Quick answer
If Tag Manager shows a tag fired but the event is missing in GA4, check whether the browser actually sent the collection request. A Content Security Policy can allow the container to run while blocking a later network request. Capture the blocked URL and directive before changing the policy, and keep consent controls intact.
Follow one event through the whole path
Use a fictional form submission or another controlled event with a known timestamp. Confirm the intended container, event name, and destination. Then compare the event in Tag Assistant with the browser request and the destination's diagnostic view. Do not mix events from different tabs or repeated tests.
A trigger firing, a tag executing, a request leaving the browser, and an event appearing in a report are separate checkpoints. Failure at any point can produce the same complaint: "analytics is missing." Establish the last checkpoint that worked before replacing tags or changing the form integration.
Capture the actual policy violation
Open the browser developer tools on the affected page and look for a Content Security Policy violation near the test. Record the blocked origin and the directive named in the message. The request panel may also identify a CSP-blocked request. Google's Tag Assistant can surface blocked resources in its page-issues view.
Check the main document response, not just the script response. A policy can come from the application, a security plugin, the web server, or an edge configuration. Preserve the headers and relevant policy settings before editing them. Redact query parameters or request data that contain identifiers or personal information.
Read the document headers safely
A headers check can establish what an anonymous request receives, although it does not replace the browser evidence for an authenticated or region-specific response. Use a GET request when checking a page whose HEAD behavior may differ. The following command discards the body and prints response headers:
curl -sS --max-time 15 -D - -o /dev/null 'https://example.com/contact/'
Distinguish script loading from collection
A policy that permits the Tag Manager script does not automatically permit every request made by every tag. Google documents different resource requirements for the container, Analytics, Ads, preview features, and other products. Compare the blocked resource with the documentation for the specific enabled feature.
Do not paste a broad allowlist for products the site does not use. Also distinguish an enforced policy from a report-only policy: a report-only violation is useful evidence but does not itself block the request. If several enforced policies apply, identify the restrictive policy rather than assuming one permissive header overrides all others.
Keep consent and security diagnoses separate
A user denying consent, an extension blocking a tracker, a network failure, and CSP enforcement are different causes. Read the actual consent state for the test and the browser failure reason. Do not grant consent programmatically or weaken a visitor's choices simply to make a reporting event appear.
A diagnostic fix should permit only the resources justified by the approved measurement configuration. Do not disable the site's CSP, add unrestricted wildcard sources, or introduce unsafe script execution as a general tracking fix. Review a narrow change with the person responsible for the policy and test it on staging first.
- Confirm the destination and container match the intended property.
- Capture the blocked origin and effective directive.
- Identify the application or edge component setting the policy.
- Retest the same event under the same deliberate consent choice.
Verify beyond the green fired indicator
After the reviewed change, check the browser request again and confirm that the destination receives the intended test event. An HTTP success alone does not guarantee that every parameter is valid or that a conversion will appear in a standard report immediately. Use the destination's appropriate debugging tools and account for reporting delay.
Repeat on the important page templates and on a clean mobile session. Check that a cached document does not retain the previous header and that preview-only behavior is not mistaken for ordinary traffic. Keep the old policy, the narrow change, and the verification record together so a future security-plugin update does not silently undo the repair.
Illustrative diagnostic example, not customer measurements.When to bring in help
For WordPress tracking troubleshooting, share the redacted blocked hostname, directive, page URL, and test-event time. Keep tokens, cookies, and personal event parameters out of screenshots and support messages.
Related troubleshooting
Debug the underlying WordPress form event.
Helpful references
Google Tag Manager and Content Security Policy. Google consent mode overview.