The CRO Checklist for
early-stage founders.

The CRO insight that beats every heatmap: read what customers actually say. Most teams skip this and fix the wrong page.

• Review 20 support tickets monthly to harvest friction language

  The exact words customers use to complain are the words that should appear on your landing page (as the problem you solve). Block 30 minutes a month, copy recurring phrases into a doc, audit your hero copy against them.

• Review lost-sales conversations and 'why didn't you buy' replies

  Auto-email every trial that didn't convert with a single question: 'What stopped you?'. Tag the replies. The dominant reason is your highest-leverage CRO fix this quarter — usually messaging, pricing, or a missing feature.

• Run quarterly customer interviews — 5–10 calls, 30 minutes each

  Mix recent-paid, recent-churned, and recent-stuck (signed up but didn't activate). Ask 'what were you trying to do when you signed up?' and 'what almost stopped you from buying?'. Recording + Otter transcription makes pattern-spotting easy.

• Analyse cancellation reasons and exit-survey responses

  Tag and count cancel reasons monthly. If you don't have an exit survey, add one this week — a single dropdown ('Too expensive / Missing feature / Switched to competitor / Other') is enough to start.

• Review on-site search queries weekly for gaps and intent

  What people type into your search bar is what they expect to find. Top empty-result searches become your next blog or landing-page topics. Track via PostHog, Algolia, or whatever powers your site search.

Find the leak before you fix the page. Most teams waste months optimising the wrong step.

• Identify the biggest drop-off step in your conversion funnel

  Visitor → email → trial → activated → paid. Map the % conversion between each. The step with the worst rate is your highest-leverage fix.

• Segment conversion by traffic source (organic, paid, social, AI)

  Paid-social visitors convert differently than newsletter clicks or Perplexity citations. A source-blind CVR average hides 3–5x differences between channels.

• Segment conversion by device (desktop vs mobile vs tablet)

  Mobile CVR is often 30–50% lower than desktop for SaaS. If the gap is bigger than that for you, you have a mobile-specific funnel bug — not a 'mobile is just lower' problem.

• Segment conversion by landing page

  Your top 10 landing pages by traffic should each have a separate CVR you watch weekly. One underperformer is usually dragging the site average down.

• Track activation-to-paid conversion as its own funnel step

  Most teams collapse 'signup → paid' into one number. Split it: signup → activated (used the product), activated → paid. Each is a separate optimisation problem with separate experiments.

Every traffic source arrives with a different mental state. Generic landing pages leave 30–50% of conversion on the table.

• Audit landing-page-to-source-intent match for your top 5 channels

  Google search, AI search (Perplexity/ChatGPT), X/Twitter, Product Hunt, newsletter — visitors arrive with wildly different expectations. Map each source's primary intent and grade your match.

• Create source-specific landing pages for paid + high-volume channels

  Don't send a 'how I built this' Twitter audience to the same page as a high-intent Google search. Even small headline + hero changes per source lift CVR 15–40%.

• Headline matches the keyword or context the visitor arrived from

  If they searched 'CRO checklist' the headline should say 'CRO checklist'. Message-match is the single most-overlooked PPC and organic lift.

• CTA matches visitor intent (educate vs trial vs buy)

  AI-search visitors are researching — offer 'See the playbook'. Branded-search visitors are buying — offer 'Start free'. The same page can swap CTAs by UTM source.

The non-negotiables. Skip these and nothing below matters.

• LCP under 2.5s, INP under 200ms, CLS under 0.1 on mobile 4G

  Core Web Vitals are now a ranking factor in both Google and most AI-search citations. INP replaced FID in 2024 — measure responsiveness, not just first input. Run PageSpeed Insights monthly.

• Above-the-fold copy answers 'what is this?' in 5 seconds

  Show your headline to a stranger for 5 seconds. If they can't describe the product, rewrite it.

• Primary CTA is visible above the fold without scrolling

  On mobile and desktop both. If the user has to scroll to find your CTA, you've lost half of them.

• Social proof (logos, count, or quote) within one scroll

  Customer logos, '4,200+ founders use this', or a single strong testimonial.

• One conversion goal per page

  Multiple competing CTAs reduce conversion. Pick one — signup OR demo OR newsletter, not all three.

• WCAG 2.2 AA accessibility baseline (contrast, keyboard nav, alt text)

  Beyond ethics: AI agents and screen readers fail your conversion funnel if your site isn't accessible. Use axe DevTools — fix everything 'serious' or 'critical'.

• AI agent compatible: works without mouse/scroll, has semantic HTML

  By 2026, Operator, Claude, and ChatGPT agents complete signups on behalf of users. If your form needs hover-revealed state or canvas rendering, agents bounce. Use real <button>, <form>, <label>.

