Fireshift / Method
How the scan and the studies work
We read public files only: a site's HTML and the Google Tag Manager and Google tag containers it loads from googletagmanager.com, up to six per site. Every Google Ads conversion tag is resolved to the trigger that fires it and sorted by fixed rules, not by a model. The Leak Score starts at 100 and loses fixed points per type of finding. The studies run the same code across hundreds of sites on a stated date. You can reproduce any finding in a browser tab.
What we read
| Read | Instant scan | Emailed Leak Score and studies | Paid live visit |
|---|---|---|---|
| Pages | Homepage only | Homepage, /pricing, /signup, /demo | Homepage, main CTAs it links to, up to 6 funnel pages |
| How | A page reader fetches the homepage and returns it; your browser keeps only the tag IDs | Our server fetches the HTML | Headless Chromium |
| Containers | Each GTM- and G- ID found, from googletagmanager.com/gtm.js or /gtag/js, plus GA4 configs a GTM container points at. Up to 6 per site. | Same, plus every request the pages send | |
| Also | Inline send_to: 'AW-…/…' conversions in the page HTML | Requests to Google Ads, GA4, Meta, LinkedIn, Reddit, TikTok and Microsoft Ads, after accepting the cookie banner where we find it | |
No step submits a form, logs in or hides that it is automated. Domains are checked against a strict pattern before any request. The instant scan runs in your browser from /assets/scan.js, a line-by-line copy of our scoring engine. A test runs both on the same containers and fails on any difference.
The checks and their points
Each type of finding takes its points once, however many conversions it hits. The score can't go below 0. Grades: A 90+, B 75+, C 60+, D 40+, F below 40. When we find no public container, there is no score.
| Finding | Points | The exact rule |
|---|---|---|
| Google Ads conversion on every page load | −30 | A conversion tag (__awct) whose trigger is only page-load events (gtm.js, gtm.dom, gtm.load, gtm.init, gtm.init_consent, history change) with no URL or other condition and no exception or blocking trigger. |
| GA4 key event that is really a visit | −25 | A GA4 key event named page_view, session_start, first_visit, user_engagement or scroll. |
| Conversion on login | −20 | An event name, URL, click or other trigger condition contains log in or sign in as a whole word (login, sign-in, userLogin). design-inspiration or blog-insights don't count. GA4 key events are checked the same way. |
| Conversion when a trial ends | −20 | An event name with trial followed by end, ends, ended, expire(s/d) or over, or freetrialend. Also checked on GA4 key events. |
| Conversion on a click | −10 | The trigger is a GTM click (gtm.click, gtm.linkClick), has a click condition, or its event name contains click, cta or button. Phone, email, SMS, WhatsApp and click-to-call links are left out: those are real lead actions. |
| Duplicates | −10 | The same conversion label on 2+ tags, or one trigger firing 2+ conversion labels. "One trigger" means the exact same trigger conditions: the same firing rule, or rules with identical conditions in the same container. |
| More than 8 conversion labels | −8 | More than 8 distinct Google Ads conversion labels across the containers we read. |
| No conversion values | −8 | Every Google Ads conversion tag sends no value (empty or 0). |
| Two or more GA4 properties | −7 | 2+ distinct G- IDs in the page HTML or the containers. |
| Page view of a non-success URL | −6 | A page-load trigger limited to a URL that doesn't contain thank, success, confirm, complete, welcome, booked, scheduled, order, receipt or onboard. |
| Conversion on every page in a live visit | −30 | Paid work only: in a headless browser visit, a Google Ads conversion fired on every page we opened. |
Each rule has its own page with examples under all checks. Why the weights are what they are: how the Leak Score is calculated.
