The CRO Audit Checklist: 48 Points We Check on Every Site

A CRO audit checklist is only as useful as the discipline behind it. The sites we have lifted from 1.8 percent to 4.6 percent conversion all followed the same pattern — the issue was rarely a single broken setting, it was 10 to 15 small misalignments compounding into a flat conversion curve.

This is the 48-point CRO audit checklist we run on every new conversion-focused client account, in the exact order we apply it. You can run this on your own site in 2 to 3 hours. By the end you will know precisely which levers to pull first to lift conversion rate and revenue per visitor.

The checklist is grouped into eight sections — hero and value proposition, copy and structure, forms, trust signals, speed and performance, mobile UX, analytics and measurement, and conversion paths. Work through them in order. Out-of-order optimisation wastes weeks.

Section 1 — Hero and value proposition (6 points)

The hero carries 60 to 80 percent of conversion weight on most landing pages. If it is weak, nothing else compensates.

1. Does the headline answer "what is this and who is it for" in 5 seconds?

A visitor should know within 5 seconds whether they are in the right place. Generic headlines like "Welcome to our website" fail this test.

2. Does the subhead address the most common skepticism?

The subhead expands the headline and addresses the implicit "is this real?" or "what's the catch?" question. We covered the full hero structure in our value proposition writing guide.

3. Is there a single primary CTA visible without scrolling?

Above-the-fold CTAs convert 25 to 50 percent better than below-the-fold equivalents. The primary CTA must be visible on first paint.

4. Does the CTA copy describe what the user gets?

"Get my free audit" beats "Submit". CTA copy should reinforce the value proposition, not just request action.

5. Is there visible social proof above the fold?

Client logos, named testimonials, review stars, case study numbers. Something credible visible without scrolling.

6. Does the hero match the source (ad copy, search query, referrer)?

If your Google Ad promised "Cut your CPL by 40%", the hero must echo that promise. Mismatched messaging triggers immediate distrust.

Section 2 — Copy and structure (7 points)

The body of the page either reinforces the hero or fights it.

7. Are benefits emphasised over features?

"Save 30 percent on Google Ads spend" beats "Includes negative keyword cleanup module". Features describe what; benefits describe what changes for the customer.

8. Is there a clear value proposition section after the hero?

The first scroll-down section should reinforce why the offer matters. Often a "Why this works" or "What you get" section.

9. Are benefits presented as a scannable grid?

3 to 5 benefits with icons, headlines, and 1 to 2 sentence descriptions. Wall-of-text descriptions underperform scannable grids.

10. Are objections addressed in the page body?

Common objections (price, time, risk, applicability) should be addressed somewhere on the page. FAQ sections, "How it works" sections, and risk-reversal language all serve this function.

11. Is there a clear risk-reversal element?

Guarantee, free trial, money-back, no credit card required, free consultation. Something that reduces the psychological cost of acting.

12. Is the page free of unnecessary navigation that pulls users away?

For paid traffic landing pages, the header navigation often distracts. Minimal navigation or no navigation works best for cold-traffic conversion.

13. Are paragraphs short (2 to 4 lines maximum)?

Long paragraphs go unread. Short blocks with white space invite scanning.

Section 3 — Forms (6 points)

Forms are where intent becomes commitment. Bad forms kill motivated traffic.

14. Does the form have 5 fields or fewer for cold traffic?

Each unnecessary field reduces completion 5 to 15 percent. We covered the full form playbook in our form optimization guide.

15. Is the form single-column?

Two-column forms convert worse on both mobile and desktop. Single column with one field per line is the proven pattern.

16. Are autocomplete attributes set on every field?

Free conversion lift on mobile. autocomplete="email", autocomplete="name", etc. Often skipped.

17. Are input types correct (email, tel, number, url)?

Right input types trigger the right mobile keyboards. Default text for every field is a mobile mistake.

18. Are error messages inline and specific?

"Please correct errors below" is the worst possible error UX. Inline errors next to each field with specific messages convert vastly better.

19. Are labels above fields (not placeholder-only)?

Placeholder-only labels disappear when typing starts. Users forget what the field was asking for. Always have visible labels above fields.

Section 4 — Trust signals (6 points)

The conversion lever most sites underuse.

