active | support.google.com | |
| Google Tag Manager (GTM) | Tag manager | Active | support.google.com | |
| Google AdSense | Advertising | Active | support.google.com | |
| YouTube embed | Social, video & map embed | Active | developers.google.com | |
| Google Maps embed | Social, video & map embed | Active | developers.google.com | |
| Meta Pixel | Meta | Advertising | Active | developers.facebook.com |
| Facebook embed (Page Plugin & SDK) | Meta | Social, video & map embed | Active | developers.facebook.com |
| Instagram post embed | Meta | Social, video & map embed | Active | developers.facebook.com |
| Microsoft Clarity | Microsoft | Analytics | Active | learn.microsoft.com |
| Microsoft Advertising UET tag | Microsoft | Advertising | Active | learn.microsoft.com |
| LinkedIn Insight Tag | Advertising | Active | www.linkedin.com | |
| LINE Tag (LINE Ads) | LY Corporation | Advertising | Active | www.lycbiz.com |
| X Pixel (formerly Twitter conversion tracking) | X | Advertising | Active | business.x.com |
| X post & timeline embed | X | Social, video & map embed | Active | docs.x.com |
Four places are read: script src, img src, iframe src (including lazy-load data-src) and the body of scripts without a src (installation snippets).
External means a different registered domain. www.example.co.jp and cdn.example.co.jp are the same site and are not counted.
Google's tag (gtag.js) is split by the ID prefix: G- is Analytics 4, AW- is Google Ads, UA- is Universal Analytics and GT- is the Google tag.
A service name in the page text is never counted, and non-executing scripts such as JSON-LD are skipped.
Only the first 512KB of HTML is read.
Sent: only the URL you enter. Our server (Cloudflare Workers) makes two DNS lookups (A and AAAA) to check the destination is safe, then fetches the page once with a public GET. Redirects get the same check at every hop (up to 5). We never request any tag or host found inside the page.
Stored: nothing. The URL, the HTML and the result are never written to a database (no KV, no D1) and leave memory when the request ends. The CSV is generated on the spot and returned.
Returned: service names, where each was found, the matched text (up to 90 characters each) and the names of hosts not in our table. The fetched page itself is never returned, so this page cannot be used to browse other sites.
Cookies: none are sent, and cookies in the response are not read.
Note: URLs pointing at internal networks, localhost or private IPs are rejected.
POST /gaibu-soushinsaki/api/inventory with JSON ({"url": "https://example.com/"}) or a form body to get the same result and the CSV back as JSON.
