Analytics setup

Analytics, and knowing what actually happened

This is the part of the audit that asks whether anything on your website is being measured at all. It reads the tags your pages already load, then sends a few plain requests to see whether the site answers.

What the check reads

Analytics tools leave a trace in the page. A GA4 tag carries a measurement ID beginning G-. A tag manager carries a container ID beginning GTM-. A Meta pixel calls fbq(). Sentry calls Sentry.init(). The check holds twenty-five of those signatures and records which ones are present. Nothing is installed and no account access is needed.

It reads the rendered page rather than the raw response your server sent, because most tags arrive after the HTML does — a container injects them later. The renderer was added after a related bug: reading the raw response on a JavaScript-rendered site produced fourteen findings that were all false, including “No H1 heading found” raised as critical on a page that has one. A tag injected by a container is genuinely there, and a check stopping at the raw response would call it missing.

What it costs when nothing is measured

The plain version first. Without measurement you cannot tell which page brought the enquiry, whether last month's change to the homepage helped or hurt, or which of the things you pay for is doing anything. The engine's own summary line for this category says there is limited measurement in place, so it is hard to see what is converting.

Two findings here matter more than the rest, and both are about knowing when something is broken rather than what is working. With no JavaScript error monitoring, a script error that breaks your contact form in one browser produces no signal at all: the visitor gives up and nothing is recorded. With no uptime monitoring, the note written against that finding says nothing was found that would tell you the site is down before a customer does — outages are discovered by complaint, and their duration is whatever it takes someone to notice.

The one live check

Eight of the nine checks read the page. The ninth asks the site directly: three plain requests to your homepage, ten-second timeout each, roughly a third of a second apart, with the round-trip time recorded for every one. Any status below 500 counts as answering — a 404 or a redirect still means the server is alive — and only the 5xx class counts as a failure. Short of three out of three, a warning is raised naming the count.

Three samples across a couple of seconds is not uptime monitoring, and the report does not present it as such. It catches a server failing intermittently at the moment of the audit, which is otherwise invisible. It cannot tell you what happened at two in the morning last Tuesday, which is why the recommendation attached is to set up external monitoring rather than trust this figure.

Presence is not proof

Detection means the code is on the page. It does not mean it is working. A GA4 tag can sit in your markup while filtering out most of your traffic, reporting into a property nobody has opened in a year, or still pointed at a domain you no longer use. Whether the numbers arriving are any good is a question about your account, and nothing running from the outside can reach inside it.

The same restraint covers checks that could not run. Anything that cannot be measured is recorded as unmeasured with the reason, never as a failure, and an unmeasured category is dropped from the overall score rather than counted as a zero. Analytics also carries a deliberately light weight in that overall — 0.8, against 1.4 for performance, SEO and security. A site that is fast, findable and secure should not be dragged down for taking its enquiries by email.

The awkward part: this site scores poorly in this very category

This engine has been pointed at this website and the result published at /sample-report. Analytics scored 62 out of 100 on nine findings, more than any other category on that report. It is deliberate. This site runs no analytics at all: no GA4, no tag manager, no pixel, no session recorder, nothing that puts a third-party script in front of a visitor. The number is arithmetic, not a verdict — two warnings at eight points and seven informational findings at three, put through the scoring curve.

Seven of the nine were then overruled by hand, each with the reason written beside it. Two stand and are ours to fix: no Search Console verification, and nothing watching whether the site is up. That gap is the argument for a person reading the report rather than a scanner counting it. Software can find nine absences; only someone who knows the site can say which seven were choices.

What the engine checks here

Each of these is a rule in the code, not a category heading.

An analytics platform of any kindGA4, Universal Analytics, Plausible, Matomo or Fathom, matched on what they actually put in the page: a gtag/js?id=G- script or a gtag('config','G-…') call, analytics.js or a UA-nnnn-n property ID, matomo.js or piwik.js or the _paq queue. None of the five present is a warning, the strongest severity this category raises.
JavaScript error monitoringSentry, Bugsnag or Rollbar, from a CDN script or an init call. None present is the category's second warning. It is ranked that high because errors on your visitors' browsers never reach your server logs: without something catching them, a broken form is reported by nobody.
A live availability probeThree requests to the URL, ten-second timeout each, 0.3 seconds apart, with latency recorded per request. A status code below 500 counts as answering. Below three out of three, a warning is raised quoting the count and the percentage — evidence gathered at audit time rather than a claim about your hosting.
A status page or uptime serviceLooked for as statuspage.io, a status subdomain, UptimeRobot, Pingdom or BetterUptime. Absent, it is informational, and it is the one finding in this category that carries a written impact line: nothing was found that would tell you the site is down before a customer does.
Search Console verificationA meta tag named google-site-verification. Missing, that is informational: without it you cannot see which searches bring people to you, or be told when Google stops indexing a page. Bing's msvalidate.01 tag is detected and recorded in the same place, but its absence raises no finding of its own.
Tag manager and conversion trackingGTM from gtm.js, a GTM- container ID or a dataLayer reference. Conversion tracking is satisfied by a gtag('event','conversion') call, an fbq('track', …) for Purchase, Lead or CompleteRegistration, or the presence of a Meta or LinkedIn pixel. Each absence is informational rather than a warning — plenty of businesses take enquiries by email and count them by hand, and that is a valid answer.
Event tracking, A/B testing and real user monitoringEvents from gtag('event', a dataLayer.push, data-event, data-track or data-analytics attributes, or a listener wired to a tracking call. Experiments from Optimizely, VWO, Google Optimize (an OPT- ID) or AB Tasty. Real user monitoring from New Relic, Datadog RUM, Cloudflare insights, SpeedCurve, or Google's web-vitals library. Each is informational.
Tools recognised but never counted against youHotjar, Clarity, Segment, Mixpanel and Amplitude are matched and listed alongside everything else found, so the report shows what you already run. Their absence raises no finding at all. A category that fires on every site tells you nothing about yours, so only the checks worth acting on are scored.

Questions

We already have GA4 installed. Is there anything here for us?

Usually the gaps beside it rather than the tag itself. On a site with GA4 and nothing else, the findings that come back are typically no conversion event, so visits are counted but enquiries are not, no error monitoring, and nothing watching whether the site is up. Whether your GA4 property is set up correctly is not something an outside check can see, and the report says that rather than guessing.

Do you need access to our Google Analytics account?

No. Every check reads what your pages already send to a browser, plus three ordinary requests to your homepage. No login, no account access, no tracking code added to your site, and nothing on your site changes. The audit appears in your logs as three visits.

You score 62 in this category yourselves. Why should we take it seriously?

Because the score and the judgement are separate things, and the report shows both. Nine findings were raised against this site and seven were overruled by hand with the reason written down, because running no analytics here is a deliberate choice. On your site the same absences may be genuine gaps costing you money. Deciding which is which is the part a scanner cannot do, and it is the reason every finding is read by a person before the report is sent. The full report is at /sample-report.

Sources

Public and checkable. Nothing here rests on a number we cannot point at.

This is one of fifteen categories. You can read a real report this engine produced on this very site — including the findings it raised against us — or ask for an audit of yours.