Short answer: A CRO audit is a structured review of why visitors to your site do not buy or enquire, ending in a prioritised list of test ideas backed by evidence. A useful one checks tracking accuracy first, then funnel drop-off by step and device, landing and product pages, usability, your offer, pricing, trust and shipping information, checkout and site speed.
Key takeaways
- A CRO audit diagnoses where and why people drop out of your funnel. A folder of screenshots with opinions attached is not an audit.
- It starts with tracking. If purchases or add-to-carts are counted wrongly, every finding built on that data is wrong too.
- The output should be a ranked list of hypotheses, each with evidence, an expected effect and a way to test or ship it, plus a test plan that fits your traffic.
- Most audits take two to four weeks. Low-traffic stores can still use one: fix clear problems directly and save A/B tests for the few big changes.
If you are spending money to bring people to your site, a CRO audit asks the next question: what happens once they arrive? Paid and organic traffic get most of the attention and budget, yet a small leak in the product page or checkout can cost more than a weak campaign.
This guide explains what a real conversion rate audit checks and what you should receive at the end. It is written with Shopify and other ecommerce stores in mind, but the method works for lead generation sites too.
What is a CRO audit, and how is it different from an SEO audit?
A CRO audit is a diagnosis of the visit, not the traffic. It answers one question: of the people who already reach your site, where do they drop out, why, and which changes are most likely to get more of them to buy?
An SEO audit looks at a different problem. It asks whether search engines can find, understand and rank your pages, and whether you get enough of the right visitors from search. The two overlap in a few places, mostly site speed, mobile rendering and page content, but they read different data and end in different actions. An SEO audit ends in technical fixes and content work. A CRO audit ends in hypotheses to test or ship on pages people already see.
| SEO audit | CRO audit | |
|---|---|---|
| Main question | Why are we not getting more search traffic? | Why are visitors not buying or enquiring? |
| Main data | Search Console, crawls, backlinks, competitor rankings | Analytics funnels, session recordings, heatmaps, surveys, order data |
| Typical findings | Indexing problems, thin category pages, weak internal links | Shipping costs revealed too late, unclear sizing, slow mobile product pages, broken checkout steps |
| Output | Fixes ranked by impact and effort | Hypotheses ranked by evidence and expected effect, plus a test plan |
A CRO audit is also different from "an opinion with screenshots". Plenty of audits on the market are a designer or marketer clicking through your store, capturing pages and writing what they would change. Some of those ideas are good. The problem is that nothing ties them to how your visitors actually behave, so you cannot tell which three of the forty suggestions matter. A real audit starts from your numbers, finds the steps where people leave, and only then looks at the pages to explain why.
What should a CRO audit check?
A CRO audit should check whether your data can be trusted, where the funnel leaks, and what on the page, in the offer or in the checkout causes that leak. Use this as a CRO audit checklist when you read a proposal or a finished report. If an area is missing, ask why it was left out.
Why tracking comes first
Every other finding depends on the numbers being right, so the first job is to compare analytics with reality. On Shopify that usually means comparing purchases in GA4 with orders in Shopify admin for the same period. A gap of a few percent is normal, because of consent banners, ad blockers and payment redirects. A gap of 30 percent, or more purchases in GA4 than orders in Shopify, means something is broken.
The common causes we see are a purchase event installed twice (once by an app, once by hand), events that fire on page load rather than on the action, and checkout steps that are not tracked at all after a theme or app change. If tracking needs fixing, the audit should say so plainly and, ideally, allow time to collect clean data before drawing conclusions. When the measurement setup itself is the weak point, marketing analytics services are often the better first step.
How deep the research should go
Analytics tells you where people leave. It rarely tells you why. That is what qualitative research is for: session recordings, heatmaps, short on-site or post-purchase surveys, support tickets, reviews and a handful of user tests. A good audit uses both, and each finding cites at least one source of each kind where it can. A finding with only a screenshot behind it is a guess. A finding with a drop-off number, ten recordings showing the same hesitation and three support emails asking the same question is evidence.
Conversion rate optimisation services that start with your data
We check your tracking first, find where your funnel leaks by step and device, and turn that into a ranked list of hypotheses with evidence and a test plan that fits your traffic. If something is simply broken, we tell you to fix it rather than test it.
See our conversion rate optimisation servicesWhat does a CRO audit find in practice?
In practice, a CRO audit turns one vague number into a small number of specific leaks. Here is an example store with simple numbers to show how that works. The store and figures are made up; the method is the one we use.