20. Are there 2 to 4 specific named testimonials with real photos and outcomes?

Specific testimonials with names, photos, and measurable outcomes beat generic praise. We covered the full pattern in our trust signals and social proof guide.

21. Is there a client logo bar with recognisable brands?

A "trusted by" line with 5 to 8 well-chosen client logos. Real customers, not platform partners.

22. Are third-party review counts and ratings displayed?

Google reviews, Trustpilot, Yelp — third-party platforms add credibility your own site cannot provide alone.

23. Are case studies linked from relevant pages?

Detailed case studies with measurable results. Heavy lifters for high-consideration purchases.

24. Are certifications and credentials displayed where relevant?

Industry certifications, professional licenses, platform partner badges (Google Partner, Meta Business Partner).

25. Are security badges visible at the payment step?

For e-commerce, SSL indicators, payment processor logos, and 3D Secure indicators are essential at the payment moment.

Section 5 — Speed and performance (5 points)

The foundation that every other tactic stands on.

26. Is mobile LCP under 2.5 seconds?

Largest Contentful Paint over 2.5 seconds drops conversion. Above 4 seconds, half your mobile visitors bounce before render.

27. Are images compressed and served in WebP or AVIF?

Hero images should be 100 to 300 KB on mobile, not 1 to 3 MB. WebP at quality 80 to 85 is the sweet spot.

28. Is the LCP image set with fetchpriority="high"?

Free 200 to 800 ms LCP improvement on the highest-impact image.

29. Are non-critical scripts deferred?

Analytics, chat widgets, A/B testing tools should defer until after first paint. Most sites have 1.5 to 4 seconds of unnecessary main-thread blocking from third-party scripts.

30. Is TTFB under 600 ms?

Server speed is the foundation. Front-end optimization cannot save slow hosting. We covered the full speed playbook in our page speed and conversion rate impact guide.

Section 6 — Mobile UX (7 points)

75 percent of traffic, often 30 to 60 percent of desktop conversion.

31. Is the primary CTA in the thumb zone (bottom third of viewport)?

The bottom third is the easiest mobile zone for thumbs. We covered the full pattern in our mobile UX conversion optimization guide.

32. Are tap targets at least 44 x 44 pixels?

Smaller tap targets cause mis-taps. The 44-pixel rule is non-negotiable for mobile UX.

33. Is body text at least 16 pixels?

Smaller text triggers user zooming, which breaks layout. 16 pixels minimum on mobile.

34. Are sticky elements not blocking content?

Sticky headers, footers, chat widgets all consume mobile viewport space. Audit which ones earn their cost.

35. Does the page work without hover interactions?

Mobile has no hover. Any tooltip-only or hover-only content fails on touch.

36. Is checkout via Apple Pay and Google Pay enabled?

For e-commerce, this is a 10 to 25 percent mobile conversion lift. Free to enable.

37. Is WhatsApp or click-to-call enabled where market-relevant?

For local services in MENA, southern Europe, and North Africa, WhatsApp click-to-message often outperforms web forms.

Section 7 — Analytics and measurement (5 points)

You cannot optimise what you do not measure.

38. Is conversion tracking firing correctly on every conversion event?

Test conversions on every form, every CTA. We covered the full tracking setup in our Google Ads conversion tracking setup guide.

39. Are session recordings being captured for review?

Tools like Hotjar, Microsoft Clarity, or Fullstory record real sessions. Watching 20 to 30 mobile sessions reveals patterns no dashboard surfaces.

40. Are heatmaps active on key pages?

Heatmaps show where users tap and where they do not. Especially useful on mobile for thumb-zone validation.

41. Is funnel tracking in place for multi-step flows?

For checkouts, signup flows, and multi-step forms, funnel reports show where visitors drop off. Knowing the step is half the fix.

42. Is GA4 data quality verified weekly?

Bounce rates over 90 percent, session times under 5 seconds, or missing conversion events all signal broken tracking. Verify weekly.

Section 8 — Conversion paths (6 points)

Beyond the page itself, the broader path matters.

43. Is there an abandoned cart or abandoned form recovery sequence?

Email or SMS sequence recovering visitors who left mid-flow. Recovers 5 to 15 percent of abandoners at near-zero cost.

44. Are exit intent strategies in place where appropriate?

For e-commerce and lead-gen sites, exit intent recovers 3 to 8 percent of monthly conversions. We covered the framework in our exit intent strategies guide.

