MarTech Audit Checklist: Speed, Tracking, CRM Lead Flow and Automation (Free Template)

A MarTech audit is a structured review of the tools, tracking and processes that turn website visitors into leads and customers. It checks that each part works, that data passes correctly from one part to the next, and that you aren’t overpaying for any of it. The checklist below covers the six areas where I most often find leads leaking: site speed, tracking, forms, CRM lead flow, automation, and access and security. At the end you’ll find a copyable template.

It’s the same structure I use when I audit a client’s stack (5+ years experience · 30+ sites shipped). You can run it yourself in an afternoon or two. If you’d rather not, I’ll get this checklist run on your site for free.

What is a MarTech audit, and what makes this one different?

Most “MarTech stack audit” guides are tool inventories: list every subscription, find overlaps, cancel what nobody uses. That’s worth doing, and it’s part of section 5 below. But a tidy tool list can still lose leads every day. A fast site can have broken conversion tracking. A form can submit fine while the lead never reaches the CRM. An automation can fail quietly for weeks.

So this audit follows the lead, not the tool list. It asks one question at each step of the journey: did the visitor, and their data, make it to the next step intact?

How to run the audit

1. Get access first. You’ll need WordPress (admin), Google Tag Manager, GA4, Google Ads, Meta Events Manager if you run Meta ads, your CRM, your automation tool, and hosting. Missing access is a finding in itself. Note who owns each account.
2. Send one test lead through the whole system. Open your main landing page with test campaign parameters (for example ?utm_source=audit&utm_medium=test), submit the main form, click the WhatsApp button, and follow that lead through GTM Preview, GA4 Realtime, Google Ads, your inbox, your CRM and any automations. Write down every step where it disappears or loses data.
3. Work through the six sections below, marking each check as OK, broken or unknown. “Unknown” counts as broken until someone proves otherwise.
4. Prioritise using the method at the end, and pick your top five fixes.

1. Site speed and Core Web Vitals

A slow landing page wastes ad spend before tracking even starts. Run your top landing pages, not just the homepage, through PageSpeed Insights on mobile and desktop.

• Read field data before the lab score. The “real users” section is CrUX data from the previous 28 days. The performance score below it is a single lab test. Field data is what your visitors actually experience.
• Check the three Core Web Vitals against Google’s “good” thresholds at the 75th percentile: LCP within 2.5 seconds, INP of 200 milliseconds or less, CLS of 0.1 or less (web.dev).
• Count third-party scripts. Chat widgets, heatmaps, old pixels and duplicate tag managers slow pages down. Every script should have an owner and a reason to be there.
• Check server response. A slow first byte points to hosting or caching, not design.

Broken if: field data fails on mobile for your paid landing pages, or nobody can say why a script is loaded. Page builders are a common cause on WordPress (here is what usually slows an Elementor build down), and so is reading a failed Core Web Vitals report the wrong way. This is how to read a failed Core Web Vitals report.

2. Tracking: GTM, GA4 and ad platforms

If tracking is wrong, every other decision is a guess. That’s why I check it before anything else gets fixed.

• One container, one GA4 setup. Use GTM Preview (Tag Assistant) to confirm that only one GA4 configuration loads per page. Duplicate tags from a theme, a plugin and GTM all at once are common.
• Key events are real leads. In GA4 (Admin → Data display → Events, as of October 2026), list the key events. Page views, scrolls and button clicks marked as key events inflate “conversions”.
• Forms fire on success only. Submit a form with a required field empty. If a lead event fires anyway, your numbers are inflated. Here’s how to confirm every form submit reaches GA4 and Google Ads.
• Non-form leads are counted. Phone and WhatsApp often bring in more leads than forms. Check that you have WhatsApp button clicks counted as conversions, labelled as clicks rather than leads.
• Google Ads sees the same leads. Check that GA4 and Google Ads are linked and auto-tagging is on. Each lead should be one primary conversion action, not two.
• Meta gets one lead event per lead, if you run Meta ads. Check in Events Manager that it isn’t missing or doubled.
• No UTM parameters on internal links. They overwrite the visitor’s real source with your own campaign tag.
• Housekeeping. GA4 data retention is set to 14 months rather than 2 (it affects explorations and funnel reports, per Google). If you show a cookie banner, make sure tags actually respect it using consent mode.

