Spooky, Scary Skeletons Hiding in Your Website and Martech Stack
Horror movies love to use that one scene where someone is fleeing, tries the door, and it won't open. We've lived that scene with a client. Their past agency owned their business’ domain, the GA4 property, and other martech accounts, and wouldn't release them back to our client. It took a letter from a lawyer and proof of the client's trademark to get their access and ownership back.
Thankfully, most of the time, our findings don't need lawyers to resolve. Usually we find things like contact forms that've been sending messages into the abyss, or tracking tags from a tool someone stopped paying for a while ago.
This blog outlines five of the most common martech stack issues we run into when we audit.
1. A Past Agency Still Owns Your Domain and Analytics
To check yours, log in to your domain registrar, hosting, and Google Analytics accounts and look at who's listed as the domain owner. It should be a company email address for a group inbox, not one person's email, or (worse) a vendor's. It should be an inbox that at least two people on your team can get into.
Check that the two-factor authentication goes to a phone or app your team can get to, too. If you're not the one with the logins, ask your team who owns your domain and GA4, and whose phone gets the codes.
At Wheels Up, everything we set up for a client goes in the client's name from day one, including the domain, GA4, ad accounts, and integrations. If a client ever stops working with us, there's nothing to hand back, because they already own all of it. I think every agency should work that way. If you're hiring one, put account ownership in the contract before you sign.
2. Forms and Conversion Tracking That Look Fine but Aren't
During an audit for a B2C client, we sent a test submission through their Contact Us form. It went through without any visible error on our side, but nobody ever followed up because the form's routing was totally broken. Nobody on their side ever saw the message.
Their tracking wasn't much better. A purchase got counted every time someone clicked the checkout button, so if you missed a field and clicked again, it showed up as two purchases. Their retargeting ads were set up off that same goal, which meant people who had already bought something kept getting ads to buy it. And Facebook was optimizing for clicks on "Register" instead of actual purchases. No attribution model can fix numbers like that.
In B2B, the same thing happens with demo requests. If the conversion fires when someone clicks the button instead of when the form actually goes through, your reports will show more demo requests than sales ever sees.
Every quarter, fill out your own forms and make sure the messages actually reach a person. Then do a test purchase or signup and see whether your analytics and ad platforms count it right.
3. Old Tracking Tags Firing Before Cookie Consent
Old tracking tags are easy to forget. A tag from a tool you stopped using can keep loading on every page and sending visitor data somewhere nobody checks, sometimes before the visitor has agreed to tracking.
Tags that load before consent also carry legal risk. Under California's Invasion of Privacy Act, plaintiffs can seek $5,000 per violation, and about 1,500 CIPA lawsuits were filed in the 18 months before August 2025, many over pixels and analytics scripts.
California's SB 690, which takes effect January 1, 2027, ends one kind of private website-tracking lawsuit. Wiretapping claims are still available, though, and attorneys at Benesch expect demand letters to shift there.
The fix is mostly knowing what's on your site and why it's there.
For a B2B software client, we set up CookieYes and removed an old Xandr ad tag from their sites. The B2C client from the forms example also had an outdated copyright line and no privacy policy.
To check yours, open Google Tag Manager and look at every tag and what triggers it. If a tag belongs to a platform you don't use anymore, make sure it isn't feeding a report or audience somewhere, then take it out. Then open your site in a private window and watch the network requests before you click accept, and make sure your privacy policy is up to date. If you don't manage the site yourself, ask your team for a list of every tag on it and what each one is for.
4. Website Accessibility That Hasn't Been Checked Since Launch
Accessibility problems build up the same way. A new form plugin or a batch of images uploaded without alt text can make the site harder to use for someone on a screen reader or a keyboard. In 2025, plaintiffs filed 3,117 website accessibility lawsuits in federal court, up 27% from 2024, according to Seyfarth Shaw's tracking.
Most of those target consumer and ecommerce sites, but B2B sites aren't exempt. And if a buyer can't get through your demo form, you lose the lead whether anyone sues you or not.
A free tool like WAVE will flag a lot of the basics on your homepage and forms, but it won't catch everything. The test I'd actually do is pull up your demo request form and try to fill it out using only your keyboard. If you can't, that's where I'd start.
5. Ad Accounts Still Spending on Old Settings
Ad accounts can drift too, and they cost money every day they run. In the same B2C client's Google Ads account, ads were showing to people outside the states the client served, Google was allowed to change ads automatically, and ads could show on inappropriate websites. The account was still running expanded text ads, a format Google stopped letting advertisers create in 2022. The client was also showing up for only 12% of searches for its own brand name, so most people searching for the company by name were seeing other results first, including competitors' ads.
To check your ads, go into your account settings and turn off auto-applied recommendations. Set location targeting to people who are actually in your service area, and look at where your ads are allowed to show.
Book a Website and Martech Audit Call With Wheels Up
If you’re not sure who owns your domain and analytics, or what’s actually firing on your site, grab time with us. We’ll look together and help where you need us to. If it turns out your team can fix it without us, we’ll let you know.
If you want to keep reading, our CRM skeletons post covers what builds up inside the CRM. Or our post on tactics to retire covers replacements like multi-touch attribution, which depend on forms and tracking that record what actually happened.
