How to Build a CRO Programme From Scratch (Step-by-Step Framework)

A CRO programme is a repeating loop: gather evidence about where and why visitors drop off, turn that evidence into ranked test ideas, run controlled experiments, then record what you learned and go again. You can stand one up in about a month with free tools (GA4, Microsoft Clarity, PostHog), and the framework below gives you the seven steps, a worked prioritisation example with real numbers, and the UK privacy rules that vendor guides written for a US audience skip entirely.

One honest caveat before you start: if your site converts fewer than roughly 500 times a month, classic A/B testing will be slow and unreliable for you. That does not mean no CRO programme; it means a different one, and there is a section below on exactly what to do instead.

Step 1: Set the baseline and define what “conversion” means

Before any heatmaps or hypotheses, agree what you are optimising. Pick one primary conversion (purchase, qualified lead, signup) and two or three supporting micro-conversions (add to basket, pricing page view, form start). In GA4 these are configured as key events, which is what Google renamed conversions to in 2024.

Then record your baseline: current conversion rate by device, by traffic source, and by landing page, over at least the last three months. If you are not sure how to compute the figure itself, our walkthrough on calculating conversion rate covers the common mistakes. Medians vary widely by sector and page type (Unbounce’s landing-page benchmark puts the overall median at 6.6 percent, with SaaS nearer 3.8 and financial services above 8), so a “bad” number in one industry is a strong one in another; our guide to what counts as a good conversion rate breaks the benchmarks down.

Step 2: Build the research layer (you can do this entirely free)

CRO without research is just redesigning things you personally dislike. You need two kinds of evidence:

Quantitative (where people drop off): GA4 is free and does the job. Use funnel and path explorations to find the leakiest steps, and segment by device; a checkout that converts fine on desktop and collapses on mobile is a very common first finding.

Qualitative (why they drop off): Microsoft Clarity is genuinely 100 percent free, with no paid tiers and no session caps. You get click and scroll heatmaps, unlimited session recordings (kept for 30 days, or 13 months if you favourite or label them), rage-click detection and AI session summaries. For an engineer-led team, PostHog combines analytics, session replay and experimentation in one product with a generous free tier: 1 million analytics events, 5,000 web session replays and 1 million feature-flag requests per month at no cost, with no per-seat charge. Hotjar is now part of Contentsquare (announced in 2021, the legal merger completed in July 2025); you can no longer sign up for Hotjar itself, but Contentsquare carries its heatmaps, recordings and surveys forward on a free plan.

Add at least one direct line to users: a one-question exit survey on the leaky page (“what stopped you completing this today?”) or five short user-testing sessions. Five users is not a token gesture; Jakob Nielsen and Tom Landauer’s much-cited model found that testing with five people surfaces about 85 percent of an interface’s usability problems.

Run this research phase for two to four weeks. The output should be a written list of observed problems, each with its evidence attached.

Step 3: Prioritise pages with PIE, then ideas with ICE or PXL

You will end up with more problems than capacity. Two frameworks, used together, sort the queue.

PIE (Potential, Importance, Ease), from Chris Goward at WiderFunnel, ranks pages or site areas. Score each from 1 to 10 and average. Potential is how much room for improvement the page has, Importance is how much valuable traffic it gets, Ease is how cheaply you can change it.

A worked example for a B2B SaaS site:

Pricing wins: high traffic, clear drop-off, and changes do not need a redesign.

ICE (Impact, Confidence, Ease), from Sean Ellis’s growth work, then ranks individual test ideas within that page, again 1 to 10 each:

ICE’s known weakness is subjectivity: two scorers can give the same idea wildly different numbers. If that drift becomes a problem, switch to CXL’s PXL framework, which replaces gut-feel scores with binary, evidence-weighted questions such as “is the change above the fold?” and “is it backed by user data?”. The pattern worth copying: PIE to choose where, ICE or PXL to choose what.

Step 4: Write hypotheses, not wish lists

Every test gets a written hypothesis with three parts: the change, the expected outcome, and the reason grounded in your research. For example: “Adding an objection-handling FAQ to the pricing page will increase plan-selection clicks, because exit surveys show 31 percent of leavers cited unanswered questions about contract terms.” The UK government’s own guidance on A/B testing, written for evaluating digital health products, takes the same hypothesis-first position, which is a useful thing to cite when persuading sceptical stakeholders that this is standard practice, not marketing voodoo.

Step 5: Pick a testing tool that still exists in 2026

The tool market has shifted and most ranking guides have not caught up:

• Google Optimize shut down in September 2023. There is no free Google A/B testing tool any more.
• VWO and AB Tasty announced a merger in January 2026 and VWO’s free Starter plan is being discontinued; new signups get a 30-day trial only. Do not budget around VWO being free.
• Optimizely remains the enterprise option, with Web Experimentation (visual editor, sequential Stats Engine) and Feature Experimentation (flag-based, server-side). Pricing is quote-based.
• PostHog is the strongest free starting point for teams with engineers: experiments run on feature flags, and the free tier covers 1 million flag requests a month.

