How to audit a Google Tag Manager container
Export the container (Admin → Export Container) and go through it in this order: conversion tags and their triggers, duplicate tags and pixels, consent settings, Custom HTML tags, paused and unused items, and who can publish. Then test in Preview mode on real pages. The first two cause most of the wasted ad spend. The rest cause most of the breakage.
Before you start
Get the container ID (GTM-XXXXXXX) and, if you have access, export the published version as JSON: Admin → Export Container. No access? The published container is public at https://www.googletagmanager.com/gtm.js?id=GTM-XXXXXXX. It holds the same tags, triggers and variables in compiled form, without names or notes.
1. Conversion tags and triggers
List every Google Ads Conversion Tracking tag (__awct in the compiled file), every GA4 event tag that sends a key event, and every Meta, LinkedIn or other pixel event. Write down each one's trigger. Red flags:
- A conversion tag on All Pages, Page View or DOM Ready. Why that hurts.
- A conversion on a click trigger ("Book a demo" clicked) instead of a success event.
- A conversion on a login or dashboard event. Those are existing customers.
- A thank-you rule like "Page URL contains
thank" that also matches a blog post.
2. Duplicates
- Two Google tags loading the same GA4 measurement ID, or two GA4 properties loading on every page.
- A pixel in GTM plus the same pixel hardcoded in the site. Search page source for
fbq(,gtag(and_linkedin_partner_id. - The same signup counted by a Google Ads tag and again by a GA4 key event imported into Google Ads.
3. Consent
Note which tags have consent settings and which fire regardless. Google tags follow Consent Mode. Custom HTML and most third-party templates don't, unless you add a consent requirement or fire them from a consent-based trigger. Then test: private window, don't touch the banner, watch the Network tab. Meta Pixel specifics.
4. Custom HTML
A Custom HTML tag runs any JavaScript on every page it fires on. Read each one. Look for vendors nobody uses anymore, scripts from domains no one recognises, and code that writes to the dataLayer in ways other tags depend on. Remove what no one can explain.
5. Paused, unused and unnamed
- Paused tags: delete them or write down why they stay.
- Triggers and variables that no tag uses. They slow down the next audit.
- Names like "New Tag (3)". Pick one pattern, e.g.
Platform - Event - Detail. - Versions with no name or notes. When a conversion breaks, version notes are how you find the change that did it.
6. Access
Admin → User Management. Check who has Publish permission on the container. Former agencies and ex-employees with publish rights are common. Keep that list short.
7. Test the live result
Use Preview mode (Tag Assistant) and click through home, pricing, signup and the thank-you step. Each conversion should fire once, only on the real success event. Then check the Network tab too: hardcoded tags and plugin-added pixels never show up in GTM.
What GTM can't tell you
Whether a Google Ads action is primary or secondary (that lives in Google Ads), and anything sent only from a server-side container or your backend.
FAQ
How often should I audit GTM?
A full audit once or twice a year, plus a check after every release that touches forms, signup or checkout. A lot of breakage comes from site changes, not GTM changes.
Can I audit a GTM container without access?
Partly. The published container at googletagmanager.com/gtm.js?id=GTM-XXXX lists tags, triggers and variables, without names or notes. Paused tags, unpublished workspaces and user permissions stay hidden.
Run all nine checks on your site, free.
Fireshift reads what your site tells Google Ads, GA4 and Meta from the outside. No install, about a minute.
Get my Leak Score