BFCM 2026 · Free playbook

The traffic is coming. Is your store technically ready for it?

Twelve checks across four parts, published in full below - the same sequence a senior engineer works through in a paid audit. Read them, run them on your own store, or take the PDF with you. Peak week is rarely lost on creative.

--Days
--Hours
--Minutes
--Seconds

Until Black Friday, 27 November 2026.

0

checks in the playbook, across speed, stack, checkout and data - every one of them something you can verify yourself this week.

0

Black Friday 2026. Cyber Monday follows on the 30th, and the trading window opens around three weeks earlier.

0

the code freeze we recommend before Black Friday. After that, only provable revenue bugs get touched.

What's inside

Four parts. Twelve checks. All of it published here.

Nothing is held back for the PDF - the PDF is just the same thing in a form you can send to your developer. Each check is small enough to verify this week and specific enough to argue with.

Part 01 · Speed

What the store weighs when it matters

Every store is fast in August. Peak week is decided by what your product and collection templates do on a mid-range phone, on a congested network,…

Read part 01 →
Part 02 · Stack

The apps nobody has audited since last November

Apps get installed for a test, a campaign, or a previous agency, and then keep injecting storefront JavaScript long after anyone remembers why. Individually each one…

Read part 02 →
Part 03 · Checkout

The promotion nobody placed as a real order

Discount logic behaves differently once it meets a real cart: stacked codes, gift-with-purchase, bundles, subscriptions, free-shipping thresholds and a second currency. Most stores validate the offer…

Read part 03 →
Part 04 · Data

The tracking that quietly stops attributing

A consent change, a duplicated pixel or a broken server-side event does not throw an error. It moves revenue into "direct" - and you spend the…

Read part 04 →
yourstore.com / product
LCP 4.1s2.1s
INP 410ms140ms
CLS 0.280.04

Mobile field data, 28-day rolling window

The same product template before and after the work in Part 01. Field data, not a lab score.
01Speed

What the store weighs when it matters

Every store is fast in August. Peak week is decided by what your product and collection templates do on a mid-range phone, on a congested network, at four hundred sessions an hour - measured on real visitors rather than a lab run from an empty office.

Check 1 / 3

Core Web Vitals on real field data

Lab scores flatter you: a synthetic run on a fast connection from a nearby server is not the experience you are shipping. Field data from actual Chrome users is the only number that predicts peak behaviour, because it already contains the slow phones and the bad networks.

Ready when
  • LCP at or under 2.5s
  • INP at or under 200ms
  • CLS at or under 0.1
  • Measured on mobile, not desktop
Check 2 / 3

The templates that actually carry the traffic

Almost everyone optimises the homepage, and almost nobody lands there during a sale. Your paid and email traffic arrives on product and collection pages. Those are the templates that decide the week, and they are usually the heaviest ones in the theme.

Ready when
  • Product template on mobile
  • Collection template with filters applied
  • Cart and the step before checkout
  • The landing page your ads point at
Check 3 / 3

What blocks the first paint

Hero media that is lazy-loaded, fonts that arrive after the text, and third-party scripts sitting on the critical path. Each is individually defensible and collectively the reason a well-built theme measures badly.

Ready when
  • Hero image sized and never lazy-loaded
  • Fonts preloaded, with a real fallback
  • No render-blocking third-party script
  • Above-the-fold content in the first response
Check your own field data free ↗
storefront scripts Blocking
1,840msmain-thread blocking
Theme & app bundle420ms
Review widget380ms
Abandoned-cart popup310ms
Upsell app (unused)290ms
Old A/B testing script240ms
Analytics & pixels200ms
Four of those six had no owner and no reason. Removing them is free performance.
02Stack

The apps nobody has audited since last November

Apps get installed for a test, a campaign, or a previous agency, and then keep injecting storefront JavaScript long after anyone remembers why. Individually each one is small. Together they are the single most common reason a fast theme measures slow.

Check 1 / 3

The storefront script audit

List every app that injects JavaScript into the storefront, what it does, who asked for it, and what it costs in main-thread blocking time. Then decide, per app, whether it earns its place through peak. Most stores find at least three that do not.

