Code Review & Testing Checklist for E-Commerce

Review currency formatting, rounding, and tax-inclusive display rules for each market. Add unit tests for price helpers to avoid €/£ mismatch or minor rounding errors that confuse shoppers during flash sales.

Write E2E and unit tests ensuring unavailable or discontinued variants do not appear in swatches, search, collections, or cart endpoints. Prevents oversells when OMS syncs lag by a few seconds under load.

Define precedence for coupon codes, auto-apply promos, and BOGO, including time windows and usage limits. Test both happy and failure paths to prevent margin leakage from unintended stacks during campaigns.

Add integration tests to confirm price ranges, availability, and attributes match your Algolia or Elasticsearch index after bulk imports. Catches stale index issues that break findability for high-velocity SKUs.

Enforce server-side sanitization and strict allowlists for CMS-sourced descriptions and reviews. Unit test sanitizer rules to block script tags, inline events, and malformed embeds that can trigger XSS.

Automate schema and sitemap snapshots for product, breadcrumb, and offer data, plus canonical and pagination rules. Protects SEO equity and prevents invisible SKU pages after URL or routing refactors.

Use Playwright or Cypress to test Stripe, PayPal, and Adyen paths including 3DS success and failure outcomes. Catch regressions that silently block revenue during promotions.

Create fixtures for destination-based, origin-based, and VAT scenarios including exemptions and rounding. Compare computed totals against provider sandboxes to avoid post-order adjustments.

Simulate wallet availability, device checks, and issuer challenge failures using gateway test cards. Ensure a graceful downgrade to card entry with clear messaging to preserve conversion.

Mock carrier APIs (UPS, FedEx, DHL) and address validators to confirm rates, delivery windows, and surcharges. Include unit tests for dimensional weight rules and free-shipping thresholds.

Ensure tokenization or hosted fields are used and that no PAN, CVV, or PII appears in application or analytics logs. Add CI grep checks and runtime redaction middleware to uphold compliance.

Cover orders mixing gift cards, loyalty points, and promo codes with min/max spend rules and exclusions. Prevents customer confusion and negative balance errors at final payment.

Set thresholds for LCP, INP, and CLS on PDPs and checkout pages and fail PRs that regress. Tie budgets to real device emulation and median metrics from synthetic runs.

Gate chat, reviews, and UGC carousels behind interaction or viewport and respect consent state from your CMP. Use coverage tools to verify that deferred bundles do not block rendering.

Serve WebP/AVIF with width descriptors and DPR variants through your CDN and lazy-load below-the-fold assets. Add visual regression tests to ensure no layout shifts on slow networks.

Automate checks for consistent canonical targets, locale alternates, and product availability markup. Prevents duplicate content and improves international SERP coverage.

Integrate axe-core into CI and add keyboard-only E2E tests for navigation, focus traps, and form errors. Checkout and promo modals must be fully operable to meet legal and UX standards.

Log React/Vue hydration warnings in CI and test dynamic content placeholders on product and cart pages. Prevents broken interactions and flicker that derail conversions.

Enable automatic PRs for vulnerable packages and verify lockfile integrity. Block merges until patches or mitigations are in place for high-severity issues.

Use rulesets tuned for Node, PHP, or Ruby stacks and add custom patterns for template injection in liquid-like engines. Catch dangerous sinks introduced during rapid feature work.

Verify strict Content Security Policy with nonce or hash, SameSite and Secure cookies, and minimized referrer leakage. Add automated header tests for CDN and edge configurations.

Enable platform-level secret scanning and add pre-commit hooks to block keys for gateways, tax, and shipping APIs. Rotate and revoke immediately on detection with audit logs.

Audit GTM or tag manager additions for scope creep and enforce consent gates for analytics and advertising pixels. Use subresource integrity and CSP to restrict origins.

Attempt to access other users' carts, orders, or discounts by manipulating IDs or tokens and verify server-side authorization. Add negative tests for guest-to-user session escalation.

Mock realistic fixtures for backorder, pre-order, and split shipment scenarios and verify reserved-quantity semantics. Prevents oversells and mis-picks when fulfillment rules change.

Implement idempotency keys for order, fulfillment, and refund webhooks with exponential backoff. Add tests for duplicate delivery and out-of-order events from providers.

Unit test event schemas for add_to_cart, begin_checkout, and purchase, and assert consent state is forwarded. Prevents attribution gaps that hide conversion regressions.

Generate test orders covering partial shipments, backorders, and returns to render via your ESP (e.g., Klaviyo) sandbox. Verify dynamic data and localization tokens populate correctly.

Use OpenTelemetry plus APM (Datadog/New Relic) to trace cart-to-capture spans and define SLOs for key steps. Alert on timeout or error-rate breaches before revenue dips.

Add dry-run checksums, time-boxed batches, and fallback scripts for product and price tables. Test on realistic volumes to avoid downtime during catalog changes.

Set thresholds for unit and integration test coverage and block merges on type errors and lint violations. Keeps rapid iteration safe as teams scale.

Automate per-PR environments and seed with top-SKU, price, and inventory fixtures for reviewers. Parallelize E2E suites to accelerate feedback loops.

Wrap new checkout steps, pricing engines, or search algorithms with flags and provide an instant off switch. Add tests to confirm default-off and safe fallback behavior.

Roll out to small cohorts and watch conversion, add-to-cart rate, and error metrics in real time. Auto-pause rollouts if KPIs degrade beyond predefined thresholds.

Gate deploys on reversible migrations and include a one-click rollback playbook tied to monitoring alerts. Practice drills so on-call knows the exact steps under pressure.

Document incident procedures for payments, inventory, and CDN failures and circulate contacts before seasonal spikes. Reduces MTTR when issues hit during high-traffic windows.