How to Set Up GA4 for Your Website, Step by Step

To set up GA4 on a website, you create a Google Analytics account and property, add a web data stream, install the Google tag on every page, set consent defaults, confirm data arrives in Realtime, filter out your own visits and mark the actions that matter, such as enquiries, as key events. A basic setup can usually be done in an afternoon. This guide is part of our website design best practices guide.

How GA4 measures a website

Google Analytics 4 records everything as events. A page load is an event, a scroll is an event and a form submission is an event. Each event can carry parameters, such as the page address or the form's ID. GA4 groups events into four types, and knowing them saves a lot of custom work:

Google advises creating custom events only when no other event fits, because they don't appear in most standard reports. For a lead-focused site, enhanced measurement plus the recommended generate_lead event covers most needs.

Before you start

You'll need a Google account, access to the site's code or CMS settings, and a list of the actions that count as success for the business: usually form submissions, calls and bookings. Decide who should own the Analytics account. It should belong to the business, with agencies and freelancers added as users, so access never leaves with a supplier.

Check what your consent obligations are where you operate. This guide covers the technical side of consent mode; it is general information, not legal advice.

Steps

1. 01
   Create the account and property.

   Go to analytics.google.com, create an account named after the business, then a property for the website. Set the reporting time zone and currency carefully: changing the time zone later only affects new data and can cause a flat spot or spike in reports. Choose the business objectives that fit, such as generating leads.

2. 02
   Add a web data stream.

   In Admin, under Data collection and modification, open Data streams and add a Web stream. Enter the site's address and a clear stream name. Leave enhanced measurement switched on: it collects page views, scrolls, outbound clicks, file downloads and form interactions without extra code. Copy the measurement ID, which starts with "G-".

3. 03
   Install the Google tag on every page.

   If your CMS has a Google Analytics field, paste the measurement ID there. Otherwise, add Google's snippet to the head of every page, or deploy it through Google Tag Manager. Use one method only, or every visit is counted twice. The direct snippet looks like this, with your own ID:

   html

   <script async
     src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
     function gtag(){dataLayer.push(arguments);}
     gtag('js', new Date());
     gtag('config', 'G-XXXXXXXXXX');
   </script>

4. 04
   Set consent defaults before any tags fire.

   Consent mode tells Google's tags what each visitor has agreed to. Google's guide says to set the default state on every page, before any command that sends data, then update it when the visitor chooses. A default that denies everything until the visitor agrees looks like this:

   js

   gtag('consent', 'default', {
     ad_storage: 'denied',
     ad_user_data: 'denied',
     ad_personalization: 'denied',
     analytics_storage: 'denied'
   });

5. 05
   Check data in Realtime and DebugView.

   Visit the site in another tab, then open the Realtime report: your visit and its events should appear shortly. For detail, turn on debug mode with Google Tag Assistant and watch DebugView, which lists every event and parameter from your device. Submit a test form to confirm form_submit arrives.

6. 06
   Filter out internal traffic.

   Visits from your own team inflate numbers and skew conversion rates. In the data stream's tag settings, define your office IP addresses as internal traffic, then create a data filter to exclude it. Leave the filter in testing mode at first: once a filter is active, Google says the excluded data is gone for good.

7. 07
   Set data retention.

   In Admin, open Data retention. Standard properties can keep user-level and event-level data for 2 or 14 months. The setting doesn't affect standard reports, but it limits how far back explorations and funnel reports can go, so 14 months is usually the better choice. Increasing it also applies to data already collected.

8. 08
   Mark the actions that matter as key events.

   Key events are the actions GA4 reports as success. Send a generate_lead event when an enquiry is successfully submitted, and mark it as a key event in Admin. You can mark an event before it has first arrived. Standard properties allow up to 30 key events, so keep the list to real business outcomes.

9. 09
   Link Search Console and Google Ads.

   Link Search Console to see search queries next to on-site behaviour, and link Google Ads if you advertise, so key events can become ad conversions. Our guide on how to set up conversion tracking covers calls, imports and testing in detail.

If you'd rather have analytics and tracking set up for you as part of a build, our in-house web team designs and develops sites with SEO foundations built in.

Keep tracking light, private and accessible

Analytics should measure the site without making it worse. Three areas need attention.

Speed. Every tag is extra JavaScript, and third-party scripts can slow how quickly a page responds to taps and clicks. Load the Google tag asynchronously, as the snippet does, and review every other tag before adding it. Our website speed test guide shows how to spot scripts that slow pages down.

Privacy. Google requires that no personally identifiable information is sent to Analytics. Don't put names, email addresses or phone numbers in page addresses, event names or parameters. Watch form tools that add the visitor's email to a thank-you page URL; enhanced measurement would record it.

Accessibility of the consent banner. The banner is often the first thing a visitor meets, and a poorly built one can block the whole site. It should take keyboard focus when it appears, work fully with Tab, Enter and Space, and use real buttons with clear labels such as "Accept analytics" and "Reject analytics". Text and buttons need enough contrast.

A banner pinned to the bottom of the screen must not hide the element that has keyboard focus. Google's interstitials guidance adds two search reasons to avoid a full-page consent wall: don't cover the whole page, and don't redirect people to a separate page to give consent.

Troubleshooting

Reports show no data

Cause: the tag isn't loading, is loading with the wrong ID, or is blocked before it can send anything. Common reasons are a snippet pasted into one template but not others, a typo in the measurement ID, a consent default that denies analytics with no banner to change it, or a content security policy that blocks Google's scripts. Standard reports can also take a while to fill even when Realtime shows activity.

Fix: open Realtime and visit the site yourself. If nothing appears, view the page source and confirm the snippet and measurement ID match the data stream. Use Tag Assistant to see whether the tag fires and what consent state it reads. Check that the consent banner actually updates consent when you accept. If Realtime works but reports are empty, wait a day before changing anything.

Page views or events are counted twice

Cause: the Google tag is installed more than once. Typical combinations are a snippet in the theme plus a CMS analytics field, or a hard-coded tag plus the same tag in Tag Manager. Single-page apps can also double-count when the site sends its own page_view events while enhanced measurement already records history changes as page views.

Fix: search the page source and your Tag Manager container for the measurement ID, and keep exactly one installation. In Tag Assistant, check how many page_view events one page load produces. If your site sends page views on route changes itself, turn off the browser-history option in enhanced measurement's page view settings, or stop the manual events. Then recheck in DebugView that each page load creates one page_view.

Your own visits still show up in reports

Cause: the internal traffic filter is still in testing mode, the IP addresses don't match, or your team works from addresses that change. Home connections and mobile networks often get new IP addresses, and a VPN can make staff appear to come from somewhere else. Filters also only apply to data collected after they're active.

Fix: check the IP rules against your current public IP address, which any "what is my IP" search shows. Once you're confident the rule matches only internal visits, switch the filter from testing to active, remembering the effect is permanent. For remote teams, consider a browser extension or setting that opts staff out, or use a separate test environment. Compare a day's data before and after to confirm.