GA4 Setup and Audit Checklist for Business Websites

Why GA4 setups go wrong

GA4 is easy to install and surprisingly easy to install badly. Paste a tag into the site header and data starts flowing within minutes. Page views, sessions, some automatically collected events. It looks like it works, so nobody checks further.

Then the problems surface one at a time. The lead count does not match the CRM. Paid social traffic shows up as referral. Every booking appears to come from the payment processor. The office’s own visits inflate the numbers. A redesign removes the form tracking and nobody notices for a season.

This checklist is for two situations: setting up a property properly, usually alongside a new website, and auditing one that already exists. The steps are the same. Before either, you should know what you are trying to measure, which is the job of a marketing measurement plan. GA4 is where that plan gets implemented, not where it gets written.

A note on durability: Google renames and moves things in the GA4 interface often. This list describes what to check, not which menu to click, so it should outlast the next redesign.

Foundations: property, tag and data retention

• One property, one web data stream for the site. Multiple streams or duplicate properties for the same website split your data. If you have a separate app, it can be another stream in the same property.
• The tag fires exactly once per page. A common audit finding is GA4 installed twice: once hard-coded by a developer and once through Google Tag Manager or a CMS plugin. Every page view and event is doubled, and engagement metrics look oddly good.
• Ownership sits with the business. The GA4 account should belong to your organization’s Google account, with agencies and freelancers added as users. If the person who set it up leaves and takes the admin login with them, you will be starting again.
• Data retention extended. GA4 defaults to a short retention period for event-level data used in explorations. Standard reports are unaffected, but if you want to explore last year’s behaviour, set retention to the maximum your property allows on day one. It does not apply retroactively.
• Time zone and currency correct. Atlantic time, and Canadian currency if you record revenue. Small, and annoying to discover later.
• Search Console and Google Ads linked. Linking brings organic query data and ad performance into context and lets key events flow to Google Ads. Our Search Console guide covers the other half of that connection.

Events and key events

GA4 records everything as an event. Some are collected automatically, some come from enhanced measurement (scrolls, outbound clicks, file downloads, site search, video engagement and form interactions, each of which can be switched on or off), and the rest you define.

What to check

• Enhanced measurement settings are deliberate. The automatic form interaction events can fire on forms that were never submitted successfully, or miss forms built with embedded tools. Many setups switch them off and track forms explicitly.
• Each business action has its own, properly named event. A quote request, a booking, a phone click, a brochure download. Google publishes a list of recommended event names (generate_lead and purchase among them); use them where they fit, because some reports and integrations expect them.
• Form tracking fires on success, not on click. A tag that fires when the submit button is clicked counts failed validation, spam and double clicks. Fire on the confirmation: a thank-you page, a success message or the form platform’s success callback.
• Only real business actions are key events. Key events (what GA4 used to call conversions) should match the primary conversions in your measurement plan. If scrolls, page views and newsletter signups are all key events, the total is meaningless and any ad platform importing them will optimize toward the cheapest one.
• Useful parameters are attached. Form name, booking type, location or language. If parameters need to appear in standard reports, register them as custom dimensions.

For bilingual sites, decide early whether English and French pages share one event with a language parameter or use separate events. Sharing one event is almost always easier to report on.

Cross-domain tracking and unwanted referrals

Many business websites hand visitors off to another domain to finish the job: a booking engine, an online store on a separate platform, a donation tool, a scheduling service, a payment page.

• If you control the tag on both domains, configure cross-domain measurement in the GA4 tag settings so the visitor is recognized as the same person on both sides. Test it: click from your site to the other domain and confirm the session continues rather than starting fresh.
• If you do not control the other domain, at minimum stop it from stealing credit. Add payment processors and booking tools to the list of unwanted referrals, so a visitor returning from checkout is not recorded as a new session from that tool.
• Check where the conversion actually happens. If bookings complete on a third-party system that sends visitors back to a confirmation page on your site, track that page. If they never come back, you may need the vendor’s own integration or a server-side feed.

Tourism operators, recreation facilities and event venues in Atlantic Canada run into this constantly, because the booking engine is rarely the same system as the website. It is also the most common reason a season’s worth of data shows the booking tool as the top traffic source.

