Auditing an e-commerce website

Two independent detections look for a shop. The category engine scores the crawled pages: each schema.org type among `Product`, `Offer`, `AggregateOffer` and `OnlineStore` adds 30 points, a markup fingerprint such as the Shopify CDN, WooCommerce, PrestaShop, Magento or an add-to-cart class adds 20, a path such as `/product`, `/shop`, `/cart` or `/checkout` adds 12, and wording such as "add to cart" or "in stock" adds 8.

A category needs 24 points to be reported at all. A site can carry up to four categories: a secondary one is kept when it reaches 35 percent of the primary score, so a shop with a blog is audited as both.

The commerce report keeps its own confidence: 25 for a cart page, 25 for a checkout page, 20 for each product page carrying Product JSON-LD and 12 for one recognised otherwise, a quarter of the confidence of a detected shop platform, and 20 when the category engine said e-commerce. At 40, the site is treated as a shop.

A brochure site that mentions a price once does not reach either threshold, and that is deliberate: commerce findings on a site that sells nothing would be noise.

A product page is any crawled page whose URL contains `/product`, `/products` or `/p/`, that declares `og:type` product, or that carries Product JSON-LD. On each one, missing Product structured data is reported at medium severity, no recognisable price at high, no availability wording or schema at low, no image at all at medium, and no add-to-cart or buy wording at high.

A checkout URL reached over plain HTTP is reported as critical. Cart and checkout are found by URL — `/cart`, `/panier`, `/basket`, `/checkout`, `/commande` — and the scan never adds anything to a cart to reach them.

Shipping and returns policies are expected, as pages or as links. When the crawl stopped at the plan's page budget before finding one, the finding is downgraded to "could not be verified" rather than reported as missing.

Two low-severity signals complete the module: prices with no VAT or tax wording anywhere, and a cart or checkout with no recognised payment brand.

When no product page or no cart was reached, the module says the corresponding rules could not be verified. It never reports a shop as broken because the crawl did not reach its catalogue.

A separate block of checks runs only on a detected shop and stays silent everywhere else. `ecommerce.detected` documents why the block ran; `ecommerce.categories` looks at category and collection pages and how well they are filled; `ecommerce.currency` compares the currency shown to buyers with the one declared in Product markup.

`ecommerce.product_descriptions` flags missing, generic, short or duplicated product descriptions. `ecommerce.review_schema` and `ecommerce.breadcrumb_schema` read ratings and breadcrumb markup when the shop publishes them.

`ecommerce.conversion_tracking` lists the trackers and e-commerce event names visible in the markup, and `ecommerce.consent_context` sets them against the consent mechanism the page shows.

`ecommerce.mobile_checkout` observes the checkout page statically — HTTPS, form fields, input types, autocomplete, viewport — and `ecommerce.transactional_emails` covers order, shipping and refund emails, which an external scan can only name, never read.

In the report, each category of checks weighs in the overall score according to a relevance factor. For a site detected as selling — e-commerce, marketplace, booking, classifieds or crowdfunding — the commerce category counts 1.3 times its base weight; for a site whose category is known and does not sell, it counts for nothing, so a brochure site is never judged on a checkout it does not have.

Privacy, cookies and legal checks count 1.2 times for a shop; performance, images and mobile 1.2 times; SEO and structured data 1.25 times.

`structure.cta` expects a purchase action — add to cart or buy — and reports its absence. The legal-document discovery expects refund and shipping documents only from sites that sell or book, and marks them not applicable elsewhere. A FAQ and an HTML sitemap are treated as relevant rather than optional.

The scan never creates an account, adds to a cart or submits an order, so payment flows, order confirmation, stock accuracy and delivery are not tested. Pages behind a login are recorded as restricted, not analysed.

Everything above is read from the HTML the server returned. A price or a purchase button injected by JavaScript after load may not be in it, which is why the rules speak of what was detected rather than of what the shop contains.