From the Outside is a series where we take a real business website, evaluate what can be inspected from outside, and say what we found.

How we looked. Two of our own free tools plus a manual read, in a single ordinary visit. The Tracking Health Check reports which analytics and advertising tags a page references; the AI Answer Visibility Check reads the homepage and robots.txt the way an AI system would. Then we read by hand how the site asks for the job. Everything below came from files any visitor’s browser already downloads: no access, no credentials, no contact with the business, and nothing a normal page view wouldn’t do.

About the subject. A real, long-established heating, cooling, and plumbing company in a Midwest metro. It isn’t a client, and we’ve anonymized everything that could identify them: no name, no address, no screenshots, and numbers stated in ranges. Every finding below is a system problem, and most of them arrived through a vendor or a platform setting rather than through a decision anyone made.

That last sentence is the reason the series exists. We keep asking a narrow question of each site: was this a decision, or is it just what happened? We share our thoughts throughout and how you can check your site today.

Three tag manager containers are running at once

The tracking check found three separate Google Tag Manager container IDs referenced on the homepage. A container is the box that holds your tracking tags, and there’s usually only one per site because it’s meant to streamline your code and lighten your management load.

Three containers is valid. Google has supported multiple containers on a page since 2015, and there are real reasons to run them, mostly depending on permissions. If two teams need to publish tags without being able to edit each other’s, separate containers are one way to do that. Google’s own guidance is to use a single container where you can, but “where you can” concedes that sometimes you can’t.

So the finding isn’t that three is invalid. It’s that three is only correct when someone chose it, and this shape suggests otherwise. In our experience, the pattern is historical: an agency sets one up, the relationship ends, a new agency adds theirs and leaves the old one in place, and somewhere in between another vendor might add a third one for a campaign. Everything stays because removing something you didn’t install feels risky, or no one really knows who needs what still.

Four things follow from that issue.

Double counting, which is the least likely of the four

It happens only when the same analytics tag or conversion sits in more than one live container. Then every visit and every form submission gets recorded more than once, since Google Analytics deduplicates none of it: send two page views, get two page views. Worth knowing, and worth ruling out first.

More often, containers installed by different vendors carry different tags pointing at different destinations, so nothing doubles. What you get instead is several partial views of the same business, each correct on its own terms, but all creating slightly different pictures. That’s harder to notice than an inflated number, since nothing looks wrong until two reports disagree.

Access, and a choice worth making on purpose

Three containers means at least two accounts somebody else controls, holding rules that fire on this website today. That isn’t automatically a problem, and it isn’t a security hole. Plenty of businesses give a marketing vendor their own container precisely so they don’t have to hand over admin access to everything else, which can be a sound arrangement when someone picks it. But auditing a container requires logging into it, so whoever holds those accounts is the only person who can say what’s inside. If one of them is a firm the company stopped working with years ago, that arrangement has outlived the reason for it.

Every container shares one data layer

This one shows up only when somebody tries to fix the others. All containers on a page share one data layer, which is the small pocket of information the page hands to its tags. Google is explicit that a single shared data layer is the supported arrangement, and the practical result is that values pushed for one container are visible to all of them. Tags in a forgotten container can fire on data meant for the current one. That’s why untangling this takes a careful afternoon rather than three deletions.

Weight, which costs you either way

This one lands no matter how well the containers are configured. Each one is a separate script the browser fetches, parses, and runs, and each carries whatever tags have accumulated inside it. Three containers on a page where one would do is measurable load on every visit, paid by a customer waiting for the page to load. Where a business genuinely needs several destinations, the sound arrangement is a single container feeding them all.

Our tool can’t tell you which containers load, but Tag Assistant can

Our tool reads the served page and its scripts without running them, so it can tell you three container IDs are referenced and not which of them load. Some setups reference several containers and only activate one.

That part you can settle yourself, free and without owning anything. Google’s Tag Assistant connects to any public address and shows which containers load and which tags fire as you move through the site.

