This website personalization audit checklist is for two situations: you are about to start personalizing and want to know if you are ready, or you already run personalization and suspect it is not doing much. It has 42 checks in seven groups, each with a pass condition you can verify yourself. Copy the tables into a spreadsheet, or download the template as CSV.
It is not a general conversion audit. If your tracking or forms are broken, run the CRO audit checklist first: personalizing a page whose conversions you cannot measure only adds variables to a problem you cannot see.
How to Use This Personalization Audit Checklist
- Audit the live experience, not the plan. Check what visitors actually see today, on the pages that carry personalization or will soon.
- Mark each check Pass, Fail or Unknown. Unknown counts as Fail in the score. If nobody can answer it, nobody owns it.
- Record evidence for each Fail: a screenshot, a report, a test result.
- Score per group using the sheet at the end, and fix the lowest group first, in the order listed. Groups are ordered by dependency: content without data cannot be targeted, and results without measurement cannot be trusted.
1. Data (7 checks)
| # | Check | Pass condition | Status |
|---|---|---|---|
| 1.1 | Identification rate known | You can state what share of sessions on key pages is matched to a company, for the last 30 days | |
| 1.2 | Match quality checked | A sample of 50 matched visits was checked by hand and the error rate is written down | |
| 1.3 | Firmographics available at render time | Industry and employee count are available before the page renders, not seconds after | |
| 1.4 | One industry taxonomy | All industry labels from all tools map to one list (for example NAICS) in a maintained table | |
| 1.5 | CRM status usable | The site can tell an open opportunity and an existing customer from a new prospect | |
| 1.6 | Behavioural signals stored | Visit count and key page views (pricing, product, case studies) are available per visitor | |
| 1.7 | Data freshness known | You know how often firmographic and CRM data used for rules is refreshed |
2. Segments (6 checks)
| # | Check | Pass condition | Status |
|---|---|---|---|
| 2.1 | Segments come from revenue | Each segment is justified by closed-won data, not by preference (see the ideal customer profile template) | |
| 2.2 | Segments are mutually exclusive | Rules are evaluated in a fixed order and a visitor can only land in one segment per rule set | |
| 2.3 | Segment size measured | Monthly identified sessions per segment are known and each live segment has enough to measure | |
| 2.4 | Customers handled separately | Existing customers get their own rule and never see acquisition CTAs like "book a demo" | |
| 2.5 | Segment count capped | Live segments do not exceed what you can create content for and measure (usually 3 to 6) | |
| 2.6 | Definitions written down | Each segment has a written rule, owner and creation date in one shared document |
3. Content (6 checks)
| # | Check | Pass condition | Status |
|---|---|---|---|
| 3.1 | Content kit complete per segment | Each live segment has a headline, proof, case study and CTA written for it | |
| 3.2 | Proof is permitted | Every logo and quote shown in a variant has written permission on file | |
| 3.3 | Claims are true per segment | Labels like "Most popular" or "Trusted by X" are accurate for the segment that sees them | |
| 3.4 | Destinations match labels | Every personalized CTA leads to a page that delivers what the label promised | |
| 3.5 | Default is maintained | The default (unpersonalized) version is reviewed with the same care as variants | |
| 3.6 | Content is current | No variant references an old product name, past event or outdated case study |
4. Experience QA (7 checks)
| # | Check | Pass condition | Status |
|---|---|---|---|
| 4.1 | No flicker | The default content does not visibly flash before the variant appears on a normal connection | |
| 4.2 | No layout shift | Variant swaps do not move content; CLS on personalized pages stays in the "good" range (web.dev, CLS) | |
| 4.3 | Fallback renders complete | With the personalization script blocked, the page shows the full default with no empty blocks | |
| 4.4 | Timeout set | If the data lookup is slow, the default shows after a fixed timeout instead of waiting | |
| 4.5 | Mobile checked | Every variant was checked on a phone; longer headlines and labels do not wrap or truncate badly | |
| 4.6 | Every segment forced and screenshotted | A QA record shows each segment's variant on each personalized page | |
| 4.7 | SEO unaffected | Search engines see the default content; no variant changes the title, canonical or indexable copy for bots only |
5. Measurement (6 checks)
| # | Check | Pass condition | Status |
|---|---|---|---|
| 5.1 | Holdout exists | A share of each segment sees the default, assigned per visitor, so lift can be measured | |
| 5.2 | Primary metric agreed | Each personalization has one primary metric tied to pipeline (sales-accepted demos, qualified signups) | |
| 5.3 | Results reported per segment | Conversion rates are shown per segment and per arm, not blended | |
