Half of them had analytics installed
that had never run.
I scanned fourteen hotels belonging to a single US management company. No relationship, no access, no permission needed. Every finding below was read from pages any guest can load. The owners of these properties believe they have measurement. Seven of them have none.
A tag manager container sitting in the page source looks installed. It appears in the code, someone was paid to put it there, and the job was marked done. Whether it ever loads is a different question, and the only way to answer it is to watch what the browser actually requests. Nobody checks, so nobody knows.
Six checks, fourteen properties.
Each property was loaded like a guest would load it. Every outbound booking link on the page was parsed, not just the first one, which matters more than it sounds.
The attribution number is the one that costs money quietly. Thirteen of fourteen booking links correctly identify which property the guest is booking. One carries any information about the campaign, search or ad that sent them. Every other booking arrives at the engine anonymous, which means the ad spend that produced it cannot be credited to it.
None of these are exotic.
All three were read straight out of authored HTML. No clever tooling, just looking at what ships.
One property hardcodes an arrival date of September 2019 into several room-level booking buttons. A guest clicking through lands on an engine being asked about a stay that predates the pandemic. Two other properties ship stale dates of their own.
On one page, the currency parameter is written so that the browser reads part of it as an HTML entity and silently replaces it with a symbol. The currency never reaches the engine. Some buttons on the same page are correct and some are broken, which is exactly why nobody has caught it.
Two properties still hand the booking engine a cross-domain tracking value frozen into the markup, one timestamped August 2020. It belongs to an analytics product that has since been retired. It has been passed along on every click for six years.
Eight properties carry a tag manager container in the page source. On seven of them, a twenty-five second watch recorded zero requests to the tag manager. Verified on two separate runs, against the rendered page as well as the network.
The limits, stated plainly.
Findings are only worth anything if the caveats come with them. Three apply here.
- This is 14 properties, not the whole portfolio.
The group manages far more. Their own site does not link to every hotel they run, so the sample is what could be found from outside. The counts describe the sample. - I could not test whether tags survive into the booking engine.
The engine serves a bot challenge to an automated browser, by design. Any tool claiming to measure that on a company it has no access to is reading a challenge screen. That check needs the owner’s cooperation and it is part of the paid work, not the free finding. - Nothing here required permission, and nothing was submitted.
Public pages only, robots.txt honoured including its crawl delay, no form filled, no room selected, no account created, so no terms of service ever accepted.
I corrected this scan once already. An earlier run read the booking engine’s bot challenge as a broken tag and produced findings that were not real. Those were thrown out and the engine now records not measurable instead of inventing an answer. A finding you cannot stand behind is worse than no finding.
Three things you can check today.
None of these need me. They need thirty seconds each and someone willing to look.
- Open your own booking link and read the address bar.
Check the arrival date, the currency, and whether anything identifies the campaign that sent the guest. - Check more than one button.
The worst defect in this scan was not on the main Book Now. It was on room-level buttons further down the page. - Confirm your tag actually loads, not that it exists.
Open the network panel, filter for your analytics host, reload. If nothing appears, the container is decoration.