What it won’t show you is the inside of each container: the tags that exist but stayed quiet on the page you tested, the triggers and variables deciding when they fire, and the account holding all of it. That’s private workspace detail and needs a login.

Which is the finding restated, and the reason it matters. The problem here was never the number three. It’s that answering “what is this container actually doing” requires access nobody in the building currently has.

The AI crawler block came from the hosting layer, not the business

The AI Answer Visibility Check reported that the site disallows GPTBot, ClaudeBot, and Google-Extended, the crawlers behind ChatGPT, Claude, and Google’s AI answers, across the whole site. It’s the same check you can run on your own site in about a minute.

Our first thought was that somebody had decided this, which would have been legitimate. Then we ran the same check against an unrelated business in a different industry and got a byte-identical block list: the same eight AI crawlers, in the same order.

Amazonbot, Applebot-Extended, Bytespider, CCBot,
ClaudeBot, Google-Extended, GPTBot, meta-externalagent

Read that list again and notice it’s alphabetical. People don’t often alphabetize a blocklist. Software does.

Both sites sit behind Cloudflare, which can serve a managed robots.txt in place of the one on your server. Somebody switched that on here: it’s opt-in for existing domains, so a person enabled it. From September 15, 2026, it becomes the default for new domains, which Cloudflare announced in its post on AI crawler options. Today it’s a setting somebody chose, but in six weeks, it’s what arrives with the box.

Either way, the site is currently excluded from a growing way customers find contractors, and no one in the building knows it happened. The company may well conclude it wants the block, and plenty of businesses reasonably do. We wrote up the mechanism, and what it means for everyone else, in a separate post on managed robots.txt.

This finding changed our own tool. It used to say “if you meant to do that, nothing to fix,” which is true and useless to someone who never made the decision. It now recognizes the managed-file signature and says the block appears to come from the hosting layer.

Analytics and an advertising tag are both live, and the page sets no consent signal. Google publishes Consent Mode for exactly this, and its tags read those signals when they’re present.

Whether it matters depends on where the customers are and which rules apply, and we’re not lawyers. What we can say is factual: tracking currently runs for every visitor regardless of what any of them would have chosen. Sorting that out costs far less before it matters than after.

Fix the measurement first, and here’s the order

Not the website. Not the rankings. The containers, in week one.

The reasoning is boring and right: every other decision on this list depends on numbers, and the numbers are currently untrustworthy. Choosing where to spend, judging whether last quarter worked, deciding whether the ads pay, all of it sits downstream of measurement that needs to be audited. Fixing tracking isn’t exciting, but the results are, and doing anything else first means deciding on figures inflated by an unknown amount. Streamlining these containers can also improve page performance, improving the site’s SEO competitiveness and UX.

In order:

  1. Find out who owns the three containers, and get owner-level access to each or the right information to make updates. Some of this means an awkward email to a former vendor. Send it anyway because the alternative is permanent.
  2. Establish which are live, then consolidate to one and remove the rest.
  3. Verify conversions once, by submitting a real form and watching it arrive. This is the only way to know the number means what you think it means.
  4. Decide the AI crawler question on purpose. Either direction is defensible. Make it a decision.
  5. Then look at consent, and only then at content or rankings.

What we couldn’t see

From outside, we can’t tell whether the phones get answered, whether the CRM is real, what they spend on advertising, or whether the leads they get are any good. We can’t see inside the tag containers, which is where the configurations actually live. We can’t judge the quality of their work, which is presumably excellent because a company lasts this many decades on the work rather than on the marketing.

A free tool that reads public files can tell you something is wrong. Telling you how wrong, and what to do about it, requires business familiarity. That’s the honest boundary of everything on our tools page, and it’s why every result there says what it can’t see.

Curious what these checks say about your own site? The Tracking Health Check and the AI Answer Visibility Check are free, take about a minute, and never ask for your email. If you’d rather have someone sort out the containers with you, contact us about analytics and lead tracking.

Sources: Google Tag Assistant · Google Tag Manager: organize your containers · Google Consent Mode · Cloudflare’s managed robots.txt documentation · Cloudflare on AI crawler defaults