What does a CRO audit include, and is it worth paying for?

What is a CRO audit supposed to answer?

Your Meta spend is up, sessions are up, and your conversion rate has sat on the same number for two quarters. One agency offers a CRO audit. Another offers a free one. A third says the theme is the problem and quotes a redesign.

Before you compare offers, get clear on what you are buying. A CRO audit should answer one question: where between the ad click and the order confirmation are you losing buyers, and how many orders a day is each leak worth? Everything else in the deck is decoration.

That question has a money answer, not a design answer, and only your own data can give it. An audit that never asks for that data cannot answer it, however many pages it runs to.

What does a real audit measure first?

The funnel, page by page. Conversion rate is the last link of a chain: sessions that add to cart, sessions that reach checkout, sessions that complete checkout. Shopify defines conversion rate as sessions that completed checkout divided by sessions, and reports each step as its own metric (Shopify ShopifyQL sessions schema).

The trap is reading those steps sitewide. A store with a long-form lander, two product pages and a homepage all taking paid traffic has four funnels, and the sitewide average hides which one leaks. The same Shopify schema carries a landing page path dimension, so every step rate can be split by the page where the visit started. GA4's funnel exploration does the same with a breakdown dimension (Google Analytics Help).

The sitewide row says nothing is badly wrong. The page rows say three different things: the lander loses people before the cart, the bundle page loses them between cart and checkout, and product page A carries the most traffic, so even a small gain there is worth the most orders. Three leaks, three owners, three fixes. That table is the first deliverable of a real audit. Our guide on add to carts without purchases shows how to pull the step rates yourself, and our supplement conversion rate benchmarks explain why each page needs its own yardstick.

Scroll depth versus the buy button

Step rates tell you where people leave. Session recordings and scroll maps tell you what they saw before they left. The finding that matters most is often not a bad button. It is a button most visitors never reach.

Nielsen Norman Group's 2018 eyetracking study, run on desktop screens, found users spent about 57% of their page-viewing time above the fold and 74% in the first two screenfuls, and that people "rarely go beyond the third screenful" (Nielsen Norman Group). A phone screen holds far less, so on a long supplement page the buy box can sit several screens down, after the story, the ingredients and the reviews. A real audit puts two numbers side by side: the share of mobile sessions that reach the buy box, and the add-to-cart rate of those who do. The tooling does not have to cost anything: Microsoft says Clarity, which offers session recordings and heatmaps, is "a free service forever" (Microsoft Clarity FAQ).

What should the audit check in the checkout and the offer?

These are the two places closest to the money, and the two places a checklist audit most often skips.

Checkout completion by flow

Shopify's checkout is not one flow. Accelerated checkouts (Shop Pay, Apple Pay, Google Pay, Amazon Pay, PayPal) appear in an Express Checkout section at the start of checkout, ordered dynamically to show the fastest method for each customer, and they can also run from product pages so the buyer skips the cart (Shopify Help Center). Shopify claims Shop Pay can lift conversion by as much as 50% compared to guest checkout, citing a study by a consulting firm (Shopify). Read that as the vendor's claim. The audit question is simpler: on your store, express and standard checkout complete at different rates, and a blended checkout rate hides which one is leaking.

Standard checkout is where usability research applies. Baymard's benchmark finds the average US checkout shows 23.48 form elements by default, against an ideal of 12 to 14, and estimates that the average large ecommerce site can gain a 35.26% increase in conversion rate through better checkout design (Baymard Institute). Those are averages across large sites, not a forecast for yours. They explain why checkout belongs near the top of the list.

The offer math

Price, bundles, the subscription discount and the free-shipping threshold decide whether a visitor who wants the product can say yes to the number in front of them. In Baymard's latest study of why US online shoppers abandon, once "just browsing" is set aside, 40% cite extra costs that were too high (shipping, tax, fees) and 12% say they could not see or calculate the total order cost up front (Baymard Institute).

