Most sites are quietly losing data — a dead Universal Analytics snippet, two copies of GA4 firing at once, consent signals missing. This reads the tracking code your pages already serve publicly. No Google login. No account connection. No access granted to anyone.
Enter just the domain. We fetch the public homepage — nothing else.
Universal Analytics stopped processing data in July 2023 and all of its history was deleted in July 2024. Millions of sites are still running the old snippet while believing their numbers are real. These checks find that class of problem in about two seconds.
The snippet still downloads ~45 KB on every page load and collects nothing. It also makes consent scanners report a broken cookie setup.
Two tags double-count every event. Traffic looks plausible while conversions are inflated — and Google Ads learns from the inflated numbers.
Consent Mode v2 is required for EEA advertising. Without it, lost conversions get modelled and remarketing audiences shrink.
Ad blockers and privacy settings remove conversions before they are counted. Around 30% of internet users run an ad blocker (GWI, Q2 2025); how much it costs you depends on how privacy-minded your audience is.
Eleven checks, grouped by how much damage a failure causes. Each one links to a page explaining how we detect it, what the broken code actually looks like, and how to fix it — including the cases where our own check will report something that does not match reality.
Universal Analytics stopped processing data in July 2023 and all history was deleted in July 2024. A site still on UA has been measuring nothing for two years.
Two GA4 tags on one page double-count every event. Traffic figures look plausible while every conversion number is inflated and every ROAS calculation feeds wrong data to Smart Bidding.
Consent Mode v2 became required for advertising into the EEA. Without the signals, Google models the conversions you lose to consent refusals, and remarketing audiences shrink sharply.
GTM lets you change tags without a developer. It also creates its own failure mode: installed but unused, or firing twice.
UA shut down in July 2023. The snippet still downloads roughly 45 KB on every page load, and its presence makes cookie-consent scanners report a broken setup.
Missing conversion tags mean no remarketing audiences, no conversion optimisation, and no way to measure advertising return.
Server-side tagging sends events through your own infrastructure, so ad blockers and browser privacy settings cannot block them.
A consent banner that fires before tags is the practical prerequisite for Consent Mode. Its absence usually means tags load before any choice is made.
A missing or broken viewport tag means mobile visitors may never trigger scroll or click events correctly. Mobile is roughly half of global traffic (StatCounter, September 2026) — enough that mis-fired events are not a rounding error.
A googlebot-specific noindex was the old trick to hide AdWords landing pages from organic search. It now removes the page from Google entirely — so it earns no organic traffic at all, regardless of how well its tracking is configured.
Missing Open Graph tags means shared links render as a bare URL, which measurably reduces click-through on social.
A single number is only useful if you know how it was produced. Ours is deliberately weighted so that silent failures cannot hide behind a healthy-looking average.
Each check carries a severity, and the score is a weighted average rather than a plain one. The reason is specific: a site with two copies of the GA4 tag still reports plausible traffic. Simple averaging would let that configuration score above 60 and read as "mostly fine", when in fact every conversion is inflated and Google Ads is learning from a wrong signal.
| Severity | Weight | What the failure costs you |
|---|---|---|
| critical | 1.6 | Numbers are silently wrong. Traffic looks normal, decisions come out wrong. |
| high | 1.0 | Visible problem with a measurable cost in lost data or page weight. |
| medium | 0.5 | Indirect effect. Breaks measurement quality or distribution instead of tracking. |
| optional | 0.25 | An improvement. Depends on your traffic mix and budget, not required to function. |
Within a severity band, every check resolves to one of three states. Pass contributes nothing. Warn counts as 0.4. Fail counts as 1.0.
A warning is not a softer failure. It means "this may be broken and we cannot tell from the code alone" — for example, a Tag Manager container that exists but whose internals we cannot read without a Google login.
Every critical failure caps the total at 100 minus 18 per failure. Two critical
failures means the score cannot exceed 64, no matter how many optional checks pass.
This is intentional. Some failures are not additive. A site with no analytics at all and a site with analytics that double-counts every conversion are different problems, but neither is "half broken" — and a weighted average alone would let the second one hide behind passing optional checks.
The verdict is generated from the findings, not the score alone. If any critical check fails, it says so explicitly instead of showing "healthy" beside a red failure count — a contradiction that would rightly destroy your trust in the number.
It reflects configuration, not performance. A 100 means nothing is obviously misconfigured. It does not mean your data is correct, your campaigns are profitable, or your tags fire as intended. Those require GTM Preview and GA4 DebugView, both of which need your Google login.
Tracking platforms change their requirements regularly. Each check below is tied to a primary source rather than to a blog post describing it.
UA- property still loading collects nothing.ad_storage, analytics_storage, ad_user_data and
ad_personalization. The last two are new in v2; a site carrying only the first
two is running the superseded version.G- prefix, loaded from
googletagmanager.com/gtag/js.GTM- prefix, loaded from
googletagmanager.com/gtm.js. Checked separately from GA4, because one container
loading one GA4 tag is the correct setup, not a duplicate.window.dataLayer, window["dataLayer"], the inline GTM snippet and the
gtag('js') call.connect.facebook.net
and one served from a first-party proxy are both legitimate.firstPartyLoader, fpl.js and ss-gtm style
identifiers.No login, no OAuth, no access to your account, no crawling behind authentication, and no storage of the pages you submit. Submitted HTML is analysed in memory and discarded; results are held for five minutes only to avoid refetching the same site.