Ready when
  • Every script has a named owner
  • Every script has a reason
  • Blocking time measured, not guessed
  • Anything unclaimed is removed or deferred
Check 2 / 3

Theme freeze and a rollback you have tested

A dated freeze, a published theme you can revert to in one action, and one named person allowed to break the freeze. On the day, the plan matters more than the code: the question is never whether something will go wrong, it is how fast you can undo it.

Ready when
  • Freeze date agreed and in the calendar
  • Rollback theme published and verified
  • One named person can approve an exception
  • Every change after the freeze has an undo
Check 3 / 3

Caching, CDN and traffic that is not human

Cache hit rate under load, image formats and weights, and how much of your peak traffic is bots, scrapers and monitoring rather than shoppers. That last number surprises people, and it changes what your infrastructure has to survive.

Ready when
  • Cache behaviour checked under load
  • Images in modern formats, correctly sized
  • Bot share of traffic measured
  • Third parties off the critical path
yourstore.com / checkout
2Wool crewFig / M$118.00
1Gift setBundle · BOGO eligible$64.00
BFCM40WELCOME10BOGO
Subtotal$182.00
Discounts−$189.20
ShippingFree
Total−$7.20
Stacking not capped. Three codes combined on a bundle line and took the order below zero. Nobody tested this combination.
A real cart, not a preview. This is the failure a crawler cannot reach.
03Checkout

The promotion nobody placed as a real order

Discount logic behaves differently once it meets a real cart: stacked codes, gift-with-purchase, bundles, subscriptions, free-shipping thresholds and a second currency. Most stores validate the offer in a spreadsheet and discover the edge cases live, from customer emails.

Check 1 / 3

Place the promotion as a real order

Not a preview, not a staging approximation: real carts, real combinations, on a throttled mobile connection. Include the combinations you did not design for, because your customers will find them within the first hour and post them.

Ready when
  • Stacked codes tested together
  • Gift-with-purchase and bundles
  • Subscription and one-off in one cart
  • Every market and currency you sell into
Check 2 / 3

Inventory and fulfilment sync at peak velocity

Your sync interval was set for a normal week. At peak velocity the gap between sold and synced is where oversells live, along with ERP, 3PL and marketplace webhooks that retry silently, or not at all.

Ready when
  • Sync interval known, not assumed
  • Oversell exposure quantified at peak rate
  • Failed webhook behaviour understood
  • Someone is watching the queue on the day
Check 3 / 3

Checkout extensibility and payment edge cases

Any remaining legacy checkout customisation, plus the express wallets, local methods and B2B terms that only some of your customers use. These fail quietly for a segment rather than loudly for everyone, which is why they survive until November.

Ready when
  • No legacy checkout customisation left running
  • Express wallets tested end to end
  • Local payment methods verified per market
  • B2B and net terms still work under load
Get a human to review your cart path free ↗
one test order Duplicate
Purchase · $182.00
GA42
Meta CAPI1
Klaviyo1
GA4 counted it twice. Client and server both fired without deduplication, so reported revenue and ROAS are both overstated.
One order should produce exactly one event per platform. Inflated ROAS is how brands overspend.
04Data

The tracking that quietly stops attributing

A consent change, a duplicated pixel or a broken server-side event does not throw an error. It moves revenue into "direct" - and you spend the most expensive week of the year making budget decisions from numbers that are quietly wrong.

Check 1 / 3

One purchase, counted exactly once

Place a single test order and follow it. It should appear once in GA4, once in the Meta conversions API and once in Klaviyo, with the right value and the right currency. Duplicates inflate ROAS, and inflated ROAS is how brands overspend into a bad week.

Ready when
  • One order, one event, in every platform
  • Correct value and currency everywhere
  • No client and server double-count
  • Order ID deduplication actually working
Check 2 / 3

Both consent states, and the server-side path

Most tracking is verified once, by someone who accepted every cookie. Test the other path too: the visitor who declines, the visitor in a stricter region, and whatever your server-side layer does when the browser sends nothing.

