Analytics Audit (analytics-audit)

Summary

Tag managers, analytics, pixels, consent mode, blocking scripts, and tracker inventory (21+ trackers detected; only rows below produce findings).

Classification

• Category: SEO
• Plugin id: analytics-audit
• Version: 1.0.0
• Target types: WEBSITE, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 4 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for analytics-audit.

Check	Typical severity	Why
GTM loaded but no dataLayer	WARNING	GTM can fire tags, but without a working data layer your events and conversions lose context and become hard to trust.
dataLayer exists but has no push events	INFO	An empty data layer usually means tracking is initialized but no meaningful business events are being published.
Google Consent Mode v2 not configured	WARNING	Missing Consent Mode v2 can break compliant measurement in the EU/EEA and reduce modeled conversion quality.
Consent Mode defaults to granted	INFO	Default-granted consent can create legal/privacy risk and send tracking signals before the user has made a choice.
Render-blocking tracking scripts	WARNING	Blocking trackers delay first render and interaction, which hurts UX and can impact conversion and SEO signals.
Duplicate tracker instance (per tracker name)	WARNING	Duplicate tags often double-fire events, inflating metrics and making attribution/reporting unreliable.
Universal Analytics without GA4	WARNING	UA is deprecated, so relying on it without GA4 creates continuity risk and limits future reporting capabilities.

How each check works

1. Single-page fetch — GET target URL once (default timeout 15s). All detection is on the initial HTML string; no JavaScript execution.
2. Tracker inventory — Match 21+ definitions (GTM, GA4, UA, Meta/Facebook Pixel, TikTok, Snapchat, LinkedIn, Pinterest, Hotjar, Clarity, Plausible, Fathom, Matomo, Umami, Segment, HubSpot, Google Ads, Cookiebot, CookieYes, OneTrust) via regex and substring patterns on HTML.
3. dataLayer — Detect dataLayer / dataLayer.push in HTML; count pushes and extract event names from inline push objects. Does not inspect GTM container JSON.
4. Consent Mode v2 — Look for gtag('consent', 'default'…) or update in HTML. WARNING only when Google trackers exist, consent is not configured, and no CMP (Cookiebot/CookieYes/OneTrust) is detected.
5. Blocking scripts — Cheerio scan of <script src> in head/body whose src matches known tracker domains; count scripts without async or defer.
6. Duplicates — For GA4/UA and Facebook Pixel only: more than one ID in HTML triggers a per-tracker WARNING.
7. UA without GA4 — UA pattern present and no GA4 measurement ID (G-…) in HTML.
8. Metrics-only signals — Absence of trackers, GTM trigger heuristics (purchase/addToCart/contact from dataLayer + HTML), Meta fbq('track') checklist, privacy-policy link heuristic, and trackingHealthScore do not create findings when tags are missing by design.

Caveats and concerns

• Static HTML only — Tags injected client-side (SPA, delayed GTM loads, consent-gated tags) may be invisible; empty dataLayer does not prove broken runtime tracking.
• GTM trigger checklist is heuristic — Cannot read GTM trigger definitions server-side; purchase/cart/contact signals are pattern guesses.
• No duplicate check for most pixels — Only GA/UA and Facebook Pixel IDs are deduplicated; double TikTok/Hotjar tags are not flagged.
• Consent/legal — Findings are technical signals, not legal compliance advice.
• Wildcard Meta Pixel — “Meta Pixel” detection without fbq('init') may false-positive on generic Facebook SDK snippets.

Source

packages/test-plugins/src/plugins/analytics-audit.ts