• No broken links, weekly check

  Use Ahrefs or Screaming Frog. Broken links destroy trust and tank SEO.

• Favicon, Open Graph image, and X Card image all set

  OG image shows on link-shares; favicon shows in tabs. AI engines also surface OG images in citations now.

• Page works with JavaScript disabled (or has SSR fallback)

  AI crawlers like GPTBot and PerplexityBot still don't reliably execute JS. If your hero loads via client-side JS, you're invisible to them.

The first 600 pixels do 80% of the work.

• Headline is benefit-led, not feature-led

  'Ship faster' beats 'AI-powered project tool'. Lead with the outcome the customer gets — not your tech stack.

• Subheadline adds clarity — does NOT repeat the headline

  Most subheads are wasted. Use it to address the specific pain or specific audience.

• CTA button copy uses verb + outcome

  'Start free trial' > 'Sign up'. 'Get my growth report' > 'Submit'.

• CTA button color strongly contrasts the background

  Bright accent on neutral. The isolation effect drives clicks. Verified weekly via Hotjar / Clarity heatmaps.

• Hero visual shows the product, not stock photography

  Screenshot, GIF, short video, or interactive demo. Stock images destroy credibility instantly in 2026 — AI-generated images even more so.

• Secondary CTA for hesitant visitors (Learn more / See demo)

  Some buyers need 3 clicks of context. Give them a path that's not the primary one.

• Mobile hero is under 500px tall — visitor sees something below the fold

  Mobile users who hit a full-screen hero with nothing below assume the page is empty.

• Headline tested across at least 3 variants quarterly

  Run a 2-week A/B test each quarter. Headline changes routinely lift CVR 10–30%.

For early-stage startups, trust is usually a bigger conversion blocker than UI. Under-invested by default.

• Founder face + name visible on homepage or About page

  Strangers buy from humans, not from logos. A real photo (not a stock avatar or AI portrait) with first-person voice on the About / founder note lifts trust dramatically.

• Real customer names + companies in testimonials (no 'CEO of SaaS startup')

  Vague testimonials read fake. 'Sarah Chen, Head of Growth at Linear' beats 'Marketing Lead at a tech company'. Get permission, name the person + company.

• Public roadmap shows the next 3–6 months of priorities

  Buyers want to see the product is moving. Tools like Productboard, Linear's public roadmap, or a simple Notion page work. Update monthly.

• Public changelog with a regular shipping cadence

  Even a simple /changelog page with weekly entries signals momentum. Buyers check this to confirm you're alive and shipping. Date every entry.

• Security + privacy page describes data handling concretely

  Not a 30-page legal doc — a plain-English page covering: where data is stored, who can access it, encryption, GDPR/SOC2 status. B2B buyers check this before they reply to a sales email.

• Refund policy is clearly stated and easy to find

  A visible money-back window removes the 'what if I commit and hate it' barrier. Loss aversion is real — make the exit visible.

Often the second-most-visited page on your site. Treat it like the front door.

• Maximum 3 tiers (4 if you have an enterprise tier)

  Hick's law: more choices = more hesitation. 3 plans converts better than 5.

• 'Most Popular' or 'Recommended' badge on the middle tier

  Bandwagon effect — most buyers pick the badged one. Steer toward your healthiest plan.

• Monthly vs annual toggle, annual savings emphasised

  'Save 2 months' is more compelling than '17% off'. Show the savings, not the percentage.

• Geo-aware pricing (purchasing-power parity for non-US/EU)

  Stripe Adaptive Pricing, Paddle, and Lemon Squeezy now do this natively. Captures 3-5x more international conversion without cannibalising premium markets.

• FAQ section addresses cancel, refund, exceed-plan, and AI usage questions

  Pre-emptively answer the 5 most-common sales emails. For AI products: clarify token limits, data-retention policy, and model upgrade path.

• Money-back guarantee or refund window clearly displayed

  Even a 14-day refund offer lifts conversion 5-15%. Loss aversion is a buying force.

• Risk reversal (No credit card / Cancel anytime / Free 14 days)

  Visible on every tier. The mental barrier of 'what if I commit' kills more sales than price.

• Tested charm pricing (£99 vs £97 vs £100)

  The left-digit effect makes £99 read 25% cheaper than £100. Test it against round.

Every field is a tax on conversion. Make each one earn its place.

• Top-of-funnel forms have 4 or fewer fields

  Each extra field drops conversion 7-11%. If you don't need it on day one, don't ask for it.

• Passkey signup option offered first

  By 2026 every major browser supports passkeys (WebAuthn). They convert 2-4x better than passwords and eliminate the password-forgot funnel entirely. Use Apple/Google/Microsoft passkey + SSO before falling back to password.

• SSO options (Google, Apple, Microsoft) above password

  30-50% of users prefer SSO when offered first. Cuts password friction forever.

