Reading a page's HTML tells you nothing. Anything deployed through GTM is injected at runtime and never appears in the source. This runs inside the page instead, so it sees the real network log: which containers loaded, which IDs are configured, and whether a single hit was ever sent.
1
Pick your tools
Tick what Misfire should check. The bookmarklet you install in step 2 is built from this selection. Unticked tools are still listed when found on the page, just not checked in depth.
3 of 17 selected
The consent platform (OneTrust, Cookiebot, Osano, CookieYes or a bare TCF framework) is always detected, so a tag that loaded but sent nothing names what is holding it instead of shrugging at you.
2
Install
Your bookmarklet, checking GTM, GA4 and Clarity. Drag it to your bookmarks bar, then click it on any page you want to check. Change your picks later? Come back and drag it again.
var d=document,s=d.createElement('script');s.src='https://misfire.konvert7.com/check.js?t='+Date.now();d.body.appendChild(s);
When the site has a strict CSP
Both of the above fetch check.js, and a strict script-src blocks that fetch. Running the loader from the console does not get around it. The <script src> it appends is still the page loading a script. Paste the whole checker instead; it requests nothing and carries the same selection.
(()=>{function N(e){return typeof e==="objec… // the whole checker, 20.8 KB, no network
See it catch something
The demo page installs GA4 twice over and denies analytics consent. Run the bookmarklet there and it should report both. If it does not, the checker is broken, not your site.