45. Is there a clear post-conversion experience?

What does the user see after converting? Thank-you page, next-step offer, account creation prompt. Most sites waste this moment.

46. Is retargeting active for non-converters?

Visitors who did not convert should be retargeted across Meta and Google for 7 to 30 days. Many sites have the pixel but no campaigns running.

47. Are there clear secondary conversion goals?

If the visitor will not convert on the primary action, what secondary action captures intent? Newsletter signup, lead magnet download, demo request, return browser intent.

48. Is the conversion path tested end-to-end at least monthly?

Form fills, payment processing, confirmation emails, follow-up sequences. Test the full path. Things break silently.

How to score the audit

Count how many of the 48 points you pass. Most sites we audit pass 18 to 28 points. Top-tier accounts pass 38+.

Each missed point is a leak. The order in this checklist roughly matches impact size — hero first, copy second, forms third. Fix in that order.

A 30-day plan to fix the worst leaks

Run the audit. Then attack the gaps in this order.

Days 1 to 5 — Hero and value proposition. Rewrite headline, subhead, and CTA. Place social proof above the fold. Match to traffic source.

Days 6 to 10 — Forms. Reduce fields. Add autocomplete. Single column. Inline errors. Right input types.

Days 11 to 16 — Trust signals. Collect testimonials with names and outcomes. Add logo bar. Surface review counts. Add case study links.

Days 17 to 22 — Speed. Compress images. Defer scripts. Hit LCP under 2.5 seconds.

Days 23 to 27 — Mobile UX. Thumb-zone CTA. Touch targets. 16px text. Apple Pay or click-to-call.

Days 28 to 30 — Measure. Compare conversion rate to baseline. Most sites see 20 to 50 percent lift in this window.

Common audit findings on accounts under €10K monthly revenue

These are the patterns we see most often on smaller accounts.

• Generic value proposition (75 percent of accounts)
• Form with 7+ fields for cold traffic (60 percent)
• No autocomplete attributes (55 percent)
• Stock photo testimonials or none at all (50 percent)
• Mobile LCP over 4 seconds (45 percent)
• No exit intent or recovery sequences (70 percent)
• No A/B testing program (80 percent)
• Broken conversion tracking (40 percent)

If any of these match your site, fix that first.

A real example — Marseille cosmetics audit

We audited a Marseille cosmetics e-commerce store at 21 of 48 points. Audit revealed: generic homepage hero, 12-field checkout, no Apple Pay, mobile LCP at 4.7 seconds, no testimonials with photos.

After 45 days of the framework above, the account moved to 39 of 48 points. Conversion rate lifted from 1.4 percent to 4.7 percent. Revenue per visitor up 240 percent. The full story is in our Marseille cosmetics e-commerce case study.

Frequently asked questions

How long does a CRO audit take?

A thorough audit takes 2 to 3 hours per page on a typical site. For an e-commerce store with 5 to 10 key pages (home, category, product, cart, checkout), budget 10 to 20 hours total.

How often should I audit my CRO setup?

Full audit every 6 months. Mini-audits (key pages, top conversion funnels) quarterly. After any major site change, immediate audit.

Can I audit my own CRO setup without expert help?

Yes for the first audit. This 48-point checklist gives you a self-audit framework. The discipline to execute the fixes consistently is where most sites still need help.

What is the single highest-impact CRO fix?

Usually one of three: rewriting a generic hero, reducing form field count, or fixing mobile page speed. The right answer depends on which is weakest in your current setup.

Should I trust a CRO audit from the same agency that built the site?

A self-audit from your current agency carries inherent bias. Independent audits surface issues a managing agency might miss or downplay.

How fast can a properly-audited site see results?

Hero and form fixes show in 7 to 14 days. Speed fixes show in 2 to 4 weeks. Trust signal work compounds over 30 to 60 days. Most sites see meaningful conversion movement within 30 days of audit fixes.

Get a free 48-point CRO audit

We run this exact audit on conversion-focused sites free of charge. Within 48 hours, you get a scored breakdown of all 48 points and a prioritised action plan ranked by expected impact on conversion rate.

Book a free 30-minute audit. We screen-share, walk through your site and competitor sites, and you leave the call with a clear list of what to fix first.

Or explore our CRO service for the full system we run on managed accounts.