The store health checklist
What I check first on any store, grouped by area and written so you can run through it yourself in an afternoon. The full list is below; the emailed copy is a printable version to work through and tick off.
01 / Contents
What's in it
Speed
- Largest Contentful Paint measured on a phone for the home page, a product page and the checkout, not the home page alone.
- The first image on each page is sized for phones, served as AVIF or WebP, and preloaded.
- No scripts or font files block the first screen from drawing.
- Each tracking pixel and chat widget loads once, and only after the page is usable.
- Server response time checked on pages that can't be cached: cart, checkout and account.
- Page caching and a CDN sit in front of the store, with cart and checkout excluded from the cache.
Security
- Every admin has a login of their own, with two-factor authentication on.
- No unknown admin users; former staff and developers removed.
- WordPress, plugins and theme up to date, and plugins nobody maintains any more removed.
- Listing user accounts through the REST API and author pages is blocked.
- Login and checkout are rate-limited, with firewall or bot rules in front of them.
- Card authentication (3-D Secure) is turned on in the payment gateway.
Backups
- Files and database are backed up automatically every day.
- At least one copy is stored off-site, outside the hosting account.
- A test restore to a staging site has been done in the last month.
- Backups go back far enough to restore a version from before a hack was noticed.
- You know who restores the site, how, and how long it takes.
Tracking
- Purchases in GA4 compared with real orders for the same week.
- Each pixel is installed once, checked across the theme, plugins and Tag Manager.
- The purchase event fires once per order, on the confirmation page, with the order ID and value.
- Every email and ad link carries UTM tags.
- The consent banner works, and tags respect the visitor's choice.
Checkout
- A full test order placed on a phone, as a guest, with a real card.
- Guest checkout is available.
- Every payment method and shipping option tested again after each update.
- A declined card shows a clear message and keeps the customer's details.
- Shipping costs and delivery times are shown before the last step.
Email deliverability
- The SPF record lists every service that sends email as your domain.
- DKIM signing is on for the store and for the email platform.
- A DMARC record is published, and its reports go to someone who reads them.
- Order and password emails go through a transactional email service, not the web server.
- Test emails from the store land in the inbox at Gmail and Outlook, not in spam.
02 / Get it
Where should I send it?
You confirm your email first. Then you get the checklist, and three short emails over the next two weeks: one real fix, one project write-up, and an invitation to a discovery call. Every email has a one-click unsubscribe link.