How to Audit a Google Tag Manager Container You Didn't Build

Taking over an account usually means taking over a tag manager container that somebody else built, under deadline, for reasons nobody wrote down. There are forty tags, half of them named “Untitled Tag 12”, and you are expected to report on performance by Friday. This is the order we work through one in, and the specific things that are usually broken.

The goal of the first pass is not a clean container. It is an accurate answer to one question: can I trust the numbers this account is reporting? Cleaning up comes after, and only where it changes that answer.

Before you open anything, get the inventory

Start by finding out what is actually on the site, which is not the same as what is in the container. Tags can be hardcoded into the theme, injected by a plugin, or added by a second container you have not been told about. A container audit that only looks at the container will miss all three.

The fastest way to get this is to read the published container from outside. Our free tracking scan does exactly that: it pulls the public container payload, lists every tag with its real ID, and shows anything hardcoded on the page alongside it, so you can see the whole picture before you log in anywhere. It takes about thirty seconds and needs no access.

Step one: what is firing on every page

Open the container and sort by trigger rather than by tag. The tags on All Pages are the ones that affect every visitor, every session, and every number in every report. They are also where the expensive mistakes live.

• A conversion tag on All Pages is the single most damaging thing you can find, because it reports every visitor as a sale and Smart Bidding believes it. We wrote this one up separately in your conversion tag is firing on every page.
• Two analytics tags with different IDs both on All Pages means traffic is split or double counted across properties, and only one of them is feeding your ad platform.
• Custom HTML tags on All Pages are arbitrary JavaScript running on every page of the site. Each one is a performance cost and a potential security question, and this is where forgotten third-party pixels accumulate.

Step two: identify every tracking ID

Write down every ID you find, grouped by platform. You are looking for duplicates, and for IDs nobody can account for.

1. Meta pixel IDs. More than one firing on the same page means the same event is reported to more than one dataset. If the same ID appears both hardcoded in the theme and as a GTM tag, every event fires twice. That is a different problem with a different fix, covered in fixing duplicate events.
2. Google Ads conversion IDs, the ones beginning AW-. Two different ones usually means a previous agency's account is still being fed. Both accounts will report conversions, neither will match the business, and whichever one is bidding is working from a partial picture.
3. GA4 measurement IDs, beginning G-. Two properties collecting the same traffic produce two sets of reports that will never reconcile, and only the one linked to Google Ads affects your bidding.
4. Everything else. LinkedIn, Microsoft, TikTok, Pinterest, Snap. Not problems in themselves, but each one is a vendor relationship, and you should know whether the client still has it.

Any ID that nobody at the client recognises is worth escalating before you delete it. The usual explanation is a previous agency. The occasional explanation is a department you did not know existed, running their own campaigns.

Step three: find the tags that do nothing

Dead tags are the easiest win in any inherited container, because removing them carries almost no risk and makes everything afterwards easier to reason about.

• Universal Analytics tags. Google stopped processing Universal Analytics data in July 2024. These tags still load, still fire, and send to somewhere that stopped listening. They cost load time and nothing else.
• Google Optimize tags. Optimize was retired in September 2023. Worse than inert, the anti-flicker snippet it uses can still hide your page briefly while it waits for a service that no longer exists.
• Paused tags. Usually harmless housekeeping. Occasionally one of them is a conversion tag somebody disabled to debug something and never switched back on, which is worth checking one by one.
• Tags with no trigger at all. They cannot fire. Either somebody half-built something, or a trigger was deleted out from under them.

Step four: read the triggers properly

This is the step most audits skip, and it is where the real findings are. A tag list tells you what could fire. Only the triggers tell you when.

For each conversion tag, write out the firing condition in plain English. Not the trigger name, which is often wrong or inherited from a copy and paste, but what the condition actually says. You are checking that the English sentence describes a real conversion.

