The ecommerce CRO audit: a 7 step template for agencies

An ecommerce CRO audit is a structured review of a store’s data, visitor behaviour and pages that ends in a ranked list of fixes and tests, each with its evidence and a value in the client’s own numbers. A complete audit runs 7 steps: scope and data access, quantitative research, qualitative research, a review by page type, the journey after the sign up and the order, prioritisation, and the report.

A complete ecommerce CRO audit runs from the kickoff call to the report in 7 steps, and a lighter version of the same steps runs on a prospect before the pitch, with no logins.

Baymard’s collection of 50 studies puts the average documented cart abandonment rate at 70.22%, and its benchmark finds that the average large ecommerce site can gain a 35.26% increase in conversion rate through better checkout design. Page reviews and analytics cover what happens on the store. A second set of faults sits in what the store sends afterwards: in a test of 362 ecommerce brands that Joy Joya published in July 2026, using new email addresses and phone numbers, 158 sent no welcome email and 20 sent an offer that didn’t match their pop up.

What a CRO audit covers

An audit produces findings with evidence, a value for each in the client’s own numbers, and a plan of what to fix now and what to test, in order. For a new client it sets the test roadmap. Before a client signs, the audit is often the sale, and a lighter version run from outside needs no logins.

Step 1: scope and data access

Agree the scope in writing before you open any data, because the client will judge the audit against it.

• The goal. 1 primary metric: conversion rate, revenue per visitor, first order rate or average order value.
• The period. The last 90 days and the same period last year, with sale days such as Black Friday, Friday 27 November 2026, reported separately.
• A change log. Every theme, app, checkout, discount and email flow change, with its date, so that each drop in the funnel can be matched to a release.
• Read access. GA4, Shopify’s reports, the testing, recording, email and text tools, the ad accounts and the review platform, plus past test results so that the plan doesn’t repeat a test.
• Test labels. The test email addresses, order tag and URL parameter you will use, so that the client’s team can exclude your activity from reports and test results.

Step 2: quantitative research

Find where visitors drop and who drops. Shopify’s behaviour reports break conversion into sessions, sessions with cart additions, sessions that reached checkout and sessions that completed it. A GA4 funnel exploration takes up to 10 steps, splits each by a dimension such as device category, and can show the average time between steps.

• Segments. Device, new or returning visitor, source and campaign, landing page and country. A drop on mobile only points to step 4. A drop for 1 campaign points to that ad’s page.
• Tracking accuracy. Compare GA4 purchases with Shopify orders for the same days. A large gap is a finding, and it needs fixing before anyone trusts the funnel.
• The pages that carry revenue, ranked by sessions and sales, so that later findings can be weighted by traffic.
• Site search, including the searches that return nothing.
• Speed. PageSpeed Insights shows field data from real Chrome users over the previous 28 days for public pages. Google’s Core Web Vitals count as good at a Largest Contentful Paint within 2.5 seconds, an Interaction to Next Paint of 200 milliseconds or less and a Cumulative Layout Shift of 0.1 or less, at the 75th percentile, with mobile and desktop measured separately.

Write each drop as a number with its segment, such as “mobile visitors from paid social reach checkout at half the desktop rate”.

Step 3: qualitative research

Use the drops from step 2 to choose what to watch and whom to ask.

• Recordings, filtered to the device, source and page where the funnel drops, with each problem logged and linked.
• Heatmaps of clicks and scrolling on the main landing, collection and product templates, with mobile and desktop kept apart.
• Surveys: 1 open question on the page where visitors leave, such as “What’s stopping you from ordering today?”, and 1 on the thank you page.
• Reviews, returns and support chats from the period, each tagged by theme: delivery cost, sizing, trust, product information.
• User tests. 5 people from the store’s audience buy on a phone and say what they think as they go. Jakob Nielsen’s analysis found that 5 users uncover about 85% of usability problems, and recommends several small rounds over 1 large study.

Group what you find into themes, each with a count and 2 or 3 examples.

