E-commerce Website Maintenance Checklist

Pull LCP, INP, and CLS from PageSpeed Insights and Search Console's Core Web Vitals report for the homepage, top 3 collection pages, and top 5 PDPs by traffic. The Search Console field data (real users) is what Google ranks on; lab data from PSI is supplementary. Flag any URL where LCP > 2.5s or INP > 200ms on mobile.

Use Chrome DevTools or WebPageTest to inspect total page weight, image sizes (look for un-WebP'd hero images), and third-party script load. Klaviyo, Yotpo, Gorgias chat, and analytics pixels are common culprits — defer non-critical tags via GTM if total JS exceeds 500KB.

Open tickets with the developer or theme partner for each failing URL. Common fixes: preload the LCP hero image, lazy-load below-the-fold imagery, remove unused app embeds, and audit liquid loops on collection pages. Re-test after deploy.

Check Cloudflare or Fastly dashboards for cache hit ratio on static assets — should be 90%+. A sudden drop usually points to cache-busting query params from a new app or a broken cache rule.

Confirm the most recent automated backup completed successfully (Rewind, BackupMaster, or your platform's native snapshot). Check both DB and theme/files. A missed backup the night before a corrupted-deploy is the worst-case scenario for an e-commerce business.

Restore the most recent good snapshot to a staging store or sandbox to confirm backup integrity, not just that the job ran. Escalate to the developer immediately if restore fails — a backup that won't restore isn't a backup.

Apply pending Shopify theme updates (Dawn, Impulse, etc.) or WooCommerce/WordPress core + plugin updates. Always update on a duplicate/staging theme first and smoke-test mobile checkout before publishing — a broken checkout deploy can cost a day of revenue before anyone notices.

Review the staff/admin user list against your active employee roster — remove ex-staff and contractors whose engagements ended. On WooCommerce, run a Wordfence or Sucuri scan; on Shopify, audit the activity log for suspicious admin actions. Magecart-style card skimmers hide in third-party scripts.

Confirm the cert on the primary domain and any subdomains (shop., checkout., blog.) is more than 30 days from expiry. Shopify-managed certs auto-renew; custom certs on WooCommerce/Magento need manual tracking. An expired cert breaks checkout instantly.

Run Screaming Frog or Ahrefs site audit against the full domain. Pay particular attention to internal links pointing to discontinued SKUs — these need 301 redirects to the parent collection or a similar product, not a generic 404 page that loses the conversion.

Use Shopify's Bogus Gateway or a real card on a low-priced SKU. Test guest checkout AND logged-in checkout, on mobile AND desktop. Confirm the order writes to the OMS, the confirmation email fires from Klaviyo, and tracking pixels fire (check via GA4 DebugView and the Meta Pixel Helper).

Page the developer or platform support immediately. Disable any recently-installed app suspected of breaking checkout, and post a status update for the CX team so they can warn inbound shoppers. Track conversion-rate impact in GA4 until resolved.

Express checkout buttons can silently disappear after a theme deploy or domain change. Test on a real iPhone (Apple Pay) and Android device (Google Pay) — emulators don't reliably render these. Express checkout typically lifts mobile conversion 8-15%.

Spot-check tax in 2-3 economic-nexus states (CA, TX, NY) via Avalara or TaxJar against expected rates. Verify shipping zones still map correctly — a recent carrier-rate update or Shopify Shipping change can quietly under-charge or over-charge customers.

Pull the diagnostics report from Google Merchant Center. Common errors: missing GTIN, incorrect availability, image URL 404s, and price mismatches between feed and landing page. Disapproved products don't show in Shopping or PMax — every disapproval is lost paid traffic.

Use Screaming Frog to find PDPs missing meta descriptions, duplicate H1s, or empty image alt text. Validate Product schema (price, availability, aggregateRating) using Google's Rich Results Test on a sample of PDPs — schema breaks silently after theme updates.

Pull the top 10 organic-traffic blog posts from Search Console. For any with declining CTR or position drop month-over-month, refresh the title tag and meta description. Update internal links from each post to current collection pages, not retired SKUs.

In Yotpo, Okendo, or Judge.me, sort by lowest rating and read every 1-2 star review from the last month. Tag by issue type (sizing, quality, shipping) so the product manager sees patterns. Three reviews mentioning the same defect is a manufacturing signal, not noise.

In GA4, compare sessions, conversion rate, and revenue MoM and YoY by channel grouping. Investigate any channel down >15% — common causes: a broken UTM, a paused Meta campaign, a Google algo update, or pixel/tag drift after a theme deploy.

Check blended MER and per-channel ROAS in Triple Whale, Northbeam, or your attribution tool. Watch for Meta and Google ROAS divergence vs. last 30 days; if MER is dropping while platform-reported ROAS holds, you have an attribution-inflation issue worth flagging to the performance team.

In Klaviyo, check the deliverability tab: open rate trend, hard bounce rate (>2% needs list cleaning), and complaint rate (>0.1% will get you Gmail-throttled). Confirm DKIM, SPF, and the dedicated sending domain are still aligned — registrar changes can break authentication silently.

Test the OneTrust, Cookiebot, or Termly banner from a fresh incognito session on EU and California IP (use a VPN). Confirm rejected categories actually block tags in GTM, and that Global Privacy Control (GPC) signal is honored as opt-out per CPRA. Document any gaps in the issues field below.