Conversion Tracking Audit Checklist: 12 Checks in 20 Minutes

It is written for anyone spending real ad budget: performance marketers, growth leads, and agencies. You do not need developer access to complete most checks. You do need admin access to your analytics and ad accounts and a report from whatever system holds your real orders or leads.

What is a conversion tracking audit?

A conversion tracking audit compares three things: what your business counts as a conversion, what your tags and server-side integrations send, and what each ad platform reports. Where those three disagree, you have a tracking problem, a settings problem, or both. The audit finds the disagreement and tells you which kind it is.

Most audits fail because they start in the tag manager. Start with the business definition instead. If nobody agrees on what one conversion is, no amount of tag debugging will make the numbers match.

What you need before you start

You need admin access, one test order or lead you can place yourself, and an export of real conversions for a fixed date range. Gather these first so the 20 minutes is spent checking, not hunting for logins.

• Admin access to GA4, Meta Events Manager, and TikTok Events Manager (or whichever destinations you use).
• Access to the tag manager or the platform plugin that installs your tags.
• A report of real orders or leads from your store, CRM, or database for the last 30 days.
• A free scanner such as the Tracking Pixel Inspector or the Free Website Tracking Audit to see which tags actually load.
• A browser with a fresh incognito window for placing a test conversion.

The 12-check conversion tracking audit checklist

The checks are ordered so that each one narrows down the next. Time estimates assume a single site with GA4, Meta, and TikTok. Add a few minutes per extra domain or destination.

1. Inventory your business conversions first, then map them to platform events

Write down every action that counts as a conversion in your business before you open a single platform. Then map each one to the event name each platform expects. Most mismatches between platforms come from this step being skipped: GA4 counts a form submit, Meta counts a Lead, and the CRM counts a qualified lead, and all three are called the same thing in meetings.

In GA4, a key event is any collected event you mark as important to the business; only those marked events count in conversion reporting. Make sure each row in your inventory has a matching key event switched on, and that nothing is marked as a key event that the business does not treat as one.

2. Confirm the pixels actually load

Run your homepage, a product or pricing page, and your thank-you page through a scanner and confirm every expected tag appears on every page. A tag installed only on the homepage template is one of the most common findings on sites that use multiple page builders or themes.

The Tracking Pixel Inspector lists the pixels a page loads. The Free Website Tracking Audit goes further and gives you a scored, shareable report plus an estimate of how much of your traffic is likely to be lost to iOS and ad blockers. If you run a platform-specific stack, the Shopify, WooCommerce, and Google Tag Manager audit pages cover the failure modes specific to each.

3. Find duplicate pixel IDs and double-firing tags

Look for the same pixel ID appearing twice, or two different IDs for the same platform. Both cause inflated counts. The usual cause is a native platform integration (a theme setting or app) plus a manual tag manager install of the same pixel. Keep one path and remove the other.

Also check for a tag that fires on both a page-view trigger and a click trigger for the same event. In Meta Events Manager, an event that reports roughly double what your orders show is the giveaway.

4. Verify tags fire on the confirmation page

Place a real test conversion and watch it arrive on every platform. Do this in an incognito window with any ad blocker disabled so you are testing the tags, not the blocker.

1. 1Open Meta Events Manager's Test Events tab and TikTok Events Manager's test tool, and enable GA4 DebugView.
2. 2Complete a purchase or form submission the way a customer would, including any payment redirect.
3. 3Confirm the purchase or lead event appears once on each platform with the expected value and currency.
4. 4Repeat for the edge cases that break tracking most often: an off-site payment redirect that returns to your domain, a single-page checkout that never changes URL, and a browser back-button return to the thank-you page.
5. 5Refund or delete the test conversion in your order system so it does not distort reconciliation later.

5. Confirm server-side events are actually sending

Check that each server-side destination shows events arriving in the last 24 hours, and that they cover the same events the browser sends. A server-side integration that was set up and then silently stopped is a common finding, especially after a platform migration or a token rotation.

Meta exposes two diagnostics for this in Events Manager and through its Dataset Quality API. Event Coverage is the 7-day average percentage of pixel events that are also covered by the Conversions API with a deduplication key. Data Freshness describes the delay between when an event happened and when Meta received it. Low coverage means the server path is missing events the browser sends; poor freshness means your server path is batching or lagging. Meta's best-practice guidance is to send events as they happen.