The store gets 40,000 sessions a month and takes 573 orders, a blended conversion rate of about 1.4 percent. On its own that number says very little. Split by device and funnel step, it starts to say something.
| Funnel step (one month) | Mobile | Desktop |
|---|---|---|
| Sessions | 30,000 | 10,000 |
| Added to cart | 1,500 (5% of sessions) | 600 (6% of sessions) |
| Reached checkout | 750 (50% of carts) | 420 (70% of carts) |
| Ordered | 300 (40% of checkouts) | 273 (65% of checkouts) |
| Conversion rate | 1.0% | 2.7% |
Some gap between mobile and desktop is normal. What stands out here is where the gap sits. Add-to-cart rates are close, so the product pages are doing their job on both devices. The difference opens after the cart: mobile shoppers are much less likely to start checkout and much less likely to finish it.
Observation
On mobile, only 40% of checkouts become orders, against 65% on desktop. Cart to checkout is also 20 points lower on mobile.
Evidence
Recordings show mobile shoppers scrolling the cart looking for delivery costs, then leaving at the shipping step when the cost appears. A third of exit survey answers mention shipping. Desktop shows the delivery banner above the fold; on mobile it is hidden by the theme.
Hypothesis
If we show delivery cost and the free shipping threshold on mobile product pages and in the cart, more mobile shoppers will start and finish checkout, because the cost will no longer be a surprise.
Size of the prize and next step
If mobile checkout completion rose from 40% to 50%, that would be 75 more orders a month, or €4,500 at a €60 average order. That is a ceiling to judge priority, not a forecast. Next step: fix the hidden banner now, then test cart messaging.
Notice what the audit did not do: suggest a new homepage hero or a full redesign. The data pointed at one stage, the research explained it, and the hypothesis is specific enough to test or ship.
What is different on Shopify
A Shopify CRO audit has a few specific checks. Shopify's own analytics has a simple funnel report (added to cart, reached checkout, converted) that is useful for cross-checking GA4. Apps are a frequent cause of slow pages and duplicate tracking, so the audit should list which apps load scripts on product and cart pages and whether each one earns its place. Checkout customisation is limited compared with the rest of the store, and more options exist on Shopify Plus, so recommendations should be realistic for your plan. A finding that says "redesign the checkout" on a standard plan is not something you can act on.
Speed and content findings sometimes overlap with search work. If the same slow templates are also holding back rankings, our guide on how to improve SEO on Shopify covers the search side, and Shopify SEO services can pick those fixes up alongside the conversion work.
What should you get at the end of a CRO audit?
You should get a short, ranked list of hypotheses, each with evidence, an expected effect and a recommended way to act on it, plus a test plan that fits your traffic. Everything else in the report exists to support that list.
In our experience the finished audit has four parts:
- A one-page summary. Where the funnel leaks, in plain language, and the three to five changes to make first.
- A tracking verdict. Whether your data can be trusted, what was fixed or needs fixing, and how big any remaining gap is.
- The hypothesis backlog. Each idea written as "if we change X, Y will improve, because Z", with the evidence, the affected step and device, an estimate of effort and a priority score.
- A test plan. Which ideas to A/B test, which to ship directly because the problem is obvious, which to validate with user research, and in what order.
Here is how a weak audit compares with a useful one. If the report you received looks more like the left column, it is worth asking for more.
How hypotheses should be prioritised
Most CRO teams use a simple scoring model: some version of impact, confidence and effort. The exact formula matters less than being honest about each input. Impact should reflect how many sessions pass through the affected step and how big the drop-off is. Confidence should reflect how much evidence sits behind the idea, not how much the auditor likes it. Effort should be checked with whoever builds it. A hypothesis that affects checkout for all mobile users, with three kinds of evidence, usually beats a homepage tweak that one stakeholder feels strongly about.
"The add to cart button should be bigger and a brighter colour. Best practice is to make the main call to action stand out."
"On mobile, 30% of product page visitors scroll past the variant selector without choosing a size, and recordings show repeated taps on the disabled add to cart button. We expect a visible size prompt and a size guide link next to the selector to raise mobile add-to-cart rate. Effort: half a day. Test it if traffic allows, otherwise ship and watch the step for four weeks."
How long does a CRO audit take and what does it cost?
Most CRO audits take two to four weeks, and the market price typically runs from a few hundred euros for a light review to five figures for a full audit with user research on a large store. What drives both is how much research goes in and whether tracking has to be fixed first.
Timing
A typical full audit breaks down roughly like this, though the order and length vary with the site:
- Week one: access, tracking checks and fixes, funnel analysis by step, device and source.
- Weeks one to three: recordings, heatmaps, surveys, support and review analysis, page by page review of key templates, speed checks.
- Final week: writing hypotheses, scoring, the test plan and a walkthrough with your team.
