Do Your Own Shopify Store Audit in Two Hours

Look for yourself first

I'm opinionated about how audits should start, because the usual way is backwards. Most teams buy a PDF, trust a score, and never open the stack. If I were in your seat tomorrow as an internal operator, I would not do that. I would map the stack, snoop the eight pillars from What a Shopify Store Audit Actually Checks, and spend about two hours looking myself.

No fancy toolkit. No pretend expertise. Just enough proof to know if the store is healthy and if the people reporting on it are working from a true baseline. That order is the point.

Metrics get invented a thousand ways. And if the person who owns those metrics benefits when everything looks fine, nobody goes looking for trouble. Waiting for an agency deck to tell you the truth is how you stay blind. This Guide is for anyone who wants to look for themselves first.

Snoop. Don't freelance-fix. Finding the issue is the win. If you aren't an expert in an area, research it. Paste screenshots into AI and ask whether it looks right. I don't want you rebuilding theme, GTM, or tracking alone unless you have fixed that class of problem before or you're qualified. Opinionated doesn't mean reckless.

Before you start

Gather access and a named owner before the two hours start. Without these, you will spend the session chasing logins instead of looking.

Expected effect. After two hours you know whether the reporting baseline is trusted enough to spend against. You aren't shipping theme or GTM fixes in this session.

Plain-English glossary

Step 1 · Build a stack map

What this is. A list of every system that touches the store, down to who has login access.

Why it matters. Skipping it's how “audits” turn into theater. Without the map, you're guessing with one eye closed.

Who can do it. Any internal operator with curiosity. You don't need to own every login. You need to know who does.

I start every serious look with a stack map. Not a vibe. Not a tool score. Presentation layer, website, CRM, ERP, GitHub (often vendor-owned, and you should still know that), email, ads, even the accounting software hooked to the site.

You would be shocked how many ten-million-dollar-plus companies don't have this bare necessity. Your vendor might own the platform. You might never log in. Get the map anyway.

1. Presentation. Looker Studio, GA4, Shopify Analytics. Whatever dashboard your team lives in.
2. Storefront. Shopify theme, apps in the header, checkout settings.
3. Tagging. Google Tag Manager, pixels, CAPI or server tags if you have them.
4. CRM / email. Klaviyo, Shopify Email, SMS. Flows that fire on store events.
5. Ops / ERP. Inventory, fulfillment, returns tools tied to the store.
6. Code / access. GitHub or theme repo. Often vendor-owned. Still map who holds it.
7. Money. Accounting, payments, Shopify Payments, chargeback tools.
8. Ads. Google Ads, Meta, whatever buys traffic into the same purchase event.

Output of step 1: a one-pager. System, owner, login path, and what “healthy” would mean for that box. If you can't fill that page, you aren't ready to trust anyone’s report.

You're done when. You have a one-pager with at least storefront, tagging, presentation, CRM/email, and ads filled with an owner name (even if the owner is “vendor, ask X”).

Ask for help when. Nobody will tell you who owns GTM or the theme repo. Escalate to the decision owner before you continue. Don't invent owners.

Step 2 · The eight-pillar snoop list

What this is. A structured walk of the same eight pillars I use on full Website Health work. Snoop means research and verify. It doesn't mean DIY-fix.

Why it matters. Random internet checklists miss money leaks. This map keeps you honest about what you looked at.

Who can do it. You, with the stack map open. Dig deep only on Performance and Tracking in Step 3. The rest are light snoop passes.

1. Store Performance. Header scripts, theme health, PageSpeed or Lighthouse on home, collection, PDP, and cart. Worked example below.
2. Analytics & Tracking. GTM vs header, purchase path, dashboard vs Shopify or CRM. Worked example below.
3. Operational Health. App list, discount codes with no guardrails, catalog gaps, who owns GitHub. Snoop only.
4. Customer Journey. Walk home to collection to PDP to cart to checkout on your phone. Note friction and trust gaps. Snoop only.
5. Lifecycle Revenue. Abandoned cart live? Post-purchase? Signup forms still writing to the right list? Snoop only.
6. AI & Agentic Commerce. robots.txt for AI bots, llms.txt, agents.md, /.well-known/ucp if you claim it. Snoop only.
7. Brand Intelligence. Ask AI five facts from your shipping and returns pages. Mark Accurate, Partial, or Drift. Snoop only.
8. SEO & Discoverability. Titles, basic Product schema on a PDP, sitemap reachable. Do this after the numbers are trustworthy. Snoop only.