This is a constraint we chose rather than a limitation we worked around. It is also the reason several checks stop at "installed" and cannot confirm "firing" — a line we keep visible on every result page rather than hiding behind confident phrasing.
Eleven checks, grouped by how much damage a failure causes. Each one links to a page explaining how we detect it, what the broken code actually looks like, and how to fix it — including the cases where our own check will report something that does not match reality.
Universal Analytics stopped processing data in July 2023 and all history was deleted in July 2024. A site still on UA has been measuring nothing for two years.
Two GA4 tags on one page double-count every event. Traffic figures look plausible while every conversion number is inflated and every ROAS calculation feeds wrong data to Smart Bidding.
Consent Mode v2 became required for advertising into the EEA. Without the signals, Google models the conversions you lose to consent refusals, and remarketing audiences shrink sharply.
GTM lets you change tags without a developer. It also creates its own failure mode: installed but unused, or firing twice.
UA shut down in July 2023. The snippet still downloads roughly 45 KB on every page load, and its presence makes cookie-consent scanners report a broken setup.
Missing conversion tags mean no remarketing audiences, no conversion optimisation, and no way to measure advertising return.
Server-side tagging sends events through your own infrastructure, so ad blockers and browser privacy settings cannot block them.
A consent banner that fires before tags is the practical prerequisite for Consent Mode. Its absence usually means tags load before any choice is made.
A missing or broken viewport tag means mobile visitors may never trigger scroll or click events correctly. Mobile is roughly half of global traffic (StatCounter, September 2026) — enough that mis-fired events are not a rounding error.
A googlebot-specific noindex was the old trick to hide AdWords landing pages from organic search. It now removes the page from Google entirely — so it earns no organic traffic at all, regardless of how well its tracking is configured.
Missing Open Graph tags means shared links render as a bare URL, which measurably reduces click-through on social.
A single number is only useful if you know how it was produced. Ours is deliberately weighted so that silent failures cannot hide behind a healthy-looking average.
Each check carries a severity, and the score is a weighted average rather than a plain one. The reason is specific: a site with two copies of the GA4 tag still reports plausible traffic. Simple averaging would let that configuration score above 60 and read as "mostly fine", when in fact every conversion is inflated and Google Ads is learning from a wrong signal.
| Severity | Weight | What the failure costs you |
|---|---|---|
| critical | 1.6 | Numbers are silently wrong. Traffic looks normal, decisions come out wrong. |
| high | 1.0 | Visible problem with a measurable cost in lost data or page weight. |
| medium | 0.5 | Indirect effect. Breaks measurement quality or distribution instead of tracking. |
| optional | 0.25 | An improvement. Depends on your traffic mix and budget, not required to function. |
Within a severity band, every check resolves to one of three states. Pass contributes nothing. Warn counts as 0.4. Fail counts as 1.0.
A warning is not a softer failure. It means "this may be broken and we cannot tell from the code alone" — for example, a Tag Manager container that exists but whose internals we cannot read without a Google login.
Every critical failure caps the total at 100 minus 18 per failure. Two critical
failures means the score cannot exceed 64, no matter how many optional checks pass.
This is intentional. Some failures are not additive. A site with no analytics at all and a site with analytics that double-counts every conversion are different problems, but neither is "half broken" — and a weighted average alone would let the second one hide behind passing optional checks.
The verdict is generated from the findings, not the score alone. If any critical check fails, it says so explicitly instead of showing "healthy" beside a red failure count — a contradiction that would rightly destroy your trust in the number.
It reflects configuration, not performance. A 100 means nothing is obviously misconfigured. It does not mean your data is correct, your campaigns are profitable, or your tags fire as intended. Those require GTM Preview and GA4 DebugView, both of which need your Google login.
Tracking platforms change their requirements regularly. Each check below is tied to a primary source rather than to a blog post describing it.
UA- property still loading collects nothing.ad_storage, analytics_storage, ad_user_data and
ad_personalization. The last two are new in v2; a site carrying only the first
two is running the superseded version.G- prefix, loaded from
googletagmanager.com/gtag/js.GTM- prefix, loaded from
googletagmanager.com/gtm.js. Checked separately from GA4, because one container
loading one GA4 tag is the correct setup, not a duplicate.window.dataLayer, window["dataLayer"], the inline GTM snippet and the
gtag('js') call.connect.facebook.net
and one served from a first-party proxy are both legitimate.firstPartyLoader, fpl.js and ss-gtm style
identifiers.No login, no OAuth, no access to your account, no crawling behind authentication, and no storage of the pages you submit. Submitted HTML is analysed in memory and discarded; results are held for five minutes only to avoid refetching the same site.