• Email field auto-focused on page load (with autocomplete='email')

  Saves a click. Tiny but compounds across thousands of visitors. Proper autocomplete also enables passkey/credentials API.

• Inline validation, not on-submit

  Show errors as the user types, not after they click submit and get a wall of red.

• Mobile keyboard types match input (type='email', 'tel', 'number')

  On mobile, the wrong keyboard for an email field is a silent conversion killer.

• Submit button shows loading state and prevents double-submit

  Stop the second-click problem. Disable + change text to 'Creating account…' on submit.

• Field labels above inputs (not placeholders alone)

  Placeholder-only labels disappear when the user types. Causes form abandonment, accessibility failures, and breaks autofill.

• Multi-step forms have a visible progress bar

  Progress bars lift completion rates 10-25% on longer forms by reducing perceived effort.

Most churn happens in the first 24 hours. Earn the second session.

• First 'aha moment' fires within 5 minutes of signup

  Identify the single action that correlates with retention. Get the user there immediately.

• AI-assisted setup: auto-detect / pre-fill what you can

  In 2026, asking 'What's your company name?' when the user signed up with a work email is friction. Use Clearbit/Apollo enrichment or LLM inference to pre-fill 60-80% of fields.

• Progress indicator visible during multi-step setup

  Show '3 of 5 steps complete' so the user sees the finish line.

• Skip option for power users

  Forcing every new user through a 5-step tour kills your fastest activators.

• Empty states are guided, not blank

  First-run empty screens should suggest a first action, not show 'No items yet'.

• First action defaulted or templated

  Pre-fill the new project name with a smart default. Removes blank-page paralysis.

• Welcome email arrives within 60 seconds (via Resend/Postmark, not SendGrid)

  Beyond 5 minutes and the user has lost context. Modern transactional ESPs (Resend, Postmark, Loops) have far better deliverability than legacy options.

• Activation event explicitly tracked + segmented in analytics

  Define the event (e.g. 'shipped 1 invoice', 'invited 1 teammate'). Without this you can't optimise.

• Quick-win celebrated visibly with micro-animation

  'You sent your first message ✓' triggers a positive feedback loop and reinforces retention.

65%+ of B2C and 40%+ of B2B traffic is now mobile-first. Treat it as the primary experience.

• All tap targets are at least 44×44 pixels (Apple HIG / WCAG 2.2)

  Smaller targets cause mis-taps and bounce. WCAG 2.2 now formalises the 24×24 minimum, but Apple's 44px is still the conversion-optimal target.

• Input fields have font-size 16px or larger (prevents iOS auto-zoom)

  Anything smaller still triggers iOS Safari to zoom on focus in 2026. Looks broken.

• Primary CTA accessible without scrolling on mobile

  Sticky bottom CTAs work well. Or a thumb-zone position in the lower-third.

• Burger menu has 5 or fewer top-level items

  Information architecture matters more on mobile. Cut ruthlessly.

• Tested on a real iPhone and Android device — not just Chrome devtools

  Touch events, hover quirks, gesture conflicts, and Safari-specific bugs only show up on real hardware. Browserstack works if you don't have devices.

• Total page weight under 1MB on initial load

  Even 5G users hate bloat (and many are on metered plans). Lazy-load below the fold. Avoid React bundles over 300KB gzipped.

• Works in Safari Lockdown Mode and DuckDuckGo mobile

  Privacy-first browsers are 8-12% of traffic by 2026. If your site relies on third-party JS or fingerprinting, it breaks here silently.

What you don't measure, you can't optimise. Wire this up before shipping anything else.

• Privacy-first analytics installed (PostHog, Plausible, or Fathom)

  GDPR/CCPA/UK GDPR + Apple's MPP and Safari ITP make cookie-based analytics increasingly unreliable. Privacy-first tools also avoid the cookie-banner conversion hit.

• Server-side event tracking for revenue + activation events

  Client-side tracking misses 30-40% of events in 2026 (ad blockers, MPP, ITP, agents). Critical events (signup, payment, activation) should fire server-side.

• Funnel from landing → signup → activation visible in one dashboard

  Drop-off step is your highest-impact place to fix.

• Session recording tool installed (Microsoft Clarity is free, or Hotjar)

  Watch 20 sessions a week. You'll find a UX bug or rage-click within 30 minutes.

• Heatmap on every key conversion page

  See where attention dies. The fix is often a hero CTA mid-page that nobody scrolls to.

• A/B test framework set up (PostHog Experiments or GrowthBook)

  Wire it before you have traffic. Reduces friction when you're ready to test. Note: Google Optimize is dead — don't use it.

• North-star metric defined + visible on team dashboard

  Pick one (signups, MRR, activation rate). Make it visible. Optimise toward it ruthlessly.

