GA4 Audit: A Practical Checklist for Trustworthy Analytics

Most properties were migrated in a hurry before Universal Analytics stopped processing data on 1 July 2023, and nobody has looked at the settings since. A GA4 audit is how you find out whether the numbers your team argues about every month are worth arguing about.

This is not a theoretical exercise. A first audit on a neglected property typically turns up three or four issues that were materially distorting reporting — a retention setting throwing away 12 months of history, key events counting the same action twice, or internal traffic inflating engagement. Work through the sections below in order; each one takes minutes.

Property and admin settings

Start in Admin, because these are one-click fixes with outsized effects:

• Data retention. The default is 2 months for event-level data. Set it to 14 months. This only affects explorations and non-standard reporting, but the difference between 2 and 14 months is the difference between having year-over-year analysis and not. It is not retroactive — data already aged out is gone.
• Time zone and currency. Wrong time zone shifts every daily number. Changing it later does not restate history, so fix it and note the date.
• Data streams. One web stream per site. Multiple streams for the same site cause duplicated sessions and inconsistent attribution.
• Internal traffic filters. Check they exist and that they are set to Active, not Testing. A filter left in testing mode does nothing.
• Unwanted referrals. Payment gateways, auth providers, and your own subdomains belong here. Missing entries are the classic cause of self-referral traffic and lost campaign attribution.
• Cross-domain measurement. Every domain in the user journey should be listed. Missing domains break sessions and dump traffic into Unassigned.
• Reporting identity. Know which setting you are on. Blended and observed identities behave differently from device-based, particularly around data thresholding.

Data collection and tagging

Next, verify what is actually being sent. Open the site with debug mode active and watch DebugView.

• Confirm the GA4 configuration fires exactly once per page. Duplicate tags — one hardcoded, one in Google Tag Manager — double your pageviews and halve your engagement rate.
• Check the event order. Any event arriving before the configuration produces sessions with missing landing page and campaign values.
• Verify consent mode behavior in both states if you run a banner. Test with consent granted and with it denied, and note the difference.
• Check for personally identifiable information in URLs. Email addresses in query strings violate the terms of service and can get a property disabled. Use data redaction settings on the stream to strip email and query parameters.
• Confirm the tag fires on every template, not just the homepage. Checkout pages and thank-you pages are the ones that get missed in a redesign.

Compare a day of GA4 sessions against server logs or your CDN analytics while you are here. You should expect GA4 to be lower — ad blockers and consent refusals see to that — but you want to know the size of the gap rather than discovering it during a board meeting. On many sites the difference sits somewhere between 5% and 20%, and it is a number worth writing down.

Events and key events

The naming layer is where most reporting confusion originates. GA4 renamed conversions to key events in 2024, so if your documentation still says conversions, update it while you are here.

• Naming convention. One convention, lowercase with underscores, applied consistently. Mixed conventions produce near-duplicate events that never get merged.
• Reserved names. Custom events must not use GA4’s reserved names. Collisions cause silent data loss.
• Key event count. If everything is a key event, nothing is. Five to eight meaningful key events is a healthy number; twenty means nobody can interpret the conversion rate.
• Double counting. A form submission tracked both by enhanced measurement and by a custom tag counts twice. Check totals against the back end.
• Custom definitions. Confirm every event parameter you rely on is registered as a custom dimension, and remember registration is never retroactive.
• Unused definitions. Archive dimensions nobody uses. The limits are 50 event-scoped and 25 user-scoped, and neglected properties run out.

Traffic quality checks

Now look at the data itself for symptoms of the problems above:

• “(not set)” rates. Check landing page and session campaign specifically. A few percent is structural; 20% points at tag sequencing or cross-domain gaps.
• Unassigned traffic. Break down Traffic acquisition by session source / medium and read the unassigned rows. The offending UTM values are printed right there — usually bad casing or invented mediums.
• Self-referrals. Your own domain appearing as a referrer means a cross-domain or unwanted-referral gap.
• Suspicious spikes. Sudden traffic from an unexpected country with zero engagement time is bot or spam traffic. Compare with server logs before you build a theory.
• Direct traffic share. Above 30% on a marketing site usually means attribution is leaking, not that everyone types your URL.
• Thresholding warnings. If reports show the thresholding icon, some rows are being withheld and your breakdowns will not sum to totals.

Integrations

Missing links quietly degrade several reports at once:

• Google Ads. Linked, with auto-tagging enabled and no competing manual UTMs on the same campaigns.
• Search Console. Linked and the collection published, so query and landing page data is reachable inside GA4 — with the honest caveat that the linked reports expose only a limited slice and cannot be combined with arbitrary GA4 metrics.
• BigQuery export. Turn it on even if you have no immediate use. It is free at the daily export tier for most sites and it is the only complete record you will ever have; you cannot backfill it later.
• Merchant Center, Google Signals, and any server-side setup — verify each is configured deliberately rather than by accident.

The reporting layer and access

Two areas people skip and later regret.

Check attribution settings under Admin. Note the current model and lookback window, because changes to either apply retroactively to your reports and can silently restate last quarter. Write the current configuration into your documentation so a future change is detectable.

Then review user access. Remove departed staff and former agencies. Confirm someone other than one person holds Administrator, because properties get orphaned when the only admin leaves. Check whether anyone with Editor rights could publish a report change that others would mistake for a data change.

While in the reporting layer, open the Library and see what is actually published. Properties accumulate abandoned collections and half-finished detail reports that nobody trusts but everybody still opens. Unpublish the ones that no longer reflect how the business measures itself; an unused report that quietly contradicts the current definition of a key event will eventually be quoted at you.

Making it a routine, not an event

A first audit takes two to three hours. Keeping the property healthy takes about thirty minutes a month:

1. Monthly: unassigned percentage, “(not set)” rates, key event totals against the back end, any new events appearing in the events list.
2. Quarterly: custom definition inventory, user access, attribution settings, DebugView pass on the main templates.
3. After every site release: confirm the tag still fires on changed templates and that key events still register.

Write the findings down each time. An audit with no record is one you will repeat from scratch next year.

What an audit cannot tell you

Clean GA4 data tells you what happened after the click. It never tells you what people searched to get there, because GA4 does not report keyword-level search terms — that is Search Console’s job, and the linked reporting inside GA4 exposes a narrow view of it. Nor does GA4 say anything about your competitors, your rankings, or the queries you could be winning.

SEO Rocket connects Search Console and GA4 as ground truth for your own site and displays that measured data beside third-party estimates, clearly labeled so a modeled figure is never read as a recorded one. It does not replace GA4 or implement tracking for you — every fix on this checklist is still your work to do. What it changes is where the clean data lands afterwards: next to the ranking, query, and competitor picture, in one place, so the audit you just finished actually informs the next decision.