Search for an ecommerce audit checklist and nearly every result hands you the same list: page speed scores, mobile tap targets, meta descriptions, checkout button color. Work through all of it, fix every item, and a store can still be scaling ad spend against a ROAS number that is wrong by a third, because none of those checks ever touch the data the business is actually making decisions from.
That is not a hypothetical gap. It is the most common blind spot we see walking into a new engagement: a store that passed its SEO and UX review with flying colors and still could not explain why GA4 revenue and Shopify revenue disagreed by double digits.
Site speed and on-page SEO are real, worth checking, and not what this post covers. This is the checklist for the audit almost nobody's guide includes, the one that checks whether your tracking, funnel data, ad spend, and reports can actually be trusted, because that is usually where the expensive mistakes are hiding.
Why the standard checklist misses this
A site speed or SEO audit answers "can people find and use my store." A measurement audit answers a different question: "is the data I am making decisions from actually true." Those are not competing checklists, they are checklists for different failure modes, and most guides only cover the first one.
The gap matters because the second failure mode is invisible from the outside. A store can have a fast, well-designed, technically clean website and still be scaling ad spend against a ROAS number that is inflated by a third, or reporting revenue that does not match what the bank actually received. Nothing about the site itself would show that.
Here is what each of the four measurement domains should cover, in the order most audits actually work through them.
1. Tracking: does the data collection itself work
Start here, because every downstream number depends on it. A funnel or reporting problem that traces back to bad tracking will keep reappearing no matter how many times you fix the report on top of it.
- Check for duplicate tags on the same page. A single container firing GA4 twice, or a native platform pixel app running its own copy of a tag alongside GTM, inflates every event count without any obvious symptom until someone compares total sessions to actual traffic. GA4's DebugView shows every event firing in real time and is the fastest way to catch a duplicate before it pollutes 90 days of reporting.
- Confirm the real purchase event fires, and that nothing generic is standing in for it. In one delivered audit, GA4 showed roughly 526,000 "conversions" over 90 days against $0 recorded revenue, because session_start and user_engagement had been marked as key events while the actual purchase event never fired at all. All eight linked Google Ads conversion actions read zero for the same reason.
- Walk the full measurement plan against what is actually live in GTM. The same engagement had a complete plan on paper, 42 dataLayer variables and 13 funnel triggers for a 14-screen intake, but 10 of the 13 triggers were orphaned and no GA4 event tag existed to catch them.
- Check consent configuration against real visitor geography, not an assumption. A consent banner set to show only for EU browser timezones once left every non-EU visitor permanently consent-denied, blocking ad and analytics tags globally without anyone noticing for weeks.
- Confirm cross-domain and cross-device signal is actually surviving the handoff, not just configured to. UTMs a server silently rewrites internally, or click IDs stored in a way that clears on referrer change, will pass a config review and still fail in production.
Our GA4 audit checklist goes deeper into the specific layering, configuration, event quality, then reconciliation, that catches most of this before it reaches a report.
2. CRO: where the funnel actually leaks
Once the data collection itself is trustworthy, the funnel numbers it produces become worth acting on. This is where a checklist should look for where visitors actually drop off, not where a template says to look.
- Map add-to-cart to purchase completion by step, not just as one blended rate. One high-AOV Shopify store, roughly $460 average order value, lost 63 percent of add-to-cart sessions at the shipping step alone, because shipping rates were hidden behind a three-field calculator instead of shown up front. Surfacing the estimate earlier was worth an estimated $8,000 a month in recovered revenue at that AOV.
- Check where social proof actually renders, not whether it exists. The same store had over 540 five-star reviews, all buried in the page footer, with nothing visible near the add-to-cart button. Product-view-to-cart ran at roughly 4 percent.
- Audit paid traffic landing pages against the actual offer. Three of four paid social ads for one brand pointed at a free-guide page that attributed roughly $50 in revenue from over 1,050 visits, with zero of about 250 guide signups converting to a purchase within 30 days. The ad spend and the landing experience were solving different problems.
