An ecommerce audit checklist that stops at the website misses where most of the money is decided: which customers the ads buy, what the discounts cost, and which channels the platforms over-credit. We run 18 outside checks first, then read 24 months of data through read-only access, and every finding ends in a test with the metric that will show it worked.
- Outside, no access: site, search and AI answers, ad libraries, offers, signup, checkout and speed. Each check becomes a question for the data.
- Inside, read-only: Shopify, GA4, Search Console, the ad accounts, email, subscriptions, returns and finance. Never write access, never customer names.
- On an anonymized $50.0M sample brand, the most advertised product was one of the least valuable first purchases, and the ad platforms claimed purchases equal to 49% of all orders.
Source: our client audit checklist and access list; Shopify, Google and web.dev documentation, October 23, 2026; Sample Co. is illustrative, anonymized sample data · Analysis by Taylor Sicard, Taylor Sicard Consulting
What belongs on an
ecommerce audit checklist?
Three layers, in this order. Eighteen checks anyone can run from outside the business. Read-only access to the systems that hold the money. Then twelve analyses on 24 months of that data, where every finding ends in a fix or a test. The website is only the first of the three.
| Layer | What we look at | What it answers |
|---|---|---|
Outside-in | Site structure, product pages, offers, subscription visibility, reviews, speed, tracking from the outside, ad libraries on Meta, Google and TikTok, share of search, AI answers | Where the brand looks weak to a stranger, and what to ask the data |
Access | Shopify, GA4, Search Console, Bing, ad accounts, email and SMS, subscriptions, reviews, returns, support, surveys, Merchant Center, finance, 3PL, wholesale, the org chart | What the brand actually earns, from whom, and at what cost |
Analysis | RFM and cohort value, repeat timing, new vs returning, spend and revenue per visitor, contribution by channel and product, discount dependency, first product to lifetime value, incrementality, subscriptions, returns, search opportunity | Which of the problems is binding, and what to test first |
If you only want the website layer, our Shopify CRO audit checklist covers it, and the free Shopify Store Audit runs about 35 of those checks on any public URL. This post is about what comes after.
What can an audit see
before anyone grants access?
Enough to write the questions the data has to answer. We read the site from a phone on a US connection, sign up for the emails, walk to the first checkout screen, and read the brand's ad libraries. Our Vuori brand teardown is a public example of this layer.
Each weak spot becomes a question for the data. "The hero tee is in every catalog ad" becomes "is the tee the best first product, or just the most advertised one?" From outside we can't size any of it; sizing waits for the data.
- Search and AI answers. Crawl and index health, product-page schema, which AI crawlers robots.txt blocks, and whether the brand is named when a buyer asks an AI assistant about the category.
- The store. Navigation against what sells, product page depth on a 375px screen, the hero product's placement, offers and the free-shipping line, subscription visibility, reviews, cart and checkout.
- Speed, measured properly. Field data first. Google's own bar is a largest paint of 2.5 seconds or less, an interaction response of 200 milliseconds or less and a layout shift of 0.1 or less, at the 75th percentile (web.dev, Web Vitals). A single lab run is a flag to check, not a finding.
- Tracking, from the outside. Which tags fire, duplicate pixels, and whether declining the cookie banner actually stops them.
- Paid media. How long ads survive in each library, the format and creator mix, how often a discount leads, and whether the top ads land on the page they promise, rated the way The Handoff rates ad-to-page pairs.
What access does a
business audit need?
