How to Run a CRO Audit (Free Checklist)
A CRO audit is a structured review of analytics, heuristics and real user sessions that finds the specific reasons visitors leave before converting.
A CRO audit is a structured review of analytics, on-page heuristics and real user sessions that finds the specific reasons visitors leave a page before converting, ranked by how much revenue each fix is worth. It replaces guessing with a prioritized backlog.
That backlog is what feeds an A/B testing program — without one, most tests start from a hunch instead of from evidence a page actually has a problem.
On this page
What exactly does a CRO audit check?
Three things, in a specific order. First, where visitors actually drop off, from analytics. Second, why they might be dropping off there, from a heuristic review against known usability patterns. Third, whether that guess is right, from watching real sessions or talking to real users. Skipping straight to the third step without the first two means watching hours of footage with no idea which page matters most.
The heuristic pass is where most of the audit's judgment calls live, and it benefits from a fixed set of questions rather than an open-ended look. Is the primary action visible without scrolling? Does the page answer price, and what's included, without a form? Is there a visible reason to trust this specific business over the alternative in the next tab? A page that fails several of these at once is your first candidate for a product page review, since that is usually where the most of them pile up.
Write the checklist down before you look at a single page, not while you're looking at it. An open-ended review drifts toward whatever the auditor personally finds ugly, which is a different question from what is actually costing conversions. A fixed list forces the same standard across every page, and it is what turns "I think this page is confusing" into "this page fails four of our twelve checks," which is a finding someone can act on without having to trust your taste.
What data do you pull before you look at a single page?
Four numbers, at minimum: sessions, conversion rate, exit rate, and device split, all segmented by traffic source. A funnel that converts at 3% for paid search and 0.4% for organic is not one problem, it is at least two, and an audit that averages them together will chase the wrong fix.
Pull the funnel report for the exact path you're auditing — landing page to product page to cart to checkout, or homepage to pricing to signup — and note the single biggest percentage drop between two adjacent steps. That step gets audited first, not the page with the most total traffic. A high-traffic page converting acceptably is not where the next quarter's revenue is hiding; the step people are actually abandoning is.
Segment by new versus returning visitors too, if your analytics can split it cleanly. A step that looks merely weak in the blended number can be fine for returning visitors and badly broken for new ones, or the reverse, and averaging the two hides which audience you're actually failing. Most first-time audits skip this cut and end up auditing a page for a problem that only half their traffic experiences.
Which heuristics catch the most problems, fastest?
The ones built on usability testing rather than opinion. Nielsen Norman Group's own research recommends five participants for a typical qualitative session because that is enough to surface most of a page's common problems without paying for a study far larger than the finding requires [2]. An audit that borrows the same discipline — a handful of structured sessions rather than one designer's read — catches things a checklist alone misses, like a label that reads fine to you and confuses everyone else.
65% of sites
That number is about checkout specifically, but the pattern generalizes: most sites carry more friction than their owners assume, and it clusters in a few predictable places — unclear pricing, a form asking for more than it needs, a product page that never actually answers the buyer's question.
None of that means every site needs a full research budget to find its version of the same problem. A short structured pass with a fixed checklist, run by someone who was not involved in building the page, surfaces most of the obvious gaps in a day. The research-grade methods matter most for the frictions that survive that first pass — the ones subtle enough that an outsider's first look does not catch them either.
How do you turn findings into a prioritized backlog?
Score each finding on two axes: how much traffic or revenue sits behind the page it's on, and how confident you are that fixing it will move the number. A high-traffic page with a low-confidence fix and a low-traffic page with a near-certain fix can land in the same priority tier; the axis that matters is expected impact, not either number alone.
| Method | What it catches | Typical time |
|---|---|---|
| Funnel analytics | Where visitors drop off, and how much traffic is at stake | 1-2 days |
| Heuristic review | Known usability failures against a fixed checklist | 2-3 days |
| Session replay | The specific moment a real visitor gets stuck | 3-5 days for enough sessions |
| Moderated user testing | Why a visitor got stuck, in their own words | 1-2 weeks including recruiting |
How many pages should the first audit cover?
Fewer than you'd think. Cover the exact path most of your revenue travels — usually landing page, one core content page, and the conversion page itself — rather than every page on the site. A thin audit of the whole site produces a long list of small issues; a deep audit of the real path produces a short list of the issues actually costing money.
