---
title: "example-commerce-host.com: Google’s example cart domain"
description: "The example shopping cart domain from Google’s cross-domain guides. Where it comes from, what to replace, and why to rotate credentials sent here."
url: https://example-commerce-host.com/
language: en
---

# example-commerce-host.com

example-commerce-host.com is an example domain from Google’s documentation on measuring visitors across domains, where it stands in for a third-party shopping cart: a shop at example-petstore.com sends its visitors to a cart such as example-commerce-host.com/example-petstore. It hosts no cart, checkout or payment page. If this name appears in your code or settings, replace it with the address your cart provider gave you.

## Sent a key, token, password or payment details here? Act now.

Requests from code that points at example-commerce-host.com reach this server instead of the real shop or payment provider, including any API key, access token, password, session cookie or card details they carry. Treat them as exposed:

1. Revoke the key, token or password at the service that issued it, and issue a new one.
2. Keep credentials in configuration or a secrets manager, not in code.
3. If real card details were sent, contact the card issuer.
4. Correct the address in your code, so new credentials only go to the real service.

[Where to revoke keys at GitHub, AWS, Google Cloud, Stripe and others](https://example-petstore.com/guides/leaked-credentials)

## Where this name comes from

Each example below shows the outdated snippet as it was published, and what to use instead. The highlighted part is what you replace. [The full history](https://example-petstore.com/history) has dates and archived sources.

### A shop and a third-party cart in Classic Analytics

Google’s guide to tracking multiple domains with Classic Analytics (`ga.js`) sent visitors from the shop at www.example-petstore.com to a cart at www.example-commerce-host.com/petStoreCart.

Outdated example

```
<form action="…"
      onSubmit="pageTracker._linkByPost('www.example-commerce-host.com/petStoreCart/begin.php');">

_gaq.push(['_setCookiePath', '/myStore/']);
_gaq.push(['_cookiePathCopy', '/myCart/']);
```

Classic and Universal Analytics no longer collect data. Remove this code and point forms and links at your real checkout. Copied forms and links with a full address still send visitors here, often with `__utma`-style parameters in the address.

Use instead

```
<!-- Google tag (gtag.js) for Google Analytics 4 -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>
```

[Full guide: from Classic Analytics to Google Analytics 4](https://example-petstore.com/guides/google-analytics-cross-domain)

### Measuring your shop and your cart together

Google’s current guide on measuring across domains still introduces a website at example-petstore.com with a cart at example-commerce-host.com/example-petstore; its code samples use `example.com`. In Google Analytics 4, the domains are set in the admin: Admin › Data collection and modification › Data streams › your web stream › Configure tag settings.

- **Configure your domains:** your shop and your cart provider.
- **List unwanted referrals:** payment pages that appear as referrers.

Without this, a customer who moves from the shop to the cart is counted twice, and the sale loses the link to how they found your shop. In Google Tag Manager, the same settings are under Google tags › your tag › Show all.

Or in code

```
// Only if you configure cross-domain measurement in code instead of in the admin;
// place this before gtag('config', …)
gtag('set', 'linker', {
  'domains': ['www.example.com', 'checkout.example.net']
});
```

[Step-by-step: cross-domain measurement](https://example-petstore.com/guides/google-analytics-cross-domain#cross-domain)

### API clients and scripts

Requests with a body, or to API-style paths, come from code that uses this domain as an address. They receive `410 Gone` with a JSON explanation.

Use instead: read the address from configuration

```
# Python: read the address from configuration, not from the code
import os
BASE_URL = os.environ["API_BASE_URL"]

// JavaScript / Node.js
const baseURL = process.env.API_BASE_URL;

// PHP 8
$baseUrl = getenv('API_BASE_URL') ?: throw new RuntimeException('API_BASE_URL is not set');
```

[Full guide: configuring API clients and SDKs](https://example-petstore.com/guides/api-base-url)

### The shop side: example-petstore.com

The shop in these examples, and the other places where it appears (sitelinks search box markup, site moves in Search Console), are covered on [example-petstore.com](https://example-petstore.com/).