Ready when
  • Tested with consent granted and denied
  • Consent mode behaving as configured
  • Server-side events firing independently
  • No silent gap between the two paths
Check 3 / 3

Retention capture and sending reputation

Peak is the cheapest list growth of the year and the easiest week to burn a sending domain. Capture has to be live and tested, core flows switched on, and the volume ramp planned rather than discovered on the second send.

Ready when
  • Capture live and tested on mobile
  • Welcome, browse and abandon flows on
  • Sending volume ramp planned in advance
  • Segmentation ready before the list doubles
Audit the retention half free ↗
Take it with you

The whole playbook, in one PDF.

Twelve checks, what "ready" looks like for each, and the freeze timeline - formatted to hand to a developer or forward to whoever signs off the work.

BFCM 2026 Readiness Playbook

The same twelve checks you have just read, plus the freeze timeline and a one-page summary your developer can work from. Free, and we send it straight to your inbox.

PDF12 checksFree

One email with the playbook, then only BFCM-relevant notes until December. No drip sequence · Privacy policy

On its way. If it has not landed in a few minutes, check promotions or spam. You can also grab it directly:

Download the PDF
What to do, and when

The calendar decides what advice is honest.

The same finding gets a different recommendation in September than it does in November. Any audit that ignores the date is selling you a project rather than a peak week.

SEP

Rebuild window

The only month where structural work is still safe: theme refactors, app removals, template rewrites, migration decisions.

Change freely
OCT

Fix and test window

Targeted fixes, promotion logic built and tested end to end, tracking verified, load and fulfilment paths rehearsed.

Change carefully
NOV

Freeze and rehearse

Freeze roughly two weeks before Black Friday. After that, only provable revenue bugs get touched, and every change has a rollback.

Change rarely
27-30

Trade and watch

Monitoring, not building: conversion by device, checkout errors, sync failures, sending health, and a named person on call.

Do not change
Run them yourself, free

Six tools we built. None of them need a call.

Built by our own specialist agencies - ForgeCRO for audits and CRO, RetentionControl for retention. Between them they cover a real share of this playbook before you spend anything. See the full toolkit.

ForgeCRO

Free Shopify CRO Audit

Eleven questions, then a senior reviewer reads your store personally and writes back. Not a score - an actual review of your conversion path before peak.

Request the CRO audit ↗
RetentionControl

BFCM Retention Audit

The other half of peak week: whether your flows, segments, capture and sending reputation can carry the volume you are about to add to them.

Run the retention audit ↗
ForgeCRO

Shopify SEO Audit

Crawls your storefront and checks Core Web Vitals against real Chrome user data - the same field numbers Part 01 is about, for your own URLs.

Run the SEO audit ↗
ForgeCRO

AI Visibility Audit

Tests your store against 13 real AI shopping agents. Increasingly the first place a customer asks what to buy, and invisible in every analytics tool you own.

Run the AI visibility audit ↗
RetentionControl

Retention ROI Calculator

What another point of repeat rate is worth on your numbers. Useful in November for deciding what the December programme has to earn.

Calculate your ROI ↗
ForgeCRO

Shopify Plus Migration Cost

If peak proves the platform is the ceiling rather than the pages, this prices the move honestly before anyone commits to it in January.

Price a Plus migration ↗
The manual BFCM readiness audit

A senior engineer goes through your store. Not a crawler.

One engineer, three to five working days, your actual store rather than a sample of it. No junior handoff, no template report with your logo dropped in the corner. If we find nothing that threatens your peak week, we will tell you that too - it is a cheaper answer than finding out in November.

  • 01A written report of every finding, ranked by revenue risk and by fix effort - so you can act on it in the order that pays.
  • 02All twelve checks above, run properly against your store, your apps, your promotion logic and your markets.
  • 03Checkout and discount testing with real cart states, including the combinations you did not design for.
  • 04Tracking verification across GA4, Meta CAPI and Klaviyo, under both consent states.
  • 05A recommended code-freeze date and rollback plan for your specific stack and team.
  • 06A 45-minute walkthrough call, so nobody has to interpret a PDF alone.
  • 07A fix list your own developer or agency can work from. Implementation by us is optional and scoped separately, at a fixed number.

