CRO audit: how to find and fix conversion leaks in 7 steps
Most CRO audits land at one of two extremes: a glance at bounce rates in Google Analytics, or a lecture on statistical significance. The practical version sits in between - seven steps that locate the leak in a funnel and settle what to do about it.
What a CRO audit actually covers
A CRO audit is not a single report or a tool export. It is a structured process that combines quantitative data (analytics, heatmaps, session recordings) with qualitative insights (surveys, user tests) to form a prioritized list of changes. The goal: remove friction so more visitors complete your desired action, whether that is a purchase, signup, or lead.
Do not confuse a CRO audit with a usability audit. Usability checks whether elements work: the button is clickable, the form submits. CRO checks whether the user chooses to act at all.
An audit typically covers landing pages, product pages, checkout flows, and signup forms. It can also include email triggers and off-site paths if they are part of the same funnel.
- Define the conversion goal (macro vs micro).
- Gather data from analytics, heatmaps, recordings, surveys.
- Identify friction points (drop-offs, confusion, trust issues).
- Prioritize hypotheses by potential impact and effort.
Define your conversion goals and metrics
Before looking at any data, write down what 'conversion' means for each page. For an e-commerce site, the primary macro conversion is a purchase. Micro conversions might be add-to-cart, email signup, or product view. For a SaaS, trial start or demo request.
Then list the metrics you will track in the audit: conversion rate, drop-off rate per step, average time on page, bounce rate, exit rate, and engagement metrics like scroll depth and click distribution. Without clear metrics, you cannot measure improvement.
Set a baseline. If checkout converts at 2% today, that is the number every change gets measured against.
Collect quantitative data
Start with Google Analytics (or your platform) to see where users drop off. Build a funnel report: landing page, category page, product page, cart, checkout, thank you. Look for the steepest drops. A 70% drop from cart to checkout is more urgent than a 30% drop from landing to category.
Then overlay heatmaps and session recordings (tools like Hotjar, Crazy Egg, or Microsoft Clarity). Heatmaps show where users click, move, and scroll. Recordings reveal confusion: users hesitating, clicking non-clickable elements, or filling forms incorrectly.
Focus on pages with high traffic but low conversion. A product page with 10,000 views and 1% conversion is a bigger opportunity than a page with 100 views and 5% conversion.
Run qualitative research
Quantitative data tells you what happens; qualitative tells you why. Use on-site surveys (e.g., Qualaroo, SurveyMonkey) to ask users what stopped them from buying. Keep it short: 'What almost prevented you from completing your purchase today?'
Also run user tests (unmoderated like UserTesting or lookback.io). Ask five users to complete a key task (buy a product, sign up) while recording their screen and voice. You will spot confusion in minutes: buttons people miss, text they don't read, trust symbols they ignore.
Analyze customer support tickets and chat logs. If 20% of support questions are about shipping costs, you have a clear info gap on the checkout page.
Generate hypotheses from findings
Every finding must become a testable hypothesis. Bad hypothesis: 'The button color is wrong.' Good hypothesis: 'Changing the CTA button from gray to green will increase click-through rate by 10% because green implies action and contrasts with the page background.'
Structure each hypothesis with a mechanism: 'We believe that [change] will [effect] because [reason].' Then assign an estimated impact (low/medium/high) and effort (hours to implement).
Combine findings. For example, if heatmaps show users ignore the main CTA but click an image that leads nowhere, a hypothesis could be: 'Making the hero image a link to the product page will increase engagement and conversions.'
- Hypothesis: Add trust badges to checkout, reduce anxiety, increase completion by 5%.
- Hypothesis: Simplify form from 10 fields to 5, reduce friction, increase signup by 15%.
- Hypothesis: Move pricing table above the fold, increase plan selection by 8%.
Prioritize your test ideas
Not all hypotheses are worth testing right away. Use a prioritization framework like ICE (Impact, Confidence, Ease) or PXL (Potential, Importance, Ease). Score each idea from 1 to 10 on three dimensions, then average. Run the highest-score tests first.
Example: Adding a progress bar to checkout might have high impact (reduces abandonment), high confidence (proven in e-commerce), high ease (plugin). Score 9/9/9 = 9.0. Redesigning the entire homepage might score lower due to effort.
Do not skip low-effort, high-confidence tests even if impact is medium. Quick wins build momentum and fund bigger experiments.
Run controlled experiments
Test changes one at a time using A/B or multivariate testing. Use tools like VWO, Optimizely, or AB Tasty. Run tests until you reach statistical significance (95% confidence is standard) and sufficient sample size (at least 100 conversions per variation).
Do not stop tests early. The first 100 visitors can swing either way. Let the test run for at least one full business cycle (a week, including weekends) to account for traffic patterns.
Track secondary metrics too. A change that increases clicks but decreases revenue per visitor is not a win. Adding a pop-up, for example, might boost email signups while annoying users into buying less.
Implement and iterate
When a variation wins, roll it out to all users. Monitor the change for at least two weeks to catch any unexpected side effects (e.g., increased support tickets, lower average order value). If the metric holds, you have a new baseline.
Document the test thoroughly: what was changed, why, results, and learnings. This builds an institutional knowledge base. Over time, you see patterns: certain page elements consistently improve conversions (e.g., social proof, clear CTAs).
CRO is not a one-time project. Run audits quarterly or after major traffic or product changes. Each audit builds on the previous one, compounding gains.
Common ways a CRO audit goes wrong
Leaning on a single data source is the most common. Analytics alone miss user intent; heatmaps alone miss drop-off context. Both halves are needed to read the same funnel.
Another mistake is testing too many changes at once. You won't know which change caused the effect. Run A/B tests with a clear control and one treatment.
Finally, do not ignore segmentation. A change that works for new visitors may harm returning visitors. Segment users (new vs returning, device type, traffic source) before and after the test.
| Hypothesis | Impact (1-10) | Confidence (1-10) | Ease (1-10) | ICE score |
|---|---|---|---|---|
| Add trust badges to checkout | 8 | 7 | 9 | 8.0 |
| Simplify signup form (10 to 5 fields) | 8 | 8 | 6 | 7.3 |
| Move pricing table above fold | 6 | 5 | 8 | 6.3 |
| Redesign homepage hero | 7 | 4 | 3 | 4.7 |
FAQ
How often should I run a CRO audit?
Perform a full audit quarterly. If you launch a new product, change your pricing, or see a sudden traffic drop, run an audit sooner. Regular audits keep you ahead of friction points.
What tools do I need to start?
Essential: Google Analytics (or equivalent), a heatmap and recording tool such as Hotjar or Clarity, and an A/B testing platform such as VWO, Optimizely, or AB Tasty. For surveys, Hotjar or SurveyMonkey. No need to buy everything at once.
How many visitors do I need for a valid test?
It depends on your baseline conversion rate and the expected lift. Use a sample size calculator. As a rule, you need at least 100 conversions per variation. If your current rate is 2%, you need 5,000 visitors per variation.
Should I test only big changes?
No. Test small changes too because they are easy to implement and can compound. Changing button copy from 'Submit' to 'Get My Free Guide' can lift conversions by 10-20%. Prioritize by ICE score.
Can I rely on best practices instead of testing?
Best practices are a starting point, but your audience is unique. What works for an industry leader may fail for you. Always validate with tests. Even Amazon runs thousands of experiments each year.
I will take a second look at your account.
I go through the account and tracking, then hand back a prioritized fix list.