3. Forms and lead capture

• Every form works, including popups, footer forms and landing pages nobody has opened in a year. Submit each one.
• Campaign data is saved with the lead. Hidden fields capture UTM parameters and the GCLID, so the CRM knows which campaign produced each lead.
• Notifications arrive and don’t land in spam. Check them with a real inbox, not just the form’s success message.
• Spam is filtered (a honeypot or reCAPTCHA) without blocking real people.
• The form asks for the right contact method. If your sales team works on WhatsApp, ask for a WhatsApp number. That’s why it’s the required field on my own audit form.

Broken if: a test submission arrives without its source, or arrives twice, or not at all.

4. CRM and lead flow

This is where the most expensive leaks hide, because nobody sees them in a dashboard.

• Every lead becomes a CRM record. Compare a week of form submissions with new contacts created in the same week. The numbers should match.
• Source survives the trip. Original source, campaign and GCLID end up in CRM properties, not just in an email.
• Every lead gets an owner automatically, with a defined response-time target, and someone checks it’s met.
• WhatsApp conversations reach the CRM, not just someone’s phone. See how WhatsApp conversations get into HubSpot.
• Lifecycle stages mean something. “Lead”, “qualified” and “customer” have written definitions your sales team actually uses.
• Ad platforms learn from lead quality. Qualified leads and sales are sent back to Google Ads and Meta, so campaigns optimise for real customers, not form fills. Here is sending qualified-lead signals back to Meta.

5. Automation and integrations

• Inventory every automation: trigger, what it does, owner, monthly usage, and what breaks if it stops. Include Zapier, Make, n8n, native CRM workflows and custom code. If speed-to-lead is a worry, consider an AI agent that qualifies WhatsApp leads.
• Failures are visible. Someone gets an alert when a run fails, and failed runs are retried or reviewed.
• Cost matches value. Check which workflows use the most tasks or runs, and look at where automation bills quietly grow. A form-to-CRM handoff can often be done with a webhook or a native integration instead of a paid connector, and you can pass form data by webhook instead of a paid connector.
• The company owns the accounts. Connections that run on a former employee’s or agency’s login are a risk waiting to happen.

6. Access, security and hosting

• WordPress users: remove former staff and agencies, and give everyone the lowest role that does the job. That includes tools and AI agents that connect to the site, so look at giving AI tools limited access to WordPress.
• Updates: WordPress core, themes and plugins are current, and unused plugins are deleted, not just deactivated.
• Backups: stored off the server, and a restore has actually been tested.
• Monitoring: uptime alerts go to someone who will act on them.
• Signs of compromise: unexpected redirects, unknown admin users, or a security warning in Google Search Console. Treat any of these as urgent, and learn the signs a site has been compromised.

The MarTech audit template

Copy this table into a spreadsheet, add an “Owner” and a “Status” column (OK / broken / unknown), and work through it.

How to prioritise what you find

A long list of problems doesn’t help anyone. Score each broken item on two things: impact (does it lose leads, waste ad spend, or put the site at risk?) and effort (an hour, a day, or a project?). Then:

1. Fix measurement first. If lead tracking is wrong, you can’t tell whether any other fix worked.
2. Then fix leaks. Leads that never reach the CRM, or never get an owner, cost more than anything else on this list.
3. Then speed and cost. These are usually ongoing improvements, not one-off fixes.
4. Security warnings jump the queue. A hacked site or an unknown admin user comes before everything else.

Pick the five high-impact, low-effort items and fix those first. That’s exactly how I structure the free audit: a PageSpeed/CWV report, a GTM/GA4/pixel health check, a form/CRM/lead-flow review, and the top 5 quick wins. Brands I’ve worked with include Rewaa, Qoyod, iFit and evercare, and the order is the same every time: measure, stop the leaks, then speed up.