The studies
Every study runs the same static scan (homepage, /pricing, /signup, /demo, up to 6 public
containers) on a list of B2B SaaS domains, then counts. We remove redirects and sites that serve an identical container set, so one
company doesn't count twice. We publish shares, never site names.
| Study | Scanned | Sample | Headline |
|---|---|---|---|
| 449-site study | 4 Nov 2026 | 452 B2B SaaS domains; 449 with a result; 235 with a Google Ads conversion | 61.7% of the 235 count a page view, login or click |
| Click conversions | 4 Nov 2026 | 349 domains; 258 after removing sites with the same containers; 225 with a Google Ads conversion | 45.3% fire one on a non-contact click |
| Duplicates | 4 Nov 2026 | 312 domains; 309 after de-duplication; 228 with a public container; 203 with a Google Ads conversion | 30.0% count one action twice (exact trigger conditions) |
| Login and trial | 5 Nov 2026 | 306 domains; 229 after de-duplication; 206 with a Google Ads conversion | 7.3% count a login; none counts a trial ending |
| Conversion values | 5 Nov 2026 | 285 domains; 209 with a public container; 193 with a Google Ads conversion | 68.4% send no value; 21.6% of 162 GA4 sites load 2+ properties |
The samples are hand-picked, not random: well-known SaaS vendors plus the SaaS sites on our own outreach list. They lean to larger companies. Each study reads a different list, so its numbers aren't a rescan of the same sites.
Known limits
- Primary vs secondary. We can't see in your Ads account whether a conversion is primary or secondary, or set to count One or Every. A secondary conversion doesn't drive bidding. Every report says so.
- Homepage only in the instant scan. Tags that load only on pricing, signup or demo pages show up in the emailed score, not the instant one.
- Static read. Server-side tags, Conversions API events, tags added by a consent tool or a non-Google loader, and anything after a form submit are missed. Real numbers are likely higher.
- Setup, not hits. We see that a value comes from a variable, not what it resolves to, and we can't tell whether a trigger still fires.
- Rules read names. Login, click and trial checks read event names, URLs and click conditions. A custom name can hide intent, and a page view of
/signupcan be a real step in some funnels. - Duplicates compare exact trigger conditions. Since 5 Nov 2026 the scan counts one trigger firing 2+ labels only when the labels share the same firing rule, or rules with identical conditions. Before that it compared a readable summary, which made different triggers look the same: 66.5% of our 203-site sample against 30.0% on exact conditions. Two labels on one trigger can still be deliberate, such as two Ads accounts, so check which account each label belongs to. See the corrections log.
- One location. Sites that change tags by country are seen from wherever the scan ran.
The full list with a two-minute self-check for each: what we can't see from outside.
Reproduce a finding yourself
- Open your homepage, view the source and search for
GTM-. That is your container ID. - Open
https://www.googletagmanager.com/gtm.js?id=GTM-XXXXXXXwith your ID. This is the file every visitor's browser downloads, and the file we read. - Search it for
__awct. Each hit is a Google Ads conversion tag.vtp_conversionLabelis the label,vtp_conversionValuethe value. - Find which trigger fires it: in
"rules", an"add"entry lists tag numbers and the"if"entry next to it lists the conditions ("predicates"). A condition on__eis the event name, on__uthe URL. Or skip the reading and open the container in GTM Preview in your own account. - Compare what you see with the rules above, or paste the same ID into the GTM container viewer or the free scan.
- Then check the one thing we can't: in Google Ads, Goals, Conversions, Summary, is the flagged action primary?
For a study, email hello@fireshift.ai and we send the aggregate file behind it (counts and shares, no site names). If your numbers differ from ours, tell us. If we are wrong, it goes in the corrections log.
FAQ
Does the scan use AI to judge my tracking?
No. The checks are fixed rules in code, the same for every site. AI helps us write and build, not score. See how we use AI.
Why do the studies have different sample sizes?
Each study read its own list of domains on its own date, and each counts only the sites where we could read a public container with a Google Ads conversion.
Check your own site, free.
Fireshift reads what your site tells Google Ads, GA4 and Meta from the outside. No install, no account access.
Scan my site