Google Tag Manager is legitimate. A suspicious container or unauthorized tag needs an ownership and change-history review. Removing a visible script can stop one symptom while leaving the account or site access that introduced it unchanged.
Distinguish an unknown container from an altered one
Inspect the page source and browser network initiators to identify the container ID and how it was inserted. Compare with the organization’s approved tagging inventory. An unexpected ID may have been injected into WordPress; an expected ID may instead contain an unauthorized published change. Those situations require different access and recovery steps.
Inspect the insertion point
The snippet may come from a theme, a header-injection plugin, a page builder, site options or an edge integration. Record the source rather than removing unrelated analytics. If an attacker edited that source, investigate other modifications in the same access window. A reputable script-hosting domain does not establish who controls the loaded container.
Review the published configuration
Where you own the container, compare its live version with the last approved configuration and inspect tags, triggers and user permissions. Tag Manager supports published versions; use that history as evidence. A legitimate business change can also explain a new tag, so confirm with the person responsible for measurement before treating every unfamiliar script as hostile.
Coordinate containment with the account owner
For a confirmed malicious tag, remove the unauthorized change or restore an approved version through the authorized account. For an attacker-controlled container, remove the unauthorized insertion from the site and inspect the route that allowed it. Secure affected accounts and access permissions. Do not publish a container you do not control or turn off unrelated customer-facing functions without planning the impact.
Verify the behaviour that triggered the report
Retest the original visitor journey, including referrer or device conditions if relevant. Check that the unauthorized container or payload is no longer requested and that approved consent, analytics and conversion flows still behave as intended. Record the affected version and remediation so a later import cannot silently restore the same unwanted tag.
Questions about this problem
Does a GTM script mean the website is hacked?
No. Tag Manager is widely used for legitimate tagging. Ownership and the actual published behaviour are the useful evidence.
Will a WordPress file scan find every malicious tag?
A tag configured in an external container may not exist as a standalone local payload file. Review the external configuration as well as the insertion point.
Primary references
General diagnostic guidance, not a diagnosis of an individual site. Use a recoverable copy for changes that may affect production.