Audit your tracking in 10 minutes
Seven checks, in order, using tools that are free. Most sites fail at least three, and the failures are usually the cheap ones to fix.
tags fire? · durable id? · UTMs survive? · server-side? · de-duped? · platforms reconcile? · windows real?
Seven checks, ten minutes, no signup. The most common failures are a missing durable id, no server-side conversion, and UTMs dropped by a redirect — and all three are fixable in a day.
Do them in order. Later checks are meaningless if an earlier one fails.
No spreadsheet, no access to the codebase, no signup. Seven checks, in order — later ones only make sense if the earlier ones pass.
1. Do your tags actually fire? (1 min)
Run your URL through the pixel health checker. It makes a real request from a server and reports the HTTP status, TLS expiry, the redirect chain, and which of GA4, Meta, GTM and TikTok are present in the returned HTML.
Fail: a tag you believe is installed does not appear.
Usually because: it is injected by a tag manager after user interaction, or a consent banner is gating it, or a deploy dropped it.
2. Is any of it first-party? (1 min)
Run the first-party tracking scanner. It lists every script the page loads, classified first vs third party, with the vendor named.
Fail: everything is third-party.
Consequence: 20–30% of paid traffic never runs any of it, and that share is not randomly distributed.
3. Is there a durable visitor id? (1 min)
Run the cookie inspector. Look for a first-party cookie in the response headers with a long lifetime.
Fail: no server-set cookie at all — the usual result.
Consequence: every identity on the site is on Safari’s seven-day clock, so your attribution window is decorative for that traffic.
This is the highest-value fix on the list. About an hour of backend work.
4. Do your UTMs survive the redirects? (2 min)
Take a real campaign URL — the exact one in the ad, not a clean version — and run it through the UTM inspector.
Fail: parameters disappear at some hop.
Usually because: non-www→www, trailing-slash normalisation, or a legacy path redirect without query-string preservation.
Consequence: every click through that path lands as direct traffic.
5. Is your taxonomy consistent? (2 min)
Paste a month of campaign URLs into the UTM taxonomy validator.
Fail: casing drift, synonyms, missing parameters.
Consequence: one campaign appears as three underperforming rows.
6. Do your conversions reconcile? (2 min)
Put what each platform claims and what you actually banked into the ghost-conversions checker.
| Result | Diagnosis |
|---|---|
| Platforms claim 25–45% more | Normal. View-through plus cross-platform double claiming. |
| Platforms claim 60%+ more | Likely double counting — check your CAPI event_id. |
| Platforms claim fewer | Signal loss so severe the platforms cannot see your conversions. |
| Within 10% | Either you already do this properly, or you are comparing different periods. |
7. Is your attribution window real? (1 min)
Run the ITP loss estimator with your Safari share and your time-to-convert.
Fail: above roughly 8% structurally uncreditable.
Consequence: it is already changing your budget decisions — prospecting looks worse than it is and direct traffic scales with spend.
The scorecard
| # | Check | Typical result |
|---|---|---|
| 1 | Tags fire | Pass |
| 2 | First-party | Fail |
| 3 | Durable id | Fail |
| 4 | UTMs survive redirects | Mixed |
| 5 | Taxonomy consistent | Fail |
| 6 | Conversions reconcile | Fail |
| 7 | Window is real | Fail |
Failing five of seven is the normal outcome, and it is genuinely good news: the available improvements are large and none of them require a platform migration.
Fix in this order
- Durable server-set visitor id (check 3) — one hour, biggest single gain.
- Server-side conversion confirmation (check 6) — one afternoon, and it makes the count honest.
- Redirect query-string preservation (check 4) — minutes, and it recovers whole campaigns.
- Canonical UTM vocabulary (check 5) — half a day, plus a habit change.
- Move critical tracking first-party (check 2) — a day, once the id is in place.
Then run the audit again and watch the reconciliation gap close. Put a quarterly reminder in the calendar — tracking breaks silently, and always during a deploy nobody thought was risky.
Frequently asked questions
Do I need access to the site's code?
Not for the audit. Every check here works against a public URL or against numbers you already have in your ad accounts.
What if I fail everything?
That is the normal result, and it is good news — it means the improvements available are large and cheap. Fix them in the order listed.
How often should I run this?
Quarterly, and after every site redesign, replatform or tag manager change. Tracking breaks silently and almost always during a deploy nobody thought was risky.
What is the single highest-value fix?
A durable, server-set first-party visitor id. It takes about an hour and it is the difference between a 7-day attribution window and a real one.
Can I run this on a client's site?
Yes. Every check works from outside, which makes this a good opening slide for an agency pitch.
Start with check one
The pixel health checker makes a real request to your URL and reports status, TLS expiry, redirects and which tags are actually present.
Stop guessing which ad made the sale.
Flowsk Signals stitches the anonymous click to the email to the purchase — first-party, server-side, de-duplicated. One snippet, $29/mo, and every conversion comes with a receipt you can inspect.