FreeNo signup for the free scan.
Your site has analytics.
Is it measuring anything?
Google and Meta spend your budget against the conversions they’re told about. TagAudit scans your site in a real browser and flags faults that can skew that signal: signs of more than one GA4 measurement ID on the page you scan; no Google Consent Mode signal alongside a consent banner and Google or ad tags; and tags that keep firing after the scan clicks Reject, when it finds the button. Free, no install.
No signup for the free scan.
Google says tagging problems can make your reported conversions wrong, and that this can affect Smart Bidding. The free scan flags signs of these tracking faults. Your own ad spend tells you what they’re worth.
No Consent Mode behind your banner. Google’s EEA consent policy asks for consent signals to keep using its tags for measurement and remarketing. We flag a banner with Google or ad tags and no Consent Mode signal.
Ad tags that only run in the browser. Tracker blockers, and the 7-day cookie limit in Safari and other WebKit browsers, can hide conversions from your ad platforms. We flag ad tags with no server-side or first-party collection seen.
Pageviews, and nothing else. If your analytics records only pageviews, it can’t count form submits or checkout steps, so cost per lead by channel needs event tracking first. We flag the signs.
Quick to fix. Standard Universal Analytics stopped processing in July 2023, and Optimize was switched off in September 2023. If their code still loads, delete it once GA4 covers what it did.
Every flag above is free. Pro shows the fix steps for these. The scan reports what it saw on the pages it opened; it doesn’t see your ad accounts or your revenue.
Take your monthly ad spend. Whatever share of it is optimised on miscounted conversions is spend steered by bad data. The scan tells you whether it saw these signs on the pages it opened; your ad spend tells you what they could be worth.
For a shop: Pro looks for a category page and a product page and checks them for the view events that Meta’s catalogue ads and Google’s dynamic remarketing use.
Three things no source-code scanner can tell you.
Agencies and freelance analysts — check a new client's tags and consent before onboarding gives you logins, and scan before and after a relaunch.
In-house analysts — after a release, see whether GA4, GTM and your pixels still fire, and what fires after Reject.
Online shops — see which pixels your store loads and what they send when a visitor declines cookies.
One URL in, one work order out.
A clean headless browser visits your site — fresh profile, no cookies, and your consent banner left unanswered or declined.
Network beacons, cookies, dataLayer, consent state — at load and while interacting with your page.
Health score, stack inventory, consent behaviour, and a prioritised list of problems. Pro adds the fixes your developer can start today.
Most tools need a script on your site or a configured journey before they can tell you anything. We start at none — and only ask for more when it buys you something.
Most public websites. Nothing to install, nothing to configure, and no access to your analytics accounts, so you can check a client's site before onboarding gives you logins, with their go-ahead. Bot protection in front of the site can block it, and a page with too little on it to audit is turned away.
Works on the same public sites as the free scan. If bot protection blocks us, allowlist one address and the scanner reaches your real site instead of a bot challenge. It's the only change we ask for, it's scoped to your hostname, and it's reversible in the same click that made it. How to allowlist us →
Logged-in journeys, checkout and purchase confirmation can't be reached from outside at all. Covering them means collecting inside your own session — so we do it only when you ask. Never the default, never switched on quietly.
Start free. One-off — nothing recurring, nothing to cancel.
Prices are loading. If this persists, the pricing service is unavailable — nothing here is out of date, it just isn't showing yet.
Only a site you own or have its owner's permission to audit: that is what our Terms require. The free scan loads publicly accessible pages exactly like a normal browser visit and analyzes only what any visitor's browser receives — the same category of analysis as BuiltWith or Wappalyzer. Interaction testing goes further and we are specific about it: on every scan we scroll, click in-page links, and fill in form fields to see what tracking fires — every value we enter says, in the field itself, that it is a test. Submitting them is switched off in our current configuration, on every site.
Add a DNS TXT record or a meta tag we give you. Takes two minutes and proves you control the site. No scan needs it.
Sometimes not — bot protection can't distinguish our scanner from any other automated client, so it may serve a challenge page instead of your site. When that happens the scan says so and withholds the score rather than reporting a near-empty stack as if it were real. On a domain you've verified, one allowlist rule fixes it permanently: how to allowlist us.
We never enter payment details and never pay for anything. Actions that would send something to your site — submitting a form, adding to a cart, walking into checkout — are switched off in our current configuration, on every site. Forms are filled and abandoned so we can watch which tracking fires, and every value we put in a field says so in the field itself — a form reads "THIS IS A TEST - PLEASE IGNORE", so whoever sees it knows immediately.
Server-to-server integrations — Meta CAPI, offline conversion uploads, warehouse syncs — aren't externally observable. The report flags where these likely exist and tells you exactly what to verify in your own accounts.
Often not. The most common finding across audits is a properly installed banner that only gates half the stack. Having a CMP is not the same as enforcing it — that's precisely what we test.
No. The scan loads your public pages in a real browser, the way a visitor would, and reads what the browser sends. It never needs your analytics or Tag Manager login. The GTM comparison works from a container file you export and attach.
Partly. We read the consent state Google tags send. When a consent banner is detected and GA4 or an ad pixel loads with no Consent Mode signal at all, we flag it. We don't yet decode every Consent Mode parameter.
No. It's technical evidence of what your site sends before and after a visitor declines. Whether that's lawful depends on your consent setup, your purposes and your jurisdiction; that's a question for your counsel.