BFCM 2026 · Free readiness playbook
BFCM 2026 Shopify readiness audit: 12 technical checks before Black Friday.
Twelve checks across four parts, published in full below – the same sequence a senior engineer works through in a paid audit. Read them, run them on your own store, or take the PDF with you. Peak week is rarely lost on creative.
Until Black Friday, 27 November 2026.
400+ Shopify stores shipped · $120M+ GMV powered · Senior-only engineers
On its way.
If it has not landed in a few minutes, check promotions or spam. You can also grab it directly.
Download the PDFWhat’s inside
Four parts. Twelve checks. All of it published here.
Nothing is held back for the PDF – the PDF is just the same thing in a form you can send to your developer. Each check is small enough to verify this week and specific enough to argue with.
What the store weighs when it matters
Every store is fast in August. Peak week is decided by what your product and collection templates do on a mid-range phone, on a congested network, at four hundred sessions an hour - measured on real visitors rather than a lab run from an empty office.
Read part 01 · SpeedThe apps nobody has audited since last November
Apps get installed for a test, a campaign, or a previous agency, and then keep injecting storefront JavaScript long after anyone remembers why. Individually each one is small.
Read part 02 · StackThe promotion nobody placed as a real order
Discount logic behaves differently once it meets a real cart: stacked codes, gift-with-purchase, bundles, subscriptions, free-shipping thresholds and a second currency. Most stores validate the offer in a spreadsheet and discover the edge cases live, from customer emails.
Read part 03 · CheckoutThe tracking that quietly stops attributing
A consent change, a duplicated pixel or a broken server-side event does not throw an error. It moves revenue into "direct" - and you spend the most expensive week of the year making budget decisions from numbers that are quietly wrong.
Read part 04 · Data
Part 01 · Speed
What the store weighs when it matters
Every store is fast in August. Peak week is decided by what your product and collection templates do on a mid-range phone, on a congested network, at four hundred sessions an hour – measured on real visitors rather than a lab run from an empty office.
Core Web Vitals on real field data
Lab scores flatter you: a synthetic run on a fast connection from a nearby server is not the experience you are shipping. Field data from actual Chrome users is the only number that predicts peak behaviour, because it already contains the slow phones and the bad networks.
Ready when
The templates that actually carry the traffic
Almost everyone optimises the homepage, and almost nobody lands there during a sale. Your paid and email traffic arrives on product and collection pages. Those are the templates that decide the week, and they are usually the heaviest ones in the theme.
Ready when
What blocks the first paint
Hero media that is lazy-loaded, fonts that arrive after the text, and third-party scripts sitting on the critical path. Each is individually defensible and collectively the reason a well-built theme measures badly.
Ready when
Part 02 · Stack
The apps nobody has audited since last November
Apps get installed for a test, a campaign, or a previous agency, and then keep injecting storefront JavaScript long after anyone remembers why. Individually each one is small. Together they are the single most common reason a fast theme measures slow.
The storefront script audit
List every app that injects JavaScript into the storefront, what it does, who asked for it, and what it costs in main-thread blocking time. Then decide, per app, whether it earns its place through peak. Most stores find at least three that do not.
Ready when
Theme freeze and a rollback you have tested
A dated freeze, a published theme you can revert to in one action, and one named person allowed to break the freeze. On the day, the plan matters more than the code: the question is never whether something will go wrong, it is how fast you can undo it.
Ready when
Caching, CDN and traffic that is not human
Cache hit rate under load, image formats and weights, and how much of your peak traffic is bots, scrapers and monitoring rather than shoppers. That last number surprises people, and it changes what your infrastructure has to survive.
Ready when
Part 03 · Checkout
The promotion nobody placed as a real order
Discount logic behaves differently once it meets a real cart: stacked codes, gift-with-purchase, bundles, subscriptions, free-shipping thresholds and a second currency. Most stores validate the offer in a spreadsheet and discover the edge cases live, from customer emails.
Place the promotion as a real order
Not a preview, not a staging approximation: real carts, real combinations, on a throttled mobile connection. Include the combinations you did not design for, because your customers will find them within the first hour and post them.
Ready when
Inventory and fulfilment sync at peak velocity
Your sync interval was set for a normal week. At peak velocity the gap between sold and synced is where oversells live, along with ERP, 3PL and marketplace webhooks that retry silently, or not at all.
Ready when
Checkout extensibility and payment edge cases
Any remaining legacy checkout customisation, plus the express wallets, local methods and B2B terms that only some of your customers use. These fail quietly for a segment rather than loudly for everyone, which is why they survive until November.
Ready when
Part 04 · Data
The tracking that quietly stops attributing
A consent change, a duplicated pixel or a broken server-side event does not throw an error. It moves revenue into “direct” – and you spend the most expensive week of the year making budget decisions from numbers that are quietly wrong.
One purchase, counted exactly once
Place a single test order and follow it. It should appear once in GA4, once in the Meta conversions API and once in Klaviyo, with the right value and the right currency. Duplicates inflate ROAS, and inflated ROAS is how brands overspend into a bad week.
Ready when
Both consent states, and the server-side path
Most tracking is verified once, by someone who accepted every cookie. Test the other path too: the visitor who declines, the visitor in a stricter region, and whatever your server-side layer does when the browser sends nothing.
Ready when
Retention capture and sending reputation
Peak is the cheapest list growth of the year and the easiest week to burn a sending domain. Capture has to be live and tested, core flows switched on, and the volume ramp planned rather than discovered on the second send.
Ready when
Take it with you
The whole playbook, in one PDF.
Nothing is held back for the PDF — it is the same twelve checks in a form you can send to your developer.