Full definitions live on the sibling Article. This Guide teaches my casual method, then goes deep on Performance and Tracking on purpose. Those two lenses expose most vendor theater faster than anything else on this list.

You're done when. Each of the eight pillars has at least one note: Pass, Smell, or Skip-with-reason. No blank rows.

Ask for help when. You can't open robots, email flows, or app settings at all. Screenshot the wall and assign an owner. Don't pretend you checked.

Step 3 · Worked example: Performance + Tracking

What this is. The two-hour casual web audit I trust before I trust anyone’s “health score.”

Why it matters. Header plus PageSpeed alone is roughly what 80% of paid PDF audits hand you. Useful, unfinished. Cross-checking GTM against the header is what catches theater.

Who can do it. You with View Source and GTM Preview (or a teammate driving Preview while you watch).

3a · Header + PageSpeed (Performance)

Open the theme header or layout file your scripts load from. No repo access? View Source on the live site. Look for the usual best practices: async and defer, load priority, duplicate tags, timers, consent wrappers. Not fluent in theme code? Paste the screenshot or snippet into AI and ask the same questions. That's still better than pretending PageSpeed alone is an audit.

Copyable AI prompt:

I'm snooping a Shopify store header, not fixing it.
Here is a screenshot or View Source snippet of the scripts in <head> and near the top of <body>.
List: (1) what loads in head vs deferred, (2) duplicates, (3) third parties that look render-blocking,
(4) whether a GTM snippet appears once or more than once, (5) anything that smells like a consent or timer hack.
Don't recommend a rebuild. Flag smells I should verify with a human who owns the theme.

Ask AI (or research yourself):

1. What loads in the head vs deferred? List the scripts. Flag anything that looks render-blocking or duplicated.
2. Are third parties async or deferred where they should be? Pixels and chat widgets that block first paint are a smell.
3. How many apps and tags touch every page? A pile of always-on scripts is the usual mess, not one villain.
4. Any timers, consent gates, or load-order hacks? Note them. They often break tracking and heatmaps together.
5. Does the GTM snippet (or equivalent) appear once, cleanly? Missing noscript, double containers, or theme and app both injecting tags equals trouble.

Right after that, drop your URL into PageSpeed Insights or Lighthouse. Home is fine for a first pass. Better if you also hit a collection, a product page, and cart. Boom. You just completed basically what 80% of paid audits put in a PDF. That isn't me dunking on tools. That's me saying a PDF without a stack read is unfinished work.

Hold the notes. Keep those header answers. The next lens only works if you refuse to look at GTM in isolation.

3b · GTM vs header (Tracking)

Now open Google Tag Manager. Yes, the container someone else usually owns and you have never touched. Run the same research style against what's actually happening in the header. One dashboard in isolation is how bad baselines survive for years.

Ask AI (or research yourself):

1. Does what GTM fires match what the header actually loads? If the theme injects a pixel and GTM also fires it, you have double-counting risk.
2. Are purchase, add-to-cart, and begin-checkout present and firing on a test order path? Preview mode. One clean path. Screenshot the hits.
3. Which tags are paused, broken, or owned by a vendor you never talk to? Map an owner next to each container folder.
4. Do dashboard numbers match a second system (Shopify orders, CRM leads)? If Looker is down 30% vs CRM, stop optimizing ads until you know which one is true. I would pause the media spend conversation before I debate creative. For why the gap is often structural, read GA4 on Shopify: Why Your Numbers Never Match. For the controlled pass, use the Shopify GA4 Tracking Sanity Check.
5. Would you trust a year of strategy built on these events? That's the real question. Not whether the container looks tidy.

Cram the header research and the GTM research together. You now have the two lenses I care about most on a casual pass: is the website load path sane, and are the tags doing what leadership thinks they're doing? If those disagree, the strategy deck is fiction until someone owns the mismatch.