If you run an agency engagement or manage testing in-house, the same rule applies either way: scope the first audit to the path, not the site, and expand once that path is fixed.
There is a second reason to keep the first audit narrow: a short list of findings actually gets fixed. A ninety-item report from a whole-site sweep tends to sit in a shared drive while everyone waits for someone else to start on it. A ten-item report scoped to one path, ranked by expected impact, is something one person can start on the same week — and a finished ten-item list beats an untouched ninety-item one every time.
What does the checklist look like, start to finish?
Pull the funnel
Get sessions, conversion rate and exit rate per step, segmented by traffic source and device, for the exact path you're auditing.
Find the steepest drop
Identify the single step with the largest percentage loss between it and the step before it. That step is audited first.
Run the heuristic checklist against that page
Check visibility of the primary action, price and inclusion clarity, trust signals, and load time against a fixed set of questions, not open impression.
Watch or run five real sessions
Session replay or a small moderated study, five participants is enough to surface most of what's wrong.
Score and rank findings
Traffic behind the page times confidence in the fix. The result is your backlog, not a wish list.
How often should you re-run the audit?
After any redesign that touches the funnel, and at minimum once a year even if nothing visible changed — traffic mix and device split shift on their own, and a page that was fine for last year's audience is not automatically fine for this year's. A rigorous test still needs a correctly scoped hypothesis to test, and the audit is where that hypothesis comes from; running tests without one is how a program spends months proving things nobody needed proven.
Treat the re-audit as a smaller version of the first one, not a full repeat. You already have the checklist and you already know which path matters most; the work is mostly re-pulling the funnel numbers and checking whether last year's fixes actually held. A page that regresses after a redesign is common enough that this alone often justifies the hour it takes. Build it into the calendar the same way you would a routine security check — scheduled, not triggered only by a visible drop in the number, because by the time the drop is visible you have usually already lost a full quarter of the traffic it cost you.
Questions people also ask
How long does a full CRO audit take?
A single funnel — homepage through checkout or signup — usually takes a week for the analytics and heuristic passes, plus another one to two weeks if you add moderated user testing. A multi-funnel site takes longer in proportion to how many distinct paths you have to review.
Do I need a tool to run one, or just a spreadsheet?
A spreadsheet and your existing analytics account cover the heuristic pass. Session replay and a testing tool make the data pass faster and the eventual fixes measurable, but neither is required to start; they just mean you audit again from a stronger baseline next time.
What's the difference between a CRO audit and a UX audit?
A UX audit asks whether a page is usable in general. A CRO audit asks the narrower question of why visitors who intend to convert do not, which means it weighs a friction point by how much revenue sits behind it rather than by how it looks.
Should the audit happen before or after we pick a testing tool?
Before. An audit tells you which pages and which specific frictions are worth testing; picking a tool first just gives you a way to test the wrong thing efficiently.
Sources
- Conversion Rate Optimization (CRO): The Complete Guide — VWO (checked 22 September 2026)
- Usability Testing 101 — Nielsen Norman Group (checked 22 September 2026)
- Conversion Rate Optimization — Optimizely (checked 22 September 2026)
- Checkout Usability — Baymard Institute (checked 22 September 2026)
Get your funnel audited before you spend a quarter testing the wrong page
Book a free 30-minute consultation with Ibrahem and Jeremy. We look at your site while we talk, and you leave with a prioritised plan.
Who wrote this
Ibrahem HelalCo-founder
Leads strategy and delivery.
Works on: SEO, GEO
Reviewed before publishing by Jeremy Zava, Co-founder.
- A/B Testing: The Complete GuideWhat A/B testing is, when your traffic can support it, how to run a split test that holds up, and how to read the result without fooling yourself.
- CRO Agency vs In-House: Which to PickWhat a CRO agency and an in-house tester each actually deliver, what they cost, and the traffic and budget thresholds that decide which one fits.
- Product Page Optimization: What Actually WorksProduct page optimization is fixing the specific gaps between what a buyer needs to decide and what your page currently gives them, in priority order.
- Bayesian vs Frequentist AB Testing, ComparedBayesian and frequentist AB testing answer different questions with different rules about peeking, sample size and what a result actually means.