In this guide
- A page cannot see inside a cross-origin iframe. Events inside it are invisible to your tags unless the embed sends a message.
- Use
postMessagefrom the embed, or your own container inside the iframe if you control it. - Safari and others partition storage in iframes, so cookies and IDs behave differently.
Booking widgets, forms, video players and payment pages are often embedded in iframes. A form from another vendor may collect the leads that matter most, and your analytics sees nothing. This page explains why, and the ways to track what happens inside. It builds on multi-domain tracking and data validation.
Why it is hard
- Same-origin policy. A page cannot read or listen to events inside an iframe from another origin.
- Storage partitioning. Browsers limit cookies and storage inside third-party iframes. An ID set inside may not match the ID outside.
- Referrers. The iframe's traffic often looks like a visit from your own page.
Check your tracking in one pass
This is an example. Run the check on your own site to see where yours stands.
The options
| Option | How | When |
|---|---|---|
| The embed sends messages | The vendor's script calls window.parent.postMessage with events; your page listens and pushes to the data layer | The vendor supports it (many form and booking tools do) |
| Your own tracking inside the iframe | You install Tag Manager inside the embedded page | You control the embedded page |
| A redirect to a thank-you page | After the action, send the visitor to a page on your domain | A simple, robust option for forms |
| Server-side webhook | The vendor calls your server when a lead or booking is made | You need reliability and the vendor offers webhooks |
Listen for postMessage
window.addEventListener("message", function (event) {
// check the sender before trusting the message
if (event.origin !== "https://forms.vendor.example") return;
if (event.data && event.data.type === "form_submitted") {
window.dataLayer = window.dataLayer || [];
window.dataLayer.push({ event: "generate_lead", form_name: event.data.form });
}
});Always check event.origin. Never trust a message from an unknown sender, and never put personal data from a message into analytics.
Raw events in. Clean events out.
Open Tracked collects each event on your own domain, removes the noise and sends what is left to Meta, Google Ads, TikTok.
Cross-domain with iframes
If the iframe is on a domain you own, configure cross-domain measurement so the client ID is shared. If it is a vendor's domain, you cannot share the ID directly. In that case, rely on the thank-you redirect or a webhook to send the conversion from your server, with the identifiers saved on your page before the embed loads. See CRM data to Meta with webhooks.
Server-side route
A webhook from the form vendor to your tagging subdomain turns an invisible event into a server-side conversion. The container can then send it to Meta, Google Ads and GA4 with hashed customer data, with consent. Open Tracked hosts the tagging server, and its Data Store and Enricher can remember the hashed e-mail for later events.
Common problems
Works with your stack
Grab a logo and throw it. These are the tools Open Tracked already talks to.
Frequently asked questions
Can I track events inside an iframe?
Not directly if it is cross-origin. Use postMessage, your own tracking inside it, a redirect or a webhook.
What is postMessage?
A browser feature that lets an iframe and its parent page send messages to each other.
Why do cookies behave differently in iframes?
Browsers partition storage in third-party iframes.
How do I track a form in an iframe?
Ask the vendor for a postMessage event, a redirect to your thank-you page or a webhook.
Is it safe to listen to messages?
Yes, if you check the origin and avoid putting personal data in analytics.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Integrations · 6 min read