Ten slides on what the audit covers, what you get and what it costs - for whoever signs off the work.

Request your BFCM 2026 audit

Tell us where the store is and what you are worried about. A senior engineer replies within 12 hours - not a form autoresponder.

No spam, no drip sequence. We use your details to reply about this audit and nothing else - see the privacy policy.

Who you would be working with

The capabilities deck, if you want the longer answer.

Seventeen slides on how we build: the architecture decisions, two case studies, the process, and how scope and price are fixed before anything starts. Read it here or take the PDF.

Capabilities deck, slide 1 of 17 Capabilities deck, slide 2 of 17 Capabilities deck, slide 3 of 17 Capabilities deck, slide 4 of 17 Capabilities deck, slide 5 of 17 Capabilities deck, slide 6 of 17 Capabilities deck, slide 7 of 17 Capabilities deck, slide 8 of 17 Capabilities deck, slide 9 of 17 Capabilities deck, slide 10 of 17 Capabilities deck, slide 11 of 17 Capabilities deck, slide 12 of 17 Capabilities deck, slide 13 of 17 Capabilities deck, slide 14 of 17 Capabilities deck, slide 15 of 17 Capabilities deck, slide 16 of 17 Capabilities deck, slide 17 of 17
1 / 17
BFCM 2026 questions

The things brands ask before booking.

When is BFCM 2026?

Black Friday falls on Friday 27 November 2026 and Cyber Monday on Monday 30 November 2026. In practice the trading window is wider: most brands open early access in the first half of November and keep discounting into the first week of December, so the traffic profile your store has to survive starts roughly three weeks before Black Friday itself.

What does "technically ready" actually mean?

That the store keeps working when the variables all move at once: more concurrent sessions, a heavier mobile traffic mix, discount logic that only fires during the sale, inventory moving faster than your sync interval, and paid traffic that has to be attributed correctly to be worth buying. A store can look perfect in August and still fail on any one of those. Readiness is about the failure modes, not the design.

Is this a Shopify Plus only audit?

No. It is written for Shopify and Shopify Plus, and most of it applies equally to both. Plus-specific areas - Functions, checkout extensibility, Flow, B2B catalogs, multi-store - are covered where they exist. If you are on another platform we will tell you honestly whether the audit is worth your money before you pay for it.

How is a manual audit different from running a free tool?

A tool tests a page. A senior engineer tests a path. Automated scans are genuinely useful for what is measurably wrong - Core Web Vitals, missing tags, render-blocking scripts - and we give four of them away free. What they cannot do is put three items in a cart with a stacked discount and a gift-with-purchase, on a throttled mobile connection, and tell you the promotion breaks. That is the part that costs stores their peak week.

How long does the audit take and what do I get?

Three to five working days from receiving store access. You get a written report of what we found, each item ranked by revenue risk and by how long it takes to fix, a recommended code-freeze date for your specific stack, and a prioritised fix list your existing developer can work from. A 45-minute walkthrough call is included so you are not left interpreting a PDF alone.

It is already late in the year. Is there still time?

Yes, and the honest answer changes with the date. In September there is time to rebuild things properly. In October there is time to fix and test. In November the right advice is usually to stop changing things, fix only what is provably breaking revenue, and freeze - and a good audit will tell you that rather than sell you a project you cannot safely land before peak.

Do you fix what you find, or just report it?

Either. The audit is a standalone deliverable and plenty of brands hand it to their in-house team or their existing agency - a perfectly good outcome, and the report is written to be usable that way. If you would rather we implement, we scope that separately at a fixed number after the audit, so you are never approving work before you know what it is.

Peak week does not move

Find out in September. Not on 27 November.

Every problem in this playbook is cheaper to fix now than it is to discover live. Send us the store and a senior engineer will tell you, in plain terms, what would break.

Every call ends with a written plan and a fixed number, whether or not we work together.