If tracking is badly broken, add two to four weeks of clean data collection before the funnel analysis means much. If you want moderated user testing, add time to recruit participants. Be wary of anything promising a full audit in two days: that is usually a heuristic review, which has its place, but it is not the same thing.
Typical market costs
Prices vary widely, so treat these as typical ranges you will see in the market, not quotes:
| Type of audit | What it usually includes | Typical market range |
|---|---|---|
| Light heuristic review | An expert walks through key pages and lists issues, with little or no analytics work | A few hundred to around €2,000 |
| Data-led CRO audit | Tracking checks, funnel analysis, recordings and heatmaps, page reviews, ranked hypotheses | Roughly €2,000 to €8,000 |
| Full audit with research | Everything above plus surveys, user testing, competitor review and a detailed test plan | Often €8,000 and up, more for large or international stores |
The trade-off is depth against cost. A light review is fine when your tracking is solid and you want a fresh pair of eyes. It is a poor choice when you do not yet know where the funnel leaks, because it skips the part that tells you. Some agencies fold the audit into an ongoing programme of work; if you are comparing a one-off audit with a retained conversion rate optimisation agency, ask what happens to the hypotheses after the report is delivered.
What if you don't have enough traffic for A/B tests?
You can still get a lot from a CRO audit. Fix clear problems directly, use qualitative research to choose changes, and reserve A/B tests for the few large changes where you can reach a meaningful answer in a reasonable time.
The reason is maths, not opinion. To detect a small improvement with confidence, a test needs a lot of conversions in each version. As a rough rule of thumb, if your store converts at 2 percent and you want to detect a 10 percent relative lift (from 2.0 to 2.2 percent) with standard settings, you need somewhere around 80,000 sessions per version. At 20,000 sessions a month, that test would take the best part of eight months. To detect a 20 percent lift (2.0 to 2.4 percent) you need about a quarter of that, so roughly two months. Small tweaks need huge traffic; bold changes need less.
Low-traffic tests often look like clear winners after a week, then fall back to nothing. If you stop as soon as the result looks good, you will ship changes that did not work and believe they did. Decide the sample size before you start and do not call it early.
What to do instead, in roughly this order:
- Ship the obvious fixes. Broken buttons, hidden shipping costs, a checkout error on one browser or a missing size guide do not need a test. Fix them and watch the affected step.
- Test bigger changes, not smaller ones. If you do test, test a reworked product page or a new offer, not a button label. Bigger changes produce bigger effects that you can detect with less traffic.
- Measure closer to the change. Testing against add-to-cart rate rather than purchases gives you more events and faster answers, as long as you check that orders do not fall.
- Use research as your confidence. Five to eight user tests, a post-purchase survey and your support inbox can tell you a lot about what stops people buying, without any test at all.
- Compare before and after carefully. Track the affected step for four to six weeks against the same period before, and note anything else that changed, such as promotions, ad spend or seasonality.
Low traffic is also a sign to look at the whole growth picture. If the store is small, more of the upside may sit in getting the right visitors in the first place, which is where broader ecommerce marketing services come in, with conversion work running alongside.
Frequently asked questions
Often yes, as long as it is scaled to the store. A small store benefits most from the tracking check and the funnel breakdown, because they show whether money is leaking from something broken. A long test plan is less useful when you cannot run many tests.
A basic one, yes. Compare purchases in your analytics with real orders, build a funnel by step and device, watch 20 to 30 session recordings of people who reached the cart and did not buy, and read your last month of support emails. The hard part is staying neutral about your own site.
Read access to your analytics and tag manager, staff or collaborator access to your store admin, and ideally access to your recording or heatmap tool and support inbox. You should not need to share passwords; grant user access and remove it when the audit is done.
No, they are inputs to one. Recordings explain behaviour once you know which step to look at, but without funnel data you end up watching random sessions and drawing conclusions from a handful of them. Use them to explain the numbers, not to replace them.
It is usually a good idea. If a leak in checkout costs you a share of every visitor, more ad spend makes that leak more expensive. Fixing the obvious problems first means every extra euro of traffic has a better chance of turning into an order.
A full audit once a year is reasonable for most stores, plus a lighter check after a redesign, a theme change, a new checkout setup or a large shift in traffic sources. If you run a continuous testing programme, the audit becomes an ongoing backlog rather than a one-off report.
What to do next
A CRO audit is worth having when it ends in a short list of evidence-backed changes your team will actually make. You can start on the groundwork today.
- Compare last month's purchases in your analytics tool with real orders in your store admin. If the gap is large, fix tracking before anything else.
- Build a simple funnel table like the example above, split by mobile and desktop, and note the step with the biggest gap.
- If you want a second pair of eyes, ask us for a free written audit. You get it within 48 hours, with the biggest leaks ranked by impact, whether or not you go on to work with us.