Fireshift / Help / How the scan works

How the scan works

By the Fireshift team · Updated 2026-11-05

Short answer

There are two free reads. The instant scan on /scan/ runs in your browser: it finds the tag IDs on your homepage, loads those containers from googletagmanager.com and shows the findings in seconds. The emailed Leak Score also reads /pricing, /signup and /demo and up to six containers. Both read every Google Ads conversion tag and its trigger and every GA4 key event, and sort them by our rules. No forms, no logins. The Teardown and Fix Sprint add a live visit in a headless browser.

Step by step

  1. Validate the domain. Lowercase letters, digits, hyphens and dots only. Anything else is refused before any request.
  2. Fetch the pages (the homepage for the instant scan; homepage, /pricing, /signup and /demo for the emailed score) and pull out every GTM-, G- and AW- ID, plus any inline send_to: 'AW-…/…' conversion.
  3. Download the containers. googletagmanager.com/gtm.js?id=GTM-… and gtag/js?id=G-… are the same files every visitor's browser downloads. We read up to six per site, including GA4 configs a GTM container points at.
  4. Parse them. A container holds tags, triggers ("rules"), conditions ("predicates") and variables ("macros"). For each Google Ads conversion tag (__awct) we take the label, the value, and the trigger conditions that fire it.
  5. Apply the checks. Page load with no condition, page view of a non-success URL, login, trial end, click, duplicates, more than 8 labels, no values, 2+ GA4 properties. Each rule is on its check page.
  6. Score it. 100 minus the points of each finding. How the score works.

What the live visit adds

For the Teardown and Fix Sprint we also load the site in headless Chromium: the homepage, the main CTAs it links to (clicked, never submitted), and up to six funnel pages such as pricing, signup and demo. We accept the cookie banner where we can find it and log every request to Google Ads, GA4, Meta, LinkedIn, Reddit, TikTok and Microsoft Ads, decoded to vendor and event. That shows conversions that fire on every page we open, and tags loaded outside GTM.

Rules we never break

  • No form submissions, no signups, no logins, no demo requests.
  • No bot-detection workarounds. If a site blocks headless browsers, we report that.
  • Only what the site serves publicly.

FAQ

How long does a scan take?

The instant scan shows results in a few seconds. The emailed Leak Score, which reads more pages, arrives within 24 hours.

Do you store my scan?

The instant scan stores nothing unless you ask for the report by email. An emailed request and its result are kept for 12 months. See privacy and data.

Check your own site, free.

Fireshift reads what your site tells Google Ads, GA4 and Meta from the outside. No install, no account access.

Scan my site

See a sample reportOr have us fix it: Fix Sprint, €1,500