Read-only access to every system that records an order, a dollar of spend or a customer's reason for leaving, with 24 months of history where the system keeps it. Nothing we ask for can change a setting, move money or touch a customer record, and customer names, emails and addresses never leave the client's systems.
| System | Access | Why we need it |
|---|---|---|
Shopify | A read-only app the store owner creates | Orders, line items, refunds and discounts are the only full record of who bought what, at what price |
GA4 | Viewer | Sessions by channel and landing page; the denominator for every per-visitor number |
Search Console and Bing | Restricted user; Read only | Queries, positions, and which pages AI answers cite |
Meta, Google Ads, TikTok | View-only partner access; Read only; Analyst | What each platform claims, so it can be checked against orders and tests |
Email, SMS, subscription | Read-only users or keys, exports where none exist | Flow revenue, list health, subscription churn by month |
Reviews, returns, support, surveys | Read-only users or exports | Why customers return, complain or say they found the brand |
Finance, 3PL, wholesale | Reports-only access or exports | Landed cost, shipping and fulfillment, inventory, sell-through: the costs that turn revenue into margin |
Why the order history needs care
Shopify is the one system where the setup decides whether the history arrives complete. By default an app only sees the last 60 days of orders (Shopify, API access scopes). We send the store owner a one-page guide for a read-only app that sees all of it. Subscription data comes from the subscription platform directly, because Shopify only shows an app the subscriptions that app created.
History matters as much as access. Twenty-four months gives two full peak seasons to compare. Search Console only keeps 16 months of performance data (Google Search Central, Debugging drops in Google Search traffic), so we start archiving it on day one.
Which analyses run on
the data, and in what order?
Twelve, in the same order every time, because economics comes before channels. They cover what a customer is worth, measured as gross profit (the reason is in LTV vs lifetime revenue), what each channel and product earns after every cost (contribution margin), and what the spend returns in total (MER and break-even ROAS). Each one lands in a lens of The Read.
- RFM and cohort value
- Repeat rate and time to second order
- New vs returning customers
- Spend and revenue per visitor
- Contribution by channel and product
- Discount dependency
- Channel mix and creative fatigue
- MER and incrementality
- First product to lifetime value
- Subscription health
- Returns by SKU
- Search and AI-answer opportunity
What does the data show
that the website can't?
Where the money goes. We built an anonymized sample brand, Sample Co., at $50.0M in trailing revenue with $15.2M a year in marketing, and ran the full audit on it. The numbers below are illustrative sample data, not a client's. The patterns are the ones we see.
The hero product can be the wrong door
Sample Co.'s Everyday Tee takes 58% of its catalog ad spend. Customers whose first order is the tee earn $105 of gross profit in their first year. Jogger first buyers earn $126, and Essentials first buyers $127 to $138, because they come back more often. The website can't show this; it takes orders joined to each customer's first product.
Codes buy customers who come back less
Customers whose first order used a code earned $100 of gross profit in their first year; full-price first orders earned $130. Only 18% of code-first customers placed a second order at full price, against 28%. That's the RFM split we wrote up for discounts, run on a full customer file.
The platforms claim more than happened
Added up, Sample Co.'s ad platforms reported purchases equal to 49% of all store orders. Meta took 51% of media spend; 24% of new customers named Instagram or Facebook in the post-purchase survey. CTV took 12%, got no last-click credit at all, and 4.0% of new customers named it.
When retargeting was switched off in half the regions for four weeks, Meta had reported 1,648 purchases from those regions over the same stretch. Returning orders there came in about 210 below what the other half predicted. Platform reporting counts every purchase its ads touched. The budget question is how many would have happened anyway, and only a test answers that.
Alongside MER, I track total marketing spend per site visitor next to total revenue per visitor, month by month (more in our attribution tools comparison). It counts the CTV, influencer and agency dollars that never earn a click. On Sample Co., revenue per visitor fell year over year from May, after a broad Meta push bought more, cheaper traffic. The platform dashboards looked fine.
Why does every finding
end in a test?
Because a single metric moving the wrong way is often the point. Each test names its objective metric before it starts, and the guardrail metrics expected to move against it, so nobody reads a falling number out of context.