• “Page load where URL contains /thank-you” is a conversion.
• “Page load” is not.
• “Any click anywhere” is not, though it is often a phone number click that somebody built badly and it can be repaired.
• “Element visibility” on a form means the conversion fires when the form scrolls into view, not when somebody submits it. This one looks correct in a tag list and is completely wrong.

Step five: check what is missing

An audit that only looks at what exists will not tell you what should exist and does not. Three absences are worth checking specifically.

Conversion linking

Google needs a way to remember which ad a visitor clicked before they converted. Either a Conversion Linker tag on All Pages, or the modern Google tag, which performs the same job itself. If neither is present, browsers that restrict third party storage break the link between click and conversion.

Enhanced conversions

A setting on the conversion tag that sends a hashed email or phone number alongside the conversion, so Google can match it to a click when the cookie is gone. Google classes an enhanced conversions match rate below fifteen percent as low. It is off by default, so inherited containers very often do not have it. See enhanced conversions for Google Ads.

Coverage across the whole site

Tags installed via a theme template rather than the container often miss pages built outside that template. Check a landing page, a blog post, and the checkout, not just the homepage.

Step six: the consent layer

If there is a consent management platform on the site, everything above is conditional. Tags may be configured perfectly and simply never fire for most visitors, because the banner defaults to denied and most people never accept.

This is correct behaviour and not a bug, but it changes how you read every number in the account, and it is the explanation for a great many “tracking is broken” tickets that turn out not to be. Find out the actual opt in rate before you conclude anything. Consent Mode modelling can recover a share of what is lost, and Google reports it recovers more than half of lost ad click to conversion journeys on average. Our write up is in Consent Mode v2 and your tracking.

What to change, and in what order

Resist the urge to tidy. A container full of badly named tags that measures correctly is in better shape than a beautifully organised one you have just rewired under time pressure.

1. Fix anything that is actively reporting false data. A conversion tag on All Pages is the only true emergency on this list.
2. Fix anything that is losing real conversions. Missing conversion linking, enhanced conversions switched off, a tag missing from part of the site.
3. Remove the provably dead. Universal Analytics, Optimize, tags with no trigger.
4. Escalate the unknown. Any ID nobody can account for gets a question, not a delete.
5. Rename and document last, once you know what everything does.

Publish in small batches with a description on each version. GTM version history is the only record of what you changed, and the next person to inherit this container will be reading it the way you just read the last person's work.

What to hand back

The audit is only worth what survives it. Write down four things, somewhere the client can find them without you, because the next person to inherit this container will be in exactly the position you were in an hour ago.

• Every tracking ID on the site and who owns it. One line each. This is the document that prevents the whole problem recurring.
• What counts as a conversion, in plain English.Not the tag name, the actual condition. “A purchase is recorded when someone reaches /order-complete.”
• What you changed and when. Any report spanning the change date will show a step, and in six months nobody will remember why.
• What you found and deliberately did not change, with the reason. This is the one people skip, and it is the one that protects you.

Three things that look wrong and are not

An audit that flags everything is as useless as one that flags nothing, and new eyes on an old container tend to over-report. These three come up constantly and are usually fine.

1. A lot of Custom HTML tags. Normal on a mature site. Custom HTML is how anything without an official template gets implemented. Worth reading, not worth alarming anybody about.
2. A conversion tag on a page load trigger that also has a URL condition. This is the correct way to track a thank you page. The page load event is not the problem. The absence of a condition is.
3. Events firing that nobody asked for.Scroll depth, outbound clicks, video plays. These are usually GA4 enhanced measurement doing its job automatically, not somebody's abandoned experiment.

The part an audit cannot fix

Everything above is a snapshot. You can leave a container in perfect condition on Friday and have a developer ship a theme update on Monday that removes the container from half the site. One of the most common support tickets in this category begins “nothing changed”, and something always did. See what breaks tracking after a website migration.

That is the gap Taglert exists to close. It rechecks every connected account every thirty minutes and emails you the day conversion tracking stops, so the work you just did on an inherited container does not quietly come undone without anybody noticing.