I set up GA4, Tag Manager and Search Console from nothing. In October 2026 I checked all of it against the store's real orders, the email platform's own exports and the Wayback Machine. Some of what the dashboards said was wrong. This is what I found and how big each hole was.
I lined up every order-received page in GA4 against WooCommerce, order by order. The purchase event fired on 11 of 19 orders. Only orders from about April 2026 on carried a revenue value. The earlier ones logged a sale worth $0.
The only key events were purchases. Forms were submitted 101 times and started 299 times, and none of it counted as a conversion. If those are class registrations and contact requests, GA4 was blind to the main way this business makes money.
GA4 showed email bringing in 4 sessions. Brevo's link tracker had rewritten the links, so 113 more sessions from the newsletter landed in Referral under odd domains. That's 117 in all, and about 42% of everything GA4 called referral traffic.
The newsletter's click rate needed the same check. Brevo's campaign report said 52 and 79 people clicked on the two biggest sends. Its own clicker exports list 4 and 7. The rest were machines, most likely email security scanners opening every link.
In late 2025 site activity jumped and I was stoked. Then I looked closer. Most of it was bots, a lot of them from China, and engagement time per session had collapsed. I felt like I'd failed twice: at protecting the site, and at proving growth.
Around April 2026 I georestricted the site in Cloudflare. I expected traffic to crater and find out it had all been bots. GA4 pageviews halved, but real daily users barely moved, from about 7 to about 5. That's consistent with removing automated traffic, and the real visitors were still there.