Before you spend a dollar on paid media, check that the front office can catch what the ads are about to throw at it. Most of the businesses I audit fail something here, and a campaign pointed at a broken form is not a marketing problem, it is a refund you will never get.
There are two tiers to this. Five gates you can genuinely clear in about a minute on your phone, and five that take longer and are, awkwardly, the ones that actually cost money. Do the fast five first because they are free. Do not stop there, because nothing in the fast five would catch a form that silently drops every submission.
The sixty-second five
Phone in hand, roughly twelve seconds each.
1. Is the primary action visible without scrolling?
Open the homepage on a phone and stop at the top. Is the thing you want people to do, book or buy or call or enquire, visible right there? If it sits below a full-height hero, a nav bar and three lines of tagline, your conversion rate is already reflecting that. The fold is not a design preference, it is a constraint on revenue.
2. Does the phone number open the dialer?
Tap it, on the homepage and on the contact page. If the number is baked into an image or formatted so it cannot be tapped, you are losing the mobile visitors who intended to call and will not retype a number by hand. Five minute fix, broken far more often than it should be.
3. Is there a padlock?
Check the address bar for https rather than http. Today Chrome marks an insecure page "Not secure" in the address bar and loads it anyway, so this is not yet the hard blocker some articles claim. It becomes considerably louder soon: Google has said the full-page warning before insecure content becomes the default in Chrome 154, arriving in October 2026. Fix it before your visitors get an interstitial.
While you are here, ignore anyone telling you HTTPS will lift your rankings. Google introduced it as a ranking signal in 2014 and described it at the time as "a very lightweight signal, affecting fewer than 1% of global queries." Do it for the browser warning and for trust, not for search.
4. Is the Google Business Profile claimed and current?
Search the business on Maps. Claimed profile, correct hours, working phone number, a website link, recent photos. For a local business the profile carries more first impressions than the website does, and paid search running alongside a stale or unclaimed profile is buying clicks into a credibility gap you created yourself.
5. Does anything come back from a site: search?
Type site:yourdomain.com into Google. If nothing appears, something is wrong, though be careful about concluding too much from it. Google explicitly says the site: operator "doesn't necessarily return all the URLs that are indexed" and points site owners at the URL Inspection tool in Search Console for a real answer.
One correction to advice you will see everywhere: robots.txt does not stop indexing. It stops crawling. A page blocked by robots.txt can still appear in search results if other pages link to it, and because the crawler never fetched the page it never sees a noindex rule either. If you actually need a page out of the index, noindex is the directive, and the page must be crawlable for Google to read it.
The five that take longer and matter more
None of these fit in twelve seconds. All of them can lose you the entire budget.
6. Submit every form, for real, and confirm a human received it
Not a test submission. A real one, from a real device, with a real address you can check. Then verify three things separately: the visitor sees a confirmation, the submission arrives somewhere a person actually looks, and the event registers in analytics.
I find broken forms in roughly one audit in four. The failure is almost always silent: the form appears to submit, the visitor believes they have made contact, and nothing arrives. Ads pointed at that page are a total loss, and nothing on the page looks wrong.
7. Is GA4 actually receiving data?
Open Realtime and visit the site. Bear in mind Realtime covers the last thirty minutes and is explicitly best-effort, so a slow appearance is not proof of anything.
If your visit does not show, the usual causes are mundane and worth checking before you conclude the tag is broken: an internal traffic filter or IP exclusion that includes you, an ad blocker in your own browser, or consent mode holding the data back because you have not accepted. Test from a device and network that a filter does not cover.
8. Do the key events fire?
Two things have changed here that most checklists have not caught up with. Google renamed conversions to key events in GA4, so that is the label you are looking for. And DebugView shows nothing unless debug mode is enabled, which is the single most common false alarm in this whole check.
Turn debug mode on first, through Google Tag Assistant, GTM preview mode, or by sending debug_mode: true. Then complete each primary action and watch the event arrive with its parameters. Without that step you will stare at an empty DebugView and conclude your tracking is broken when it is working perfectly. Note also that events stay invisible in debug mode if consent has not been granted, which is a second way to scare yourself for no reason.
9. Is the page fast enough, measured against Google's actual thresholds?
Run the page through PageSpeed Insights on mobile, and use the published bands rather than an invented cutoff. Lighthouse scores 0 to 49 as poor, 50 to 89 as needs improvement, and 90 to 100 as good, and Google's guidance is to aim for the green band.
The field metrics matter more than the score. The Core Web Vitals thresholds, assessed at the 75th percentile of real visits, are Largest Contentful Paint at or under 2.5 seconds, Interaction to Next Paint at or under 200 milliseconds, and Cumulative Layout Shift under 0.1. First Contentful Paint is worth watching, good at or under 1.8 seconds and poor above 3.0, but it is not one of the Core Web Vitals and carries a small share of the score.
On what speed is worth: you will see a claim that 40 percent of visitors abandon a slow page. It traces to a 2009 survey that asked about a thousand online shoppers how long they would say they were willing to wait. It is seventeen years old, it predates the mobile web, and it measured stated intent rather than behaviour. Akamai's own later work, drawn from roughly ten billion real visits rather than a questionnaire, is both more useful and less dramatic: a 100 millisecond delay was associated with about a 7 percent drop in conversion, and a two second delay with roughly double the bounce rate. Speed is worth money. It is a gradient, not a cliff at three seconds.
10. Privacy policy and consent, scoped to where you actually operate
The blanket claim that Google and Meta require a privacy policy for any advertising is too strong. Google's policy attaches the obligation to advertisers using data segments, re-engagement and similar personalisation features, which is to say remarketing. If you are running remarketing, you need it.
Consent is jurisdictional, and the usual phrasing gets it backwards for a US audience. Prior consent for non-essential cookies is an EU and UK requirement. Most US state privacy laws run on an opt-out model instead. So the question is not "do I need a cookie banner," it is "where are my visitors, and am I running pixel-based remarketing at them." Get the answer for your own jurisdictions rather than copying a European template, and have a lawyer look at it once if you are collecting anything sensitive. A generated policy is a starting point, not a compliance opinion.
What to do with the results
Fix in this order, which is by cost of being wrong rather than by effort:
- Broken forms. Total loss of everything downstream. Nothing else on the list competes.
- Key event tracking. Without it the ad platform optimises toward a signal it cannot see, which is worse than not optimising.
- GA4 receiving data at all. Prerequisite for the item above.
- Above-the-fold action, tappable phone number, page speed. Conversion rate, directly.
- SSL, Google Business Profile, privacy policy, indexing. Real, and none of them stop you launching this week.
That last tier is where the honest caveat goes. Indexing does not block paid media at all, since ads bypass organic ranking, and a missing privacy policy only blocks you if you are running the remarketing that requires one. Both belong on the backlog rather than in the way.
This check is a prerequisite, not a strategy. Clearing it means the front office can catch what the campaign drives. Whether the campaign should exist, and whether the targeting and the creative are right, is a different conversation, and one worth having only once the plumbing is confirmed.