For a fuller comparison see our round-up of A/B testing tools for 2026.

Step 6: Run tests properly (and know when not to)

Three rules cover most testing sins. First, run every test for at least two full weeks, covering complete business cycles, and up to about six; weekday and weekend visitors behave differently. Second, never stop a test early because the dashboard “looks significant” today; peeking inflates false positives. Use an A/B test significance calculator at the planned end, not daily. Third, size the test before you start with a sample size calculator so you know whether you can realistically detect the lift you expect.

The low-traffic branch. If you see fewer than about 500 conversions a month (conversions, not visitors, are what power a test), most A/B tests will take months to conclude or never will. Do this instead: fix the obvious usability failures Clarity recordings show you, run five-user tests on the core journey, ship changes backed by strong qualitative evidence without a controlled test, and measure before/after with GA4 while being honest that this is weaker evidence. Save A/B testing for your single highest-traffic page, testing bold changes rather than button colours.

Step 7: Build the learning repository and a cadence

This is the step every vendor guide compresses into one throwaway line, and it is what separates a programme from a series of one-off tests. Keep a simple log (a spreadsheet or Notion table is fine) with one row per test: hypothesis, evidence, dates, sample size, result, and one sentence on what it taught you about your customers. Losing tests go in too; a clean loss that kills a popular internal myth is often worth more than a 3 percent win.

Then set the rhythm. A workable starting cadence for a small team: a fortnightly 45-minute meeting to review finished tests and score new ideas, one named owner for the backlog (not a committee), and a target of one or two well-powered tests live at any time. Velocity grows later; learning discipline has to be there from week one.

The UK bit: consent rules changed in February 2026

If you operate in the UK, the Data (Use and Access) Act 2025 amended PECR, with new cookie consent exceptions in force from 5 February 2026. The practical headline: analytics cookies used for “statistical purposes” can now run without a consent banner, provided their sole purpose is improving your service, you give users clear information, and you offer a simple, free opt-out. Third-party analytics providers must act only on your behalf.

Two cautions. The exception does not cover advertising or cross-site tracking, and A/B testing cookies are not explicitly listed, so treat experiment cookies as still needing consent unless your legal advice says otherwise. And session recording tools such as Clarity and Hotjar capture personal data, so UK GDPR applies to them regardless of the cookie rules: configure masking for form inputs and keep recordings in your privacy notice. The ICO’s guidance on storage and access technologies is the authoritative reference here.

Handled properly, the new rules are good news for UK CRO teams: cleaner analytics data without a consent wall, as long as you stay inside the statistical-purposes lane.

Your first 30 days, condensed

Week 1: define key events in GA4, install Clarity, record baselines. Weeks 2 to 3: research, exit survey live, watch 30 recordings, list problems with evidence. Week 4: PIE-score your pages, ICE-score ideas for the winner, write three hypotheses, and either launch test one or, on low traffic, ship your first evidence-backed fix. If you want the wider strategic context first, start with our conversion rate optimisation guide.

Frequently asked questions

How long should an A/B test run? A minimum of two full weeks so you capture complete weekly business cycles, and up to about six. Decide the end date from a sample size calculation before launch, and do not stop early just because results look significant mid-test; peeking inflates false positives.

How much traffic do I need to start A/B testing? Think in conversions, not visitors. Below roughly 500 conversions a month on the page being tested, most tests will take too long to conclude reliably. Under that threshold, lean on qualitative methods: session recordings, five-user tests and surveys.

Can I run a CRO programme entirely on free tools? Yes, to start. GA4 covers quantitative analysis, Microsoft Clarity is completely free for heatmaps and unlimited session recordings, and PostHog’s free tier includes 1 million events, 5,000 session replays and experiments via feature flags each month. You will hit limits eventually, but not in your first quarter.

PIE or ICE: which prioritisation framework should I use? Both, at different levels. Use PIE (Potential, Importance, Ease) to pick which pages to work on, then ICE (Impact, Confidence, Ease) to rank test ideas within them. If scoring gets too subjective across the team, move to CXL’s PXL framework, which uses binary evidence-based questions instead of gut-feel numbers.

Is VWO still free? No. VWO’s free Starter plan is being discontinued following the announced merger with AB Tasty in January 2026; new signups get a 30-day trial. Google Optimize closed in 2023, so PostHog’s free tier is now the main no-cost route into proper experimentation.

Do I need cookie consent for analytics in the UK? Since 5 February 2026, analytics cookies used purely for statistical service improvement can run without consent in the UK, provided you inform users and offer a free opt-out. Advertising cookies still need consent, and A/B testing cookies are a grey area, so check the ICO’s current guidance before relying on the exception.