| 5.4 | Sample size planned | Each test had a sample size calculated before launch with the A/B test calculator | |
| 5.5 | Unidentified excluded from analysis | Visitors who could not be segmented are excluded from lift calculations | |
| 5.6 | Pipeline linked | Leads from personalized sessions can be traced to opportunities in the CRM |
6. Governance (5 checks)
| # | Check | Pass condition | Status |
|---|---|---|---|
| 6.1 | Owner named | One person owns the personalization program and approves new rules | |
| 6.2 | Rule inventory exists | A list of every live rule with its page, segment, start date and current result | |
| 6.3 | Review cadence | Live rules are reviewed at least quarterly; rules with no measurable effect are retired | |
| 6.4 | Change process | New variants go through the same QA as a site release | |
| 6.5 | Sales informed | Sales knows which segments see which messages, so calls do not contradict the site |
7. Privacy (5 checks)
| # | Check | Pass condition | Status |
|---|---|---|---|
| 7.1 | Consent respected | Scripts that store or read non-essential data on the device run only after consent where the law requires it (in the EU, the ePrivacy rules: Directive 2002/58/EC) | |
| 7.2 | Lawful basis documented | Your records name the GDPR lawful basis for each personal data use in personalization (Regulation (EU) 2016/679) | |
| 7.3 | Privacy notice updated | The privacy policy describes website personalization and the vendors involved | |
| 7.4 | No sensitive inferences | No rule targets or reveals health, political, religious or similar sensitive traits | |
| 7.5 | No "we know who you are" copy | Variants never name the visitor or their company in a way that feels like surveillance |
This is a checklist, not legal advice. Our post on B2B personalization and data privacy covers the topic in more depth; confirm specifics with your counsel.
Scoring Sheet
Score each group as Passes divided by checks. Unknown counts as a Fail.
| Group score | Meaning | What to do |
|---|---|---|
| 80% or more | Ready | Maintain; look for the next segment or page |
| 50% to 79% | Gaps | Fix Fails in this group before adding new personalization that depends on it |
| Below 50% | Not ready | Pause expansion; fix this group first, starting with the earliest group in the list |
Two gates override the scores. If 4.3 (fallback) fails, fix it before anything else, because a broken default affects every unidentified visitor. If 5.1 (holdout) fails, you cannot claim any result from personalization, whatever the dashboard says.
Illustrative Example
Illustrative, not a real company. A B2B software team has run industry personalization on the homepage for six months. Their audit:
| Group | Passes | Score | Key Fail |
|---|---|---|---|
| 1. Data | 5 of 7 | 71% | 1.2: nobody has checked match quality |
| 2. Segments | 4 of 6 | 67% | 2.4: customers see "book a demo" |
| 3. Content | 4 of 6 | 67% | 3.2: two logos without permission |
| 4. Experience QA | 5 of 7 | 71% | 4.1: visible flicker on mobile |
| 5. Measurement | 2 of 6 | 33% | 5.1: no holdout |
| 6. Governance | 3 of 5 | 60% | 6.3: no rule has ever been retired |
| 7. Privacy | 4 of 5 | 80% | 7.3: policy does not mention personalization |
The team believed the program was working because homepage conversion went up after launch. Without a holdout, they cannot separate that from seasonality or a campaign. Their next month: remove the two unpermitted logos (a same-day fix), add a customer rule, then relaunch with a 50% holdout per segment and sample sizes calculated in advance. If you need a structure for the relaunch, the personalization playbook template covers it.
Frequently Asked Questions
What is a website personalization audit?
It is a structured review of whether your website can show different content to different visitor segments reliably, and whether that is producing measurable results. It covers the data used to segment visitors, the segments themselves, the content per segment, technical quality such as flicker and fallbacks, measurement, governance and privacy.
How often should I audit website personalization?
Run the full checklist before launching personalization and then twice a year. Review the Experience QA group after any site release or template change, because flicker and broken fallbacks tend to appear silently when the page structure changes. Review measurement whenever a rule has been live for a full test cycle.
What is the most common personalization audit failure?
Our view is that missing holdouts are the most damaging, because they make every reported result unprovable. Teams compare conversion before and after launch and credit personalization for changes caused by seasonality, campaigns or tracking changes. Assign a share of each segment to the default and compare the two groups instead.
Does website personalization affect SEO?
It should not, if search engines see the same default content as unidentified visitors and variants only change on-page blocks for identified segments. Problems start when titles, canonicals or indexable copy differ for bots, which can look like cloaking. Keep personalization client-side or edge-side on content blocks and leave metadata untouched.