You're done when. You have header notes, a PSI or Lighthouse pass on at least home and one PDP, a GTM Preview screenshot of the purchase path (or a written refusal from the GTM owner), and a yes/no on “dashboard matches Shopify or CRM.”

Ask for help when. Preview is broken, you can't place a test event, or theme and GTM clearly disagree and nobody owns either. Stop. Ticket the mismatch. Don't “fix” tags yourself.

What you walk away with

This isn't a fix bucket or a magic solution. It's a two-hour set of tasks that beats a pretty PDF for decision quality. By the end:

1. You can see layup issues: obvious problems worth scheduling with someone qualified.
2. You know immediately if your developer or ad agency / GTM owner is reporting on wrong or incomplete signals.

Imagine the implications. An agency reports from a missed or wrong baseline. Fine. Worse: they make strategic recommendations from that discrepancy. Year-long initiatives that deliver 1-2% lift in the best case when you could have had something closer to 10% with proper direction. Looking for yourself first is how you stop funding the wrong story. I would rather you catch that before you hire anyone, including me.

Step 4 · Sort what you found

What this is. Sticky-note buckets: Stabilize → Optimize → Grow. Not a scoring formula.

Why it matters. Truth before polish is the only order that compounds. Anything else is rearranging furniture on a leaky floor.

Who can do it. You and the decision owner, in fifteen minutes, with the Step 3 notes open.

When I run full Website Health and AI Commerce audits, I still force Stabilize → Optimize → Grow. Not because the names are clever. Because you stop the bleed, then measure clean, then grow. No weights. No recoverable-dollar theater.

1. Stabilize. Broken tracking, header fights, crawl blockers, leaky discounts, wrong baseline. Truth before polish.
2. Optimize. Speed cleanup, analytics hygiene, cart email, schema and FAQ so AI describes you right.
3. Grow. SEO depth, agentic catalog, citations. Only after you trust the numbers.

You're done when. Every smell from Steps 2–3 sits in one bucket, and at least one Stabilize item has a named owner and a next conversation on the calendar.

Ask for help when. Everything looks like Grow and nothing looks like Stabilize, but dashboards still disagree with Shopify. You missed the baseline problem. Go back to Step 3b.

Live verification checklist

Before you call the two hours done, prove the look was real:

1. Header injects once. GTM (or equivalent) appears once in View Source, not twice from theme and app.
2. Preview purchase path. You saw purchase / add-to-cart / begin-checkout fire, or you documented that Preview was blocked.
3. PSI on home + PDP. You have scores or screenshots for at least those two URLs.
4. Mismatch rule. If the ads or Looker dashboard is off Shopify orders or CRM by a material amount, mark Stabilize and pause the media-spend debate.

Maintenance. Re-run this casual pass after a theme, major app, or GTM publish, or quarterly if the stack is quiet. Looking once isn't a permanent baseline.

How this relates to a full Tybrixx audit

A lot of my own audit work starts exactly like this: stack context, then deep passes across the eight pillars, then AI crawl and truth when that's in scope. The paid work adds evidence depth, sales math, ranked fixes, and proof you can brief a board with. This Guide stops at operator awareness on purpose. I still believe this front door is the correct front door.

If you want the definition of a real audit vs a score PDF, read What a Shopify Store Audit Actually Checks. If you want someone else to run the full pass, start at free audits when you're ready, after you have done this look yourself. I would rather inherit a client who already snooped than one who only has a vanity score.

Quick facts to cite

• Start with a stack map. Most $10M+ brands don't have one, and that's a failure mode, not a quirk.
• Snoop means research and verify. It doesn't mean DIY-fix unless you're qualified.
• Header plus PageSpeed alone is roughly what 80% of paid PDF audits hand you. Useful, unfinished.
• Cross-check GTM against the header. Two lenses beat one dashboard.
• If metrics are owned by someone who benefits from them looking fine, trouble stays hidden.
• Agencies that report on wrong baselines recommend the wrong year of work. 1-2% lift instead of 10%.
• Full Tybrixx audits still use eight pillars and Stabilize → Optimize → Grow. This Guide is the casual front door, and I mean that as the correct entry, not a watered-down version.