Conversion Tracking With a Hosted Checkout: Fixing Lost Purchases in Google Ads and GA4 for Peptide Stores

Why does Google Ads miss purchases when a peptide store uses a hosted checkout?

Because the purchase happens on someone else’s domain. The buyer clicks your ad, lands on your store, then gets sent to the processor’s hosted payment page, and sometimes to a 3-D Secure step, before returning, if they return at all. If the purchase tag fires on the processor’s page, the click ID stored on your domain is not available there. If the buyer closes the tab after paying, your confirmation page never loads. In GA4, the return visit is credited to the processor as a referral. The fix is to fire purchases on your own domain, link domains where you must, exclude the processor as a referral, and confirm every sale server-side.

This matters more for peptide stores than for most ecommerce. Many high-risk processors and orchestration platforms use hosted or redirected payment pages. Stores also change processors more often than most, sometimes at short notice, and each switch can move the payment page to a new domain. Our payment underwriting guide explains why.

Where does purchase tracking break in a hosted checkout flow?

Step in the flow	What can break	Symptom you will see
Ad click → landing page	Redirects or click trackers strip the GCLID; site rejects unknown query parameters	Low conversions from every campaign, not just some
Store → processor payment page	Purchase tag placed on the processor’s page, or inside its iframe; no domain linking	Conversions recorded without click attribution, or not at all
3-D Secure / bank step	Extra redirect; buyer abandons or times out	Paid orders missing from Ads; failed payments counted if the tag fires too early
Processor → your confirmation page	Buyer closes the tab after paying; return URL misconfigured	Processor shows more settled orders than Google Ads shows purchases
Return visit in GA4	Processor domain not listed as an unwanted referral	Revenue credited to “processor.com / referral”
Refunds and chargebacks	No adjustment sent back to Google Ads	Reported ROAS above what the bank account shows

How do you map your checkout flow before fixing anything?

Place a real test order and write down every URL in order. Use an incognito window and a real ad click from a test campaign, or a URL with a test gclid parameter. You need:

1. The landing page domain, and whether the gclid is still in the URL on arrival.
2. The cart and checkout domain. Is it still yours?
3. The payment page domain, and whether it is a full redirect, a pop-up, or an iframe embedded in your page.
4. Any 3-D Secure or bank verification step.
5. The return URL and the confirmation page domain.
6. Whether the processor sends a server-side notification (webhook, callback or IPN) when payment succeeds, and what it includes: order ID, amount, currency, status.

That map tells you which fixes below apply. If the payment step is an iframe on your own page and the confirmation page is on your domain, you mainly need the GA4 and server-side steps. If the confirmation page is on the processor’s domain, you need all of them.

How should the Google Ads tag be set up for a hosted checkout?

Google’s help article on how Google Ads tracks website conversions sets out the conditions directly:

• Turn on auto-tagging in every Google Ads account.
• Make sure click trackers and server-side redirects pass on the GCLID to your landing pages.
• If your conversion page is on a different domain from your landing page, use the gtag.js domain linker to pass the GCLID to it.
• Do not fire your tags from within an iframe.

In practice, for a peptide store that means:

1. Fire the purchase conversion on your own confirmation page, not on the processor’s page. Most processors let you set a return URL. Point it at a page on your domain and pass the order ID back.
2. Fire only on confirmed payment. If the return URL is also used for failed or pending payments, check the status parameter before the tag fires.
3. Send the order ID as the transaction ID. Google’s transaction ID guidance says the ID “must be unique for every single transaction” and that Google Ads “may only process the first instance” of a given ID. That is what prevents a page refresh from counting twice, and it lets browser and server records be reconciled.
4. Use cross-domain linking only where you control the tag on both sides. If the processor lets you place your Google tag on its hosted page, configure both domains in the linker. If it does not, do not try. Rely on the return page and the server-side record.
5. Turn on enhanced conversions so a hashed email from the order can help match the conversion when cookies are missing. Google says enhanced conversions for web and for leads are now a single on/off setting, and that from April 2026 Google Ads accepts user-provided data from tags, Data Manager and API connections at the same time.

How do you stop the processor stealing credit in GA4?

Google Analytics lists third-party payment processors as the textbook case for unwanted referrals. Buyers leave for the processor’s domain and return, and without configuration GA4 treats the return as a new referral. To fix it:

1. In GA4 Admin → Data streams → your web stream → Configure tag settings → List unwanted referrals, add each processor and 3-D Secure domain you see in your flow map. Google allows up to 50 per data stream.
2. If you control tagging on a second domain in the flow, also add it under Configure your domains for cross-domain measurement. GA4 will then carry the same user and session IDs across the domains through a URL parameter.
3. Update the list whenever you add or switch processors. Load-balanced setups across several merchant accounts may use several payment domains.

The fix works going forward only. Google’s help page explains that with last non-direct click attribution, a user first credited to the referring domain can stay credited to it on later direct visits. Expect some historical data to stay wrong, and annotate the change date in your reports.

What is the server-side backstop, and why do peptide stores need it?

Browser tags will always miss some purchases: closed tabs, blocked scripts, declined consent, cookie limits. For a store on a high-risk processor, the server-side record is the one to trust. It is also the record you would show an underwriter or reconcile against settlements.

1. Capture click identifiers at landing. Store gclid (and gbraid/wbraid where present) in a first-party cookie or session. Write them into the order record when the order is created, before the redirect to the processor.
2. Listen for the processor’s payment-succeeded notification. That event, not the return page, is when the sale is confirmed.
3. Upload confirmed conversions. Use the order ID, the click ID, value and currency, and consented hashed email where you have it. Google recommends Data Manager for this. Google said that from 15 June 2026, offline conversion import and enhanced-conversions-for-leads uploads would move to the Data Manager API and be blocked in the Google Ads API, except for developer tokens with legacy access. If a developer or plugin built your upload before 2026, check which path it uses.
4. Decide which source feeds bidding. Either use the browser tag as primary with the upload as a check, or the upload as primary with the tag as secondary. Do not count both as primary for the same purchase unless deduplication is confirmed.
5. Send adjustments. Google Ads supports restating a conversion’s value or retracting it. Use this for refunds and chargebacks, which matter in a category where processors watch dispute ratios.

Our main conversion tracking guide covers the overall architecture and where double counting comes from.

How do consent and validation fit in?

Consent Mode v2 applies across all of this. The Google tag should read the ad_storage, ad_user_data, ad_personalization and analytics_storage signals, and server-side uploads should respect the same consent choice made at checkout. Do not upload hashed customer data for buyers who declined. If your store also runs a telehealth or intake flow, health information must stay out of every one of these payloads. See our HIPAA-conscious tracking guide.

Then validate against money, not against Google:

• Weekly: settled orders in the processor dashboard against purchases in Google Ads, by date, for the same attribution window. Note the gap and whether it is stable.
• After any processor change: repeat the flow map and a live test order the same day.
• In GA4: check that no payment domain appears as a referral source for purchases.

A stable gap you understand is workable. A gap that moves after a processor switch means something in the flow changed. Want a view of your tracking and account readiness? Try the Readiness Score, or book a strategy call.

Sources

• Google Ads Help — How Google Ads tracks website conversions
• Google Ads Help — Use a transaction ID to minimize duplicate conversions and How to adjust your conversions
• Google Ads Help — Updates to your enhanced conversions settings and About enhanced conversions for leads
• Google Analytics Help — Identify unwanted referrals and Set up cross-domain measurement

Checked 2026-09-30. Google’s measurement features change often; the current help article governs.

Frequently asked