The ecommerce CRO checklist for 2026: every check sourced, none from 2023

An ecommerce CRO checklist covers measurement, speed, product pages, checkout, accessibility and test validity. In 2026 that means tracking GA4 key events, meeting Core Web Vitals including INP, fixing the checkout issues Baymard documents, meeting WCAG 2.2 AA, and only A/B testing when traffic allows.

Many CRO checklists still tell you to set up Google Optimize, track "conversion events" and keep FID under 100 milliseconds. All three are out of date. Most also quote average conversion rates with no primary dataset behind them. This checklist is organised by owner (analytics, performance, merchandising, checkout, accessibility, testing and compliance), every check points to its source, and there are no invented benchmarks. Sources were checked on 23 October 2026.

What changed in ecommerce CRO since 2023?

If a checklist or agency proposal still mentions Optimize, conversion events or FID, ask when it was last updated.

How should you set up measurement before you optimise?

Owner: analytics. CRO without trustworthy data is guesswork, so this section comes first.

• Write a tracking plan. List every event that matters (view item, add to cart, begin checkout, add shipping info, add payment info, purchase), its parameters and where it fires.
• Mark the right key events. In GA4, purchase is the obvious one. Add micro key events, such as add to cart or email sign-up, only if you will act on them.
• Check revenue against your platform. Compare GA4 purchase revenue and order counts with your ecommerce platform for the same period. Investigate any large gap before testing anything.
• Track the funnel by device. Mobile and desktop funnels often break at different steps.
• Capture errors. Log payment declines, validation errors and out-of-stock events, so you can see failures and not just drop-offs.
• Respect consent. Make sure tags fire according to the visitor's consent choices, and note how consent rates affect what you can see (see the consent section below).

Which speed checks matter: LCP, INP and CLS?

Owner: performance. Use Google's Web Vitals thresholds at the 75th percentile of real visits: LCP within 2.5 seconds, INP of 200 milliseconds or less, and CLS of 0.1 or less.

• Measure the templates that sell: category, product, cart and checkout, on mobile and desktop separately.
• LCP: size and compress hero and product images, preload the main image, and avoid lazy-loading anything above the fold.
• INP: audit third-party scripts (reviews, chat, personalisation, tag managers) that block the main thread when users tap variant pickers, filters or add to cart.
• CLS: reserve space for images, banners, review widgets and cookie notices so the add-to-cart button never moves under a thumb.
• Re-check after every app or tag install. On hosted platforms, each new app can add scripts to every page.

What should you check on product and category pages?

Owner: merchandising and UX.

• Category pages: useful filters for your catalogue (size, colour, price, availability), visible filter state, sort options, and product cards with price, key variant and stock.
• Search: typo tolerance, synonyms, and a review of zero-result searches every month.
• Product images: several angles, zoom, scale or in-use shots, and video where it helps.
• Price and costs: price, delivery cost or threshold, and estimated delivery date near the add-to-cart button. Baymard's survey shows unexpected costs are the top reason people abandon (below).
• Variant selection: clear size and colour pickers, out-of-stock variants marked, and a size guide close to the picker.
• Reviews: visible rating and count, with the ability to filter reviews.
• Returns and trust: returns policy summarised on the page, not only in the footer.
• Mobile layout: the add-to-cart button visible without excessive scrolling, and tap targets large enough to hit.

What should you check in the basket and checkout?

Owner: checkout. This is where Baymard's research is most useful. Its average documented cart abandonment rate is 70.22% across 50 studies (updated 22 September 2025). In its latest survey (read 23 October 2026; no sample year shown on the page), the reasons shoppers gave, excluding those "just browsing", were:

Baymard also reports that large ecommerce sites can gain a "35.26% increase in conversion rate" through better checkout design, and that most checkouts could cut their form elements by "20-60%". Its checkout usability research says "65% of sites have a performance of 'mediocre' or worse."