## Quick checklist

- Search your code, templates, theme and tag manager for `example-commerce-host` and `example-petstore`.
- Replace the cart address with the checkout address your cart provider gave you.
- Remove Classic and Universal Analytics code; in Google Analytics 4, list your shop’s domain and your cart provider’s domain.
- Rotate any keys, tokens or passwords that were sent here.
- When everything points at the right place, nothing from your site or code reaches this domain.

## Guides for this situation

The step-by-step guides are on example-petstore.com, the sister domain from the same examples.

### [From Classic Analytics to Google Analytics 4](https://example-petstore.com/guides/google-analytics-cross-domain)

Remove `_setDomainName`, `_link` and `_linkByPost` code, install the Google tag, and set up cross-domain measurement and unwanted referrals the current way.

### [Leaked credentials: what to do now](https://example-petstore.com/guides/leaked-credentials)

Keys, tokens or passwords were sent to an example domain. Revoke and replace them, with direct links to the revocation pages of common providers.

### [Configuring API clients and SDKs](https://example-petstore.com/guides/api-base-url)

Keep base URLs out of code, point them at the real service, and add a check that stops example addresses from reaching production.

### [Removing a secret from Git history](https://example-petstore.com/guides/remove-secrets-from-git)

A key was committed. Revoke it, remove it from the history with git-filter-repo, clean up GitHub and block the next leak.

[All guides on one page](https://example-petstore.com/guides)

## Questions and answers

### What is example-commerce-host.com?

An example domain. In Google’s documentation on measuring visitors across domains, it stands in for a third-party shopping cart: a shop at example-petstore.com sends its visitors to a cart at an address such as `example-commerce-host.com/example-petstore`.

### Is example-commerce-host.com a real shopping cart or payment service?

No. There is no cart, checkout or payment page, and nothing can be bought or paid here. Every address on the domain shows this page.

### Why do visitors or requests from my shop end up at example-commerce-host.com?

A cart address from an example was copied and never replaced, in a link, a form, a tracking snippet or a script. Replace it with the checkout address your cart provider gave you.

### I sent card details, a key or a password to example-commerce-host.com. What now?

Treat them as exposed. Revoke keys, tokens and passwords at the issuing service and issue new ones; if real card details were sent, contact the card issuer. Only the issuing service can revoke a key.

### How do I measure visitors across my shop and my cart provider in Google Analytics 4?

In the admin: Admin, Data collection and modification, Data streams, your web stream, Configure tag settings, Configure your domains. Enter the domain of your shop and that of your cart provider.

### Why is one customer counted as two users, or my own shop shown as a referrer?

Cross-domain measurement is missing or lists the wrong domains. List your shop and your cart provider under Configure your domains, and add stray referrers such as payment pages under List unwanted referrals.

### What are /petStoreCart, /myStore/ and /myCart/?

Made-up paths from the same examples: the pet store’s cart, and a shop and cart in separate folders on one domain. None of them exist; each leads to this page.

### Is example-zoohandlung.de the same example?

Yes. German exam preparation material translated the pet store into `www.example-zoohandlung.de` and kept the cart at `www.example-commerce-host.com/example-zoohandlung/`.

### What is example-petstore.com?

The sister example domain: the shop side of the same examples. See [example-petstore.com](https://example-petstore.com/).

## Sources

- [Measure activity across multiple domains](https://developers.google.com/tag-platform/devguides/cross-domain) Google Tag Platform
- [Tracking Multiple Domains (Classic Analytics, 2009 snapshot)](https://web.archive.org/web/20090327154737/http://code.google.com:80/apis/analytics/docs/tracking/gaTrackingSite.html) Google Code via the Wayback Machine
- [Tracking Multiple Domains (Classic Analytics, 2013 snapshot)](https://web.archive.org/web/20130115024413/https://developers.google.com/analytics/devguides/collection/gajs/gaTrackingSite) Google Developers via the Wayback Machine
- [Set up cross-domain measurement](https://support.google.com/analytics/answer/10071811) Google Analytics Help
- [Identify unwanted referrals](https://support.google.com/analytics/answer/10327750) Google Analytics Help
- [Universal Analytics has been replaced by Google Analytics 4](https://support.google.com/analytics/answer/11583528) Google Analytics Help