Data going to the wrong business, 698 "sales" that were really 2, a cookie banner describing tracking that was not there, and Google reading a sitemap from May. None of it showed as an error. Here is what I found, and how to check yours.
Shopify's Google and YouTube app had been connected to the wrong Google Analytics property. Every visit and sale on my shop was being recorded in SEO Intel's analytics, not the shop's own. So SEO Intel looked busier than it was, and the shop's own property was missing its history. Nothing flagged it. Both properties just showed numbers.
How to check yours:
I switched the app to the shop's own property, removed the extra manual tags and noted the date. Numbers before that date in either property cannot be trusted, and I now judge each one only on data from after the fix.
A Performance Max campaign on my shop reported 698 conversions in 30 days at a 51.7% conversion rate. Shopify showed 2 real orders. The campaign's "purchase" was a Google Analytics event fired by an old tag every time an ad visitor loaded a page, with no sale value attached. Google's bidding saw hundreds of cheap "sales" and kept buying more of the same traffic: £165.88 in 30 days spent chasing a number that was not real.
How to check yours:
I paused the campaign, removed the old tag from the theme, and cut the shop's key events from eight down to one: purchase. The honest downside: clean tracking did not create sales. It just stopped me paying Google to chase fake ones.
My six free tool sites all showed a cookie banner saying they used Google Analytics and ads. Neither was switched on. Both were placeholders in the code that had never been filled in. So the banner was asking people to agree to cookies the sites did not set, and meanwhile nothing was measuring the sites at all. They had around 6,900 appearances in Google search over three months and 4 clicks, and I had no analytics to tell me what those visitors did.
I switched analytics on for all six sites in their own Google Analytics account, kept apart from my other businesses, and changed the banner to say exactly what happens: Google Analytics cookies to count visits, and no ads. Analytics cookies are only set after someone clicks Accept. With Google's Consent Mode, a visitor who clicks Reject still sends Google an anonymous, cookie-free ping, so the privacy text now says that too.
How to check yours: open your site in a private window, open your browser's developer tools and look at the cookies before and after you click Accept. What loads should match, word for word, what your banner and privacy page say.
Search Console showed Google had last read this site's sitemap on 31 May, when it listed 13 pages. The site now has 34. Five of my tool sites had never had a sitemap submitted at all. My shop had three broken sitemap submissions, plus around 200 "not found" errors from 33 old product addresses that had been removed without a redirect.
How to check yours:
Search Console's Performance report counts how often your pages appeared in Google search and how often they were clicked. It does not count visits, bots, form spam or hacking attempts. If you are worried about suspicious activity, look at Security issues and Manual actions in Search Console, unusual spikes in Google Analytics, and your host's own traffic panel.