For TikTok, confirm Events API events appear alongside pixel events in Events Manager. For GA4, confirm Measurement Protocol events include a valid session_id from the client so they attach to the session instead of landing as (not set).

If you have not set up a server-side path yet, the server-side conversion tracking guide explains what to send and why.

6. Check deduplication: event_id on both paths, dedup rate, transaction_id

Deduplication is the check that answers the question people search most: are my pixel and CAPI double counting? Meta deduplicates browser and server events that share the same event_id and event name within a 48-hour window and keeps the first event received; TikTok uses the same event_id-plus-event-name key, so check its event deduplication article for the current window. If your browser event has an event_id and your server event does not, or they are generated independently, you will double count.

Meta's Dataset Quality API also reports a deduplication rate: the share of browser and server events that share a dedup key. A low rate with a high event count on both paths is the double-counting signature. Meta's fallback method using fbp or external_id only works when the browser event arrives before the server event, so treat it as a safety net rather than the plan.

For GA4, confirm every purchase event carries a unique transaction_id. GA4 deduplicates purchases with the same transaction_id, but only on web streams. Two failure modes to look for: an empty string, which makes GA4 collapse every purchase into one, and a hardcoded value that undercounts everything after the first order.

7. Check Event Match Quality and which user_data fields are populated

Open each server event in Meta Events Manager and read the Event Match Quality score. Meta scores web events from 0 to 10 based on how well the customer information sent with the event can be matched to a Meta account, and shows which match keys are present. A low score usually means the server path is sending only IP and user agent.

Meta's Conversions API documentation lists email, phone, first and last name, and client IP address as high-quality parameters, and requires client_user_agent, event_source_url, and action_source for website events. It also recommends sending external_id and event_id on every event, and refreshing the fbp and fbc cookie values because they change over time. Identifiers should be hashed before they leave your server. Check which of these your integration populates on the purchase and lead events specifically, since those are the ones optimization depends on.

8. Audit UTM and parameter hygiene

Pull a source and medium report for the last 30 days and look for the same channel spelled three ways. Facebook, facebook, and FB are three sources to a report and one to a human. Casing, trailing spaces, and missing utm_source on paid links are the usual culprits, and each fragment steals conversions from the channel you are trying to measure.

• Every paid link has utm_source, utm_medium, and utm_campaign, all lowercase.
• Ad platform auto-tagging (gclid, fbclid, ttclid) is not being stripped by a redirect or consent tool.
• A written naming convention exists and new links are built from it, not typed by hand. A UTM Campaign URL Builder enforces the convention at the point of creation.
• Mapping rules normalize the variants you already have so historical data is not thrown away.

The UTM parameters guide covers the naming convention and the mapping rules in detail.

9. Reconcile platform counts against your order system or CRM

Compare the number of conversions each platform reports against your real orders over the same date range, in the same time zone. This is the one check that tells you how much to trust everything else. Pick a closed range, such as the previous full calendar month, so late-arriving events and refunds have settled.

1. 1Export real orders or leads from your store or CRM for the range.
2. 2Pull the total purchase or lead count from GA4, then the total from each ad platform for the same range.
3. 3Expect the ad platform totals combined to exceed your order count. Each platform claims any conversion inside its own attribution window, so a customer who clicked a Meta ad and a TikTok ad is counted by both.
4. 4Compare GA4 against orders directly. GA4 should be lower than orders, not higher.
5. 5Log the gap for each platform as a percentage. This is your baseline for next month's audit.

What is a normal gap? As a rule of thumb, most teams see analytics undercount real orders by somewhere in the range of five to twenty percent once tracking is healthy, driven by consent, ad blockers, and browser restrictions. That number is an expectation from practice, not a measured benchmark. If analytics reports more conversions than your order system, you have duplication. If the gap is well above that range, you have a loading, consent, or server-side coverage problem, and checks 2, 5, and 10 tell you which.

10. Account for consent, regional differences, and iOS and Safari share

Split your reconciliation gap by region and by device before deciding it is a bug. A site with heavy EU traffic and a consent banner will legitimately lose browser-side events from visitors who decline. A site with a large iOS audience loses browser-side signal to Safari's tracking restrictions. Worldwide, iOS held about a third of mobile OS usage in August 2026 according to StatCounter, and the share is often far higher in North America and Western Europe, so check your own GA4 technology report rather than assuming.