BFCM 2026 Readiness Playbook
The same twelve checks you have just read, plus the freeze timeline and a one-page summary your developer can work from. Free, and we send it straight to your inbox.
What to do, and when
The calendar decides what advice is honest.
The same finding gets a different recommendation in September than it does in November. Any audit that ignores the date is selling you a project rather than a peak week.
Rebuild window
The only month where structural work is still safe: theme refactors, app removals, template rewrites, migration decisions.
Fix and test window
Targeted fixes, promotion logic built and tested end to end, tracking verified, load and fulfilment paths rehearsed.
Freeze and rehearse
Freeze roughly two weeks before Black Friday. After that, only provable revenue bugs get touched, and every change has a rollback.
Trade and watch
Monitoring, not building: conversion by device, checkout errors, sync failures, sending health, and a named person on call.
Run them yourself, free
Six tools we built. None of them need a call.
Built by our own specialist agencies — ForgeCRO for audits and CRO, RetentionControl for retention. Between them they cover a real share of this playbook before you spend anything. See the full toolkit.
- Request the CRO audit
Free Shopify CRO Audit
Eleven questions, then a senior reviewer reads your store personally and writes back. Not a score - an actual review of your conversion path before peak.
- Run the retention audit
BFCM Retention Audit
The other half of peak week: whether your flows, segments, capture and sending reputation can carry the volume you are about to add to them.
- Run the SEO audit
Shopify SEO Audit
Crawls your storefront and checks Core Web Vitals against real Chrome user data - the same field numbers Part 01 is about, for your own URLs.
- Run the AI visibility audit
AI Visibility Audit
Tests your store against 13 real AI shopping agents. Increasingly the first place a customer asks what to buy, and invisible in every analytics tool you own.
- Calculate your ROI
Retention ROI Calculator
What another point of repeat rate is worth on your numbers. Useful in November for deciding what the December programme has to earn.
- Price a Plus migration
Shopify Plus Migration Cost
If peak proves the platform is the ceiling rather than the pages, this prices the move honestly before anyone commits to it in January.
The manual BFCM readiness audit
A senior engineer goes through your store. Not a crawler.
One engineer, three to five working days, your actual store rather than a sample of it. No junior handoff, no template report with your logo dropped in the corner. If we find nothing that threatens your peak week, we will tell you that too – it is a cheaper answer than finding out in November.
A written report of every finding, ranked by revenue risk and by fix effort - so you can act on it in the order that pays.
All twelve checks above, run properly against your store, your apps, your promotion logic and your markets.
Checkout and discount testing with real cart states, including the combinations you did not design for.
Tracking verification across GA4, Meta CAPI and Klaviyo, under both consent states.
A recommended code-freeze date and rollback plan for your specific stack and team.
A 45-minute walkthrough call, so nobody has to interpret a PDF alone.
A fix list your own developer or agency can work from. Implementation by us is optional and scoped separately, at a fixed number.
Download the audit deck (PDF) The capabilities deck (PDF)
Ten slides on what the audit covers, what you get and what it costs - for whoever signs off the work.
The things brands ask before booking.
When is BFCM 2026?
Black Friday falls on Friday 27 November 2026 and Cyber Monday on Monday 30 November 2026. In practice the trading window is wider: most brands open early access in the first half of November and keep discounting into the first week of December, so the traffic profile your store has to survive starts roughly three weeks before Black Friday itself.
What does "technically ready" actually mean?
That the store keeps working when the variables all move at once: more concurrent sessions, a heavier mobile traffic mix, discount logic that only fires during the sale, inventory moving faster than your sync interval, and paid traffic that has to be attributed correctly to be worth buying. A store can look perfect in August and still fail on any one of those. Readiness is about the failure modes, not the design.
Is this a Shopify Plus only audit?
No. It is written for Shopify and Shopify Plus, and most of it applies equally to both. Plus-specific areas - Functions, checkout extensibility, Flow, B2B catalogs, multi-store - are covered where they exist. If you are on another platform we will tell you honestly whether the audit is worth your money before you pay for it.
How is a manual audit different from running a free tool?
A tool tests a page. A senior engineer tests a path. Automated scans are genuinely useful for what is measurably wrong - Core Web Vitals, missing tags, render-blocking scripts - and we give four of them away free. What they cannot do is put three items in a cart with a stacked discount and a gift-with-purchase, on a throttled mobile connection, and tell you the promotion breaks. That is the part that costs stores their peak week.
How long does the audit take and what do I get?
Three to five working days from receiving store access. You get a written report of what we found, each item ranked by revenue risk and by how long it takes to fix, a recommended code-freeze date for your specific stack, and a prioritised fix list your existing developer can work from. A 45-minute walkthrough call is included so you are not left interpreting a PDF alone.
It is already late in the year. Is there still time?
Yes, and the honest answer changes with the date. In September there is time to rebuild things properly. In October there is time to fix and test. In November the right advice is usually to stop changing things, fix only what is provably breaking revenue, and freeze - and a good audit will tell you that rather than sell you a project you cannot safely land before peak.
Do you fix what you find, or just report it?
Either. The audit is a standalone deliverable and plenty of brands hand it to their in-house team or their existing agency - a perfectly good outcome, and the report is written to be usable that way. If you would rather we implement, we scope that separately at a fixed number after the audit, so you are never approving work before you know what it is.
Shopify Plus experts
Let's talk Shopify, Shopify Plus and the store you actually want.
An accredited Shopify Plus agency that designs, builds, migrates, supports and grows stores for brands that have outgrown templates. Ready when you are: talk to an engineer about the project.
Get in touch
