The Shopify CRO audit: nine checks that find where the money leaks

Search “shopify cro audit” and you get the same playbook twenty times over. Rewrite the product page. Add urgency. Test the headline. Watch a session replay. That list is identical for a store doing $200,000 a year and one doing $50 million, and at the top end it misses almost all of the money.

The short answer. At $5M to $50M, the leak is rarely the product page. It sits in the cart to checkout handoff, in mobile checkout, in the code that changes prices at checkout, and in the post purchase window. Nine checks find it. Five of them use data already sitting in your Shopify admin.

Conversion rate optimisation, often shortened to CRO, means raising the share of visitors who buy without buying more traffic. Autonomous Technologies builds and runs the systems behind Shopify stores for founders and operators who own the store after launch. We get called when the conversion number moved and nobody can point at the cause. That bias is worth stating, so we have linked every platform claim below to Shopify’s own pages, and our conversion rate optimisation work is on the table too.

Conversion is a chain of steps, and one number hides which link broke

Conversion is not a single rate. It is a chain: land, browse, add to cart, reach checkout, finish checkout, see the upsell, accept it. Each link has its own rate and its own way of failing. The headline number on the dashboard is the product of all of them, so a drop tells you nothing about where.

Five layers carry most of it. Theme code that grew for five years. Custom logic that changes prices at checkout. Mobile checkout, which regresses quietly on every theme deploy. B2B traffic mixed into the DTC number. And the post purchase window, which is the highest margin space on the site.

Shopify’s own report gives you four stages, not four checkout steps

Two facts have changed, and most CRO checklists still get both wrong.

First, checkout is one page by default. Shopify’s help page says the layout “is set to be a one-page checkout”, collecting order details, shipping and payment together, checked 21 September 2026. Three page checkout is still available as a choice, and merchants can switch between the two in the admin. So “checkout step three of four” is not a thing you can assume. Open your own admin and find out which layout you are on before you measure anything.

Second, Shopify’s built in funnel reports four stages, not per step rates. The stages are “All sessions”, “Sessions with cart additions”, “Sessions that reached checkout” and “Sessions that completed checkout”, checked 21 September 2026. Anything finer than that comes from checkout events you instrument yourself. Plan for that before you promise a step by step diagnosis.

Nine checks, and the number that makes each one urgent

The order matters. What you find upstream changes how you read what comes next.

Check 3 changed this year. Shopify Scripts stopped running on 30 June 2026, so there is no live Script to measure. The check is now the reverse: pull the Scripts customizations report from your admin and confirm every rule it lists was rebuilt as a function or a native setting. Our guide to the Scripts sunset walks that audit. A discount rule that was never rebuilt reads on the dashboard as a slow conversion decline.

Check 9 is a Plus B2B failure that costs real orders. Catalogues attach to a company location, up to 25 of them per location, checked 21 September 2026. If the retail price paints first and the contract price lands after, the buyer sees a number they never agreed to. Log in as a tagged test buyer and time it.

The mobile gap is the most useful number on the list

Divide mobile conversion by desktop conversion. That single ratio tells you whether mobile is normally weaker or actually broken.

A ratio near 0.55 is normal. Mobile is a harder place to buy and always will be. Under 0.40 means something specific is broken, and it is usually one of four things: the address form re-renders when the buyer taps edit, the payment sheet fights the theme CSS, the express checkout button sits below the fold, or address autocomplete fails. We have moved that ratio from 0.31 to 0.52 inside a 30 day window on three separate stores.

Conversion work only counts when the number moves and someone can point at why. On SafaiKaro we tracked one behaviour across two matched windows: the share of Google visitors who started a chat went from 17.3% to 21.5%, across the 37 days to 23 July 2026 and the 39 days after it, written up here.

Speed multiplies the other fixes, it does not replace them

Shopify holds theme store entries to “a minimum average Lighthouse performance score of 60 across the home page, product page, and collection page”, checked 21 September 2026. A live theme five years into its life is usually well under that.

Three findings repeat. Themes carry sections from campaigns that ended years ago. Product pages ship two to six times more JavaScript than they run on first paint. And images are served far larger than they display, because the theme skips the image_url and image_tag filters that build a proper srcset. Shopify’s own guidance also says never lazy load the largest image on the page.

On one Plus store doing about $14 million a year, a performance pass in early 2026 took mobile largest paint from 3.8s to 2.1s and the mobile JavaScript bundle from 480KB to 220KB. Conversion moved 0.34 percentage points across the 30 days that followed, worth roughly $52,000 a month at that store’s order volume. Useful, but smaller than any single checkout fix on the list above. Speed makes the other fixes land harder. It is not a substitute for them.

What breaks, and who owns it

The honest objection is that we sell fixes, so an audit run by us will always find work. Fair. Three things break anyway, and naming an owner is the only thing that stops them.

Nobody owns mobile checkout. It is the most fragile surface on the store and the least tested. Theme deploys, app updates and payment provider changes all land there. Pick one person who walks the full mobile checkout on a real phone after every theme deploy.

The benchmarks get used as targets. The medians above came from stores that were healthy enough to commission an audit and unhealthy enough to need one. Use them to decide what to look at next, never as a goal to hit.

The findings are bugs, not preferences. A button below the fold or a form that re-renders does not need an A/B test. It needs a fix and a check that it stayed fixed. Teams lose months waiting for significance on things that were simply broken.

Three things to do this week

1. Pull the four funnel stages from Shopify Analytics and split them by device. If reached checkout to completed is under 70% on mobile, you have a named place to dig.
2. Work out your mobile to desktop ratio. If it is under 0.40, walk the whole mobile checkout on three real handsets with a real card, and note every re-render.
3. Open the Scripts customizations report in your admin and confirm each listed rule was rebuilt. Anything unbuilt has been off since 30 June 2026.

All three take an afternoon and cost nothing. If the gaps come back small, your conversion stack is healthy and an audit is not your next best spend.

Sources, all checked 21 September 2026. One-page checkout, behaviour reports and the conversion funnel, companies and B2B catalogues, Shopify Scripts and the Script Editor app, performance best practices for Shopify themes.