- Test the mobile fold specifically, since most ecommerce traffic is mobile. A 130-option currency selector plus a first-paint email popup occupied the entire visible screen for one store where 73 percent of product views happened on mobile.
3. Paid media: is the spend efficient, or just reported that way
This is the domain where a clean-looking dashboard hides the most expensive mistakes, because platform-reported numbers are self-graded.
- Check event deduplication between browser and server-side pixels. Meta's own Conversions API documentation is explicit that a shared event ID is required to avoid double counting when both a browser pixel and a server event fire for the same action. One catalog missing that on part of its inventory ran an Events Manager dedup rate around 71 percent, with reported ROAS inflated by roughly a third as a result.
- Confirm exclusion audiences survive an event rename. A purchaser-exclusion audience built on a since-renamed event silently froze for one advertiser, and retargeting frequency climbed past 9 against roughly 22 percent recent-buyer overlap before anyone caught it.
- Check Merchant Center approval status against the live catalog, not just the feed as submitted. One store had about 11 percent of its catalog silently disapproved, including best-sellers, after a currency app update created a feed-to-landing-page price mismatch alongside missing GTINs on one product line. Google's own Merchant Center policy documentation covers the specific mismatch and missing-attribute rules that trigger this.
- Compare platform-reported ROAS to blended revenue and spend. One brand's dashboards showed 4.2x on Meta and 3.8x on Google in the same window that blended revenue against total spend worked out to roughly 1.9x. Both platforms were technically reporting correctly, on incomplete and overlapping windows of credit.
A Google Ads or Meta account can pass every line on this list and still be inefficient for reasons specific to your catalog and audience, which is why a paid media audit goes deeper than any checklist can.
4. Reporting: can anyone actually trust the number on the dashboard
The last domain is the one that decides whether the first three even matter, because a wrong number reported confidently is worse than an obviously broken one nobody trusts.
- Reconcile summed platform-attributed revenue against actual store revenue. In one reconciliation, platform-attributed revenue exceeded store revenue by roughly 40 percent in the same window, with the same order IDs showing up in both platforms' conversion exports, double-counted rather than double-earned.
- Audit UTM consistency across every channel, not just the biggest one. Roughly 31 percent of one store's traffic landed as direct or none while ad platforms recorded matching click volume, traced back to three different UTM spellings for one channel (fb, facebook, meta-paid) plus untagged email and influencer links.
- Check whether the spreadsheet still points at a live source. One founder's weekly report drifted up to 18 percent from its underlying data because a revenue column referenced a tab that had since been deleted, and the formula silently failed over to a stale cached value instead of throwing an error.
- Confirm every stakeholder is defining the same metric the same way. ROAS, MER, and blended ROAS answer different questions, and a dashboard that mixes them without labeling which is which will produce confidently wrong conclusions even when every underlying number is correct.
Our ecommerce reporting audit walks through the decision-gap and metric-definition checks that catch this specific failure mode.
Running the checklist as one audit instead of four
The four sections above can be run separately, and often should be if only one clearly feels broken. But the checklist gets more valuable the moment two domains disagree with each other, because that disagreement is usually the actual finding.
A funnel leak that traces back to a tracking gap. Wasted ad spend that traces back to a double-counted conversion event. A hero product that looks profitable until COGS and platform fees enter the picture. None of those show up if tracking, CRO, paid media, and reporting are each checked in isolation by a different vendor on a different timeline. Our breakdown of when one audit isn't enough covers how to tell whether your store is at that point or still better served by a single focused check.
That connected read is exactly what Anlyto's ecommerce performance audit is built to deliver: all four domains, one prioritized 90-day roadmap, fixed bundle pricing from $1,500. If you are not sure yet whether the issue is broad enough to need all four or narrow enough for a single focused check, an analytics audit is the fastest way to find out which one you actually need before committing to either.
The one-line version of this checklist
If none of the above is actionable this week, start with the single highest-leverage check: open GA4's DebugView on your own checkout flow right now and watch whether exactly one purchase event fires per completed order, with the correct value attached.
If that fails, stop reading checklists and fix that first. Every other number downstream, funnel rate, ROAS, blended revenue, inherits whatever that one event gets wrong.
