Tracking that stopped
Use Trace — public pages, nothing to install, an alert after a second confirmed check.
A CDN or a WAF is not script monitoring
Cloudflare, Akamai and a web application firewall see requests at the edge. They do not see a tag that loaded in the browser and never fired. Those are different layers.
| CDN or WAF | Tagnovo | |
|---|---|---|
| A request that never reached your origin | their job | not ours |
| A bot challenge, a rate limit, a known exploit | their job | not ours |
| A tag library that returned 200 and never collected | invisible | the finding |
| A new third-party script on a product page | Only if you wrote a rule for that host | diffed every check |
| A payment-page script as a real visitor received it | The edge copy, not the session | Needs the first-party tag — a scanner is served the clean page |
Where they are better
A CDN is better at cache, DDoS, TLS, and keeping origin load down. A WAF is better at blocking a known attack before it reaches the shop. Tagnovo does none of that. If you already pay for one, keep it.
The objection we hear is "we already have Cloudflare, so script monitoring is covered." The edge sees the request for gtag/js. It does not see whether/g/collect ever left. That second observation ishow we decide a tag is broken.
Scripts on a payment page
Use Manifest. A CDN hash of the HTML at the edge is not the page as the customer's browser received it.
See what payment-page monitoring produces
A CDN hash of the HTML at the edge is not the page as the customer's browser received it. Manifest records the scripts that actually ran.