Consent and privacy

Canadian privacy expectations for web analytics are tightening, and consent is no longer something to bolt on after launch. Federal privacy law expects meaningful consent for the collection of personal information, and Quebec’s Law 25 sets stricter rules for tracking technologies used on Quebec residents. Organizations in New Brunswick serving bilingual audiences often have Quebec visitors whether they planned for them or not. We cover the language side in bilingual by default. What your obligations are is a question for your legal counsel; what follows is how to make sure the setup does what you decided it should.

• A consent banner that actually controls tags. A banner that records a choice but lets every tag fire anyway is worse than useless, because it creates a record of ignoring the visitor.
• Google consent mode configured. Consent mode tells Google tags what the visitor agreed to (analytics storage and advertising storage, plus signals for ad personalization and user data) so they adjust their behaviour. Decide between basic mode, where tags wait for consent, and advanced mode, where tags send limited cookieless signals before consent so Google can model some of the missing data. That choice belongs in your measurement plan, informed by your counsel.
• Other pixels respect the same choice. Meta, LinkedIn and any other advertising tags should follow the same consent state as GA4.
• Tested in both paths. Load the site fresh, decline, and confirm in your browser’s developer tools and in GA4’s debugging tools that tags behave as configured. Then accept and check again. Most consent problems are found only this way.

Expect reported numbers to drop when consent is implemented properly. That is not a measurement failure; it is the measurement becoming honest.

Internal traffic and channel attribution

Internal and developer traffic

• Internal traffic defined and filtered. Define your office IP addresses as internal traffic, then make sure the data filter is active rather than left in testing mode. Remote staff will slip through; accept it.
• Developer and debug traffic excluded. Debug-mode hits should not appear in your reports.
• Spam and bot patterns checked. Unexplained spikes from a single city, or traffic with no engagement at all, deserve a look.

Channels

GA4 sorts traffic into default channel groups (organic search, paid search, paid social, email, referral and so on) using rules based on source and medium. If your campaign links are tagged inconsistently, traffic lands in the wrong channel or in Unassigned.

• A written UTM convention. Lowercase, consistent source and medium values, and a medium that matches what GA4 expects for each channel type. Paid social tagged as utm_medium=social will be read as organic social.
• Auto-tagging on in Google Ads, and manual UTMs on everything else: Meta, LinkedIn, email, QR codes on print, partner links.
• Unassigned and (not set) reviewed monthly. Growth in either is a symptom of a tagging or configuration problem.
• Custom channel groups where needed. If you run tourism partnerships or directory listings that matter, a custom group can report them separately.

Remember that GA4 attribution and ad platform attribution will never match. They use different rules and windows and see different data. Use GA4 to compare channels against each other; use the CRM for what actually turned into revenue.

QA before launch, and the audit after

Nothing gets reported until it has been verified. Before launch, or after any audit fix:

1. Use DebugView and Tag Assistant to walk through every primary conversion yourself, on desktop and on a phone.
2. Confirm each key event fires once, with the right parameters, only on success.
3. Submit a real test through each form and match it against the CRM or inbox.
4. Test consent in declined and accepted states.
5. Test the cross-domain handoff, including the return from payment or booking.
6. Write down what you tested and when, so the next person knows what “working” looked like.

Then re-run the checks after every website release, form change, CMS plugin update or new campaign platform. Tracking rarely breaks on its own; it breaks when something near it changes. If conversions fall suddenly, check measurement first, as described in how to diagnose a drop in website conversions.

How the tags get onto the site matters too. Our comparison of Tag Manager, direct tags and server-side tagging covers governance, and client-side vs server-side conversion tracking covers data loss from browsers and ad blockers.

When we run a GA4 audit as part of our analytics and measurement work, the most common findings are the dull ones: a duplicate tag, a key event that fires on button click, an unfiltered office and a payment processor taking credit for revenue. Fixing them is rarely glamorous and almost always changes what leadership believes about which channels work. The Crabbe Mountain engagement paired a redesign with exactly this kind of measurement foundation.