• Cookie consent banner (only if required — minimise its CVR impact)

  If you must show one (EU/UK/CA traffic + cookie-based tracking): make it small, default to 'reject all' = same user experience, no dark patterns. Better: switch to cookieless analytics and skip the banner entirely.

Heatmaps show where users look. Replays show where they get stuck. Watch the cursor, not just the clicks.

• Watch 20 failed-conversion sessions per month

  Filter for sessions that hit /signup or /pricing but didn't convert. Watch the cursor — the moment they hesitate, scroll back, or rage-click is your bug. Friction analytics will never reveal it.

• Watch 20 successful sessions per month

  Pattern-match what your converters do. Often you'll spot a page they all scroll to, or a feature they all engage with — that's your 'aha' moment to bring forward earlier in the journey.

• Tag and annotate notable sessions for the team

  When you find a rage-click, dead-click, or activation moment, tag it. Build a library so designers and PMs can watch the actual user instead of relying on your summary.

By 2026, AI engines route a meaningful share of buying-intent traffic. If your content isn't readable to them, you don't exist in those answers.

• Product pages have Product schema with offers + ratings

  Structured data is what lets ChatGPT, Perplexity, Claude, and Google AIO cite you with confidence. Use Product, Offer, AggregateRating, and Review schema where genuine.

• Pricing is crawlable (HTML, not behind JS or interaction)

  If your prices only render after a JavaScript toggle or modal, AI crawlers miss them. Output every price in static HTML even if the visible UI uses a tab toggle.

• Testimonials are real text, not screenshots or images

  Image-based testimonials are invisible to AI engines. Even with alt text, plain quoted text + cited name + company wins citations. Convert any Twitter-screenshot testimonials.

• Key features described in HTML, not infographics

  Same principle: AI engines extract text. A pretty feature diagram with no surrounding HTML description means AI engines don't know what your product does.

• Comparison pages exist for your top 3–5 competitors

  'X vs Y' and 'X alternative' searches are buying-intent. AI engines cite comparison pages heavily. Write honest, structured comparisons with feature tables.

• FAQ sections answer real buying questions directly

  Use the exact phrasing a buyer would ask ('Does X integrate with Y?', 'How much does X cost?'). Wrap in FAQPage schema. AI engines surface FAQ answers verbatim.

AI agents complete signups on behalf of users in 2026. Visitor-specific personalisation lifts CVR 10–30% on targeted segments.

• FAQPage + Article schema on every key page

  ChatGPT search, Perplexity, Claude, and Google AIO cite pages with structured data 3-5x more often than pages without. Cheap, durable, high-leverage.

• llms.txt published at /llms.txt with site overview + key URLs

  The robots.txt for AI engines. Tells LLM crawlers how to cite your content. Set up in 5 minutes, multi-year benefit.

• Test queries on ChatGPT Search, Perplexity, Claude, Google AIO weekly

  Search your product name and your top-of-funnel keywords. Track whether AI engines cite you, what they cite, and whether they cite competitors instead. Track in a sheet.

• Real-name authorship + entity signals (LinkedIn, Wikipedia, Crunchbase)

  AI engines cite from sources they trust. Verified founder LinkedIn, Crunchbase listing, and (where you qualify) Wikipedia entries dramatically lift citation rate.

• Dynamic content swaps based on traffic source (UTM-aware)

  Paid social visitors see a different headline than organic. 10-30% lifts on targeted segments.

• Personalisation by visitor's industry/role when known

  Detect via Clearbit (now HubSpot Breeze), RB2B, or self-declared. Show 'SaaS-specific' messaging vs 'agency-specific'.

• AI agent friendly: clear CTAs, semantic HTML, no dark patterns

  Operator, Claude Computer Use, and ChatGPT agents are completing form-fills and signups on behalf of users by 2026. If your CTA is a JS-only div without proper button semantics, agents skip you.

Testing cadence beats checklist length. A team shipping one experiment per fortnight outpaces a team spending six months on a redesign.

• Ship at least one CRO experiment every two weeks

  Velocity > perfection. A 2-week cadence forces small bets, sharp hypotheses, and faster learning. Tiny tests stack into compounding wins.

• Maintain a prioritised testing backlog (ICE or PXL scored)

  Score every experiment idea: Impact, Confidence, Ease (ICE) or PXL. Always work the highest-scored item. Backlog should have 10–20 ideas at all times.

• Track experiment win rate + velocity as team metrics

  Industry baseline: 1 in 5 experiments wins. If you're winning every one, you're being too conservative. If you're winning none, your hypotheses are bad. Both are signals.

Frequently asked questions

Want the full library?

548 hand-illustrated growth hacks with the how, the example, and the gotcha. One-time £49 unlock — lifetime access, no renewals.