This is a constraint we chose rather than a limitation we worked around. It is also the reason several checks stop at "installed" and cannot confirm "firing" — a line we keep visible on every result page rather than hiding behind confident phrasing.
Eleven checks, grouped by how much damage a failure causes. Each one links to a page explaining how we detect it, what the broken code actually looks like, and how to fix it — including the cases where our own check will report something that does not match reality.
Universal Analytics stopped processing data in July 2023 and all history was deleted in July 2024. A site still on UA has been measuring nothing for two years.
Two GA4 tags on one page double-count every event. Traffic figures look plausible while every conversion number is inflated and every ROAS calculation feeds wrong data to Smart Bidding.
Consent Mode v2 became required for advertising into the EEA. Without the signals, Google models the conversions you lose to consent refusals, and remarketing audiences shrink sharply.
GTM lets you change tags without a developer. It also creates its own failure mode: installed but unused, or firing twice.
UA shut down in July 2023. The snippet still downloads roughly 45 KB on every page load, and its presence makes cookie-consent scanners report a broken setup.
Missing conversion tags mean no remarketing audiences, no conversion optimisation, and no way to measure advertising return.
Server-side tagging sends events through your own infrastructure, so ad blockers and browser privacy settings cannot block them.
A consent banner that fires before tags is the practical prerequisite for Consent Mode. Its absence usually means tags load before any choice is made.
A missing or broken viewport tag means mobile visitors may never trigger scroll or click events correctly. Mobile is roughly half of global traffic (StatCounter, September 2026) — enough that mis-fired events are not a rounding error.
A googlebot-specific noindex was the old trick to hide AdWords landing pages from organic search. It now removes the page from Google entirely — so it earns no organic traffic at all, regardless of how well its tracking is configured.
Missing Open Graph tags means shared links render as a bare URL, which measurably reduces click-through on social.
A single number is only useful if you know how it was produced. Ours is deliberately weighted so that silent failures cannot hide behind a healthy-looking average.
Each check carries a severity, and the score is a weighted average rather than a plain one. The reason is specific: a site with two copies of the GA4 tag still reports plausible traffic. Simple averaging would let that configuration score above 60 and read as "mostly fine", when in fact every conversion is inflated and Google Ads is learning from a wrong signal.
| Severity | Weight | What the failure costs you |
|---|---|---|
| critical | 1.6 | Numbers are silently wrong. Traffic looks normal, decisions come out wrong. |
| high | 1.0 | Visible problem with a measurable cost in lost data or page weight. |
| medium | 0.5 | Indirect effect. Breaks measurement quality or distribution instead of tracking. |
| optional | 0.25 | An improvement. Depends on your traffic mix and budget, not required to function. |
Within a severity band, every check resolves to one of three states. Pass contributes nothing. Warn counts as 0.4. Fail counts as 1.0.
A warning is not a softer failure. It means "this may be broken and we cannot tell from the code alone" — for example, a Tag Manager container that exists but whose internals we cannot read without a Google login.
Every critical failure caps the total at 100 minus 18 per failure. Two critical
failures means the score cannot exceed 64, no matter how many optional checks pass.
This is intentional. Some failures are not additive. A site with no analytics at all and a site with analytics that double-counts every conversion are different problems, but neither is "half broken" — and a weighted average alone would let the second one hide behind passing optional checks.
The verdict is generated from the findings, not the score alone. If any critical check fails, it says so explicitly instead of showing "healthy" beside a red failure count — a contradiction that would rightly destroy your trust in the number.
It reflects configuration, not performance. A 100 means nothing is obviously misconfigured. It does not mean your data is correct, your campaigns are profitable, or your tags fire as intended. Those require GTM Preview and GA4 DebugView, both of which need your Google login.
Tracking platforms change their requirements regularly. Each check below is tied to a primary source rather than to a blog post describing it.
UA- property still loading collects nothing.ad_storage, analytics_storage, ad_user_data and
ad_personalization. The last two are new in v2; a site carrying only the first
two is running the superseded version.G- prefix, loaded from
googletagmanager.com/gtag/js.GTM- prefix, loaded from
googletagmanager.com/gtm.js. Checked separately from GA4, because one container
loading one GA4 tag is the correct setup, not a duplicate.window.dataLayer, window["dataLayer"], the inline GTM snippet and the
gtag('js') call.connect.facebook.net
and one served from a first-party proxy are both legitimate.firstPartyLoader, fpl.js and ss-gtm style
identifiers.No login, no OAuth, no access to your account, no crawling behind authentication, and no storage of the pages you submit. Submitted HTML is analysed in memory and discarded; results are held for five minutes only to avoid refetching the same site.
This is a constraint we chose rather than a limitation we worked around. It is also the reason several checks stop at "installed" and cannot confirm "firing" — a line we keep visible on every result page rather than hiding behind confident phrasing.
gtag.js and
the GTM container script. Nothing is authenticated, so nothing is accessed. That is also the limit:
anything behind a login cannot be checked here.Ctrl+U (or
View Source), select all, copy, and use the "Paste page HTML" tab instead. That path never touches
the network at all.