“Our website isn’t converting” is usually diagnosed as a copy problem or a design problem first, and a technical problem last, if at all. In our experience auditing sites for clients, it’s often the reverse - real, fixable technical issues quietly leaking leads before a visitor ever gets far enough to judge the copy or design at all. Here’s the actual checklist we run through before touching anything else.
Where leads actually leak, in the order we check
- Page speed on the actual entry pages, on mobile, on a real connection. Not your homepage tested on office wifi - the specific landing pages your ad and organic traffic actually hits, tested on a throttled mobile connection. A page that takes more than a few seconds to become interactive loses a meaningful share of visitors before they’ve seen anything, and this is invisible in your analytics as a “conversion problem” - it just looks like traffic that never engaged.
- Forms that fail silently. A contact or lead form that errors out without clear feedback, or one where a validation bug quietly rejects legitimate submissions (a phone number format that’s stricter than it needs to be, for instance), loses leads that never show up anywhere in your CRM - you don’t get a bounce, you get a submission that simply vanished. We test every form with real, varied input, not just the happy path a developer tested during initial build.
- Broken tracking, not just broken pages. A form that works perfectly but has a broken conversion tracking pixel means leads are coming in but your reporting says they aren’t - leading to wrong conclusions about what’s working, and budget misallocated away from channels that are actually converting.
- Mobile-specific breakage. Sites tested and polished on desktop often have real, undiscovered issues on mobile - a sticky header covering a submit button, a form field that’s unusable with a mobile keyboard, a click target too small for a thumb - and mobile is usually the majority of traffic for most businesses now, not a secondary experience.
- Trust signals missing exactly where hesitation peaks. The moment right before a form submission or checkout is where a visitor’s last-second doubts surface - no visible contact information, no clear privacy assurance near a form asking for personal data, no social proof near the highest-friction decision point. This isn’t a copywriting nice-to-have; it’s a specific, fixable placement problem.
The leak almost nobody checks: the notification email
Of everything on this page, this is the failure we find most often on sites where the owner is certain the form is broken and the developer is certain it is fine. Both can be right. The form saves the submission correctly and the email telling somebody about it never arrives, so the lead exists in the database and nobody ever reads it.
It happens because most contact forms send mail from the website’s own server, using the visitor’s address in the from field so that replying is convenient. That combination is exactly what modern mail authentication is designed to reject: the message claims to come from a domain the sending server has no authority to send for. Depending on the receiving provider it is either filed as spam or rejected outright, and in both cases nothing visible happens on the website.
What to check, in order. Send a test enquiry and look in the spam folder rather than only the inbox. Confirm the site sends through an authenticated mail service rather than the raw server. Make sure the from address belongs to your own domain, with the visitor’s address in the reply-to field, which preserves the convenience without the forgery. And verify your domain’s mail authentication records exist and are correct, because a domain that has never published them will have delivery problems that come and go with the receiving provider’s mood.
The reason to check this before anything else: if it is the cause, every hour spent on copy, design, and ad spend is being spent on a funnel whose last step is a bin.
Reconciling the numbers, which is how you find where it stops
Most of these leaks are invisible individually and obvious the moment four numbers are put side by side for the same period.
Count how many people started the form, how many submitted it, how many submissions were actually stored, and how many the business genuinely received and acted on. Each gap points somewhere specific. A large drop between starting and submitting is usually a usability or validation problem, and it is worth recording which field people abandon on, because it is almost always the same one. A gap between submitting and storing means something is rejecting them, which brings us to the next section. And a gap between what is stored and what the business has seen is the email problem above, or a routing rule filing them somewhere nobody looks.
Do this comparison honestly and it usually converts an argument about whether the website works into a specific defect with an owner.
Your own spam defences are a common cause
Every lead form needs protection from automated submissions, and that protection is frequently what is discarding real people. This is a failure mode we take seriously because we have found it on live sites more than once, and it never produces an error anybody sees.
- Validation stricter than reality. Phone rules that reject a number typed with spaces, a country code, or a leading zero. Name rules that reject a single-word name, an initial, or an apostrophe. The rule to apply is that the format should be normalised for the visitor rather than demanded from them.
- A honeypot field that is actually visible. The hidden field meant to catch bots relies entirely on being hidden. If the styling that hides it fails to load on the page where the form sits, real visitors see a labelled input, fill it in helpfully, and have their enquiry silently discarded as spam.
- Rate limits that treat an office as one person. Submissions capped per address will block genuine enquiries from a company, a campus, or anywhere behind shared connectivity, and the people affected are disproportionately the larger enquiries.
- Silent rejection with no record. Whatever you block, log it. A rejected submission you cannot see is indistinguishable from a submission that never happened, and the log is how you discover the filter is wrong.
How we actually run this audit
Real user session recordings and heatmaps on the actual entry and conversion pages, not assumptions about where drop-off happens. Form submission testing with deliberately varied, sometimes deliberately awkward input, not just a clean test case. A genuine mobile device test, not a browser dev tools simulation, because real device behavior - keyboard overlays, actual tap accuracy - differs meaningfully from simulated mobile testing.
Consent banners changed what your analytics can see
One modern complication worth separating from the rest, because it produces a drop that looks exactly like a leak and is not one. If you have added a cookie consent banner, analytics only records visitors who accepted it. Reported traffic and conversions fall, sometimes sharply, while the actual business is unchanged.
The danger is misreading that as a technical regression and reversing decisions on the strength of it. The way through is to keep at least one count that does not depend on consent - enquiries stored in your own database, calls received, quotes issued - and to treat analytics as a measure of relative change rather than of absolute volume. If your stored enquiry count held steady while analytics fell, nothing leaked; your measurement narrowed. Note the date the banner went live so that later comparisons are made against the right baseline.
What you can check yourself in half an hour
Before commissioning anything, this sequence finds the majority of what we find, and needs only a phone on mobile data.
Open the page your advertising actually points at, not the homepage, and time how long until you can use it. Fill in the form as an ordinary person would, with a spaced phone number and your real name, and submit it. Confirm the confirmation message says something specific rather than reloading the page silently. Then check every place the lead should appear: the inbox, the spam folder, the CRM, and whatever the site stores internally. Finally, look at last month’s stored enquiries and count how many the sales side actually followed up.
Whichever step is the first to disappoint you is where the leak is, and it is very often the last two.
What we typically find, in order of frequency
Mobile-specific form or layout bugs are the single most common finding across audits we’ve done - issues that are completely invisible during desktop-focused development and QA. Slow page speed on the actual landing pages (versus a fast-loading homepage that isn’t where paid traffic lands) is the second most common. Broken or missing conversion tracking, which doesn’t lose leads directly but actively misleads every subsequent marketing decision, rounds out the top three.
What we’d recommend before spending on more traffic
If conversion rate has been flat despite genuine effort on messaging and design, run this technical audit before increasing ad spend or rewriting copy - driving more traffic to a page that’s silently losing a fixed percentage of visitors to a technical issue just means losing more leads at the same rate, at a higher cost per lead.
We run this exact audit as part of our website development and optimization work. Get in touch if your conversion rate has been stuck and you want a real technical audit before changing anything else.