Magento 2 Audit Checklist: 60+ Points to Self-Run

Run the 60+ checks below before you pay anyone. They are grouped into the same seven areas a full Magento audit covers, so whatever you find here maps directly to the paid work. Each point is a concrete check plus why it matters, using free tools where possible - you do not need a consultant to spot the obvious wins.

Performance and Core Web Vitals

These map to the Magento performance audit. Test on real product and category pages, not just the homepage.

• Full Page Cache hit rate - a cold FPC means every request hits PHP; low hit rate kills TTFB.
• Varnish in front of Magento - the built-in FPC is fine, but Varnish handles concurrency far better.
• Time to First Byte - over 600ms server-side signals caching, DB or hosting problems.
• Largest Contentful Paint - Google flags LCP above 2.5s; usually the hero image or web fonts.
• Cumulative Layout Shift - unreserved image or banner space shifts content and fails CWV.
• Interaction to Next Paint - heavy third-party JS blocks the main thread and hurts INP.
• JS bundling and minification - unbundled RequireJS modules cause dozens of blocking requests.
• Image formats and lazy loading - serve WebP or AVIF and lazy-load below-the-fold media.
• Redis for cache and sessions - file-based cache does not scale; Redis is the baseline.
• Production mode and DI compilation - developer mode in production is a silent, massive slowdown.
• Indexer health and reindex duration - anything stuck, invalid or suspended in indexer:status. On large catalogs catalog_category_product is the usual offender; see Could not acquire lock for index.

Code quality and architecture

• Plugin (interceptor) count - too many around plugins on core methods stack latency and hide bugs.
• Preferences vs plugins - full class preferences break on upgrade far more often than plugins.
• Coding standard compliance - run phpcs with the Magento ruleset to catch structural debt.
• Raw SQL vs repositories - direct queries bypass caching and break on schema changes.
• Business logic in templates - logic in .phtml files is untestable and slow to render.
• Custom module dependency graph - circular or hidden dependencies make every change risky.
• Deprecated API usage - deprecated calls will break at the next major upgrade.
• Layout XML rewrites - broad <referenceBlock remove> and full rewrites fight future changes.
• Automated test coverage - zero unit or integration tests means every deploy is a gamble.

Security and patches

• Latest security patches applied - unpatched stores are the number one cause of Magento breaches.
• Version still supported - EOL Magento gets no security fixes; confirm your version is in support.
• Custom admin URL and 2FA - default /admin plus no 2FA is an open door.
• Vulnerable dependencies - run composer audit to flag known CVEs in packages.
• File permissions and ownership - world-writable pub/ or app/ directories invite compromise.
• env.php and secrets exposure - config files must never be reachable over HTTP.
• Content Security Policy - report-only or missing CSP leaves you open to skimming attacks.
• Security scan results - MageReport and the Adobe Security Scan flag public misconfigurations fast.
• CAPTCHA on public forms - login, contact and checkout forms without CAPTCHA get abused by bots.

Upgrade readiness

• Current version vs latest - the further behind you are, the larger and riskier the jump.
• PHP version compatibility - each Magento release drops old PHP; confirm your target matches.
• Composer 2 migration - Composer 1 is unsupported and blocks modern package installs.
• Deprecated and removed APIs - code calling removed methods will fatal after the upgrade.
• Custom module compatibility - every in-house module needs testing against the target version.
• Third-party version availability - confirm each paid extension ships a compatible release.
• Database upgrade window - large catalogs need a tested setup:upgrade timing plan.
• Staging environment parity - upgrades tested on mismatched staging give false confidence.
• Core hacks vs clean core - edits to vendor/magento will be silently overwritten on upgrade.

Third-party modules

• Total module count - dozens of extensions multiply conflict surface and slow the DI compiler.
• Installed but disabled modules - dead modules still bloat config and confuse debugging.
• Overlapping functionality - two modules touching checkout or catalog often collide.
• Abandoned extensions - unmaintained modules never get security or compatibility fixes.
• Modules that disable caching - some extensions punch holes in FPC and crater performance.
• License compliance - unlicensed or nulled modules are a legal and security liability.
• Modules with core rewrites - class preferences from vendors block your own upgrades.
• Vendor support cadence - check the vendor still ships updates before you depend on them.
• Render-path impact - extensions injecting synchronous JS into every page hurt Core Web Vitals.

Technical SEO

These map to the Magento SEO audit. Crawl the store as Googlebot would.

• Canonical tags - missing or wrong canonicals create duplicate-content dilution on catalog pages.
• XML sitemap - a stale or partial sitemap starves Google of your real URLs.
• robots.txt rules - accidental Disallow lines can deindex whole sections.
• Structured data - Product, Offer and Breadcrumb schema drive rich results.
• hreflang for multi-store - multilingual stores without hreflang split ranking signals.
• Faceted navigation control - uncontrolled layered-navigation URLs waste crawl budget massively.
• URL rewrites on catalog changes - deleted products without 301s leak link equity to 404s.
• Meta robots on filtered pages - filtered and sorted URLs should be noindex where thin.
• Core Web Vitals as a ranking factor - the performance checks above are also an SEO lever.

Infrastructure and DevOps

• Web stack tuning - default Nginx and PHP-FPM pool sizes throttle traffic under load.
• CDN in front of static assets - serving JS, CSS and media from origin adds needless latency.
• Cron reliability - failed cron breaks indexing, emails and cache flushing silently.
• Zero-downtime deploys - deploying without setup:upgrade staging risks locking the store.
• Tested backup and restore - a backup you have never restored is not a backup.
• Monitoring and APM - without New Relic or similar you are blind to regressions.
• Log rotation and disk - unrotated logs fill disks and take the store down.
• Database engine and config - outdated MySQL or MariaDB with default tuning bottlenecks everything.
• Search engine health - a degraded Elasticsearch or OpenSearch cluster breaks catalog search.

What each finding maps to

Once you know where the problems cluster, they point to a focused audit:

A downloadable PDF and a versioned GitHub copy of this checklist are on the way, so you can track your own passes over time. Based in Dubai, I run these audits for merchants across the UAE and GCC - see the Dubai Magento audit page for local details, or the main Magento audit service for scope and turnaround.