A gap that is concentrated in one region or one browser is usually a coverage problem that server-side sending narrows. A gap that is uniform everywhere is more likely a tag or setting problem.

11. Align attribution windows and time zones across GA4, Meta, and TikTok

Confirm that every platform uses the same reporting time zone as your order system, and record each platform's attribution window so nobody compares a 90-day window against a 7-day one. The platforms will never agree exactly, but they should disagree for known reasons.

GA4 applies a time zone change only to data going forward, and Google warns that a change causes a flat spot or spike around the switch, so make time zone corrections at a month boundary and note the date in your audit log.

12. Set up the monthly re-test and decide what to monitor in real time

Book the same 20-minute audit on the first working day of each month, and pick two or three signals to watch daily so a break does not wait a month to be found. The monthly audit catches drift; the real-time signals catch outages.

• Monthly: repeat checks 1 through 11, and compare this month's reconciliation gap against last month's baseline.
• After every site change: repeat checks 2, 4, and 6. Theme updates, checkout changes, and new consent tools are the top three causes of silent breaks.
• Daily or real-time: conversions per destination in the last hour, live active visitors versus conversions, and the share of conversions arriving via the server path. A destination dropping to zero while others continue is the earliest sign of a broken token or a removed tag.

How do I know if my conversion tracking is working?

Your tracking is working when a test conversion appears exactly once on every platform, each server event shows a healthy dedup rate and match quality, and last month's analytics count sits slightly below your real order count with a gap you can explain by region and device. If any one of those three fails, use the check number above to isolate the cause.

Why don't my ad platform conversions match my orders?

They do not match because each platform counts conversions it can attribute to itself inside its own window, in its own time zone, with its own losses. The table below lists the usual causes, ordered by how often they show up in audits.

How often should I audit conversion tracking?

Run the full checklist monthly, run the technical checks after every site or checkout change, and watch live visitors against conversion counts in real time, checking each platform's Events Manager for per-destination arrival. Tracking rarely breaks on a schedule. It breaks when a developer ships a theme update, a marketer adds a new pixel, or an access token quietly expires, and the damage compounds for every day it goes unnoticed while campaigns keep optimizing on bad data.

Free tracking audit tools compared

Several vendors offer a free scanner that shows which tags a page loads. They differ mainly in scope and in what the scan is designed to lead to. As of September 2026, these are the ones you are most likely to find while searching, described from their own sites.

Any of these will tell you whether a pixel is present. None of them can see inside your Events Manager or your order system, so use a scanner for checks 2 and 3 and do the rest by hand.

Where EndFrame fits in the audit

EndFrame is a first-party attribution and server-side conversion tracking platform, and it removes several of the audit checks rather than automating them. Its snippet collects visits and actions on your own domain and forwards conversions server-side to Meta Conversions API, GA4 Measurement Protocol, TikTok Events API, and custom webhooks, with hashed identifiers and browser-to-server event-ID deduplication handled for you. Each destination is a toggle in the dashboard, so check 5 becomes a glance at which toggles are on, and check 6 stops being a manual comparison of event IDs.

For check 8, EndFrame normalizes UTM and query parameters into clean dimensions with mapping rules and validation, so the casing variants get merged instead of splitting your channels. For check 9, it stores the raw visit to action to conversion chain, which means you can reconcile a specific order back to the visit that produced it rather than comparing totals. For check 12, real-time reporting shows live active visitors and conversion counts with sub-second slicing by geo, device, path, referrer, and UTM, which covers the daily live-visitors-versus-conversions signal. Per-destination arrival still needs a glance at each platform's Events Manager. It starts at $49 per month with a 14-day free trial and no credit card required, and the free tools work without an account.

The bottom line

A conversion tracking audit is twelve short checks, done in order: define the conversion, confirm the tags load once, confirm the server path sends and deduplicates, reconcile against real orders, and explain the gap by region, device, window, and time zone. Twenty minutes a month, plus a real-time monitor per destination, is enough to keep every ad platform optimizing on numbers you can defend.