Steps 2–3 — Implement the fraud0 Tag

The Main Tag is the core of fraud0. It fires a 1×1 tracking pixel immediately when the page loads — catching bots that abandon the page before any JavaScript executes — and then loads the full detection script asynchronously.

This page covers two things: choosing the right embed path for your setup (Step 2), then implementing the tag with the correct variant (Step 3).

Step 2 — Choose your embed path

There are three supported embed paths. Use your answers from the Pre-flight questionnaire (Q1–Q4) to pick the right one.

Decision matrix

	A. SGTM (preferred when SGTM exists)	B. Direct in `<body>` (preferred when no SGTM)	C. Standard GTM (only if GTM loads before consent)	D. GTM behind consent gate (not supported)
When to choose	You already operate a Server-Side GTM endpoint on your own domain	No SGTM and your web team can place a script in the `<body>` template	GTM container loads unconditionally on every page, no SGTM	—
Updates	Fast — change in GTM UI, no IT release	Slow — needs IT release whenever the snippet changes	Fast — change in GTM UI, no release	—
IT involvement	None (after one-time SGTM setup)	One release for the snippet, then none	None after initial setup	—
Bot-blocking risk	Very low — proxied through your own domain	Very low — only ad blockers targeting `api.fraud0.com` directly	Medium — `googletagmanager.com` is on many ad-blocker lists	High — fraud0 only fires after consent, and bots reject consent
Detection coverage	Maximum	Maximum	Reduced — bots blocking GTM are invisible	—
Works with strict CSP	Yes (allow-list your SGTM domain)	Yes (allow-list `api.fraud0.com`)	Yes (allow-list both `googletagmanager.com` and `api.fraud0.com`)	—

Quick recommendation

You have SGTM: use Variant A.
No SGTM, but you can change website code: use Variant B.
Neither: Variant C is acceptable only if your GTM container loads unconditionally (before any consent gate). Otherwise, fix the GTM bootstrap first — Variant D is not supported.

Step 3 — Implement the Main Tag

The code snippet

Replace {{fraud0 cid}} with your customer ID from the dashboard.

<!-- FRAUD0.com fraud detection BODY TAG -->
<script async src="https://api.fraud0.com/api/v2/fz.js?cid={{fraud0 cid}}"></script>
<script>(function(){var i=document.createElement('img');i.alt=' ';i.src='https://api.fraud0.com/api/v2/pixel?cid={{fraud0 cid}}&cb='+Math.random()+'.'+(new Date()).getTime();
i.width=i.height=1;i.style='width:1px;height:1px;display:inline;position:absolute;margin-top:-1px;';document.body.append(i);})();</script>
<!-- End of FRAUD0 BODY TAG -->

What this does:

Loads fz.js asynchronously — this is the full detection logic.
Immediately creates and appends a 1×1 tracking pixel. The pixel fires whether or not the JavaScript ever finishes loading, which is what allows fraud0 to detect bots that abandon the page in the first few hundred milliseconds.

Variant A — Implement via Server-Side GTM

In your GTM web container, create a new tag → Custom HTML.
Name it fraud0 Main Tag.
Paste the snippet above into the HTML field.
Open Advanced Settings → set Tag firing priority to 1000 (ensures it fires before any other tag).
Set Triggering to All Pages.
Under your SGTM client configuration, ensure that requests to fz.js and the pixel are proxied through your SGTM endpoint (tagmanager.yourdomain.com). Contact support@fraud0.com if you need help with the SGTM proxy configuration.
Publish your container.

Variant B — Implement directly in `<body>`

Open the master template that renders on every page (e.g. layout.html, _layout.cshtml, WordPress header.php).
Place the snippet immediately after the opening <body> tag, before any CMP or consent script.
Replace {{fraud0 cid}} with your actual customer ID.
Deploy as part of your next release.

Variant C — Implement via standard (client-side) GTM

In GTM, create a new tag → Custom HTML.
Paste the snippet above into the HTML field.
Open Advanced Settings → set Tag firing priority to 1000.
Set Triggering to All Pages.
Publish your container.

Once the Main Tag is deployed, continue to the Conversion Tag.

Step 4 — Implement the Conversion Tag Tag your confirmation pages to help fraud0 identify false positives.

Imprint Privacy Policy Terms & Conditions DPA