Sample Co. tested free shipping from $60 instead of $75, split 50/50 by visitor for four weeks. Average order value fell 3.0%, which on its own looks like a loss. Conversion rose 8.9%, and contribution per visitor, the objective, rose 3.4%.
| Metric | Role | $75 line | $60 line | Change |
|---|---|---|---|---|
Contribution per visitor | Objective | $1.34 | $1.39 | +3.4% |
Revenue per visitor | Guardrail | $2.39 | $2.52 | +5.3% |
Conversion rate | Guardrail | 1.91% | 2.08% | +8.9% |
Average order value | Guardrail, the trade | $124.94 | $121.15 | -3.0% |
Every test gets its design and its read date before it starts, so nobody can argue the result into whatever they hoped for.
Benchmarks get the same caution. We'd rather compare a brand with its own rolling average or a set of genuinely similar stores, and note what was different then: a younger brand often had cheaper clicks, and a category that's since filled with competitors isn't the same market.
What does a client get
at the end?
A short document that opens with one page: what's true, what it's costing, and what to do first. Everything after that page is evidence and sequence.
Each finding carries the number behind it, what it was measured against, an owner (ads, product, finance, site, ops or leadership) and the metric that will show the fix worked. Findings are ranked by likely value and how cheap they are to try, so the first month's work is obvious.
Then comes a 90-day sequence: what ships in the first two weeks, which tests run next and in what order, and what can wait. It also names the two or three tempting moves we wouldn't make, so the team knows what to leave alone as well as what to change.
For Sample Co., that meant fixing tracking and a size chart in the first two weeks, running paid-media tests one at a time by region, and leaving CTV and the subscription club alone until each was tested, even though both looked weak on their own reports.
What happens to the
access after the audit?
It keeps working, or it's removed. The same read-only connections refresh the per-visitor view, the cohort tables and the test log every month, so nobody on the client's team spends a day exporting. When an engagement ends, access and the data we hold are removed.
A one-off report goes stale the month after it's delivered. Connected data stays current, and every test on the roadmap has somewhere to report its result. Where a system has no read-only option, we take exports instead of a seat that could change something.
Where does this audit
stop short?
It can't fix what nobody owns, and it can't make an untested channel incremental by analysis alone. Where the sources disagree, the honest answer is "unknown until tested", and we say so.
- Platform-reported results are reported as claims and checked against orders, the survey and tests. Attribution and audience breakdowns are read as direction, never as a budget instruction.
- Sample Co. is a seeded, anonymized dataset built to behave like a $50M apparel brand. It isn't a client, and none of its numbers are results.
- Search and AI-answer opportunity is estimated on the brand's own click-through curve, as a range, and kept conservative.
Questions about
the ecommerce audit.
Q: What should an ecommerce audit checklist include?
Three layers: outside checks on the site, search, ads, offers, signup and checkout; read-only access to Shopify, analytics, ad accounts, email, subscriptions, returns and finance; then analyses like cohort value, contribution by channel and discount dependency. Every finding should end in a fix or a test with a named metric.
Q: What access should I give a consultant for an audit?
Read-only, everywhere. Viewer on GA4, a restricted Search Console user, view-only partner access on Meta, read-only on Google Ads, and a read-only Shopify app your store owner creates. Nobody auditing your business needs write access, a seat that can spend money, or your customers' contact details.
Q: How much history does an ecommerce audit need?
Twenty-four months where the system keeps it, so two peak seasons compare like with like. Search Console keeps 16 months, so archive it early. Shopify only shows an app the last 60 days of orders by default, so the read-only app has to be set up to see the full history.
Q: Is an ecommerce audit the same as a CRO audit?
No. A CRO audit looks at the site and the path to purchase. A business audit starts there, then reads orders, margin, ad spend and retention to find which problem is binding. Conversion rate is one input; contribution per visitor and first-year customer value usually matter more.
Q: Can I run this audit on my own store?
The outside layer, yes: the free Shopify Store Audit runs about 35 checks on any URL. The data layer needs someone to join orders, costs, spend and tests across systems, which is what The Read does in two weeks for a fixed fee.
Want this run on your own brand?
The Read is the two-week, fixed-fee version of this audit, credited in full if we keep working together.
See how The Read works