What the checker looks for
Tracking tags are small pieces of code that tell Google, Meta, TikTok and other platforms what visitors do on your site. Ad platforms learn from that data, so a missing or doubled tag means wrong numbers and campaigns that optimize for the wrong thing.
- Analytics and ad tags: GA4, Google Tag Manager, Google Ads, Meta Pixel, TikTok Pixel, LinkedIn, Pinterest, Snap, X, Reddit, Microsoft Ads, Microsoft Clarity, Hotjar, Yandex Metrica and Matomo.
- Cookie banners and Google Consent Mode: Cookiebot, CookieYes, Complianz, OneTrust, iubenda, Borlabs, Usercentrics and others, and the consent default that has to run before the Google tags.
- Duplicates: the same pixel set up twice, the same GA4 ID configured twice, or more pixels and GA4 IDs than you expect.
- Exposed keys: access tokens and secret API keys that should never be in the code of a public page. We show them only masked.
- Speed plugins that delay tracking until the first scroll or tap, and old Universal Analytics code.
Two ways to check
Check a URL: our server reads the public HTML of that one page, the same code your browser gets, and sends it back to your browser for the analysis. We do not store the address or the result. To stop abuse, the server keeps a count of requests per visitor for one minute.
Paste page code: open the page, view its source, copy everything and paste it. The analysis runs only in your browser and nothing is sent. Use it for pages behind a login, for test sites, or when a site blocks automated visits. Tip: in Chrome DevTools, right click the html element and choose Copy, then Copy outerHTML. That copy also includes tags that GTM or your cookie banner added later.
What a code check cannot see
The checker reads the page code as it comes from the server. Some tracking only shows up later:
- Tags set up inside Google Tag Manager. We see the container, not what is in it.
- Tags that load only after the visitor accepts cookies.
- Server events, like the Meta Conversions API, TikTok Events API or GA4 Measurement Protocol.
- Events on actions, like a purchase or a sent form, which fire only when someone does them.
For those, use GTM Preview mode (Tag Assistant), Test events in Meta Events Manager, Test events in TikTok Events Manager and DebugView in GA4. The browser extensions Meta Ads Data Advisor (formerly Meta Pixel Helper) and TikTok Pixel Helper show what fires on each page.
Why exposed keys are serious
A pixel ID is public by design. An access token is not. If an access token or a secret API key is in the code of your page, anyone who opens the page can copy it and use it with the permissions it has, for example to send fake events to your pixel. Meta’s documentation says app access tokens and the app secret must never be in client side code. Revoke the key, create a new one and send server events only from your server.
FAQ
Why does the checker not see my Meta Pixel? I know it works.
It is probably loaded through Google Tag Manager, a Shopify app or only after cookie consent. The checker sees only what is in the page code. Meta Ads Data Advisor or Test events in Events Manager show what really fires.
Is it bad to have two Meta Pixels on one site?
Not always. Some businesses use one pixel per ad account. But every pixel gets every event, so an old or test pixel that nobody uses only adds noise and confusion in reports. Keep the ones you need.
What is Consent Mode and do I need it?
Consent Mode tells Google tags whether the visitor allowed ad and analytics cookies, so the tags change what they send. Version 2 added ad_user_data and ad_personalization. If you measure visitors from the EEA with Google tags, Google requires their consent choices to be passed to it, and since March 2024 GA4 audiences for your ads include only visitors from outside the EEA unless consent mode is in place.
Does the URL check work on every page?
It works on public pages that return HTML. Pages behind a login, sites that block automated visits and apps that build everything with JavaScript work better with Paste page code.
What do you store?
Nothing about the page. In the URL check our server fetches the page and returns it to your browser without saving it. To stop abuse it keeps a short count of requests per visitor, without the addresses that were checked. Pasted code never leaves your browser.
Sources: Google consent mode guide and consent for EEA users, GA4 audiences and the EEA, Universal Analytics shutdown, Meta access tokens. Checked in October 2026.