Step 4: review by page type

Review every template against guidelines from research, on a phone first. Baymard’s research holds over 700 guidelines from more than 200,000 hours of UX research, grouped by page type. Its checkout figures show that the average US checkout displays 23.48 form elements by default, and that US shoppers most often abandon an order over extra costs (40%), slow delivery (20%) and not trusting the site with card details (19%).

• The page behind each live ad: the offer, price and stock match the ad. The morning check for ad landing pages covers it in full.
• Home and landing pages: the range and the current offer are clear on a phone before scrolling, and the pop up closes easily.
• Collections and search: filters suit the range, product cards show price and stock, and a search with no results suggests alternatives.
• Product pages: the full price, delivery cost and date, size or fit, reviews and returns sit near an add to basket button that stays in reach on a phone.
• Basket and checkout: shipping and tax shown before checkout, a working discount field, guest checkout, express payment, few fields and error messages that say what to fix.
• Thank you page and accounts: the order details and next steps, then sign in, account creation and password reset.

Log each issue with its page, device, screenshot and the guideline it breaks.

Step 5: the journey after the sign up

Analytics, recordings and page reviews show what happens on the store. They don’t show what the store sends after a visitor gives an email address or places an order. Run this step as a new customer: an email address and a phone number the store has never seen, a private browser window on a phone, and a sheet that logs each step, its time and what arrived.

A check of a UK skincare store begun on 22 September 2026 found no reminder within 48 hours for either a £40 gift set left in the basket or a £21 deodorant left at checkout.

The pop up’s code, through to checkout

Open the page behind a live ad and sign up through the pop up on a phone. A pass: the welcome email brings the code the pop up promised, and the code works at checkout on the products the ad promotes, including sale items and any subscriptions. Shopify Scripts stopped running on 30 June 2026, so test every custom discount built before then.

Welcome, basket and checkout emails

Leave a basket with 1 new address and stop at checkout with another, after ticking any marketing box. A pass: each reminder arrives within the flow’s delay with the product, photo and price filled in, and exactly 1 checkout reminder arrives. Wait 48 hours before you record an email as missing, then use the welcome and basket email diagnosis to find the cause.

The thank you page and tracking

Place a test order with Shopify’s test payment gateway or Shopify Payments test mode. A pass: the thank you page shows the order, the confirmation email arrives, and the purchase is recorded once in GA4 and once in each ad platform. Shopify made the additional scripts section view only on 28 August 2025, set 26 August 2026 as the deadline for stores not on Plus to upgrade their Thank you and Order status pages, and recommends app pixels for tracking. Check the purchase event on any store whose tracking lived in additional scripts, and again after every checkout or theme change.

Every live test variant

For each test that changes the pop up, an offer, a price or checkout, run the 3 checks above through every variant’s preview link. A pass: each variant’s sign up sends its email, and its code works at checkout. Intelligems’ Atlas QA browses a test’s preview as a shopper, switches groups, checks prices and compares desktop with mobile, and its 9 finding categories run from test setup to checkout. The emails a variant’s sign up triggers fall outside them. Repeat the check each morning the test is live, so that a variant that stops sending its code is found before anyone calls a winner, and exclude your visits from the results.

By hand, each run needs a new address, a phone and 48 hours per store, and each live variant needs a new run every morning. For 1 audit, a strategist can run it alongside steps 2 to 4. Across a pipeline of prospects or several live tests, the hours grow with every store and every day. Obsession’s Funnel QA for CRO agencies uses AI agents that follow a brand’s live ad as new customers, sign up through the pop up and take the code to checkout, then show what happened, with proof. After a client signs, they check every test variant past the sign up every morning it’s live.

Step 6: prioritise the findings

Sort each finding into 1 of 3 groups before you score anything.

• Fix now: anything broken, such as a refused code, a missing email, a purchase recorded twice or a sold out product behind a live ad. A fix needs no test, only a before and after.
• Test: a change with evidence and an uncertain effect, written as a hypothesis: because we saw X on page Y, changing Z for segment S will improve metric M.
• Research further: a signal from 1 source only.