So a real audit maps every offer path a visitor can take (single unit, bundle, subscribe and save) and what shipping costs on each. It checks whether the free-shipping threshold sits just above your best-selling single unit, whether the subscription discount is visible on the page that gets the traffic, and whether the bundle reads as a saving at a glance. Our guide on subscribe and save discounts covers that piece. Every offer change is then checked against margin, because an offer that converts more but earns less is not a fix.

What separates a cheap audit from a real one?

A cheap audit is a walk through your site with a best-practices checklist. It is not useless. It is unranked, and it is written from outside your data.

Traffic quality deserves its own line because it quietly distorts every rate above it. Meta runs crawlers such as facebookexternalhit, whose stated purpose is to crawl content shared on Facebook, Instagram or Messenger (Meta for Developers), and Microsoft notes that even with Clarity's bot detection on, some bot sessions can slip through (Microsoft Clarity FAQ). Sessions that never could have bought make every landing page look worse than it is.

Popups, badges and button colors are not wrong to look at. They are wrong to lead with, because nothing in the data says that is where your orders go missing.

What should you have in hand when the audit ends?

Two things: a leak map and a test plan. If you get a PDF of observations instead, you have the raw material for an audit, not the audit.

A leak map ranked by orders per day

Each leak gets a ceiling: the extra orders per day if that one step improved to a realistic level and everything else held. Ceilings are upper bounds, not forecasts, and they overlap, so they do not add up neatly. Their job is ranking. Here is how that reads for product page A from the table above, at 800 sessions and about 18.5 orders a day.

Read the table bottom up and you see why the checklist audit disappoints: the items it leads with cannot even be ranked. Read it top down and the work orders itself. Each ceiling is then checked against cost and margin. The shipping fix, for example, is only a fix if the extra orders cover the shipping you give away.

A test plan sized to your traffic

A real test plan says, for each test, which page, which metric, how many sessions it needs and how long that takes at your traffic. The primary metric should be revenue per visitor, which Intelligems defines as net revenue divided by unique visitors, and Intelligems recommends gross profit per visitor for most tests, especially those that touch price, product mix, order volume or shipping (Intelligems: revenue metrics, Intelligems: profit metrics). Conversion rate alone can rise while revenue falls, for example when a cheaper single unit pulls buyers away from the bundle.

The plan should also fix the sample size before launch. Evan Miller's advice is to "decide on a sample size in advance", because checking early and stopping on a good day inflates false wins: peek ten times and what you think is 1% significance is actually 5% (Evan Miller).

What are the red flags of a bad CRO audit?

• No data access requested. If nobody asked for Shopify, GA4, the ad account or recordings, the audit was written from outside your store. It can describe your pages. It cannot tell you where orders go missing.
• The same checklist for every store. Sticky add to cart, trust badges, urgency timers, an exit popup. If the recommendations would fit any Shopify store, they were not written for yours.
• Recommendations without expected impact. Every item should carry a leak size or a ceiling. "Improve the product page" with no number attached is a to-do, not a finding.
• No test sizing. A plan of twelve A/B tests on a page with 15,000 sessions a month cannot be run. Ask how many sessions each test needs and how long it will take.
• Redesign as the answer. A redesign changes everything at once, so nobody can tell which change helped or hurt, and it usually leaves the checkout and the offer exactly as they were.
• Sitewide numbers only. One conversion rate for the whole store, compared to an industry benchmark, is where an audit starts, not where it ends.

The same instinct applies to whoever sells you the audit. Our list of questions to ask a DTC agency has the ones that expose a template on the first call.

What should you give the auditor?

Read access, not passwords. Everything below can be shared without handing over control of the store.

• Shopify. A collaborator account. Shopify describes collaborators as Shopify Partners you allow into your store, such as agencies, with permissions set through roles you control, and they do not count toward your store's user limit (Shopify Help Center).
• GA4. Viewer access is usually enough. Google's Viewer role can see settings and data and can create explorations, which covers funnel explorations (Google Analytics Help).
• The ad account. Read access, so the auditor can match each landing page to the campaigns and creatives sending traffic to it.
• Session recordings and heatmaps. If none are installed, install them before the audit starts so there are a few weeks of data by the time anyone looks.
• A change log. Promotions, price changes, app installs, theme edits and stockouts for the last 90 days. A drop that lines up with a promotion ending is not a page problem.
• Unit costs. COGS and shipping cost per order, so offer changes are judged on margin and not only on conversion.