Checks that follow from that data:

• Show all costs early, ideally on the product page and in the basket, not first at the payment step.
• Offer guest checkout. NN/g's mobile checkout research advises: "Make guest checkout the most salient of your checkout options." (That article dates from 2 December 2018, but the advice still matches Baymard's account-creation finding.)
• Cut form fields to what the order needs; use address lookup or autocomplete.
• Show delivery options and dates before payment.
• Build trust near payment: recognisable payment methods, a clear returns line and contact details.
• Offer express wallets where your audience uses them, alongside card payment.
• Handle errors gracefully: keep entered data after a decline and explain what to do next.
• Test on real devices for crashes and broken steps, especially after platform or app updates.

Which accessibility checks matter at checkout (WCAG 2.2)?

Owner: accessibility (often UX and engineering together). Inaccessible checkouts lose customers and raise legal risk. WCAG 2.2 added criteria that apply directly to checkout (W3C):

• 3.3.7 Redundant Entry: don't make shoppers retype details they already gave; default to "billing same as shipping".
• 3.3.8 Accessible Authentication (Minimum): sign-in must not rely on memorising or transcribing; allow paste and password managers.
• 2.5.8 Target Size (Minimum): quantity steppers, remove links and variant pickers need enough size or spacing.
• 3.2.6 Consistent Help: put help or contact options in the same place on every checkout step.

Also check labels, error messages, keyboard access, focus order, contrast and screen reader announcements for basket updates. Accessibility work is audit and remediation guidance, not legal advice; for a full review, see website accessibility.

How do you keep A/B tests valid?

Owner: testing. A test that is underpowered or stopped early produces confident-looking noise.

• Gate on traffic first. Before designing a test, estimate the sample size needed for the smallest lift worth detecting, using a sample size calculator with your real baseline conversion rate. If the test would need to run for months, don't A/B test that page; ship the fix based on research, then monitor.
• Pick one primary metric (usually purchase or revenue per visitor) and write it down before launch, along with the hypothesis.
• Run whole weeks to cover weekday and weekend behaviour, and don't stop the moment a result looks significant.
• Check sample ratio. If traffic split is far from what you configured, something is broken; fix it before reading results.
• Watch for interference: sales, campaigns, stock-outs and other tests on the same pages can distort results.
• Record every result, including losers and flat tests, so the next test builds on what you learned.

A/B testing vs multivariate testing

For most stores, run A/B tests on big, research-backed changes rather than multivariate tests on small tweaks.

What consent and privacy rules apply to CRO tools (US vs UK)?

Owner: compliance, with legal advice where needed.

UK. The ICO's guidance on storage and access technologies exceptions (read 23 October 2026) lists "A/B testing - separating users into two groups to compare user interactions with two different versions" among the uses of aggregate statistical information that are likely to fit the exception for statistical purposes. It is just as clear about the limit: "The statistical purposes exception does not allow you to monitor or track individual visitors to your service." Its list of things that need consent includes "logs or recordings of individual visitors to your website and the actions they took", which is what session replay tools do. So:

• A/B testing tools: check that the storage is for statistical purposes only, produces aggregate data that can't identify people, and comes with clear information and "an easy way to object". If not, it needs consent.
• Session replay and tools that record individual sessions: consent first.
• Sharing conversions with advertising partners, profiling and cross-site tracking: consent first.

US. There is no single federal cookie-consent law. Several state privacy laws give consumers rights over how their data is used and shared, so check which apply to your customers, honour opt-out signals your stack supports, and mask personal data in session recordings.

This is a summary of published guidance, not legal advice.

CRO vs SEO: how do they fit together?

SEO brings qualified visitors; CRO turns more of them into customers. They share the same foundations, so do them together rather than in competition.

Two practical rules: run tests in a way that doesn't hurt crawling (no long-running redirects for variants, canonical tags in place), and share keyword and on-site search data with the CRO team, because it shows what visitors came for. Our ecommerce SEO team works from the same data.

What does the full 40-point ecommerce CRO checklist look like?

How can Elgrith help?

Elgrith has delivered 1,000+ projects for 250+ clients since 2015, from our New Delhi headquarters and client centers in New York, London and Shanghai. Our conversion rate optimization team runs CRO audits, fixes tracking, designs research-backed tests and builds the winning changes. UK retailers can work with our CRO agency in London, which follows the ICO guidance above. For platform work, see ecommerce development and Shopify Plus development. We don't promise lift figures; we show you the method and the evidence. You get a fixed written quote after a free call. Book a call or start a project.