How to Audit a Website's Tracking: The 60-Point Checklist I Use for GTM, GA4, Google Ads and Meta

An audit answers one question: can the business trust its numbers? This is the checklist I work through, in order, on every audit. Each section has the checks, what good looks like, and how to record findings so the report is actionable rather than a list of complaints.

Setup for the Audit

• A clean browser profile with no ad blocker, plus a second profile with a blocker.
• GTM Preview access, a tag debugger such as the Insighter Debugger extension, the Meta Pixel Helper.
• Read access to GTM, GA4, Google Ads and Meta Events Manager.
• The business's own source of truth for the last 30 days: orders, leads, bookings.
• A spreadsheet with columns: area, check, finding, severity, evidence, recommendation.

Part 1: Tag Inventory

1. List every tag loading on the homepage, a product or service page, the contact page and the thank-you or order confirmation page, using the tag debugger and the page source.
2. Count GTM containers. More than one needs a reason.
3. Count GA4 measurement IDs, Google Ads conversion IDs, Meta pixel IDs. Duplicates of any are a finding.
4. Identify sources: GTM, hard-coded, plugins, platform channel apps.
5. Note any tags for platforms the business no longer uses.

Good: one container, one of each ID, every tag from GTM.

Part 2: GTM Container

6. Naming and folders: can a stranger read the tag list?
7. Workspaces open with unpublished changes.
8. Tags with no trigger or paused for more than a quarter.
9. Triggers that fire on clicks for conversion tags.
10. Custom HTML tags without comments.
11. A Conversion Linker on All Pages.
12. A Google tag or Google Analytics destination loaded on Initialization.
13. Consent requirements on non-Google tags.
14. Exceptions for admin pages.
15. The dataLayer: are business events pushed by the site, or scraped from the DOM?

Part 3: GA4 Configuration

16. Data retention at 14 months.
17. Internal traffic defined and the filter active.
18. Unwanted referrals listed: payment gateways, own domains.
19. Cross-domain configured where the journey crosses domains.
20. Key events marked, and do they match the business's actual outcomes?
21. Google Ads linked with personalised advertising on.
22. BigQuery linked.
23. Enhanced measurement options reviewed; form interactions off unless validated.
24. Google Signals status and whether thresholding affects reports.
25. Consent signals received if EU or UK traffic exists.
26. Unassigned traffic share in the last 30 days and its causes.
27. Not set values in key dimensions.
28. Custom dimensions registered for the parameters in use.
29. Session and user counts plausible against server or CDN data.

Part 4: Conversion Reproduction

For every primary conversion, perform it in Preview and the clean profile:

30. Fires once per real action.
31. Fires only after confirmed success.
32. Does not fire on failed or incomplete attempts.
33. Carries the right value, currency and transaction ID.
34. Carries user-provided data for Enhanced Conversions and Advanced Matching.
35. Reaches GA4 DebugView, the Google Ads request, Meta Test Events.
36. Survives a page refresh without a duplicate.
37. Repeat with the blocker profile and note what is lost.

Part 5: Google Ads

38. Conversion actions list: which are primary, which secondary, and does that match the business?
39. Each action's Diagnostics status.
40. Enhanced Conversions on and match rate healthy.
41. Count settings: One for leads, Every for purchases.
42. Attribution and windows sensible for the sales cycle.
43. Duplicate sources: GA4 import plus native tag for the same action.
44. Auto-tagging on; no manual UTMs on final URLs.
45. Call reporting on for call assets if calls matter.
46. Offline conversion or Enhanced Conversions for Leads in place where leads convert later, and uploads on the Data Manager path since June 2026.

Part 6: Meta

47. One dataset, connected to the ad account.
48. Standard events in use match the funnel; nothing custom where a standard name exists.
49. Purchase and Lead carry value, currency, content IDs where relevant.
50. Advanced Matching on with fields populated.
51. Conversions API active, deduplicated by event ID; Diagnostics clean.
52. Event Match Quality per event against realistic targets.
53. Events Manager Diagnostics warnings reviewed.

Part 7: Consent and Privacy

54. A consent platform present where required, firing on Consent Initialization.
55. Default consent state denied for applicable regions.
56. Google tags in Advanced or Basic mode as intended; non-Google tags blocked until consent.
57. No personal data in GA4 parameters, URLs or user properties.
58. Privacy policy mentions the tools in use.

Part 8: Reconciliation

59. Last 30 days: GA4 key events vs the business's orders or leads; Google Ads conversions vs the same; Meta purchases vs the same. Record the gaps and the likely causes.
60. Revenue in GA4 vs the platform's order total.

Scoring and the Report

Score each area from one to five, where five means nothing to fix. Weight conversion reproduction and reconciliation highest, because they are what the business pays for. Then write the report in three sections:

• Fix now: anything causing wrong numbers or lost conversions: duplicates, click-based conversions, missing Conversion Linker, broken purchase values.
• Fix this month: retention, filters, Enhanced Conversions, consent configuration, Unassigned clean-up.
• Improve later: server-side, offline conversions, dashboards, engagement events.

Each item: finding, evidence such as a screenshot or Preview event, business impact in one sentence, recommendation, effort estimate.

Outcome

A business that knows exactly where its numbers are wrong and by roughly how much, a prioritised plan to fix them, and a baseline to re-audit against in six months.