Is a CRO audit worth it for a $2M brand?

Run the math before you buy. A $2M a year store at a $60 average order value takes about 91 orders a day. A leak worth 3 orders a day at that order value is $180 a day, or about $66,000 a year in revenue at its ceiling. (Illustrative numbers, not a client account.)

Revenue is not profit, so put the margin on those orders next to what the audit costs and what the fixes cost to build. Our guide to DTC agency costs has current market ranges. A real audit lets you make that comparison with numbers. A checklist audit gives you nothing to compare.

When a CRO audit is not worth it

When your traffic is too low to test what it finds. The table uses the standard two-proportion formula at 95% confidence and 80% power; Evan Miller's rule of thumb for sample size gives figures in the same range (Evan Miller).

Below roughly 20,000 sessions a month on the page you would test, a long test roadmap cannot be run. You can still fix what is plainly broken, such as a checkout error or shipping that appears only at the last step, but the bigger lever is usually traffic. Our comparison of Intelligems and Shoplift goes deeper on sample sizes. Two other cases where an audit can wait:

• Tracking is broken. If Shopify orders and GA4 purchases disagree badly, fix measurement first. An audit on bad data ranks the wrong leaks.
• The problem is upstream. If cost per session rose and conversion held, the leak is in the media, not the site. Our guide on a rising Meta CPA covers that split.

Should an agency run the audit, or your own team?

Either can, if the deliverable is the same. The method is not secret: per-page step rates, scroll versus buy box, checkout by flow, offer math, a ranked leak map, a sized test plan. What differs is who has the hours and who has seen enough stores to know where to look.

• In-house works when someone on the team can pull Shopify data by landing page, watch recordings with a specific question in mind, and say no to tests the traffic cannot support.
• An agency earns its fee when nobody internal owns conversion, when the team that built the pages would be grading its own work, or when you want pages judged together with the ads sending traffic to them.
• A freelancer fits a narrow brief, such as checkout only or one landing page, with someone internal to own the result.

Our guide to agency vs freelancer vs in-house covers the wider trade-off. Whoever you pick, judge the audit by its leak map, not its page count.

How we run a CRO audit at Succession

We start where the money is and work outward. The order matters more than any single check.

1. One market first. We isolate the US before reading any rate, so international traffic does not drag every step down.
2. Clean sessions. We filter Meta's crawlers and link checkers out of session data. They arrive in bursts from Meta's data centers when ads are created or edited, mostly showing up as Sweden and Ireland, and they never buy.
3. Per-page step rates. Session to add to cart to checkout to order, for each landing page that takes paid traffic, compared on volume-matched days so a spend change does not pass for a page change. Shopify orders are the scoreboard, not platform-reported purchases.
4. Scroll depth against the buy button. From recordings and heatmaps, how far visitors get on each page and where the buy box sits relative to that point.
5. Checkout and offer before design. Completion by checkout flow first, then price, bundles, subscription discount and shipping threshold, all checked against margin. Page redesigns come after.
6. A leak map. Every leak gets a ceiling in orders per day, and the fix list is ranked by that number.
7. Tests sized to traffic. Each test gets a planned sample before launch and is judged on revenue or profit per visitor, using Intelligems-style splits where the traffic supports it.

None of this needs a redesign to start. It needs clean data and someone willing to read it one page at a time.

What should you do this week?

1. Pull sessions, sessions with cart additions, sessions that reached checkout and orders for each landing page that takes paid traffic, last 60 days, US only.
2. Find the page with the most sessions and the weakest step. That is your first leak to size.
3. Install session recordings and heatmaps if you have none, then check how many mobile visitors reach the buy box on that page.
4. Split checkout completion by flow: express versus standard.
5. Write down every offer path and what shipping costs on each. Look for a free-shipping threshold sitting just above your best seller.
6. Before you buy a test roadmap, check the monthly sessions on the page you would test against the sample size table above.
7. If you want the leak map built with you, book a free growth audit.

FAQ