Score the tests with 1 framework and keep it for the whole retainer, so that scores compare from month to month.

• PIE: Potential, Importance and Ease. Conversion’s page on PIE, which credits Chris Goward with designing it, defines them as how much the page can improve, how valuable its traffic is and how hard the test is to implement.
• ICE: Impact, Confidence and Ease, which CXL says Sean Ellis popularised.
• PXL: CXL’s yes or no questions on whether the change is above the fold, noticeable within 5 seconds, adds or removes something, runs on high traffic pages and is backed by user tests, feedback, heatmaps or analytics, plus the time to build it. CXL’s view is that PIE and ICE leave too much room for subjective scoring.

Then give each finding a value in the client’s own numbers: the revenue passing through the step it affects. On the site, multiply the sessions reaching the step by the share that order and by the average order value. After the sign up, multiply the monthly sign ups by the share who order with the welcome code and by the average first order. The client can check every input in their own reports. Use the value to break ties, and forecast a lift only within a range your past tests support.

Step 7: the CRO audit report

The report has 6 parts, with the decisions first and the evidence behind them.

1. Summary, on 1 page: the 5 findings with the highest value, 3 fixes for this week with an owner and a date each, and the first 3 tests.
2. Scope and data notes: the period, the sources, the access granted, the test activity excluded and any tracking gaps.
3. Findings: 1 row each, with what happens, where (page, device, segment), the evidence (a funnel figure, a recording, a screenshot or the email as it arrived), the guideline it relates to, the fix or hypothesis, the score and the value.
4. Fixes: the steps to reproduce each one, for the client’s developer.
5. Test plan: the hypothesis, primary metric, variants, audience, duration from the testing tool’s sample size calculator, and QA steps that include step 5.
6. Out of scope: pages, markets or channels left out, and what needs more data.

Book the readout call when you send the report, and record the starting values so that the next report can show before and after.

A lighter audit before the pitch

Before a client signs there are no logins, so the funnel and recordings are out of reach. A lighter audit from outside still gives the prospect findings they can check for themselves, and pipeline is the challenge agencies name most often.

• Speed: PageSpeed Insights field data for the home page, the top collection and the top product page.
• Page review: step 4 on a phone, on those pages and the basket.
• Public reviews, tagged by theme.
• The page behind each live ad, found through the public ad libraries.
• A sign up as a new customer, with 48 hours of what arrives. Auditing a prospect’s email and SMS without a Klaviyo login gives the full method.

Check a prospect only through the public sign up any customer can use, stop at checkout without paying, and never enter invented payment details. Send 3 findings, each with its evidence and the first test you would run, and keep the full audit as the paid next step.

CRO audit tools compared

Several of these tools are free or already in the client’s stack. We make Obsession, which does some of this, so every line about another tool is taken from that tool’s own pages, checked on 23 October 2026.

For 1 audit, GA4, Shopify’s reports, Microsoft Clarity and a new inbox and phone cover every step at no tool cost. Contentsquare, Lucky Orange and Baymard add depth to steps 3 and 4, and the right testing platform depends on what the client tests. An agency that audits 1 store a month, with no live tests on the sign up, needs no tool for step 5.

Limits and next steps

An audit describes 1 period. Allow for these 5 points when you present it.

• A pass is a snapshot. A theme, app, checkout or flow change can undo it, so repeat step 5 after each release.
• Research is a sample. A theme from 1 source stays a hypothesis until a test or a second source supports it.
• Values are estimates. Only a test or a before and after comparison measures what a change is worth.
• Low traffic limits testing. A store too small to reach a test result in a few weeks gains more from fixing known faults.
• 1 inbox is 1 view. A long time customer may be sent something other than what a new subscriber receives.

Many stores freeze code from about 20 November, before Black Friday on Friday 27 November 2026 and Cyber Monday on Monday 30 November. Run step 5 on every client store before the freeze and again on Black Friday morning. For an audit that includes the sale period, deliver the full report in early January with the November results beside it.

Questions about CRO audits